Extracting prog: 21m20.284613483s Minimizing prog: 42m11.726768528s Simplifying prog options: 0s Extracting C: 22.033659904s Simplifying C: 12m59.133496717s extracting reproducer from 45 programs testing a last program of every proc single: executing 11 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-socket$inet6-close_range-mmap$IORING_OFF_SQ_RING-socket-connect$netlink-socket$can_bcm-ioctl$AUTOFS_IOC_SETTIMEOUT-setsockopt$inet6_udp_int-close_range-getsockopt$inet_udp_int-socket$xdp-syz_clone-ptrace-mmap$xdp-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-syz_usb_connect$uac1-syz_mount_image$ext4 detailed listing: executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x6) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async) r2 = socket(0x10, 0x3, 0x2) connect$netlink(r2, &(0x7f0000000200)=@proc={0x10, 0x0, 0x9, 0x400000}, 0xc) (async) r3 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$AUTOFS_IOC_SETTIMEOUT(r2, 0x80049367, &(0x7f0000000240)=0x7) (async) setsockopt$inet6_udp_int(r1, 0x11, 0xa, &(0x7f0000000280)=0x1, 0x4) (async) close_range(r1, r3, 0x0) getsockopt$inet_udp_int(r0, 0x11, 0xb, 0xfffffffffffffffe, &(0x7f0000000000)) (async) r4 = socket$xdp(0x2c, 0x3, 0x0) (async) r5 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r5) mmap$xdp(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x8, 0xa4830, r4, 0x180000000) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000040)) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x3, &(0x7f00000000c0)=[{0x34, 0x0, 0x0, 0x2}, {0x3d}, {0x6}]}) syz_usb_connect$uac1(0x3, 0x77, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x10, 0x200c, 0x1018, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x65, 0x3, 0x1, 0x81, 0xa8, 0xd1, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x6, 0xf}, [@mixer_unit={0x5, 0x24, 0x4, 0x4, 0xff}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0x1, 0x2, 0x4, {0x7, 0x25, 0x1, 0xc, 0x1, 0x7a}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0x2, 0xff, 0x5, {0x7, 0x25, 0x1, 0xc, 0x5, 0x5}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0}) (async) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000007c0)='.\x02\x00', 0x22000402, &(0x7f0000000580)={[{@noinit_itable}, {@init_itable}, {@noinit_itable}, {@block_validity}, {@min_batch_time={'min_batch_time', 0x3d, 0x6}}, {@grpjquota, 0x2e}, {@mb_optimize_scan}, {@errors_remount}, {@jqfmt_vfsv1}, {@usrquota}, {@usrjquota_path={'usrjquota', 0x3d, '.\x02'}}, {@resgid}, {@nolazytime}, {@data_ordered}], [], 0x2c}, 0x1, 0x4ef, &(0x7f00000025c0)="$eJzs3MtvG8UfAPDv2nn1mbS/6gd9QAMFEVFImrRADxwAgdQLCAkO5RjSUJWmLWqDRKuKBoTKEfEXFI5ISJy4cAIJIeACiCvcUaUK5dLAARmNvZs4iZM4b1p/PpLtmfXszn53d7zjHa8DaFm96SmL2B4Rv0VEdy07u0Bv7WVq8urIX5NXR7KoVF75M6uWuz15daQoWsy3Lc/0lSJKH2Sxv0G9ly5fOTs8NjZ6Mc8PjJ97a+DS5SuPnzk3fHr09Oj5oePHjx0dfOrJoSeaiuPaEu+nuG7ve/fCgb0nXvv4xZFKvP7D52l9t+fv18dR09NUvQsrtkalamZ6R/X54VUu/b9mR106a9vEFWFZyhGRdld7tf13Rzlmdl53vPD+dObbTVpBYN2kc9OueVPL+WspP3sBd6dMG4cWVZzx0/ff4rGR/Y/NduvZ9DxajX8qf/z0Um3blNJ32Z7aN/auOfOV8tf/N1hmKluudaEq3UvUvz0iTk78fSM9ouF1iEVkTZcEAJj2der/PNao/1ea1bfZmY+h9ETE4YjYHRH/i4g90z2hiHsi4t5l1t87Jz+///PLlmUucllS/+/pfGyreNTeKeLKpnM7qvG3Z2+cGRs9km+TvmjvTPnBRer45vlfP1rovd66/l96pPqLvmC+Hjfb5nQ+Tw2PD68i5FluvRexr61R/Nn0SEDaAnsjYt8Klp+22ZlHPzuQ0ju3zX9/6fgXkOUDF6tU+TTikdr+n4g58ddVlWpaaHxyoCvGRo8MFEfFfD/+fP3l+nx7XXpW/F3NxTT3u8hqpP2/dc7xX1t+Hn8pr3DOeO3EMuq4/vuHC0Y1K/5y3JiazOJkvvDamGLpZltnRGyZ2Wzp+O/IXq2mO/Jp7wyPj18cjOjIJ8yaPjRTX5Evyqf4+w41bv+7I/75JJ9vf0Skg/i+iLg/Ig7m6/5ARDwYEYcWif/75x56c/EttILjf42k+E81/PybPv57svrx+hUkyme/+2qh+pv6/Os8Vk315VOa+fxrdgVXs+0AAADgTlGqjkFnpf4iXXdxak9sLY1duDR+uDfePn+qNlbdE+2l4kpXd9310MH82nCRH0rpjpn80YjYVf2l0ZZqvn/kwtiOzQwcqN6rU7T/znxaf3/t9Y/yZq4ZsCGWNY5W/6OzL75c+5UBNpT7NaF1af/QurR/aF3aP7SuRu3/WsTUJqwKsMGaO/9X3G4OdyH9f2hd2j+0rpn27xd/0ELm3xJf/N3KSu70n0nsPrGq2dc9UelelyVPLH+u8jpFGnV/2rFw4SwiVlZFlBYv0xGXr3StUTjpDLVYmeKmlaYXWFqyzDNLbZb2Vf0nRkoczBOdEdHsXNea2Kdrd/wkmct+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAHe3fAAAA///pidwx") program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sysfs-socket$nl_route-ioctl$sock_SIOCGIFINDEX-mmap$IORING_OFF_SQ_RING-utime-prlimit64-sched_setscheduler-getpid-sched_setaffinity-sched_setscheduler-setxattr-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-socket$tipc-bind$tipc-socket$tipc-sendmsg$tipc-socket$nl_route-sendmsg$nl_route-setsockopt$packet_int-recvmmsg-fsopen-fsconfig$FSCONFIG_CMD_CREATE-bpf$BPF_BTF_LOAD-bpf$MAP_CREATE-fsmount-bpf$MAP_UPDATE_ELEM_TAIL_CALL detailed listing: executing program 0: r0 = openat$sysfs(0xffffffffffffff9c, 0x0, 0x5171c0, 0x94) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) utime(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000100)=0x6) setxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)=@known='trusted.overlay.redirect\x00', &(0x7f0000000300)='%$-#*..[#\x00', 0xa, 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f066bbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000002940)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r4 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r4, &(0x7f0000000080)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) r5 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r5, &(0x7f0000000380)={&(0x7f0000000140)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x4, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4000884}, 0x4) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="08000000100001082cbd7000ffffe1ff0100010000000000b4d9f544ca263fc14935bff02fc99bd8f21aff2a873a0e828d031d290e36cbe5cca16b781c65d258099af62092caa59973c2476607f9e29108dbc808fe37a60c4ac8d6e17f422a2770a80e75ce94ef5f0898390c1a2d2b202b8a090161f0a4a13aa7733f761c4d83287bd35c8c694a0a46af760aaabc3bac985ae574968171e63b63b1d7d8c310ac6ea6ca836a4c8de89f35d00c8668454e866aa0fcccfcdedb6db224f216b9e5adb36f41532788a0a3a203c82a", @ANYRES32=0x0, @ANYBLOB="fffe01000100000008001b0000000000"], 0x28}}, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x8, &(0x7f0000000100)=0x40049, 0x4) recvmmsg(0xffffffffffffffff, &(0x7f0000000480)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=""/11, 0x17}}], 0x400000000000179, 0x0, 0x0) r7 = fsopen(&(0x7f0000000200)='bpf\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r7, 0x6, 0x0, 0x0, 0x0) r8 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000340)={&(0x7f0000000400)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000504000000002e"], 0x0, 0x37}, 0x20) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0900000004000000040000000700000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=r8, @ANYBLOB="0200000001"], 0x48) r10 = fsmount(r7, 0x1, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000004c0)={{r9}, &(0x7f0000000500), &(0x7f0000000540)=r10}, 0x20) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ptmx-write$binfmt_aout-ioctl$TCSETS-syz_open_pts detailed listing: executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000600), 0x41, 0x0) write$binfmt_aout(r0, &(0x7f0000000680)=ANY=[], 0xbfb3) ioctl$TCSETS(r0, 0x40045431, 0x0) syz_open_pts(r0, 0xa5000) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmmsg$unix-socket$nl_route-write-socket$netlink-sendmsg$nl_route-sendmsg$nl_route-syz_usb_connect-close_range-bpf$MAP_CREATE_CONST_STR-bpf$MAP_CREATE_CONST_STR-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$KVM_GET_STATS_FD_vm-ioctl$ifreq_SIOCGIFINDEX_vcan-bpf$MAP_CREATE detailed listing: executing program 0: sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x40000c0) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="240000002a000103990000000000000000000000010000000000ffffffffffffff810000", 0x24) (async) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="380000006c0015000000d9fece23b82004000000", @ANYRES32=r1, @ANYBLOB="000080000000000018003480050035"], 0x38}, 0x1, 0x300}, 0x0) (async) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[], 0x38}, 0x1, 0x300, 0x0, 0x14805}, 0xc000) (async) syz_usb_connect(0x0, 0x63, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000404c17aa5600010102030109025100010100c03209040000020806500007050102000200070582020002000904000105080662000705010200020003240107050202000203020002000324030705"], 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x48) (async) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0xd, 0x10, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018210000", @ANYRES32=r2, @ANYBLOB="0000000002000020b705000008000000850000005d00000095", @ANYRES16], &(0x7f00000004c0)='GPL\x00', 0x2, 0x6ad79b3f1a62de5b, &(0x7f0000000500)=""/4106, 0x0, 0x5, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0xfffffffffffffdf8, 0x10, 0x0, 0x34, 0x0, 0x0, 0xfffffffffffffe65}, 0x23) (async) r3 = ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@bloom_filter={0x1e, 0x0, 0x3, 0x2, 0x20000, r3, 0x4e52, '\x00', r4, 0xffffffffffffffff, 0x4, 0x5, 0x0, 0x8}, 0x50) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socket$nl_route-sendmsg$nl_route-socketpair$unix-socket-getsockopt$sock_cred-setsockopt$inet6_group_source_req-setsockopt$sock_int-mmap$IORING_OFF_SQ_RING-prlimit64-sched_setscheduler-getpid-sched_setaffinity-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-bpf$PROG_LOAD detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[], 0x40}, 0x1, 0x0, 0x0, 0x81}, 0x4044014) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) r2 = socket(0x1, 0x5, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000980), &(0x7f00000009c0)=0x5) setsockopt$inet6_group_source_req(r2, 0x29, 0x2e, &(0x7f0000000a00)={0x38, {{0xa, 0x4e24, 0x7f, @loopback, 0x7}}, {{0xa, 0x4e20, 0x3023, @mcast2, 0x1}}}, 0x108) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x10, &(0x7f0000000b40)=0x7, 0x4) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000b80)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000bc0)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000c00)=0x2) sched_setscheduler(r3, 0x1, &(0x7f0000000c40)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f066bbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000c80)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000cc0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000d40), 0x400000000000041, 0x0) recvmmsg(r4, &(0x7f0000000d80), 0x80002c1, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000dc0)={0xe, 0x16, &(0x7f0000000e80)=ANY=[@ANYBLOB="61106400000000006113740000000018bfa00000000000000700000008ffffffd50301001774004095000000000000006916360000000000bf67000000000000350607000fff07201706000020190000160300000ee60060bf050000000000007b650000000000006507f9ff01000000070700004d83dde4c375000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f17540faf80250aa20c669a5e12814cb1cea5d4601d295c45a6a0b9bdb7dd399703cac4f6f3be4b369226066812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05000400c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc206438b8ef4901fd03c16dfda44221b235c8ac86d8a297dff0445a15f21dce431e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20ceddf4d03723f1c932b3a6aa57f1ad2e99e0e67ab93716d20000009f0f53acbb40b4f8e2738270b31562ed834f2af97787f696649a462e7ee4bcf8b07a10fd7ed6735154beb4000000000000000000000000004000bc00f6746a9709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253887a5ad103649afa17690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43ea0ffb567b40407d000000210000000000000000005f37d8703f37ca364a601ae899a56715a0a62a34c1d926a0f6a5480a55c22fe3a5ac00000000000000000000000500002000000000fb79ea00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e14d90deae46e26c596f84eba90000000000000000fffb0000000082fb0d3cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631d22a11dc3c693962895496d4f6e9cc54db6c7205a6b06ff7f0000000000007f31d7c8cc5d325c5379b0363ce8bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a1f37302f3b41eae59809fd05d12f6106f117b062df67d3a6473265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089e0b1c23c0f3cdad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3ff3be4d1458077c2253b0c7c7a1a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631d22bad050e9856b48ae3a03a497c37758537650fe6db89da3c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0af1cb3f1f815f8989d78854ca4d3116dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fc5fb38f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4c6ea9604faf0453bedf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202eeb81f428a5b3c29984864961a57ff52f657a67463d7dbf85ae9321fc2cc17dc4a29b9cba8ded5de8206c812439ab129ae818837ee15620789c524b3baf49a09d8be0fc5beecf153236c19740be9bb7d958d5e87c6c09bf71a894bad62934782cc308e936d7637e07c4a2b4dc87b0da20000d9ef418cf19e7a8c4c328be0ce91798adc2dca87ddd9d064e081383409ed2912c811ae63f03212a5331c2a4ead000000000000000000000000000000000000000000000000001386866b311bd144bc32e059658c9f8342c90c1ade31b78072841b8b5a943d62a44cea6b050c42e3c205fad6a23fb43c93da0f49d911877265e6ee443e37397ecf89021e7f579e8d3a74c12b52938d91e9de07fc8eeeb9505f4a9c26266bf5449484ccc1317c7476"], &(0x7f00000014c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x48) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-ioctl$FS_IOC_GETFSMAP detailed listing: executing program 0: r0 = syz_mount_image$ext4(&(0x7f0000006100)='ext4\x00', &(0x7f0000006140)='./file0\x00', 0x9, &(0x7f0000006180)={[{@init_itable_val={'init_itable', 0x3d, 0x6}}]}, 0x0, 0x4ae, &(0x7f0000006500)="$eJzs3VFrXFUeAPD/nSRt2qabdHcfuoXtlm2XtOx2Jmm2bfChVhB9Kqj1PcZkEkImmZCZtE0okuIHEERU8MknXwQ/gCD9CCIU9F1EFNFWH3zQjszkTlpjJhlqmkszvx+c3nPumZn/OZ3MnXvuucwJoGOdiIjLEdEVEWcioj/dn0tTrK6l+uPu3b05UU9J1GpXv08iSfc1XytJt4fSp/VGxEvPR7ya/DFuZXlldrxUKi6m5UJ1bqFQWV45OzM3Pl2cLs6PjAxfGL04en50aMf6eunZr99+44PnLn3yv+tfjn17+rV6s/rSuof7sZPWut7T+L9o6o6IxccRLANdaX96sm4IAABtqZ/j/zUi/t04/++PrsbZHAAAALCX1J7ui1+SiBoAAACwZ+Ua98AmuXx6L0Bf5HL5/No9vH+Pg7lSuVL971R5aX5y7V7ZgejJTc2UikPpvcID0ZPUy8ON/IPyuQ3lkYg4EhFv9R9olPMT5dJk1hc/AAAAoEMc2jD+/6l/bfwPAAAA7DEDWTcAAAAAeOyM/wEAAGDvM/4HAACAPe2FK1fqqdZc/3rfteWl2fK1s5PFymx+bmkiP1FeXMhPl8vTjd/sm9vu9Url8sL/Y37pRqFarFQLleWVsbny0nx1rLGu91jROtEAAACw+4786/YXSUSsPnWgker2pXXG6rC35bJuAJCZrqwbAGSmO+sGAJkxxgeSbep7W1V8+kjharVa7ZGeCAAAPLrBf5j/h05l/h86l/l/6FzN+f/k/voFeacE0CHaH+O3nAEEnnC7PP8PAABkoK+Rklw+vfDXF7lcPh9xuLEsQE8yNVMqDkXEXyLi8/6e/fXycNaNBgAAAAAAAAAAAAAAAAAAAAAAAIAnTK2WNBbjBgAAAPauiNw3Sbr+12D/qb6N1wf2JT/3N7YRcf29q+/cGK9WF4fr+39Y3199N91/LosrGAAAAMBGzXF6cxwPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADvp3t2bE820m3G/eyYiBjaL3x29jW1v9ETEwR+T6H7oeUlEdO1A/NVbEXF0s/hJvVkxkLZiY/xcRBzIOP6hHYgPnex2/fhzebPPXy5ONLabf/660/RntT7+5daPf10tjn+H24xx7M5HhZbxb0Uc694Yv7a/HqEZP2kR/2Sb8V95eWWlVV3t/YjBTb9/kt/FKlTnFgqV5ZWzM3Pj08Xp4vzIyPCF0Yuj50eHClMzpWL676Yx3vznx/e36v/BFvEHtun/qTb7/+udG3f/tkX80yc3f/+PbhG//jfxn/R7oF4/2MyvruUfdvzDz45v1f/JFv3f7v0/3Wb/z7z4+ldtPhQA2AWV5ZXZ8VKpuCgjIyOznsn6yAQAAOy0Byf9WbcEAAAAAAAAAAAAAAAAAAAAOtdu/JxY1n0EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGjHbwEAAP//kRbbrg==") ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f00000069c0)=ANY=[@ANYBLOB="000000004c9002000400000003000100000000000000000000000000000000000000000000000000000012000000000000000000000000000000000000000000000000000500e7ffffff000000000000010000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000ffffffff"]) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-ioctl$FS_IOC_GETFSMAP detailed listing: executing program 0: r0 = syz_mount_image$ext4(&(0x7f0000006100)='ext4\x00', &(0x7f0000006140)='./file0\x00', 0x9, &(0x7f0000006180)={[{@init_itable_val={'init_itable', 0x3d, 0x6}}]}, 0x0, 0x4ae, &(0x7f0000006500)="$eJzs3VFrXFUeAPD/nSRt2qabdHcfuoXtlm2XtOx2Jmm2bfChVhB9Kqj1PcZkEkImmZCZtE0okuIHEERU8MknXwQ/gCD9CCIU9F1EFNFWH3zQjszkTlpjJhlqmkszvx+c3nPumZn/OZ3MnXvuucwJoGOdiIjLEdEVEWcioj/dn0tTrK6l+uPu3b05UU9J1GpXv08iSfc1XytJt4fSp/VGxEvPR7ya/DFuZXlldrxUKi6m5UJ1bqFQWV45OzM3Pl2cLs6PjAxfGL04en50aMf6eunZr99+44PnLn3yv+tfjn17+rV6s/rSuof7sZPWut7T+L9o6o6IxccRLANdaX96sm4IAABtqZ/j/zUi/t04/++PrsbZHAAAALCX1J7ui1+SiBoAAACwZ+Ua98AmuXx6L0Bf5HL5/No9vH+Pg7lSuVL971R5aX5y7V7ZgejJTc2UikPpvcID0ZPUy8ON/IPyuQ3lkYg4EhFv9R9olPMT5dJk1hc/AAAAoEMc2jD+/6l/bfwPAAAA7DEDWTcAAAAAeOyM/wEAAGDvM/4HAACAPe2FK1fqqdZc/3rfteWl2fK1s5PFymx+bmkiP1FeXMhPl8vTjd/sm9vu9Url8sL/Y37pRqFarFQLleWVsbny0nx1rLGu91jROtEAAACw+4786/YXSUSsPnWgker2pXXG6rC35bJuAJCZrqwbAGSmO+sGAJkxxgeSbep7W1V8+kjharVa7ZGeCAAAPLrBf5j/h05l/h86l/l/6FzN+f/k/voFeacE0CHaH+O3nAEEnnC7PP8PAABkoK+Rklw+vfDXF7lcPh9xuLEsQE8yNVMqDkXEXyLi8/6e/fXycNaNBgAAAAAAAAAAAAAAAAAAAAAAAIAnTK2WNBbjBgAAAPauiNw3Sbr+12D/qb6N1wf2JT/3N7YRcf29q+/cGK9WF4fr+39Y3199N91/LosrGAAAAMBGzXF6cxwPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADvp3t2bE820m3G/eyYiBjaL3x29jW1v9ETEwR+T6H7oeUlEdO1A/NVbEXF0s/hJvVkxkLZiY/xcRBzIOP6hHYgPnex2/fhzebPPXy5ONLabf/660/RntT7+5daPf10tjn+H24xx7M5HhZbxb0Uc694Yv7a/HqEZP2kR/2Sb8V95eWWlVV3t/YjBTb9/kt/FKlTnFgqV5ZWzM3Pj08Xp4vzIyPCF0Yuj50eHClMzpWL676Yx3vznx/e36v/BFvEHtun/qTb7/+udG3f/tkX80yc3f/+PbhG//jfxn/R7oF4/2MyvruUfdvzDz45v1f/JFv3f7v0/3Wb/z7z4+ldtPhQA2AWV5ZXZ8VKpuCgjIyOznsn6yAQAAOy0Byf9WbcEAAAAAAAAAAAAAAAAAAAAOtdu/JxY1n0EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGjHbwEAAP//kRbbrg==") ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f00000069c0)=ANY=[@ANYBLOB="000000004c9002000400000003000100000000000000000000000000000000000000000000000000000012000000000000000000000000000000000000000000000000000500e7ffffff000000000000010000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000ffffffff"]) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-mmap$IORING_OFF_SQ_RING-socket$inet6_tcp-bind$inet6-setxattr$security_ima-prlimit64-sched_setscheduler-sched_setaffinity-syz_open_dev$MSR-read$msr-sendmmsg-io_pgetevents-socket$nl_generic-sendto$inet6-syz_genetlink_get_family_id$ethtool detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, 0x0, 0x0) setxattr$security_ima(&(0x7f00000000c0)='./bus\x00', 0x0, &(0x7f0000000280)=@ng={0x4, 0x9, "5e0992af4b6274505c"}, 0xb, 0x3) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x2c, &(0x7f0000000180)=0x2) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102392, 0x18ff8) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x1c) io_pgetevents(0x0, 0x8, 0x0, 0x0, &(0x7f0000000580)={0x0, 0x989680}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x4c881, &(0x7f0000000540)={0xa, 0x4e24, 0x10, @mcast2}, 0x1c) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mprotect-socket$inet-bind$inet-mprotect-socket$inet-bind$inet detailed listing: executing program 0: mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @local}, 0x10) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) (async) socket$inet(0x2, 0x4000000000000001, 0x0) (async) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @local}, 0x10) (async) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mprotect-socket$inet-bind$inet-mprotect-socket$inet-bind$inet detailed listing: executing program 0: mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @local}, 0x10) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) (async) socket$inet(0x2, 0x4000000000000001, 0x0) (async) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @local}, 0x10) (async) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-mmap$IORING_OFF_SQ_RING-socket$inet6_tcp-bind$inet6-setxattr$security_ima-prlimit64-sched_setscheduler-sched_setaffinity-syz_open_dev$MSR-read$msr-sendmmsg-io_pgetevents-socket$nl_generic-sendto$inet6-syz_genetlink_get_family_id$ethtool detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, 0x0, 0x0) setxattr$security_ima(&(0x7f00000000c0)='./bus\x00', 0x0, &(0x7f0000000280)=@ng={0x4, 0x9, "5e0992af4b6274505c"}, 0xb, 0x3) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x2c, &(0x7f0000000180)=0x2) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102392, 0x18ff8) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x1c) io_pgetevents(0x0, 0x8, 0x0, 0x0, &(0x7f0000000580)={0x0, 0x989680}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x4c881, &(0x7f0000000540)={0xa, 0x4e24, 0x10, @mcast2}, 0x1c) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) program did not crash single: failed to extract reproducer bisect: bisecting 45 programs with base timeout 30s testing program (duration=41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 29, 30, 15, 2, 2, 28, 30, 21, 6, 6, 15, 7, 24, 28, 7, 22, 30, 28, 6, 2, 9, 30, 11, 4, 10, 15, 40, 5, 6, 2, 2, 2, 7, 6, 19, 14, 5, 29, 18, 21, 14, 4, 30, 19] detailed listing: executing program 4: syz_mount_image$msdos(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x40, &(0x7f0000000180)={[{@fat=@nocase}, {@fat=@errors_continue}, {@fat=@sys_immutable}, {@nodots}, {@nodots}, {@fat=@nfs_nostale_ro}, {@nodots}, {@dots}, {@fat=@umask={'umask', 0x3d, 0x7fffffffffffffff}}, {@dots}, {@nodots}, {@nodots}, {@fat=@nfs}, {@dots}, {@nodots}, {@dots}, {@nodots}, {@nodots}, {@fat=@quiet}]}, 0x21, 0x25c, &(0x7f0000000540)="$eJzs3cFqE1EUBuAzSdqmBbFrcTHgxlVR3yBIBHFAiGShKwPVTStCuomu8hg+g4/kY3TV3UgzwZRpK0UmuTXzfVDm0J/JnDshuQTuTT4+/nJy/PXsc/nrR/T7efQi5nERcRid6EYlWx47i3o3rpoHAPC/GY0mg9Q90KDs2n/2I2KyExF716Lxzw11BQAAAAAAAAAAQMOs/weA9rl1/X9n462wJtPpYHJw41Nq/T8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACQzkVZPiz/8pe6PwCgeZfzfzfM/wDQJj7/A0D7mP8BoH3evf/wZlAUw1Ge9yPO57PxbFwdq/zV62L4LF84XJ11PpuNd5Z1MXxe5Xk9P1ic34kXN+a78fRJ9fiX2cu3RS3fi+PorXv4AAAAAAAAAAAAAAAAAAAAcC8c5X/U9vd3q/zotryqrnw/QG3/fi8e2b4PAAAAAAAAAAAAAAAAAAAAd3L27fvJ5PT003QTRdbQRR+kaH4Lijvfsf34h0v0I824Iu7J7d2uYvkay7JE70wAAAAAAAAAAAAAAAAAANA+q02/qTsBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgHRWv/+/viL1GAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIB2+B0AAP//4omFiQ==") r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000340)={0x80000000, 0x0, 0xfffffffc}, 0x10) write(r0, &(0x7f0000000380)="240000001a005f0214f9f407000904001f000000fe0086000000000008000f00fd0000", 0x23) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000400)=@updpolicy={0xc0, 0x19, 0xfd3649826d894c67, 0x0, 0x0, {{@in6=@mcast1, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x7fffffffffffffff, 0x0, 0x0, 0x2}, {0x0, 0x7ff}, 0x20000000, 0x0, 0x0, 0x1}, [@XFRMA_IF_ID={0x8, 0x1f, 0x2}]}, 0xc0}}, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000800)=@newspdinfo={0x1c, 0x24, 0x21, 0x0, 0x0, 0x0, [@XFRMA_SPD_IPV6_HTHRESH={0x6}]}, 0x1c}}, 0x0) sendmsg$nl_xfrm(r3, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000880)={&(0x7f00000008c0)=ANY=[@ANYBLOB="b8000000140067"], 0xb8}}, 0x0) r4 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000000c0)=@newlink={0x34, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2031}, [@IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r4}]}, @IFLA_GROUP={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x20048054}, 0x0) executing program 4: r0 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'wg2\x00', 0x0}) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000080)) r2 = gettid() timer_create(0x1, &(0x7f0000000180)={0x0, 0x21, 0x4, @tid=r2}, &(0x7f00000001c0)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000200)={0x0, 0x0, 0x3ed4, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r3, 0x1, &(0x7f0000000240)={{0x77359400}}, 0x0) timerfd_create(0x9, 0x800) seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0) sendmsg$tipc(r0, &(0x7f0000000540)={&(0x7f00000002c0)=@nameseq={0x1e, 0x1, 0x1, {0x0, 0x4, 0x1}}, 0x10, &(0x7f0000000400)=[{&(0x7f0000000300)="7c6c56f09ac26487fb14373e523c4893721efcd5b7df56d5c4ea4f9c5475fcc361bf045d1df9e218378f52bc63a517a52171c6d6667e69ca8e27137916351f2ae1caa9ee012d84d334e42a2758a8ad546b6fd61ba6a4649fb78981d0d29ddda27238abb646ddd0ef012b56280139cd6643a20226ee233893176f05c3ac930e2bf8da628cfd1ba5419f9af846a53cb4c360562bdb3d175647408c6839082c9a2f4063235e5884890c4745cde16be96851de93cc7488e9dfec1b5842a01b35da57d4607ec2b09bffec754f59065d92097de1aa5e9058fdbaa794367ef28fda72d12a3edecc1c862004d8aae945", 0xec}], 0x1, &(0x7f0000000440)="7be88c2100bfa061785ce75a1e16da5d8081b8f2e7b9ea1ed3d8cab206b46218560d41bc80012ddbae9af0388610adf6ab5e57d5100986f4b1b357863b793c28e423e73e537b707dc26ea322e83c8fe7aa5982e12f9c9e0a735b491a22cd65b1359a0d45f2d29afe8d1902bf67c915792115d0ba87e1124445f3835f6e5b84c83b5e611a2d7df17486e6eac0259d1ffa40b1011d4d017312dd75367eff1142271fb21e065f9c03ea9992c02b6aa0e3238a9e0fc6c9dbb53ee93e94bfc2dcff9f082bf0fbcd1686663e80a3", 0xcb, 0x4008804}, 0x10) r4 = getpid() sched_setaffinity(r4, 0x0, 0x0) sched_setscheduler(r4, 0x1, &(0x7f0000000580)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000680)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000700), 0x651, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2, 0x50, 0xffffffffffffffff, 0x0) r7 = socket$unix(0x1, 0x2, 0x0) bind$unix(r7, &(0x7f0000000740)=@abs={0x0, 0x0, 0x4e22}, 0x6e) ioctl$int_in(0xffffffffffffffff, 0x5421, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) connect$unix(r7, &(0x7f00000007c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) close(0x3) prctl$PR_SET_MM(0x23, 0x8, &(0x7f0000001000/0x4000)=nil) prctl$PR_SET_MM(0x23, 0x9, &(0x7f0000001000/0x1000)=nil) sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r1, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x4c840) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000640)=@newtfilter={0x24, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r1, {0xfff2, 0xfff1}, {0x1, 0xfff3}, {0x9, 0xf}}}, 0x24}, 0x1, 0x0, 0x0, 0x20041891}, 0x0) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000a40)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000a80)='./sys\x00', &(0x7f0000000ac0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./sys/bus/acpi/devices/PNP0501:00/status\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r1, {0x0, 0xc}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000e00)=@newtfilter={0x884, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r1, {0xb, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_flow={{0x9}, {0x854, 0x2, [@TCA_FLOW_POLICE={0x848, 0xa, 0x0, 0x1, [@TCA_POLICE_TBF={0x3c, 0x1, {0x5, 0x8, 0x65, 0x2, 0x4d, {0x1, 0x2, 0x2, 0x3, 0x3, 0x4}, {0x5, 0x0, 0x400, 0xab, 0x0, 0x9}, 0x2, 0x6, 0x8000}}, @TCA_POLICE_RATE={0x404, 0x2, [0x7, 0x7fffffff, 0x8, 0x7ff, 0x3, 0x2, 0x1, 0x401, 0xb9, 0xace, 0x0, 0x1, 0x9, 0x43, 0x7, 0x2, 0x0, 0x1ce00000, 0x7, 0x6, 0x103, 0x3, 0x1c000, 0x1ff, 0x2, 0x6, 0x9b16, 0x6, 0x100, 0x15a, 0xe, 0x40, 0x5, 0x4, 0x80000001, 0x4a, 0x1, 0x8, 0x99a9, 0x340d, 0x3, 0x2, 0x7, 0xd, 0x400, 0xfffffffa, 0x6, 0x100, 0x0, 0x5, 0x5, 0x2, 0xffff0001, 0x2, 0xdd1, 0x9, 0xfb, 0x4, 0xf, 0x324, 0x6, 0x8, 0x6, 0xff, 0x8, 0x401, 0x7fffffff, 0x4, 0x5, 0x800, 0x8261, 0x3, 0x6, 0x8, 0x2, 0x9, 0x4, 0x4, 0x6, 0x5, 0xf, 0x9, 0x38c8, 0x80000001, 0x4, 0xa11, 0x6, 0x8, 0x604, 0xfff, 0xab, 0x7, 0x5, 0x8, 0x1, 0x9, 0x401, 0x0, 0x4, 0x1ff, 0x4, 0x17, 0xffffff7f, 0x7c, 0x4, 0x4, 0xa42, 0xfffffff7, 0x4, 0x5b564ea6, 0xaa32, 0x2, 0x2, 0x4000008, 0x1ff, 0x5, 0x3, 0x7, 0x6, 0xfffff000, 0x12aeb60c, 0x4, 0xbb6, 0x1, 0x3, 0x5, 0x2, 0x3, 0x85, 0x10, 0x1, 0x5, 0x1, 0x10004, 0xb, 0xf65, 0x1d7, 0x9, 0x100, 0x0, 0x0, 0xc2, 0x1, 0x3, 0xffffffff, 0x1ff, 0x1, 0x30bb, 0x7, 0x40, 0xfffffff8, 0x5, 0x2, 0x1, 0x8, 0x8000, 0x5, 0x4, 0x31e, 0xffff8001, 0x6, 0xff, 0xa, 0x1ff, 0x9, 0x7, 0x7, 0x2, 0x412, 0x6, 0xf441, 0x6, 0x1, 0x7, 0x89, 0x3, 0x5, 0x0, 0x9, 0x7, 0x1, 0x4, 0x0, 0x4, 0x4, 0x200, 0x1, 0x720a, 0xff7f, 0xfff, 0x9, 0x7fff, 0x8, 0x3ac8efcb, 0x8, 0xf2c, 0x7, 0x80000000, 0x12, 0xfffff802, 0x2e4, 0x7, 0xfffffff9, 0x400, 0x4, 0x30, 0x10000, 0xfd, 0x4, 0x1, 0x5, 0x7, 0x0, 0x7, 0x47, 0x0, 0x0, 0x1, 0x7, 0x0, 0x8, 0x3, 0x6, 0x0, 0x10001, 0x0, 0xe9, 0x5, 0x1, 0x4, 0xaacc, 0x6f, 0x7fffffff, 0x5, 0x6, 0x2, 0xffff, 0x4, 0x10000, 0x9, 0xe, 0x45e8, 0x9, 0xfffffff8, 0x6, 0x100, 0x5, 0xe, 0x73d, 0x31, 0x3, 0x0, 0x2, 0x3, 0xb70, 0x3]}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0xfffffff7, 0x5, 0x7, 0x4, 0x2, 0x6, 0x1, 0xfb0, 0x8, 0x3, 0x5, 0x3, 0x0, 0x4, 0x9a, 0x9, 0x7, 0xfff, 0x7, 0x40, 0x5, 0x7fff, 0x6c, 0x3, 0x5, 0x7ff, 0x4, 0x2, 0x7, 0x2, 0x83d, 0x2, 0x3b, 0x4, 0x0, 0x4, 0x9, 0xc, 0x1cabbb02, 0x4, 0x4, 0x2, 0x8001, 0x7fff, 0x80000000, 0x10000, 0xffff8906, 0x7fffffff, 0x0, 0x0, 0x9, 0xc0000000, 0x2, 0x6, 0x83, 0x3, 0x10000, 0x3, 0x1, 0x6, 0x0, 0x1, 0x100, 0xcc2, 0x3800, 0x6, 0x18, 0x0, 0xfffffe00, 0x3, 0x6, 0x4, 0x3, 0x7, 0x1, 0xfffffffc, 0x8e4, 0xf5c1, 0x1, 0x5077, 0x3, 0x5, 0x7fff, 0x2, 0x4, 0x2, 0x3, 0x401, 0x6, 0x40, 0x7, 0x95, 0x5, 0x200, 0x1, 0x2, 0x7ff, 0x4, 0x8, 0xb, 0x6, 0x2, 0x0, 0xd266, 0x4, 0x0, 0x10001, 0x2, 0x101, 0x401, 0x200, 0x6, 0x1, 0x4a, 0x8, 0x2, 0xfffffffe, 0x14e, 0x4, 0x3, 0x1, 0x2, 0x94e6, 0xfffffbff, 0x5, 0x2, 0xfffd, 0xc, 0x4, 0x2, 0x40800000, 0x1f, 0x4, 0xffffffff, 0x800, 0x401, 0x3ff, 0x7ff, 0x101, 0x10, 0x5, 0x374, 0xc2f, 0x3, 0xffffff81, 0xfffffff7, 0x6, 0x8000, 0x8, 0x1, 0x1, 0x200, 0xcae, 0xc64, 0xffff, 0x7fff, 0x1, 0x8, 0x3c0, 0x9, 0x0, 0x6d3, 0xfffffff3, 0x9, 0x476b3752, 0xff, 0x0, 0x9, 0x7ff, 0x4, 0x3, 0x4, 0x7, 0x7249, 0x7, 0xffff8001, 0x95f, 0x8, 0x0, 0x1000, 0x800, 0x0, 0xfff, 0xf2, 0x0, 0x3, 0xffff, 0x0, 0x0, 0x8000, 0x9, 0x4, 0xcc6, 0xffe01000, 0x22, 0xd56, 0xfffffff0, 0x3bb8, 0x10, 0x140, 0x81, 0x9, 0x40, 0x2, 0x2, 0x4, 0x3, 0x0, 0x3, 0xf, 0x0, 0xc527, 0x9, 0x8, 0x1, 0xffff86fd, 0x7, 0x2, 0x8, 0x3, 0x9, 0x5, 0x0, 0x4, 0xc12, 0x7f, 0x0, 0x0, 0x80000000, 0x6f3, 0x7, 0x9, 0x7, 0x9, 0x4, 0x2, 0xc9, 0xaf8, 0x3, 0x80000000, 0xad8c, 0x4, 0x2, 0xea9, 0x9a1, 0x5, 0x1, 0x4, 0x8, 0x5, 0x10000, 0x3, 0x7fb, 0xdbbb, 0x4, 0x2]}]}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1}]}}]}, 0x884}, 0x1, 0x0, 0x0, 0x20041090}, 0xd0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000001740)={'tunl0\x00', &(0x7f00000016c0)={'gre0\x00', 0x0, 0x0, 0x7800, 0x3, 0x9, {{0x13, 0x4, 0x2, 0x33, 0x4c, 0x68, 0x0, 0x2, 0x4, 0x0, @multicast2, @empty, {[@timestamp_addr={0x44, 0xc, 0x71, 0x1, 0x3, [{@private=0xa010100, 0x8}]}, @ra={0x94, 0x4}, @timestamp_prespec={0x44, 0x14, 0xe5, 0x3, 0x5, [{@rand_addr=0x64010100, 0x3f89}, {@multicast2, 0x8000}]}, @timestamp={0x44, 0x10, 0x13, 0x0, 0x0, [0x5, 0xfffffffa, 0x4000000]}, @noop, @end]}}}}}) getsockname$packet(r0, &(0x7f0000001780)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000017c0)=0x14) getsockname$packet(r0, &(0x7f0000001800)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000001840)=0x14) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000001900)={'syztnl2\x00', &(0x7f0000001880)={'syztnl1\x00', 0x0, 0x2f, 0x9, 0x8, 0x4, 0x68, @private1, @mcast2, 0x8, 0x80, 0x4, 0x5}}) getpeername$packet(r0, &(0x7f0000001940)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000001980)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000019c0)={'team0\x00', 0x0}) getsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000001a00)={@remote, @remote, 0x0}, &(0x7f0000001a40)=0xc) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000001ac0)={'syztnl0\x00', &(0x7f0000001a80)={'syztnl0\x00', 0x0, 0x8000, 0x8000, 0x2, 0x6, {{0x6, 0x4, 0x1, 0x7, 0x18, 0x68, 0x0, 0x3, 0x2f, 0x0, @local, @private=0xa010100, {[@end]}}}}}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001dc0)={r0, 0xe0, &(0x7f0000001cc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f0000001b00)=[0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x2, 0x7, &(0x7f0000001b40)=[0x0, 0x0], &(0x7f0000001b80)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xcf, &(0x7f0000001bc0)=[{}, {}, {}, {}, {}, {}], 0x30, 0x10, &(0x7f0000001c00), &(0x7f0000001c40), 0x8, 0x80, 0x8, 0x8, &(0x7f0000001c80)}}, 0x10) r11 = socket(0x10, 0x803, 0x0) r12 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000001e00)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f0000001e40)={0x0, 0x0, &(0x7f0000001e80)={&(0x7f0000001ec0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, r13, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0, 0xfff3}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x4, 0x3c}}]}}]}, 0x48}}, 0x0) sendmsg$nl_route_sched(r11, &(0x7f0000001f40)={0x0, 0x0, &(0x7f0000001f80)={&(0x7f0000001fc0)=@newtfilter={0xb0, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r13, {0xf}, {}, {0x7, 0xfff3}}, [@filter_kind_options=@f_u32={{0x8}, {0x7c, 0x2, [@TCA_U32_ACT={0x54, 0x7, [@m_skbedit={0x50, 0x1, 0x0, 0x0, {{0xc}, {0x24, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0x5, 0x3}}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0x9, 0x20000000, 0x1, 0xd6}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x3}}}}]}, @TCA_U32_SEL={0x24, 0x5, {0x8, 0x7, 0x1, 0x3d3f, 0x0, 0xfff, 0x3, 0x58f, [{0x2, 0x20008000, 0x4, 0x1}]}}]}}, @TCA_RATE={0x6, 0x5, {0x2, 0xe}}]}, 0xb0}, 0x1, 0x0, 0x0, 0x1}, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000002080)={'wg1\x00', 0x0}) sendmsg$ETHTOOL_MSG_RINGS_GET(r0, &(0x7f0000002300)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000022c0)={&(0x7f00000020c0)={0x1c8, 0x0, 0x200, 0x70bd25, 0x25dfdbfe, {}, [@HEADER={0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}]}, @HEADER={0x74, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pim6reg1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pim6reg\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'caif0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pimreg1\x00'}]}, @HEADER={0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x6c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}]}, @HEADER={0x54, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r10}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0xb37c366b34703741}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r13}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvtap0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pim6reg\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r14}]}, @HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_hsr\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan1\x00'}]}]}, 0x1c8}, 0x1, 0x0, 0x0, 0x80}, 0x20008004) r15 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r15) wait4(r15, 0x0, 0x8, 0x0) r16 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route(r16, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="540000004900010928bd700018dcdf250a001c00", @ANYRES32, @ANYBLOB="0000000014000100fe80000000000000000000000000001f14000100fe8000000000000000000000000000bb080002"], 0x54}, 0x1, 0x0, 0x0, 0x20}, 0x0) ptrace$getregset(0x4204, r15, 0x202, &(0x7f0000000000)={&(0x7f0000000040)=""/152, 0x98}) read(r0, &(0x7f0000000cc0)=""/265, 0x109) executing program 4: r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, 0x0, 0x0) setxattr$security_ima(&(0x7f00000000c0)='./bus\x00', 0x0, &(0x7f0000000280)=@ng={0x4, 0x9, "5e0992af4b6274505c"}, 0xb, 0x3) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x2c, &(0x7f0000000180)=0x2) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102392, 0x18ff8) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x1c) io_pgetevents(0x0, 0x8, 0x0, 0x0, &(0x7f0000000580)={0x0, 0x989680}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x4c881, &(0x7f0000000540)={0xa, 0x4e24, 0x10, @mcast2}, 0x1c) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) executing program 0: r0 = syz_mount_image$ext4(&(0x7f0000006100)='ext4\x00', &(0x7f0000006140)='./file0\x00', 0x9, &(0x7f0000006180)={[{@init_itable_val={'init_itable', 0x3d, 0x6}}]}, 0x0, 0x4ae, &(0x7f0000006500)="$eJzs3VFrXFUeAPD/nSRt2qabdHcfuoXtlm2XtOx2Jmm2bfChVhB9Kqj1PcZkEkImmZCZtE0okuIHEERU8MknXwQ/gCD9CCIU9F1EFNFWH3zQjszkTlpjJhlqmkszvx+c3nPumZn/OZ3MnXvuucwJoGOdiIjLEdEVEWcioj/dn0tTrK6l+uPu3b05UU9J1GpXv08iSfc1XytJt4fSp/VGxEvPR7ya/DFuZXlldrxUKi6m5UJ1bqFQWV45OzM3Pl2cLs6PjAxfGL04en50aMf6eunZr99+44PnLn3yv+tfjn17+rV6s/rSuof7sZPWut7T+L9o6o6IxccRLANdaX96sm4IAABtqZ/j/zUi/t04/++PrsbZHAAAALCX1J7ui1+SiBoAAACwZ+Ua98AmuXx6L0Bf5HL5/No9vH+Pg7lSuVL971R5aX5y7V7ZgejJTc2UikPpvcID0ZPUy8ON/IPyuQ3lkYg4EhFv9R9olPMT5dJk1hc/AAAAoEMc2jD+/6l/bfwPAAAA7DEDWTcAAAAAeOyM/wEAAGDvM/4HAACAPe2FK1fqqdZc/3rfteWl2fK1s5PFymx+bmkiP1FeXMhPl8vTjd/sm9vu9Url8sL/Y37pRqFarFQLleWVsbny0nx1rLGu91jROtEAAACw+4786/YXSUSsPnWgker2pXXG6rC35bJuAJCZrqwbAGSmO+sGAJkxxgeSbep7W1V8+kjharVa7ZGeCAAAPLrBf5j/h05l/h86l/l/6FzN+f/k/voFeacE0CHaH+O3nAEEnnC7PP8PAABkoK+Rklw+vfDXF7lcPh9xuLEsQE8yNVMqDkXEXyLi8/6e/fXycNaNBgAAAAAAAAAAAAAAAAAAAAAAAIAnTK2WNBbjBgAAAPauiNw3Sbr+12D/qb6N1wf2JT/3N7YRcf29q+/cGK9WF4fr+39Y3199N91/LosrGAAAAMBGzXF6cxwPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADvp3t2bE820m3G/eyYiBjaL3x29jW1v9ETEwR+T6H7oeUlEdO1A/NVbEXF0s/hJvVkxkLZiY/xcRBzIOP6hHYgPnex2/fhzebPPXy5ONLabf/660/RntT7+5daPf10tjn+H24xx7M5HhZbxb0Uc694Yv7a/HqEZP2kR/2Sb8V95eWWlVV3t/YjBTb9/kt/FKlTnFgqV5ZWzM3Pj08Xp4vzIyPCF0Yuj50eHClMzpWL676Yx3vznx/e36v/BFvEHtun/qTb7/+udG3f/tkX80yc3f/+PbhG//jfxn/R7oF4/2MyvruUfdvzDz45v1f/JFv3f7v0/3Wb/z7z4+ldtPhQA2AWV5ZXZ8VKpuCgjIyOznsn6yAQAAOy0Byf9WbcEAAAAAAAAAAAAAAAAAAAAOtdu/JxY1n0EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGjHbwEAAP//kRbbrg==") ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f00000069c0)=ANY=[@ANYBLOB="000000004c90020004000000030001000000000000000000000000000000000000000000000000007f0000000000000000000000000000000000000000000000000000000500e7ffffff000000000000010000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000ffffffff"]) executing program 0: bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000002000000080000ff0700000000200000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000002000000080000ff0700000000200000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) (async) executing program 0: bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) mkdir(&(0x7f0000000a00)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000ac0)='./debug\x00', &(0x7f0000000b00)='debugfs\x00', 0x0, 0x0) lseek(0xffffffffffffffff, 0xfffffffffffffffc, 0x1) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000005c0)={'syz_tun\x00', 0x0}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="05000000050000000200000001"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r2, 0xffffffffffffffff}, &(0x7f0000000780), &(0x7f00000007c0)}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x11, 0xc, &(0x7f00000008c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x10004000}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x6, 0xc, &(0x7f0000000a00)=ANY=[], &(0x7f0000000a40)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000a80)={r4, r1, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0x13b, &(0x7f0000000ac0)=ANY=[], 0x0) syz_mount_image$ext4(&(0x7f00000001c0)='ext3\x00', &(0x7f0000000240)='./debug/usb/devices\x00', 0x20c810, &(0x7f0000000b80), 0xfa, 0x572, &(0x7f0000000bc0)="$eJzs3V9rm9UfAPDvk6bdn26/dTDGTy+ksAsnc+na+meCF/NSdDjQ+xnarIymy2jSsdaB24W78UaGIOJAfAHeezl8A76KgQ6GjqIX3lSe9EmXNUmbtpnpzOcDac95npOcc/I85+R78iQkgIE1nv7JRbwUEV8lEcea9uUj2zm+Xm71ya2Z9JbE2trHvyeRZNsa5ZPs/2iW+X9E/PxFxJlca73V5ZX5YrlcWszyE7WF6xPV5ZWzVxeKc6W50rWp6enzb05PvfP2Wz3r62uX/vr2owfvn//y1Oo3Pz46fi+JC3Ek29fcjz243ZwZj/HsORmOC5sKTvagsv0k6XcD2JWhbJwPRzoHHIuhbNQD/32fR8QaMKAS4x8GVCMOaKzte7QOfmE8fm99AdTa//z6eyNxsL42OryaPLMySte7Yz2oP63jp9/u30tv0bv3IQC2dftORJzL51vnvySb/3bvXBdlNtexw/lvbYdNApo8SOOf19vFP5WsxMH6383xz2ibsbsb24//3KMeVNNRGv+92zb+3bhoNTaU5Y7WY77h5MrVcimd2/4XEadj+ECa3+p6zvnVhx3nqafx30g9Bkzrb8SCWTse5Q88e5/ZYq24lz43e3wn4uW28W+yEf8mbY5/+nxc6rKOk6X7r3Ta1xz/tu//87X2Q8Sr2fG//cya6OkVrWTr65MT9fNhonFWtPrz7slfOtXfuf9Hn0NvW6XH/3Db83+j/2NJ8/Xa6s7r+P7g36VO+7Y//u3P/5Hkk3p6JNt2s1irLU5GjCQftm6fenrfRr5RPu3/6VPtx/9W5/+hiPi0y/7fPXG3Y9F+n/9p/2d3dPx3nnj4wWffdaq/u+P/Rj11OtvSzfzXbQP38twBAAAAAADAfpOLiCOR5Aob6VyuUFj/fMeJOJwrV6q1M1cqS9dmo/5d2bEYzjWudI82fR5iMvs8bCM/tSk/HRHHI+LroUP1fGGmUp7td+cBAAAAAAAAAAAAAAAAAABgnxjt8P3/1K9D/W4d8Nz5yW8YXNuO/1780hOwL3n9h8Fl/MPgMv5hcBn/MLjySb9bAPSL138YXMY/DC7jHwAAAAAAAAAAAAAAAAAAAAAAAAAAAHrq0sWL6W1t9cmtmTQ/e2N5ab5y4+xsqTpfWFiaKcxUFq8X5ho/ELKw5YMlf0S5Urk+ORVLNydqpWptorq8cnmhsnStdvnqQnGudLk0/G90CgAAAAAAAAAAAAAAAAAAAF4w1eWV+WK5XFqUkNhVIr8/miGxnmgM7D0/YH/nJQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABo9k8AAAD//24dNcY=") chdir(&(0x7f0000001200)='./file0\x00') r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000027c0)='cpuacct.usage_percpu\x00', 0x275a, 0x0) open(&(0x7f0000002800)='.\x00', 0x80000, 0x103) ioctl$NILFS_IOCTL_DELETE_CHECKPOINT(r5, 0x40086e81, &(0x7f0000000000)=0x8) ioctl$FS_IOC_SETFSLABEL(r5, 0x41009432, &(0x7f0000000040)="1533afa086f687d0b040d19917653036d275ca8d6937650996f4b7c9673b3a4d1143b020922ce2cf125df1b7830d5100db704d87858461f80fccca52e5372a6b3b07eef4aa1a5f166c50700033639e0ab8859a26842edc06f4c185558e2f4075884071346ffd0fee7597b0a173c779ef56f62c522714d721fea2d2065e004e5fbc415f040dddab7f5dd95583c27306d5bd2217e2c6a41c2e84303e739b3da0409ababfb7f3f26faa0cc22d9213ac8d4a85f202c7c5f15cf8810bbdc9b7d52ddce63dc060cff849cfac2bdde61f8f9b0e600f8ead3ef11388049493728b169705243cdd49e1da98b160cb0f9266a3e552acf1b449029178acfa142ee01fc57431") r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=@ipv4_newrule={0x24, 0x20, 0x301, 0x0, 0x0, {}, [@FRA_GENERIC_POLICY=@FRA_PRIORITY={0x8}]}, 0x24}}, 0x0) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0x3, 0xc, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x200000}, 0x94) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x1, 0xc, &(0x7f00000005c0)=ANY=[], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000640)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r9, 0x1, 0x32, &(0x7f0000000680)=r8, 0x4) sendmsg$inet(r10, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x20000000) socket$nl_route(0x10, 0x3, 0x0) executing program 0: close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) syz_mount_image$vfat(&(0x7f0000000080), &(0x7f00000000c0)='./file1\x00', 0x884, &(0x7f0000000100)=ANY=[@ANYBLOB='\x00'], 0x1, 0x28d, &(0x7f0000000180)="$eJzs3c9qK2UUAPAzyaRJdJEsXIlwB3Th6nLrE7TIFcSCoGShLvTizQVJwgUvBFrF2JVP4BP4PG7EF/ABFHcWEUemM0mTMuk/06bo77fp4Xzn5DvfZNquMvnstcno6fMXz46//iU6nSQae7EXJ0n0oxFz30atn3+rzwMA99xJnsfvealdpg5XK1prOtPGrQ8HANyK5f//254FALgbH3708Xv7BwePP8iyTsTku+kgifJnub7/LL6IcQzjUfTir4h8oYzfeffgcaRZoR9vTGbTQdE5+fTH6vX3f4047d+NXvTr+3ez0lL/bDpoxUvV/nvjGL7/Q/Tilfr+t2r6Y7ATb76+NP/D6MVPn8fzGMfTarZ5/ze7WfZ2/v0fX31SZIv+ZDYdtBd1VXXzTt8YAAAAAAAAAAAAAAAAAAAAAAD+0x5mC/3V5+/MH/xft96dXfZ8oNnS83keZVmWJ2X92eun8Woa6TbPDgAAAAAAAAAAAAAAAAAAAPfFi8Oj0ZPxePjlRoP5x/prluLv1Uw7Im6+14OrF5fzRLMabZxEXGmL46K4CFrRPu28vKt5zVN0k6TYIkljc29Bssh0l5cexPw4R6NuGSxl/szz/F/t3onTYH53jZ4kMWxceMU6dTfJBoK85vZrru3aOZ/pVieoKe5esPvOyzeaOe+tWUoiorW4mKs16blf4dZmr+Gd/PkBAAAAAAAAAAAAAAAAAACWnH3ot2bxeAsDAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAWnH3//zWCWdW8riZvFkEaVWbLRwQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOB/4J8AAAD///3QYpI=") r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000015c0)='./file0\x00', 0x8000, 0x90) getdents64(r0, &(0x7f0000000480)=""/4070, 0xfe6) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000007, 0x2000002, 0x401c031, 0xffffffffffffffff, 0x0) fstatfs(0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000016c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001700)='./proc\x00', &(0x7f0000001740)='proc\x00', 0x10, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000001780)='./proc/sys/net/ipv6/conf/syz_tun/addr_gen_mode\x00', 0x1, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000017c0)={'syz_tun\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000001800)={0x0, 0x0, &(0x7f0000001840)={&(0x7f0000001880)=@getchain={0x24, 0x11, 0x1, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x5}, {0xfff3}}}, 0x24}}, 0x0) write$FUSE_OPEN(r1, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f00000018c0)='fd/3\x00') r4 = socket$inet_udp(0x2, 0x2, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) setsockopt$inet_udp_encap(r4, 0x11, 0x64, &(0x7f0000005800)=0x2, 0x4) madvise(&(0x7f0000069000/0x3000)=nil, 0x3000, 0xe) openat$cgroup(0xffffffffffffffff, &(0x7f0000000000)='syz0\x00', 0x200002, 0x0) r5 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) process_vm_writev(r5, 0x0, 0x0, &(0x7f0000000040)=[{0x0}], 0x1, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x14) syz_open_dev$loop(&(0x7f0000001480), 0x200, 0x200100) unshare(0x24020400) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f00000014c0), 0x40000, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000001600)={0x0, 0x0, &(0x7f0000001640)={&(0x7f0000001680)=@ipv4_getaddr={0x18, 0x16, 0x701, 0x70bd2c, 0x25dfdbfb, {0x2, 0x38, 0xe0}}, 0x18}}, 0x8004084) ioctl$KVM_CREATE_DEVICE(r7, 0xc00caee0, &(0x7f0000001500)={0x4, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r9, 0x4018aee1, &(0x7f0000001540)=@attr_riscv64=@attr_imsic={0x0, 0x1, 0x2, &(0x7f0000001580)=0x3}) executing program 0: r0 = gettid() timer_create(0x1, &(0x7f0000000800)={0x0, 0x21, 0x4, @tid=r0}, &(0x7f0000000000)) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x3ed4, 0x5}) timer_create(0x2, &(0x7f0000000080)={0x0, 0x19, 0x0, @tid=r0}, &(0x7f00000000c0)) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) unshare(0x2040400) r1 = fsopen(&(0x7f0000000480)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) openat$urandom(0xffffffffffffff9c, &(0x7f0000000100), 0x140, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000005000000010001000900000001"], 0x48) close(r2) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0x10003, 0x9, 0x1}, 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000200)={r3, 0x0, 0x0}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r2, &(0x7f0000000280), 0x0}, 0x20) bpf$MAP_UPDATE_CONST_STR(0x4, &(0x7f00000002c0)={{r2}, &(0x7f0000000300)=0x4, 0x0}, 0x20) r4 = fsmount(r1, 0x0, 0x8) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000004c0)={@fallback=r4, 0x32, 0x0, 0xce2c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) executing program 0: mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @local}, 0x10) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) (async) socket$inet(0x2, 0x4000000000000001, 0x0) (async) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @local}, 0x10) (async) executing program 32: mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @local}, 0x10) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) (async) socket$inet(0x2, 0x4000000000000001, 0x0) (async) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @local}, 0x10) (async) executing program 33: r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, 0x0, 0x0) setxattr$security_ima(&(0x7f00000000c0)='./bus\x00', 0x0, &(0x7f0000000280)=@ng={0x4, 0x9, "5e0992af4b6274505c"}, 0xb, 0x3) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x2c, &(0x7f0000000180)=0x2) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102392, 0x18ff8) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x1c) io_pgetevents(0x0, 0x8, 0x0, 0x0, &(0x7f0000000580)={0x0, 0x989680}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x4c881, &(0x7f0000000540)={0xa, 0x4e24, 0x10, @mcast2}, 0x1c) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) executing program 1: bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x4, 0xe, &(0x7f0000000b00)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000001580), 0x8}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x46) capset(&(0x7f0000000080)={0x20071026}, &(0x7f00000000c0)={0x200000, 0x200000, 0x0, 0x1, 0xfffffffd, 0xfff}) mount$incfs(&(0x7f0000000100)='./file0\x00', &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f0000000200)="441f08100000009837a0324d7df546bcb8e8c94efe76cef3e200000000", 0x1d) syz_mount_image$vfat(&(0x7f0000000140), &(0x7f0000000000)='./proc_mnt\x00', 0x4008, &(0x7f0000000940)=ANY=[@ANYBLOB="757466383d302c696f636861727365743d63703835302c756e695f786c6174653d312c636865636b3d7374726963742c6e6f6e756d7461696c3d302c6e6f6e756d7461696c3d302c2c6e6f636173652c73686f72746e616d653d77696e39352c73686f72746e616d653d6d697865642c73686f72746e616d653d77696e39352c726f6469722c726f6469722c00fe563abfc89c35c87f6c94b3af8d4e0c78068f2d55c3e57bc40f3931e0074cce38a9e9d660fa49cb19a26be1ef061f5f46a2b000"/207], 0x81, 0x2f6, &(0x7f0000000280)="$eJzs3T+LI2UYAPBnsskmOQ83hZUIDmhhtdzdJ9hFVjjcSgmijS7eHkgmHGQhcKcYt7IXrPwOdvcB7GxsrG0sbMXOK8SR+bfJ5hI3B7t7x/H7NXkyz/vM+4d32RCYN5+9MR7de3By//Sr36PXS6K1F3vxJIlBtKLWDQDgpfIkz+OvvHJR2+1z79qtqxwXAHB1Nv7/v3VtQwIArtiHH3/y/v7h4cEHadqLGH87HSZRvVb5/fvxRWRxHLdiJ/6JyM9U8c27hwfRTtPmy4BpP4YR409/iXz+iaGovx07MViub75RSEvxdhGX/c+mw07cSCL286Rqcid24rWIvBP1TaqX9+4eHtxJm/qirhj5eBbD7XjnrR/q8f/7UUTsxK+fx4PI4l55i3n917fT9N38+7+/rGYwjEhm02G3bDeX+wQEAAAAAAAAAAAAAAAAAAAAAMCl2U3PDBbPzylPA5xF7O4u59vDiD/HTf38fKC9KM8Hqk/4mS2cr3MrTdPmGJ/psFOf79OO19vRfo5TBwAAAAAAAAAAAAAAAAAAgBfGycNHo6PscUyqIDsug5/yIuifa1On1gbthSvNY/0XVy0ENyKaYYx+jNiw6hmD2KqHliVPdZE0qeNJf9MbPl6T6q6r+q3uZHLSK7oqU/2q0/ONo7VuDdtZJJ2IGH23nLp5WtWsH/Obsaqv7NUy6MaK8n5suLyDOCpG1Xr4aNTsrtFREmWb7fmOW6rqrd4kC7uuf7ZiyTNsyHzF0m2trdq+6IZbmy3C9isrUj9vspH6sSpVzLhTz7qe/TdNm97SYnYu+S9lSXL+rZM7AAAAAAAAAAAAAAAAAADg0s0f+o0/nkqePpchAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMC1K3//v58dT8ogK4IY1MHZleVgVheXV1r/37g7OVnR7eCapwkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMBL7r8AAAD//xfPN7Y=") executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000080)={0xa, 0x400000000008d}, 0x0) (async) sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) (async) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)=0x0) ptrace$getregset(0x4204, r1, 0x3, &(0x7f00000007c0)={&(0x7f0000000540)=""/209, 0xd1}) (async) sched_setscheduler(r0, 0x1, &(0x7f0000000140)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x9a5eb000) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000280)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000300), 0x651, 0x0) (async) recvmmsg(r2, &(0x7f0000000340), 0x4000087, 0x2, 0x0) (async) add_key(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) (async) mmap$IORING_OFF_SQ_RING(0x0, 0x8000, 0x2, 0x2172, 0xffffffffffffffff, 0x0) (async) socket$inet_icmp_raw(0x2, 0x3, 0x1) (async) bind$inet(0xffffffffffffffff, &(0x7f0000000300)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(0xffffffffffffffff, &(0x7f0000000340)={0x2, 0xfffa, @empty}, 0x10) setsockopt$sock_int(r3, 0x1, 0x1e, &(0x7f0000000040)=0x4, 0x4) (async) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000180), 0xc) (async) syz_emit_ethernet(0x46, &(0x7f0000000580)=ANY=[], 0x0) keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f0000000400)={0x0, 0xfff0}, 0x0, 0x0, 0x0) (async) setsockopt$sock_int(r3, 0x1, 0x4b, &(0x7f00000001c0)=0x7, 0x4) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000800)=ANY=[@ANYBLOB="4c0100001800010025bd7000ffdbdf251d0106001e0106001d0162ff0971ec6d721744cd5200080000f8cfcad4c4ec6511ec028c5028564abce87afe14c93e15e556c2baed7f897fe841c155a2b2a4b9f3052995cdf66a9c7922ff0300005b6c67281f1519cd7c32c2bf7563b9452575505da99ea128d37616896be8764a2c78edbad5bde7a5e405bdc893770338925f824bd24689c0d11a5568fc3aaa9ad0d7766d8ea8d3bf1006e3df494e2f373148ecb4adafdd39874e9808b118301f1e76054a64c6d243563f5de7b347f3b740e105d0ed18fae7289635301ebd8949263a01c077f8cf5fc033acdac92c8090b3bcd4cbed5f1cfe93becc51ed30802f96defe9e8ea850529827c5e301953a8abaafa1f121e590f74e28233f4129d4587eee87ec5d42c3ef0619022c035c8dc9f00000e4ffff004d0101ffff2814edb2ea000015000400000000c0000300004f4d5a01d49f9755070000004b"], 0x14c}, 0x1, 0x0, 0x0, 0x4040}, 0x4014804) executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000100)=[{{0x0, 0x0, 0x0}, 0x9}], 0x1, 0x100, 0x0) bind$inet6(r0, &(0x7f0000000380)={0xa, 0xe22, 0x0, @rand_addr, 0x10000}, 0x1c) close(r0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r2, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20008004}, 0x4) writev(r1, &(0x7f00000003c0)=[{&(0x7f0000000400)="580000001500add427323b472545b4560a117fffffff81000e220e227f000001925aa80013007b00090080007f000001e809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee000000deff0000000200000000", 0x58}], 0x1) prlimit64(0x0, 0xe, 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x2241, 0x0) r4 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000300)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) write$selinux_attr(r4, &(0x7f0000000340)='system_u:object_r:hugetlbfs_t:s0\x00', 0x1d) readv(r4, &(0x7f0000000a40)=[{&(0x7f0000001cc0)=""/175, 0xaf}], 0x1) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001dc0)={0x12, 0x22, 0x0, 0x0, 0x401, 0x0, 0x0, 0x0, 0x45, '\x00', 0x0, 0xf, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001ec0), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000001f00)='./file0\x00', &(0x7f0000001f40), 0x0, &(0x7f0000001f80)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) syz_fuse_handle_req(r5, &(0x7f0000002000)="de98ee653502c564abeb97fc678bde22efebcf99c2d89952950acc703a3c6268a54c8b1bd1ee165c82980cd315b55a070dc41deeb2d4c1842d936a0bcde5fd7ed6031fdd9cb58ebfe8261528f097f309813b5722c24a1af8e6bc6ddaef7e85d2659690154bc5e6ee73c3fe7176509ad7b30e1098fc9873db91d3c1816825e710374de8d40693578b598922d9c523cfff93a630f121251d17ad40bce021d7fd57945fe2a186618a40b5f3995a9f0ceaa3e22b57e4f68e53fffeb5474fb83afaf5cde6b0aaf5cf0313ede442ddf1df6c280921e43d80dddfd005969272e1719b37fd8f749fcde83f8201826b4cf5b1c1da394568aa7d8833dd11309f46422b0152ede5ab29b17bc1ae80147346155b20a98d6fc2650bec3fe73327c45cad1b38f7c983cd070556a8f8ed5d58e1052f6436fad905099d18fb3e62c2c36a1c2209a94c820e30e5234e77be3beb4cd183015d281e7bf39cdcf0f1e541211c75d64a49df66bea814bab91ed65386d6a491a6295c24dbaf752a5e7a856e0dfe46a6f9e718ca3919c6f8978b0fd65c9e389114e5afd8e9e2a575b854463b63f46d08795f0f1d0d48d6d610fd74e9238de32ee3fa2ffef550336341803c083ac1d749be6c5440bbe4bd3bc3015bcde2b4e2160ba266d281a9641f74d9348fb6fa8550d1e8a8362999452e40b75c412cfa77ab8e1aaf1a9e83c855ec9b7ada38690f0d2e59f67a1f3babbcda8011595ea720816c24726b833beaca0a9d11e7b99373601d27d18c9e29940503d3a12149fdc4fe0065c3d023d6e7712eb853df19f2b4b886e08d61629288ff16c2597d7fae5bfc8b41f92fc325ffe0f61683b1f661409bdd7c3d88a854f8393484f4669b5d9654fd3a0819a32110b9064539a7419c332629b3fc71da35b7ed4f7c693842ce83733a63f2e6af37989cfcb768ab8cea5d21b82a0e9f6fdcec26b0107708867dec54c4e739fe9b931b3c6da013bfae097c57f1e16ba54f9028e672511938a0ad9d681d7feebc65a2f5f588abd66261393f3ba02d7b2cf650a9f7c6a4ca55b4d41132908dc9c90e26f0da8e2259e3a2b63b2d9e27754e278827ab80438070698c690ec375a9aeb4193079a28a2a062961ba0e65af01644af063f3ebefda92c4986379f7b099b2fd3960929578736f09887fc5816cb1b982e5b121b79662d1674dd0c6e82627cf8c63e576e5c1eb0af9415ddc10ff880e8ae3ce8c4fb87b8f9d364974c2a1d8eba4e04bc2bc018bfabc435683b2551c0e4908570b930c4fd7c03ddb95e9ec1d1994e3df0305fdac4e5b914641ae25b0c469b194c0bb78ab04887cdc4262da468475b926a18254d23b4c44705aeca34ef8a7b04dd55a43f39996529a23804e054655c5ba8661f7c02737e7539650364928d62b9b8d80988232009acb54214f06640e9bc6614c0ce02e4a22dc8b91a0aad711e4fd01d7020b7c7185e41e27ce266b9f5aec682cbd4bba3240d6277b17b564937254f37afe580cba0b78c6b0cc81830eaf10d7cc1f7e918d49e935629fe6c24b4368a04af1b99f6981340ee031874f3d4b3a9ebc31719b3b775bfe1fdfa0460a3820bff6f61b49b11ac2ca00836a0c4a74aed92a619f34231196669b942e761538e64f965d23d4f7814256e876263fe5307985c4e6eb69c974f66276764e80ab1de3f5c55e7b2cfdb78dd183a85473e968918ad73f29a266c818b9bf9f62eed86df25b2577bb6d98e3996e94f5bdf119b869541a94eb3536c979c3d77cc0df7c0c48a902ca2f03f5ba5a8ef9431cf95f6fc89744e8440e1d5ebb837e30ef7541fbc27672c31566ac3676a173cb9e466a2d206ba1ebc2b985eddcd6ff937375fbc8415eba46f5ec68cfa9f3a669d41b078867dd9f5160ba45fa4719f32cf877d4b7a6d77c977533659f7c7ac22c68f5e93c1df6c2a3d45b55a4afd3355680aed864f6bbe13da2da28a4851f73c88e555f3bb1c34a21fc45ab6c28287902e8b5fcae6899c804f364cd878a8d1734462bb075cb7bc709cc2c5d7747c4c29a2fa9259752301c26b852b7993adf889d45dbe39094c9b7b168756e5b939ed10bb6df57b8f5e14352cfc7d8b03cda5b978b06cf2430af5db17177b1ef664bc4b00307f970c4fc606a6bab72125f62b0f59655c35b104da7af188a953cfc09b3aa0785abf330830fefedcc8bf9a11d5dc4b5642f679d45cb44fe61ab1d906345c1c345f6b8027bae9585580c20115d2504d9c83ab54ea2557b6d2dd3bc65fa29f091aa46a215e77621836154104e6969fa9107139a19f2e45cc6bf55422a0e1a6d037ad9e63df5f9cd2045e13ac2d6a15bc12008c4cd23782df7d41bfecc0037292d22c7b42f2cc1a22db7502332d9f4fa85f7640c8635b9469681adb6bcec2dfdf6926f1815156d80a835ae918527f549ea6df45f350f618dc1f3ca139759be28e35013034f8bbfd3fa1a8f302594213c18015305911f42e287f2d86f17d76f8a0ea03fb574c60c808669f9f4454fc2eaf0e93873f688e34bd3341f6874d5d8fe754172a751d6ab23dc1642220e7fb1071df0ee3c7e07c338915494a3b360bdc0b38ed221c2c2bc86b29744448b255802b3ddfe600c1d0f9acabb2185e4e9dae5e456d5825f516c857f63e72e4a5f3d45eaf11a0e3a5ad0ba30a0bf0f94cc99586fd202d6118bb6f9c272f6cbe39dd9b8b36ea7fa51dfe0bb87a633be11c16a14d1bce8492387696e195fa3c5f172690b4434aa2e91ce7d225d73b1983d2605ec725aae0ae402cd2f79fc202a307f1896f3dfcf8c0fd8b841dcfeda5d65bb7d76f7c2d2eb1b164c0368e9984f320a224d7d438bc5c699acbc18a587b7589e960af114afbc9f59243646557962fc2e0cb5b5bf160a313bcfd9ade3e140b808e9f19415808aa312ae9c9e8bcd5a47fc721eda59d10670088714984a71d5c0df8b68e675a8e31ec15a92ff6a04d17e0ef849c782b302d11f742efe6486ab904fd65c0aac4ec25c6d877b453dce80e894de703aa8b1e5d00701850f149fe437fd0944cb95e54a924a49bd86bb9a602cf2904fbd9e399f1cdcd0b45b6d8f872e285f9dfeaa26aa760074651393c6451b36c643dd0b7236ec7803d69cec1b09bf1b63fbb68ad7c01507f00083b184ff01a62096f386f4c8fdc85e93eecf3f4b384aec1c10ccc60d8109a6d887bd389c3406163f9600879f0e944443d783e8644f69344f6f44f7bbf1883cda7369c9b9904d991c01552135f158a0bbb7f40c354f292c034824d82c209ebc770f5b756768ae51d45f8875b59904a07090689e65b40625566eed5d209130db812f287b966ae21ba46a3a7a3a0360a4e284d8d91ba9ed9806ea063827c8dda0fa98f758cbfa523ac645421f444a40b95bb065a64256c19354b1ad5002bb7b2add9b5236ad64e9052734b9d263515683db121b5e4dc1eab244dd8fc0fc62d962834ba0b21aad872b127afc0a33c7869a3f213519aa2ef51bab9ab28ed18859fd8239841a6668fc614dedd099121ae6c220a143c119cb9bff9068f65d0554b4c12105e59a22e91203a08ab8c718ec62c42d7ebb7b495e9e1be8fb7e4aab2777025da37b48d9d7b97578841a73898a6eab994e250106e096390c77b0600537be881ab7d81e3cb468bf1fe318b1e804d8df9875e9b8da22e6244997317391cce608085a28b8d070d654a29afab324ba3eecf427b6dfd43501ec0db919f71a932897eb37fe3bd64ab5a34ec60011696298b74ddd7a3710d3e444cedcc5cdc357f9dd58e67dc0ed3fc8df6dad82b3c00b4290c3280c28f78df052ec9cdd9df025abe8834616eddd5bb93379c69092911cd60761e7d14b426a83e335bfc8bf67a14e01df7cefb6023f0c6556534b975ed889de0d96d968526372402ce3d21a2c5c64a449dc3ba4ee0b5ceabc2fa29679e225681c8e946dc94b48af024bb1633e1860c7d8c14500967f24e2f8f46db537232a4e9f4abf8408f53bb52b035bdb89917a6f2f4bd22403ad002c2d936b785ecd965177e9f6235787a185d0eca92532f1aab16756ae86ece13925ba4a1fd08125102ae08c428d073aa426c4e792b5a4acf618605df1707021ce1eed62da4ee87334e34edf43338a0076b8ec739e2c31071e10c6a853e19fbf25b8a356527a67c8f7696dc184e374f4641f4e5b0aa345f1e6c4bfeba3a392d9a994bc271717a051c98d6c5b1f3296caf4c01d80ffb75b6fbdd0a0583f9d4695a44a2878df0c09a85aaab14522320cc3d2611603a34e52da03677a60cc87cc3c689975e5b5366c82e040b6643b8865d8bea0c84cef9ff85245a8b4bc41af1a50775b29fe55e42ac4b29fe80ddaf02e8c9bd07cab823f3d9021ac88236525ec045688a2fc9c6df66f549b10720cebf09ead919524f071cd128fb7575c84190c698b420f89b3c11195b5d83022d1f7e48afc21203995caf8f9286dcd5bd51b65c1af1caadf5a1b3f12579066855ff851075adb959dc3e086a7fb4e9a27fe80e8f3c0959b042486310ae7b785b0612e0385e36f50d4cae3474dd000c3957955534b4907b9480e2e5d83dedbeb76cb78d893c5b64dd51e31abc8e8b4c56b96f67c4b6e43861d91681af3270aae1a8f50712bd97326ee46a2640285b2902f051071d5a3400e99b76459956ac6908688c314bd8e54365383a65b186a6386cc5218e41e0b386759de81bccf5aa68f8608831a9d33ad1af2bdbd8579c5921cd8c3dd2f3bf1f123c742e118c76e2f43618bb7885e44826b7417c9ca5a139d774c16fbf74c8969c038ba6a54f27bab46ecc94d6455188d8dc1edf1da715c8d9976226877096df4158eeecced2248c7b88de0dd11a076db1f06bae4adba8286dc39aa62a55233886e011622ae1cf97238914a55078a7890814529440000004e0d34364e0f3daa9eba6fa54c085777b18c0523818ff8710dee4bfeb3db549c3f38dde73b99a7b1b219282407a4e0ab3794089e21f6f2045ab6254ac3703903edb302fb2f0f97e47cca7969ad6b5b6cf27314137a04d5f4f29c193cfc5540592ab1342a1a9cbd514a7b4d6b23f724a5d7bfa6ffe8e3d9de29b8661139f179a0fafecf234f19bee75c25faffc765e02377d83e0ad0a0029c08f5c71595bc1b2fe88f0fe958f3f1f8ba6821ab834cab9bc902b2d47bd4b5ed52b5b0d7b3bc999b2f68879be39ddcb0428ce3a617b68c11459b746651f413d9e9a098cd2b5c0fcfd0ea1db2cde1672818d7bc73b053015692f9e9259a0153e3c9ac5e73e3343dd350cfbcaa57be93cc881a35063aec2db4ed71df2b1bd90b5ecbd84f399d4530c5450d622188423e151cec49673dc633e503c497d53843f4824750dc09abae9f2f465e92888715b6879f5edbab7bcd58f0899e1430ffb5f3063450945cb0fb3b5c3088ed6966c54dddae3aab489a80341b45a17cac02ae62749f209a7e16ecdfd86b43569c7b34511c65474acf2b2c18834e158e20957bf2320e4a6b9d63caea93b3a7dd4f7ba54443aba1ac2b6f2b27e1bf6f17d3fd1582462e0debc7069bb70e219654cbb99adfed54ab94329382163f2ab6710bb581d189cb3449a02c917c1f2d1d5f51958ce605fdb0e37ae5f3cb3f123276d43b2c26ea948dee863e0b679ecddf0fe41ce78bbca30167c9c7d6b0e9193c98090facd7205a490727e1ac49bb4d639348a32546007459c61c27bf8df87dd2ed3f3228b8193422a72d15f848bac13c6ffa7b8a767cf04866feb7c7a81267d7a8e890128d4709e4873223578aa7febdd562403c6092c0a3f6e0650772ede935ab6ef95e375bcbfa395e23ef1d73532388b845a95f158dc845a123f798176c73e177926d39abd38a910d40653006375110be2f2c5f6efc87b31908be36dd07c8ba5853519a37dfc4dea981af855293f49a3270bb67cdc17b780fbf2a418fcec8953dae927909a6bbbdce230d23113efad9c02474682dafc63311050cb4f3f86c282ff29728eefac5c678360122b4ce221bcec82d24e053b63972d2e9a631a180b48bb8d2d4de7254d91a856071df51a1d87ca7eb5d19ac3def1fdd6ebd8f57c2c9e43cb6ff2fa00d27f279368f5ee29a84ba219a51d1f0f1965781164edbb3aa6209fbce6d40284fbb4a33f59bf9e1248100a623de16613eebc11f510b7718dde9f13b4c9b2b6a10dd932696cdb7fa4b5733b0377453471462762457d42038ebf8c0fb392ca7656ad1f050c326de75fffc698c48f5d809ae360ddb9856b9a54b811073233294bf91e46414441b6665f432201da12e49718b0d7929b6cbcbf310a09ce0d22f07ee5cfa8ffb9f03acd224641171ffafdf50f18be8fa3c907226cc1a6f3b16a776781a6396dbf09f689ad6bba4d537dad490a6f036a45ee3e224e6f519e44b7352ee3e7d3f0d89f8c7c8f54b6d2698c0298a07866c9d9ca09c96c2ac8efd7974294df6dd1bb0598debadb6135e7123bbfddf84870de54476a291586fc0e64784e65fdf78d462e8b51cbac38e7ff1878b11418f188220e3deb5367a2d90ad7d44395f6965cc6d680c59daac268c16814d1085302d0453b48e4a8ae78b8a5b6951a875ef42776f6d11955da7e5734a72b61cefcc6889b8f8d58db51ee78d7b1a8ffebd90e15a64654054767aaec24dd3b5f338b572496c8731049c10622b7f54fdfa43aaea316946291fee7bc9e64640e8bccf33fd1e8693b67020b49cf77faaaa8269e2fecc4e2b43c8c3378a4a9b9b85a4fe2c346c5512cda631542e0ff5706eba996f4f72e629b076d6be1966d44b1835ce664e3c6a4f18c68f5e32f900a0a167e547d5aa79c0aede966f83d00366a623ef8107e328654c8558d5e606f69a12b6c2a6fcbe0e08f945c4ad2738ed0b28d79c98514abe0819569c6e4f4751c665fd651aaa9ee392c330560ef6d57c0a97f0764f88433b2bf7641ba391634316b0ee1dac23a63be21270e50ea1ac24ac3b429a0b46c38dbd48c540bfb1e141b8b3df6caa179c7e54f2b7b1371e8eb05a30f13da95200ab70dc58325f6bea0ee9fe1f04154998df393f2b4ff4431363f3a7450fa5210e883d67620ae63cc41f72e74e26a0244de1ac722b6f1c1d293f7483b331a0efda65a4e4e9144547fe6dce2f4535e29048b07079329b63754bb124b9e046a6e97929b1f4a387765bf93804530791c9f649db6efbebebf46fa4f9af7ff2587130d0e70a32d4aab1dfbee6aadd1f3e5317e3d4c8cde75b1479bc3dd16ea35db3dca11cf1eb1d2bbac60b83605e171619d85fd4b6d0e24be8db76df12efef05eb87473b832e59f3039df44ef034e5e7546b399cc817a41b2f020286ff139072a5b909ebb185a3c955cf88f4a9929b2112e0a9ab43da0288ce3ea268ccc9f46f852d387f5d0a2831dfc8cb0bf593905ba376c069b8c9b70558ec826c5bf9835031199c4c6d84c913da7e9e7db49c1d34511d917b9ad3c40af0598737d58fd61b8f2adc46b73a284957a99943cf73414412fa5440a5f85b63c20794d122c267fba72bfcd0e2741642fd8ff5a0ae1ffd8b30d852c053d0e31f505ca13a21c0223a8ee77cdd92de1b9f87ebee4ea332e9d4573d7efb2ad3f50c35fb7a596c4edb4b72bf6df5a16ffe3c8a236f2cab8c0712ac26c2cbcc68c1dc45209b579c952c7d645642aeed7d60407ee2dc168179d536da950108e962c5c976d3a05bf5142466ee38939ee94e707a0135f99c99b5d6376f63c711e4f64950f08dbc931c812f34735d9eb1c5997770d8159068cdca2e0f192311ca438d613728b544d6a3e50ae0e4e6b1eb611ce55a96bb2f991d49173073d8547f5ede69d8b587a34bb8f637297a15ab4fc45f1384bbd19b3feab5fb81322ba831386eeb6067e55af374c1b1eb9613a6c41dfe2bbbcfad157dd042c67c44400b350f0dc40a8611f2e947f32ea3ac3f609027b5dbc95b157c13216fe7c35edcc82950bd4e38bcb02b63d2576489c331a222e013e73b5333694889b184bedbbb6fdd6fd40a62b1d5d494e68cd2aefc264f74bf70ef38373e599faaa326f574ae32b1aad86854af22db8c9673d14666aa7c0c3bbe0d76a835ba4b391552777ed20c5c6cd0aa84f3be73ca0a3c128914107fb8fc02220317fb111cf13398480cd3325582a7e55f4c4ef5a258bcd01a97615e95f89c8046d41d04340b88cd5f4b1d827a030637145d98422facadbbbce97dc3060402a7bfa73d7b4dde53184a0923c0ee29c6e8e2c35e396808df2481af6aab053b619fcb2833f14f87051c5461567c5f8dd40383a7521971775493f896e18c78bad8219f88258ea686652780c03ebafb63ecbfcb23e24d52a2f88a77ed3b2280637807a5e155f4fad7149b76841772471a3b77aa42e8058c0af1ac2be9d88b5152851708f1a77582b3e31702864ee6a244a38f3f95d9797a60cddeb5ddf08cc48fc677f03f9e717ebe7f472883e5a6a7df31ca4272228f26991460c537ebc8aecb6a0c34a763eb1f57124fbfafd6db4c21bedf6723b252aeb21eb1fd9f4f811fd3e2e764422964761b2ef3aaaf986a48f7be66f6387578f9492feebc97dfbc6bc97380394a5635dbe582e52a1fb18ea8fc4e53974c63d198cf0d878ba8a8d58688a037c0f753c7073337ef3da4c134ef939c98c8806d09943591e6013a1342de7c722f993fd7eb36ba8e8407d1ea60eb5724b0d6262c70469dbd8ea1956b8d7f5a77707a9cbe2137079e7abda3966c5bee4fd86e8a3c4969bc88ff328a2adc8f4546f647575866d5ced16df06bf40d9a5f178f9d19e490bd76e187c441e7de0e571f6cea5512ec9bea48903d91a519dc82defe34a06b0244d623090b5a250786bbc66c1e76db6b18d81ed33c81a7c93782d5cdbe0a7cf7d1ab29c04be6ff4a9bbc10f716a67d52fd52d91425abd2002cf83c3797861db5fbeaec745a552ca4a50604340f2cf2c1b10e9ba76c8ea43b283c73f774f8be213f17f70cf93b9f6a8bab1f516a935e80c3cc6756945edafd572e6e00840eedf61fc40351869f03562d8c13006de585a1141c02f1311fbc8e45e4b3878c32810698e4764a6e8495f165eefee35714a1794f9ab50897c5565ab745425933d9d6272a172c1f2a274f9ca7bc8e1b01a27b8bd06fd9dc61880789696348c99e9a70c9dd2a62ca04d1f86dc87380b618c2a78b16229d614702fce242fa17ea90cda2648f9375bf7e78b4267d558983e08a9566d95871998d23cc6d22c23370ae067b677609844abc140df81cbd9addbf657fffaab5c22c479acca18f3e4b508cf01ff7b2ca308ff116389790f26f2c7635f89c747a5bc66f61de575653069349a89fd7e3dd785266b7bccf16eb8b4a8a86751de60d33e17d64f6e4e0f9d13a16d243ad7364114db7ad011f094c4debf20a39e35e7eeb440bbe8811db2857b965edd1e2675ceb1bc9a1691f123dedb341962fbbe539485d2241b0409adce2587d035187a0dd5a62076ac4eb5c3e2f4455569b6eac0fc16155da1774cbe505dc92e2087585a7846bae699bef32e3c5ec2356dd4433ed29d4b03ff7b38f7b3cb96b92874eefda6c2e0e326214e40f14cc2ef80e1cd3fe226257a423b8ff5bb368b87ac7066c5136487775b5b122a858334c37f6a3f53d758c3c866e2e79daf9aeab36a59eddbae2fa5b6d20973014196ef0a4cde1373c7297833e6f1e46828f4a42eebd829dd4f17999abe285218ed5dc6007b21bceb588a213b29dbb1ab1a79b41a12df26fe35f0cf6a310c9e50cf10d71ad5960626e4efec211032ec4ae52512001362ba4108d86eb774d2d4d0364cbb1dae68f03a774e328c2dc09899ee80c05ac2a8e3ba905b0b3b7a08a3df20b505901123e7dc0a15db48d09c84189ca4345c23c2010c12cc35287fad30211cab9631e148a7c1e8bfab61ced30e098d1c3cf7b6a7fbd8288dfdc48044d0d47c17f129f6b5d751af1984d395ab1b08ccca3e7309a89a8a36dfc3fb82d2a4269bffc32571438d04a7b98137b46ae1fea1bd9ea64f99e2f0c5f12ed84886b10bbd511993b0447036c4e57b9dae6d5bdad6aa3f2d12e62471194e43111613b8b6944c2baf1f539ea14dd76c356bfef7e3d4b6fb91f6d321a796a4bce5a4c6a5caaf0f3eccd914dea21ae909be7ba486075ff6139e7e351fdd7e98013ba51ff0248852398c734f245ffd7fde8cacfa4805496ad7350b1c96d7bf9da9be492f2f414e973937ac9109b6e8b8315aa9b81840f2c21239caf85a28f0e590bb6ad12148e75bd4d7ea69a9ffb053781db98d5fb5aca30a734017be7683a559c203c006ecd4b135afe3650b906e0aa208c889f2af09f3f8263260c3bd07cf8021124b6f0e0d021f9839e47996905c3d7562df810484552de3bcc9ae054b62a01af6a7991e4d63f30c7a92d8b58e01052e53818e64d7540a3208af321709a5d891ceecae5d27a999b00ed01616a73ec8854ca61973ed1fd3d82f8628b215c55eb7908e297d77098a7b0c362709005a7d13c89c54556589b2a926c6e08cc1c0afebc7eeb5d7ae4ef0507c91b8e706e6dbf83d898819192c812554ad1c6377871a8ca50f1325630f7b5266b807ef61d0c8d399fada49cb02a14c16d39f4fa7b81272573808e761c9dce7cfd12f4f18dd06b0ee471c166e095bf84aa4aaa2d82f1afcf09e5d960257c0a8dc404225b4b62187829c59e57da50bf848d72fabfb69362c117c6913541f84095a2a4ccdd2d30860cd96640bb2315e435a4af08c62c584ad129300adb02a871f3c548b96c4f6c47efdf4a1163a8a5ba9b4766b01437bc5957324660a8cd87df0f7e000d1309e896e3ce9f57b17562c9368a95a4cf66b3a5b57f0cca563b045452bbc8ad07b96fd0322728ccb3b05bfda14ef36ecfa2f32c5aa899811a67f2d62ed970db5723d6e4e4913c98c81ed6c03469112c23549f7e20be6401c6544db9078f34e6a4ad3cc868bace2e7ec6ea17225986f9e941ec67d9a3fc57958f9df8a60f585aa38b1769e26ed3f68dd85685b2cefae9dd72a18abc0de6b94689785df377ef4a812a6abc7f738a396f0e99ccbc5731801c36e746ab6b1dda88ca6ecb899528e18543cb3dfd439cd5be566594f01a4533da3638e6331fedf5b67870938ad044aa0dfdae33e3a6258ad40baadd726eacb1f3c1eb8d83ef4e185d7603a4f1eb006d90bf5849e2f65d37ffe750eb061bbad08a0c0cfabb9abf7f27d36ee5687d23feaa923e09d2ae905410a9193f21ed9b1d6331bb1f3babb90da2f2e023a6ceda4b4fe0f5d864738ee7f65a0b136021fbe076b4adf2d3af760e1361bad7ae35cb7ca010ddf4488255a2d3c492d0b26a1a5643f998b5d04a52a59f176d9bda85c916ff901329f09fe953b030b92f6415172476ad89d3e8cdcb4eda7dde5d4fcd5d6a584a312563558e784b0f9bcea7c53d26c3f2d3350c70a5e06a67c4c0373dd6279e29c320e6580fba8ab2df3039c289235c066af1b07dd112f25b25e292020f36c1aba246cba4e054d64b38f53ed57a712dffad7d3dc97f86af511638a2779107fc55da63b6498ea5f3ae36883163e5bf2324211a61a9889278f828e58daae797fdba9218d322da7aa23db7a48a00", 0x2000, &(0x7f0000004000)={&(0x7f00000040c0)={0x50, 0x0, 0x4, {0x7, 0x29, 0x100001, 0x24ff871999e0dde7, 0x1, 0x41, 0xd, 0x8, 0x0, 0x0, 0x8, 0x5}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$FUSE_NOTIFY_STORE(r5, &(0x7f0000004140)=ANY=[@ANYBLOB="29000000040000000000000000000000010000000000000089000000001e000001"], 0x29) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000140)={'pimreg\x00', 0x5005}) r6 = socket$nl_route(0x10, 0x3, 0x0) link(&(0x7f0000001d80)='./file1\x00', 0x0) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="280000001000010024bd7000fc0ddf2500000000", @ANYRES32=0x0, @ANYBLOB="1b0b04000300000008001b"], 0x28}, 0x1, 0x0, 0x0, 0x68010}, 0x0) write$tun(r3, &(0x7f0000000c00)={@void, @val={0x0, 0x4, 0x1, 0x30, 0xfff, 0x4f}, @ipv4=@generic={{0x5, 0x4, 0x2, 0x18, 0xfe0, 0x64, 0x0, 0x9, 0x11, 0x0, @empty, @broadcast}, "465835170fa06ded05427a07dab063fd416d24e0689d552734f601503f4d395e7794229315d4d39f6453b5b0e5c4dcba679704b8245844ad9a2df7cc05734f08c63ab32f66f8ea4dec60fca3e11c64a5fdcb41dc8291282d4a0a6af9727ea119edaa53714fd2a7580edf4ff0356e360ecb0d38182fceed1ab2f6644125d5b71317c22f61205aa6554478e03cf7392e0d8e54a557f12d0db842a1e05c2d4de2d3aa4a681afee8eb9f08acc29c75e5698887c7fc925dbcfc2fb8512da9d621f4c33a51d14be564816e16d2d1cf77e7441af104aece606f6597699104233cb55c01074f73deafca015512bfa39941c6d256879c7ce230d27ba2736821a57bf96825d88cfbdddd5e48f7fad1114783079b98df132a85a5c8882be087b9d4040d603e82ad4d1b373b1a5cb484cc563bf07ec7f6415223e5bee1b60b2cd4ded9b1608f5137a2199c82672d0d73bd6f03112691fa97cf2bd22eb53cb1729e33e4d4907af29ba773a7961582dab8af2c737a67175b00f62745cdc0389040171dfe3c1b0f3e104a357fcf014cc9e75196cb9dbbe2f44828c488be7ecc64819f8cca5341ebbaf5aacb9a7ab2308540a720a940136c03ad463fbc394742ba12753dcf32256905bbb51629904978e7f09dcc4c754380629faa4409054f458c33c98dc2efcb1f3a46fda15d14f51ce09b4a6424e11078d70a848e0d011fe3328ee913009ec1de6a058b0075375917b501423d94e6fd81f3e5ef2392f4d2b8d5ad38b665eb0b5cb9868dc9c8b4da3cc100a1392438204ea73299ccf958ed8a7baa2027221ccf5b74b9d511bbbccfebcb487a61de8d575489e048d76ca577a32a0cdc81b881396dea2faf07ab3f1cba7e2b7a79e347d1d1e7167c1011fdbe4a78db08ef7aacd8dfac7d940cfb186c258c46f0fce2daf682a643c96f8ec37d9c7ac0b4560a1aa5811da8778fbc720c6a2c612581a92ef83eb7fc070000000000000039199f4b5a0016561e9512639156210a02aaac0540f0773dd3e5e417aafb6f4c31c2a104885a429101ca9faf5a93be6c70c0c6f1fd5973df9defcf6bcc38bec0f878b206b4bac240248377f9a12790f52b5ff96a2649a66798e9bd71671169e2aa195f89a937d3c431d4871463e98ba77cb09da905fc606855ed392e4b44cec624ddef813a279e1b104996fbae00491f4361edf57257f7f19b05e4375f4354edeef65a2eb230e085bd2535b59c71753c5360885419198014b554d0346bfd4137007e864386547f3432b44b2c5972ce453143dff873cf20fea179caddce77516124c9ae426a48b9485c66f1f5f18a0f3730b76730aca019ecd349bd71aebeddcb94095539a8eada5e7079c4734582b5ea1cac940762b5000c7d6363d39c2297392800e6c7147f01c17353b4e66473e3c0e2fd605de77da26a5589891d7cbf145ef93b1308ddb74e1eab386a819b517965e1a1b9c572b768097fe0bdbf3b5c3a0533fa911ed42c055c7dc17906ea4e0206aef78ea3090bd67d093ad9d65aef1c54343fa068c940435d09b2022f4b2be0182b48bffffa123122a91d4bb5dfe18f32334400aed3dd5c83f2113c3d4f1445962b82dc57c8a515cfa8501a086e711eaef2b94c93b0d39f0ddd7e09aa712cfee37125b7a7922d8718002b0d39b6d51cee6c5460ae53e888f6105d359ac89ac0ccc203570596f3280220c90b69991c97ecb8e838a19d96d0c8f37f89da2c2de958447851270b8f00576e817782bdbd5dbed996596de60f339419787ccff8296988360adbdd4abbc2cb3001163182de349717ec1706de04251af911fb9588a9203adfa2690c4794b3204b09fb117fd641b27f80ec13c5890e879f92434f155d663cb0e000d20f4b69d94162d92302599a34c950fb17fd4c9dd848a8ea346a185c8d15fb309dc23c1fe14dd81ece6709ecd891dd4f74babc5255a62117ecdd70d7bb922caf27f87a44f56daf82a34fb8f6f0b08a0c868f9c6a46a330647df1f9189a5f90635190103bf4fb17ac54ee3ff222c160a7f2ce304897629727bb3afff560505949d2064bd924fbf49495de1c87aec21c4a09367779e628567ea7da0e58eb4d413c52ba1eab851dc3b3f5d76e64ead7cbbbd77c8bc4320bbaadd0f58b028f01b88fcc3d070dd40ee3564b474a8a8e52e44d452504041e3122f607bc9215644f7f1dc4a6f8f0f864b783aa546674b54434dc12f621f323990f7c409434c05e5f14874fc8c5968bea0265e071ad968f3d97a81551110cdd2cf5483d97e51a7c312aade294a0b7f361d1c566f37f7655c829030d55115aca19b75ab920e06fcd7a4ba2c22b22c6d23663e0534917760bb6234a8353fdd6c1b7e6b66df251bfa5e73e2d1592661973807d07bf6d0e4e4dd9fff92c91d46e45a7fd46f880cf581d6b8060a104ff53f2b5ad4d079dc93228a551081daf63cfcc353831e3a924b3b3319f7413af4b462236425fec19f9bd4ba499d5ed255a2c8903266e2422d651d60f8e724e0503a3c45e18f363a6127a6ee46167e3b5c6fd1e31437e1ee607174c91a9eae4394e0624e83d8b8f23547fce4c8721ba5a76c0e377ee91afd73ebeb92d955ce8a2f77861a510913afdf1f29af5b9816d5efc5aaf0467d15e09db35cd9a1874f2d013dc3dde4227cb1ccb7d326949308ce6b9bbb1055d674e1014b956f831354aa20831a6d414c9d98f6293ee4d665e674c3aaa65647ab2f6b0af5426ecb6f659cebdd61723900ab9c68c8588f5e3552b622f3e611c6ab271d7c99b63490a9cbc68b1b5bc1ec5ccad016da7e9fabbf41b5e5655f914cc9a2b777584c45554780197f3583c7cb8db809c9f14633e3d2503af1991ea529bbf51e532941cdc08eb65fd604e28a0b07b5d6315f81236b681417e4d9a065c86d42d639b72cbc82d346d2e8eeaf812c5d95c3b6eb6d969dcb2205bb2342e7b66e4669e7b3fcc0f89d9dbd906fcdda72be4691e3b289585e96cd873662a841c52e186c60081f4528485bf756cd068935ab318a9946987b1e75e9af6d4320d60d54ae45e322fccb1860dd784d7b21f688807bcb484cafd8bd4442c6c952ccbb550545d0e50c0f303d5b6272de2c59568ca5a24a4473f91bd94cc486bdb9a020d6ccea19ee109b7b3a3c5e9cb19239f33e2d1a6f04e1f638c4d18f2cdc37cce73797eec8e703a21359d7e203e24298b5df41fe342ed803be8a0d8ccfe6db50f233225ced25b44fca26c53b769c98d1268595a2c5f33806e1cd5347d396ca6f625e6a8fc2cbc32649397578541d14050b3a98d72f795c4181cd04ae4d1fd5a1f3044a98281ee21e778ddf0616ca1d56b71da52fe5f5cc7e366e477ff36068f00031550063f6f113724f83771db172b899c0fb68798406e6556ba673a85728a01ac11799920c0e0fb309ccb97e8fdf91a4aec656d38dd007c54d240684e45bb2a0efa38defa733ef892e7bde623e5f7d1db478a524f01eab6ac854315238792cafc39296400d914d9aa32869d5c471979453437eb6d1c137200e330aca386ca28fc9b30e1baaaa51795c298bafbff6950e33d530e4f225f88889304ca5ae8898d050febd09397136df2defaa689d584d9a02eebec5257e43adff797b5e7a72ba97d1aca32f6fb97c978b9929d2eef28c4bbf294aa69d3a62d2088b2b5dc97cb541c4ed405e77c59196d94d2e1d8293ad6d80cc4462295525f249ee0a07bfd8c2707302b3831f479a3eb514a745f852e30b07e72b31b388248eea539b6bf761d870f703d19230b0c37938b2896c9706b9dc7856eb407d69a4ad8e3bc264a1c2c74812f5304e977aa10062eae1a6e4a236256f264561a2209c3e1ffc0304d4d691324bdce5052d1f63d3a3244b882f4f02525b052d2f86a61c6c008cc7d728e557a4e8f19951d9de9c5f80dbbb48356a633b00357e56685a830ecd9ee045027ca1fa0389a615e0f15625d3ebb31ad207df15860348f18d229d101be27658124d891456ed08acd630f97dda5e163ce0a475e8c4ec0bb81155f241791ab6060aabd9c3d3ade231ba3f4dbca9ea8f1da052228493c3117f268b742b94560d14e8e385e09fdda97a26792f4cb78564a690910f580615d8b6bb162957920ce84e1067b5417597a9e6f4e9d15e0462b7b88ffc6d1319de334afe7242807de6ff894248f9be17108efa329bd1327c84528c81f889d4fd32eb360b05b10f57d2de520fe4b2678a6f8a3c62c5a2dbc19719c4878d60623db456791c1374cf7a26dca2b0df69d359e497293d96591628ca0b47a6ba99f66b4fc51731e1a3d97397509fa3e81b52ee9e25158a47d3b18a9c012ea47f9a6662b8aea6349c5c2e8a154dfb93feb792b82c434692cabd304875b83ac9b9e1ec67d593da6e1d60f7b0e5285ea993343fabc307b66262cf4e6af4ca65fcafba1d991482d457a2b7c6fcf6903d963932838350dc5ae06d5a921b3eceaa6d367d88cf5ea35ef86a171eb632d3ef194b38d0f4b945386037bdb4e0bbdfd730aca3646ab03e372167cbd9d93fb07125353e32005a2cab0080091bddabf4722cefb68a8a6b72a85f588e2b20869c02655468fce7a0b5fa7d95347613ff28d6a4f2efba5eb5a13dc487548d3f6d030126500e67760f468729df8cad82038363a96aabd23a55251492e233e751eb3ead1a7e02acfb9b8e6c91d2f216c4653e3541da1d7a79240fc7461685f3ad9da0d5f545b1e63347cddbb598600f42c5ad6d4a964102a7d55bc9ecaf26cdcd005cd120115edade01377db8fa6ce1c37c2d5db91cce44752a196000e5718ced5b49cce29e99cd974f2a73d5bdd89bb2a0016245655eb886dc42597d8d8d66848186e0f7f65ac475c80b799fe1e7f17cdc6fc4938f33fdcd0071569e627926cfa6b1ea831a7087025ce1e8766f1465c4684d60c357c9c20511d9533684bbad71eab0ed55b2c0465833d599117e9545a0852d2ca374ac7f12b067711096fcd6730c4d493e5a34655208aca62795e558efe715830d93731835a95a35097c600a8471acc5bca328b2f2b94f57a07414b06ba477c095a442ffefe6c1897242d249f9a2b74e29f44197da0360628ce8f2478ac752286365a7ef9a89b0e9ef2a67ea262f685e3ca479bae73f0e895045c54f97c858039bca17ba1aa318695f5cd3e079240bd145d46facd29a4fa3b7e4970c28ee79ee4c8cf4fc7645f56f0031dc62b100ab9550fd0816e4ca22e5143abdc5ec4cbc409ad9d2c29a19a27996f0d9a8d6952b0957c7ceefc0c4c6d3c95db0e42b9a0cae8a3d28199b9531499b3e36016c54a5d399f5db5d12d16cc9b08116c6dc30951e23d34b8fa4fb82ce03388d5b7884744677dc45a13857f8d7a8de5bed8252d37de5e1ceaf15904fce0de37fce88a0683ac84bd5737262545ac502983da688f3d9b5632da32e6561aea03e9f353707b6ed150e912aa095d13f2eb6c8f64912896c3119bea04d7b4124e9d16631b49dd8888861cd2dfee110eac96bd7e9edb99311b8e876a4101c43a16b842d173ac6657271ae770355991faa3c4173a855b7695dab634ee8d0d25185ca4dd84499d9c47f240e7338444411ab0760412f285e6de63ba20faffc30840f944b088ad6392dec61e9a4b0c3c1875b73f3d2ad1504f2e426260c4409da34c7b94aea9e4f6566ff4d284e008817b6e10225262d04096375392b9ca010855a1f624202138126e2051bf673c477237149975b7610bc9"}}, 0xfea) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000040)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x2208c54, &(0x7f0000000480)=ANY=[@ANYBLOB="6e6f6e756d7461696c2c6e66732c73686f72746e616d653d6c6f7765722c757466383d312c64656275672c696f636861727365743d757466382c73686f72746e616d653d6d697865642c757466383d312c004845160000000000", @ANYBLOB="d75cf355f2a28326f7a987a567186b85041fbccd3627ff7bee3dcc171cf4e3756de04424fe0e92bba8afaa550fb32a30a8cfec8a230455fe00e7561827335387d9a7232816231205aacfcbf60e236bfd4d48b9a03b9036ed0a45c3052479a57595c366e58227d2203a22a6168b153e230898f9b6c88172ea110f6df63ced753efc44bffacb46803435bc47f0ed571e2c100e37d8baec678ac466f0c33761fed2e1c514b795da2a7f88c43f7a2b95f1ec609e520d60fd7193f2167f492cc6a4fcb0e29fdbda4773b529dfea9ede29befcecc74ebf9c6627f39fd25439c8b18b9557455c5f6e8077bfc7b88db4166f5bef388ccc56117a424fa20de7546b30a0", @ANYRESHEX, @ANYBLOB="06f137d1881ef185c472b9a9a1088b3c1dcad523b1da404b050822fdf2a8b8f200eae500b099b29abe1f8caf9c23bbc48fc387ffb40992655898", @ANYRESOCT], 0x3f, 0x2bd, &(0x7f0000000640)="$eJzs3LFrE2EYx/HHpDZpSpsIIiioD7roEto4OGqQFsSAUpuiDsLVXjTkTMpdqETEZhFX/47i6Cao/0AXcXF3K4Lg0kE86d2lvbRpm7ZJk9rvB8r75p73x71NruVJILfy4N3zUsFJF4yqROIqEZG6rIqk1maBE8EY8eaDElaXq8O/v5+///DRnWwuNzGlOpmdvpZR1dGLn168en/pS3V45sPox5gspx6v/Mr8WB5cPrvyd/pZ0dGio+VKVQ2drVSqxqxl6lzRKaVV71mm4ZhaLDum3VQvWJX5+Zoa5bmRxLxtOo4a5ZqWzJpWK1q1a2o8NYplTafTOpKQYywiMtDGsvzS1JSR3bbsRju6KXTdUKuDtp2tty7mlw5hTwAAoM/s3P/7vf72/X9uxh/30v+f2b3/F6H/75J606Nd+n8cVdfDV79tZ41E8PfbjP4fAAAAAAAAAAAAAAAAAAAAAICjYNV1k67rJtfG4JD3OCYicRFxg3qPt4kuCb/+buhnl9f/Ro+2iw4LfXEvLmK9Xcgv5P3Rr2cLUhRLTBmTpPzxroeAP5+8nZsYU09KPluLQX5xIR+VWCPfkGqVv3Bq3M9rc/6kJMLnz0hSTrc+f6ZlflCuXA7l05KUr0+kIpbMedf1Rv71uOqtu7lN+SFvHQAAAAAA/4O0rtvy/t2rewvisrXu50OfD7iuu7jT5wOb3l8PyLl2blEJAAAAAAAOzKm9LBmWZdr7mMRE5ADxzk9cV6T324hKfzwbzZObItIH2zisSVxE/CO6n/jP9XhbKbeNNQMi0vOnZQ+TXv9nAgAAANBpG03/HkLf3nRxRwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHD/t3g+ssX5LqVHYIR46XfTQf0EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACgj/wLAAD//7KDHOI=") syz_mount_image$vfat(&(0x7f0000000900), &(0x7f0000000940)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x380407b, 0x0, 0x1, 0x0, &(0x7f0000000a40)) rename(&(0x7f0000000a80)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000b80)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00') getpid() connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0xb8) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000000140)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000180)='./file0/file1\x00', 0x20400, 0x20) getdents64(r0, &(0x7f00000001c0)=""/59, 0x3b) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=@newlink={0x4c, 0x10, 0x44b, 0x70bd26, 0x0, {0x7a, 0x0, 0x0, 0x0, 0x1840, 0x42c04}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_QUERY_USE_IFADDR={0x5}, @IFLA_BR_AGEING_TIME={0x8, 0x4, 0x1}, @IFLA_BR_MCAST_SNOOPING={0x5, 0x17, 0x1}]}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20048064}, 0x24) executing program 1: syz_mount_image$vfat(&(0x7f0000000640), &(0x7f0000000680)='./file0\x00', 0x101c0ca, &(0x7f00000006c0)=ANY=[@ANYBLOB="73686f72746e616d653d6d697865642c666d61736b3d30303030303030303030303030303030303030303036362c696f636861727365743d69736f383835392d312c6572726f72733d636f6e74696e75652c756e695f786c6174653d302c696f636861727365743d61736369692c726f6469722c73686f72746e616d653d6d697865642c756e695f786c6174653d302c757466383d302c757466383d302c756e695f786c6174653d312c64656275672c756e695f786c6174653d312c666d61736b3d30303030303030303030303030303030303030303030332c6e6f63617365aec489af6ba9723d4b17106f6d47b9ade1c253d4e3b08066427cae9f41fd1e1dd25a22ec22ad6e8bf6f67e052de91b544f2f4541f87a0c0b36e8d444150b35c110bda57fe7a9c06ba087cc975447082aaf95213301f3e04b70ea67a8aa0d582ca1a9525dba7116d80f126f782a78428b878fc79c0be9ad98cb6950995e6edba78e5301e8c8e69cc85beceb8b54f84a84787815ef9a18f1fe1c81b4c1830102f7e3236e2533e486ecb46ee53991c5bfe6289a474582b2e57741fd8de78f42097851bee74d4201c7767e0e0f4b34523150639b1291441ad01f2f72ed3679d7bca0e8b4e0689f883196af0d0dfe7344f276c1b4bd333882cf7879248ad423e3f21cd0cae2309519f9d40df23cf05d9c8d8f9d07da771ea1e3bcd8478fb989f770da17f700000000000000"], 0x6, 0x2c0, &(0x7f0000000900)="$eJzs3U9rK1UUAPAz+TOJukgWrkRwQBeuHu+9rZsUeQ/ErnxkoS60+FqQJggtFKri2JVbNy78DILgB3HjNxDcCu6sUBiZyaRJ2pg2palof79Fe3vnnLlnboZ2WujJx6+O959nsXfy5a/R7SbRGMQgTpPoRyOmvo4Fg28DAPgvOy2K+KOYWCcviYju5soCADboej//W7PhT3dSFgCwQc/e/+Ddre3tJ+9lWTeejr85Gpa/2ZefJ8e39uLTGMVuPIxenEVUDwrtqJ4WyuHToijyVlbqxxvj/GhYZo4/+rk+/9bv9R8LSv3q4/nTRpX/zvaTR9nEXH5e1vFivf6gXP9x9OLl8+SF/MdL8mOYxpuvz9X/IHrxyyfxWYzieVXELP+rR1n2dvHdn198WJZX5if50bBTxc0UzTt8WQAAAAAAAAAAAAAAAAAAAAAA+J97UPfO6UTVv6ecqvvvNM/KL9qRTfUX+/NM8qetfRb6AxVFkVftcib9dR5mWVbUgbP8VrzSmm8sCAAAAAAAAAAAAAAAAAAAAPfX4fHn+zuj0e7BrQym3QBaEfHXs4ibnmcwN/NarA7u1GvujEaNergY05qfieY0JolYWUZ5Ebe0LVcNXrhUcz344cd1T9i9Oqa9fK3D4+ZNX6/84sz07trfSZbvYSemM9160e/TiFlMGtdcPf2nQ0Wsc/ulSw/11t6N9KVqkK+IiWRVYW/9Ntm5eia5eBVptatL09v1YC79wr1xrfs5upP0y98rEt06AAAAAAAAAAAAAAAAAABgo2b//bvk4MnK1EbR2VhZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHCnZu//v8Ygj4h2fYIrgtM4OPyXLxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIB74O8AAAD//0aWVl0=") r0 = socket$inet6(0xa, 0x3, 0xff) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000bc0)=@filter={'filter\x00', 0xe, 0x4, 0x370, 0xffffffff, 0x0, 0xd0, 0x1a0, 0xffffffff, 0xffffffff, 0x0, 0xd0, 0x2a0, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@ipv6={@empty, @empty, [], [], '\x00', '\x00', {}, {}, 0x6, 0x0, 0x1}, 0x0, 0xd8, 0x100, 0x0, {}, [@common=@inet=@tcp={{0x30}, {[0x0, 0xffff], [0x0, 0xffff], 0x0, 0x2, 0x2}}]}, @common=@inet=@TCPMSS={0x28, 'TCPMSS\x00', 0x0, {0x578}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3d0) r1 = socket$inet6(0xa, 0x3, 0x3c) setsockopt$inet6_IPV6_RTHDR(r1, 0x29, 0x39, &(0x7f0000000fc0)={0x0, 0x2, 0x2, 0x1, 0x0, [@mcast2]}, 0x18) (async, rerun: 64) connect$inet6(r1, &(0x7f0000001000)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, 0x1c) (rerun: 64) writev(r1, &(0x7f0000001040)=[{&(0x7f0000001080)=',', 0x5dc}], 0x1) (async) clock_settime(0x0, &(0x7f00000004c0)={0x7f, 0x2f000000}) (async) syz_mount_image$vfat(&(0x7f0000000080), &(0x7f00000000c0)='./file1\x00', 0x2048c5, &(0x7f0000000100)={[{@utf8}, {@shortname_mixed}, {@utf8no}, {@shortname_win95}, {@uni_xlate}, {@utf8no}, {@shortname_lower}, {@utf8}, {@uni_xlateno}, {}, {@fat=@usefree}, {@shortname_winnt}, {@shortname_win95}, {@shortname_winnt}]}, 0x0, 0x2e0, &(0x7f00000001c0)="$eJzs3E9rG0cYx/Gf/tiSZWzpYAotlA7tpb0stvoGKooNpYIa1yptD4V1tWqFtpLQqioqpfIt17wOk2NOCSR5A77klnvIxQQCufgQoqA/a8uSbEmJnbWj7wcsjfXs4xntzIpnBZ6jn2//VSp4VsGuKxw3Ckv7OpZSnVZfSKHuo/Y7j4satK+vll8++fTHX35dymSzmzvGbGV2v04bY1Y/e/DPf3c+f1Rf/unu6v2YDlO/Hb1IPz386PDjo9e7/l+vSLbZq1Tq9p7rmHzRK1nGbLuO7TmmWPacWt3YpubHC26lWm0au5xfSVRrjucZu9w0Jadp6hVTrzWN/YddLBvLssxKQhMsTTrgponMnJE72NmxM1cyGARh7Jqu1TJ2ZGwwd/A+BgUAAK6X6er/nrAuqv+/n6n+/7PomaJnypVOfX9B/R/WYHxC/S/NUv+jr3p+6IO7R5pHnfo/0b9+z6L+BwAAAAAAAAAAAAAAAAAAAADgJjhut5PtdjvpP/s/MUlxSf7vQY8TV4P5n28D/7gXl9xbjVwj13vuxTMFFeXK0fqC9Kq7Hvp67a3vspvrpiulh26rn99q5CKK+fm+1Pj8jV6+GciPtbSgxGD/aSW1Nj4/PZrfauQW9eUX7Vi/Z0eWknr8uypyle+u69P8/zeM+faH7FD+kvLbwcwJAAAAAACXzTInRu7fu3HL+NuGDMWlUHPw+wElJ3w/MHR/HdUn0UDfOgAAAAAAc8NbVMl2XafmNf+9cQ3NluVvZnspvUtBn4T4tAdHJfVfuTdyTFTXYirHNcKShkMLI6+Mb0TebZafS2evi7Xzpzt2enqDPmNjG+3IyVp99nfvCpgmfeqPkG+u5pMJAAAAwGXzi/5Q0AMBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGCOTbuLmH/822xCNtBdJJh3CQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFwPbwIAAP//Y0QRLg==") (async, rerun: 64) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async, rerun: 64) r3 = eventfd(0x4) (async) socketpair$unix(0x1, 0x1, 0x0, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f00000010c0)='./proc\x00', 0xae4d2f8ed3bfc611) mount(0x0, &(0x7f0000001100)='./proc\x00', &(0x7f0000001140)='proc\x00', 0x0, 0x0) (async, rerun: 64) r4 = openat(0xffffffffffffff9c, &(0x7f0000001180)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) (rerun: 64) write(r4, &(0x7f00000011c0)='7', 0x1) (async) add_key$keyring(&(0x7f0000001200), &(0x7f0000001240)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffb) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000540)='./dev\x00', &(0x7f0000000580)='devtmpfs\x00', 0x0, 0x0) (async, rerun: 32) r5 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./dev/mapper/control\x00', 0x2, 0x0) (rerun: 32) ioctl(r5, 0xc013fd08, &(0x7f0000000600)="04000000000000000000000038010000380100000000000000000000000000003200000000000000000000000000000070") ioctl$VHOST_SET_VRING_CALL(r2, 0x4008af21, &(0x7f0000000040)={0x3, r3}) executing program 6: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) setuid(0xee01) pipe(0x0) r1 = gettid() timer_create(0x1, &(0x7f00000015c0)={0x0, 0x21, 0x4, @tid=r1}, &(0x7f0000001600)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000000)={0x0, 0x0, 0xffffffff, 0x5, r0}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r2, 0x1, &(0x7f0000001680), 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r3 = fsopen(&(0x7f00000016c0)='bpf\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x0) fchdir(r4) rt_tgsigqueueinfo(r0, r0, 0x8, &(0x7f0000001540)={0x2b, 0x8, 0xfffffffb}) syz_clone3(&(0x7f0000000340)={0x801400, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x19}, 0x0, 0x0, 0x0, 0x0}, 0x40) r6 = socket(0x1e, 0x2, 0x0) setsockopt$inet_opts(r6, 0x0, 0x0, &(0x7f0000000140)="3cc9b954afb8781ff73b131b3e5e44b7", 0x10) process_madvise(r5, &(0x7f0000001500)=[{&(0x7f00000002c0)="a1b62cc97ff4ee64b264341a901889763f8b2dcb22e261acc5acc099000145fb65042e1286f1d1c994a3d99915d27940f9f2303e5f72089ab959abd8a148ae50ed529ce4e9faf7a99d656668bd468b6c38a0ad8f8521b14502897a034aec0fd75cf683293006d32aa5ec2d74cf663ddbab436b314025f6", 0x77}, {&(0x7f0000001400)="b2b752c9769d1644c7dd21561fc3148d1a28c0e7cac8d978f4040c70668fc2dba36e8366b1d3a39c0d8eac78fff2ecaaa2d79c69c842f631a2e6df45705d56b1b973cf5e5fb2e92d7a57b6120e3559136da3faef1c345c68a28819a39366c7fe88ea1f258126c6be0da126bb0c42e1d07a1a9eb15faddbfc1b877b0e0d7c280dae37c2651ab3457bf7cd377253ee8a4bac4d1374db2ed286083253fc27c06cb1b6221b4bb4848b5239450d2846eff2cfd19d27483d44866f040c6a8263b78cc58d44eee73d63463f8f0c53a5e3fa642186dd9fdde90f2f892b416810", 0xdc}], 0x2, 0x12, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000001700), 0x40, 0x0) fcntl$lock(r8, 0x11, 0x0) capset(&(0x7f0000000080)={0x20080522}, &(0x7f00000000c0)={0x0, 0x9, 0x10, 0x81, 0xffffffff}) r9 = syz_open_dev$loop(&(0x7f0000000100), 0x40, 0x100) ioctl$BLKFLSBUF(r9, 0x1261, 0x0) mmap(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x2000008, 0x32, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x8, &(0x7f0000000240)=ANY=[@ANYBLOB="180200000a00000100000000ff000000180200000a0000020000000000000000bfa2000000000000b70300004000000085000000450000009500000000000000"], &(0x7f0000000280)='GPL\x00', 0x1, 0x1000, &(0x7f0000000400)=""/4096, 0x0, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$netlink_NETLINK_PKTINFO(r7, 0x10e, 0xc, &(0x7f0000000040)=0x8, 0x4) executing program 6: r0 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'wg2\x00', 0x0}) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000080)) r2 = gettid() timer_create(0x1, &(0x7f0000000180)={0x0, 0x21, 0x4, @tid=r2}, &(0x7f00000001c0)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000200)={0x0, 0x0, 0x3ed4, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r3, 0x1, &(0x7f0000000240)={{0x77359400}}, 0x0) timerfd_create(0x9, 0x800) seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0) sendmsg$tipc(r0, &(0x7f0000000540)={&(0x7f00000002c0)=@nameseq={0x1e, 0x1, 0x1, {0x0, 0x4, 0x1}}, 0x10, &(0x7f0000000400)=[{&(0x7f0000000300)="7c6c56f09ac26487fb14373e523c4893721efcd5b7df56d5c4ea4f9c5475fcc361bf045d1df9e218378f52bc63a517a52171c6d6667e69ca8e27137916351f2ae1caa9ee012d84d334e42a2758a8ad546b6fd61ba6a4649fb78981d0d29ddda27238abb646ddd0ef012b56280139cd6643a20226ee233893176f05c3ac930e2bf8da628cfd1ba5419f9af846a53cb4c360562bdb3d175647408c6839082c9a2f4063235e5884890c4745cde16be96851de93cc7488e9dfec1b5842a01b35da57d4607ec2b09bffec754f59065d92097de1aa5e9058fdbaa794367ef28fda72d12a3edecc1c862004d8aae945", 0xec}], 0x1, &(0x7f0000000440)="7be88c2100bfa061785ce75a1e16da5d8081b8f2e7b9ea1ed3d8cab206b46218560d41bc80012ddbae9af0388610adf6ab5e57d5100986f4b1b357863b793c28e423e73e537b707dc26ea322e83c8fe7aa5982e12f9c9e0a735b491a22cd65b1359a0d45f2d29afe8d1902bf67c915792115d0ba87e1124445f3835f6e5b84c83b5e611a2d7df17486e6eac0259d1ffa40b1011d4d017312dd75367eff1142271fb21e065f9c03ea9992c02b6aa0e3238a9e0fc6c9dbb53ee93e94bfc2dcff9f082bf0fbcd1686663e80a3", 0xcb, 0x4008804}, 0x10) r4 = getpid() sched_setaffinity(r4, 0x0, 0x0) sched_setscheduler(r4, 0x1, &(0x7f0000000580)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000680)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000700), 0x651, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2, 0x50, 0xffffffffffffffff, 0x0) r7 = socket$unix(0x1, 0x2, 0x0) bind$unix(r7, &(0x7f0000000740)=@abs={0x0, 0x0, 0x4e22}, 0x6e) ioctl$int_in(0xffffffffffffffff, 0x5421, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) connect$unix(r7, &(0x7f00000007c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) close(0x3) prctl$PR_SET_MM(0x23, 0x8, &(0x7f0000001000/0x4000)=nil) prctl$PR_SET_MM(0x23, 0x9, &(0x7f0000001000/0x1000)=nil) sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r1, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x4c840) executing program 5: capset(&(0x7f0000000000)={0x20071026}, &(0x7f0000000040)={0x208004, 0x21fffc, 0xc, 0x0, 0x2, 0xfffffffe}) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0xf, 0x0, 0x0, 0x8000}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x12, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="180000000800000000000000ab0a0000"], &(0x7f0000000bc0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x8, '\x00', 0x0, @cgroup_sock_addr=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000001, 0x12, 0xffffffffffffffff, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000d80)={0x1, &(0x7f0000000dc0)=[{0x6, 0xf5, 0xe, 0x7ffffffe}]}) syz_kvm_setup_syzos_vm$x86(r0, &(0x7f0000bfd000/0x400000)=nil) executing program 5: r0 = syz_mount_image$ext4(&(0x7f0000006100)='ext4\x00', &(0x7f0000006140)='./file0\x00', 0x9, &(0x7f0000006180)={[{@init_itable_val={'init_itable', 0x3d, 0x6}}]}, 0x0, 0x4ae, &(0x7f0000006500)="$eJzs3VFrXFUeAPD/nSRt2qabdHcfuoXtlm2XtOx2Jmm2bfChVhB9Kqj1PcZkEkImmZCZtE0okuIHEERU8MknXwQ/gCD9CCIU9F1EFNFWH3zQjszkTlpjJhlqmkszvx+c3nPumZn/OZ3MnXvuucwJoGOdiIjLEdEVEWcioj/dn0tTrK6l+uPu3b05UU9J1GpXv08iSfc1XytJt4fSp/VGxEvPR7ya/DFuZXlldrxUKi6m5UJ1bqFQWV45OzM3Pl2cLs6PjAxfGL04en50aMf6eunZr99+44PnLn3yv+tfjn17+rV6s/rSuof7sZPWut7T+L9o6o6IxccRLANdaX96sm4IAABtqZ/j/zUi/t04/++PrsbZHAAAALCX1J7ui1+SiBoAAACwZ+Ua98AmuXx6L0Bf5HL5/No9vH+Pg7lSuVL971R5aX5y7V7ZgejJTc2UikPpvcID0ZPUy8ON/IPyuQ3lkYg4EhFv9R9olPMT5dJk1hc/AAAAoEMc2jD+/6l/bfwPAAAA7DEDWTcAAAAAeOyM/wEAAGDvM/4HAACAPe2FK1fqqdZc/3rfteWl2fK1s5PFymx+bmkiP1FeXMhPl8vTjd/sm9vu9Url8sL/Y37pRqFarFQLleWVsbny0nx1rLGu91jROtEAAACw+4786/YXSUSsPnWgker2pXXG6rC35bJuAJCZrqwbAGSmO+sGAJkxxgeSbep7W1V8+kjharVa7ZGeCAAAPLrBf5j/h05l/h86l/l/6FzN+f/k/voFeacE0CHaH+O3nAEEnnC7PP8PAABkoK+Rklw+vfDXF7lcPh9xuLEsQE8yNVMqDkXEXyLi8/6e/fXycNaNBgAAAAAAAAAAAAAAAAAAAAAAAIAnTK2WNBbjBgAAAPauiNw3Sbr+12D/qb6N1wf2JT/3N7YRcf29q+/cGK9WF4fr+39Y3199N91/LosrGAAAAMBGzXF6cxwPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADvp3t2bE820m3G/eyYiBjaL3x29jW1v9ETEwR+T6H7oeUlEdO1A/NVbEXF0s/hJvVkxkLZiY/xcRBzIOP6hHYgPnex2/fhzebPPXy5ONLabf/660/RntT7+5daPf10tjn+H24xx7M5HhZbxb0Uc694Yv7a/HqEZP2kR/2Sb8V95eWWlVV3t/YjBTb9/kt/FKlTnFgqV5ZWzM3Pj08Xp4vzIyPCF0Yuj50eHClMzpWL676Yx3vznx/e36v/BFvEHtun/qTb7/+udG3f/tkX80yc3f/+PbhG//jfxn/R7oF4/2MyvruUfdvzDz45v1f/JFv3f7v0/3Wb/z7z4+ldtPhQA2AWV5ZXZ8VKpuCgjIyOznsn6yAQAAOy0Byf9WbcEAAAAAAAAAAAAAAAAAAAAOtdu/JxY1n0EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGjHbwEAAP//kRbbrg==") ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f00000069c0)=ANY=[@ANYBLOB="000000004c900200040000000300010000000000000000000000000000000000000000000000000000000f000000000000000000000000000000000000000000000000000500e7ffffff000000000000010000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000ffffffff"]) executing program 3: r0 = socket$inet_icmp(0x2, 0x2, 0x1) (async) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_GET_PIT2(r2, 0x8070ae9f, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000740)=@security={'security\x00', 0xe, 0x4, 0x340, 0xffffffff, 0x188, 0xb8, 0xb8, 0xffffffff, 0xffffffff, 0x2a8, 0x2a8, 0x2a8, 0xffffffff, 0x4, &(0x7f00000000c0), {[{{@ip={@empty, @remote, 0xff000000, 0xffffffff, 'veth0_macvtap\x00', 'bond_slave_1\x00', {0xff}, {0xff}, 0x6, 0x1, 0x50}, 0x0, 0x70, 0xb8}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x3264, 'syz0\x00', {0xfff}}}}, {{@ip={@multicast1, @multicast1, 0xffffff00, 0xffffffff, 'veth0_to_team\x00', 'netpci0\x00', {}, {}, 0x1, 0x0, 0x6f}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, 0x0, 0x6, [0x1a, 0x9, 0x39, 0x27, 0x24, 0x1a, 0x28, 0x40, 0x32, 0xe, 0x15, 0x19, 0x2e, 0x3c, 0x13, 0x5], 0x1, 0x1, 0x9}}}, {{@uncond, 0x0, 0xc0, 0x120, 0x0, {}, [@common=@osf={{0x50}, {'syz0\x00', 0x0, 0x3, 0x1}}]}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @random="06eaa67f859e", 0x0, 0xa, [0x23, 0x3a, 0x2b, 0xf, 0x35, 0xe, 0x36, 0x34, 0x6, 0x34, 0xd, 0x24, 0x22, 0x2b, 0x22, 0x20], 0x1, 0x18}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3a0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'dvmrp1\x00', 0x1}) (async) ioctl$TUNSETVNETLE(r3, 0x400454dc, &(0x7f0000000100)=0x1) (async) syz_mount_image$ext4(&(0x7f0000000700)='ext4\x00', &(0x7f0000000080)='./file0\x00', 0x800, &(0x7f0000000140)={[{@noauto_da_alloc}, {@errors_remount}, {@dioread_nolock}, {@noinit_itable}]}, 0x4, 0x4e9, &(0x7f0000001140)="$eJzs3E1oXEUcAPD/2yRN+mVjrdXWqqlVDBaTNq22B0EqCh4UxArqMeajxKaNNCnYUmULUg8epOBdPHr14MWDeiniSfBaj4IUivTSVhBX3u57u5vtbtKkm6wxvx9sduZ9zcybNy/zZnY3gHVrIP2TVMJXI2JbRBQaNxiovN26cWHs9o0LY1EslY7/mZR3u5nGM9lhYnMWGSxEFD5JaivqzJ47f3J0enriTBYfnjv1wfDsufPPTvVlS44ePXzo4JHnR55beqGapJeW6+buj2f27Hr13cuvj3Xny/PU6svRLgMx0CwrZU+1O7EO21oXTro7mBGWJL3+0+rqKbf/bdEVC1VecRVzBqy0UqlU6m29ulhqdPGOJcCalUSncwB0Rv6PPn3+zV/NOgIbVqb70XHXj1UegNJy38peEY+XF+bjID0Nz7ftNBAR7xT/+jJ9xQqNQwAA1PvhWHX4Z37/r78yM/L32Ssvpu/3ZXMo/RFxf0Rsj4gHImJHRDwYETsj4qGIeLjh+F0RUVog/YGGeDX96iRU4VobitlS2v97IZvbqvX/5mWgvyuLbY3IO8wTB7JzMhg9vZNT0xMHF0jjx5d//bzVuvr+X/pK08/7glk+rnU3DNCNj86NVkLfvVf8rL4Xv3TXL0bs7m4sf9IdkVRnApKI2BURu5dw3P668NQzX++pRnrmb7d4+ctKTefR2jDPVPoq4ulK/RdjXv3XUkzmzU+eGj0xcWLi9Eh1fnK4L6YnDgxPtszNz79ceqPVukXL/+3vjbu8cuT741nLundp/W+qu/4jn7+tlb8/iUiq87WzS0/j0m+ftnymWe71vyF5qxzOn0s/HJ2bO3MwYkPy2p3LR2r75vH0PYqV8g/ua97+t2f7pGfikYhIL+JHI+KxqDwhpnnfGxFPRMS+Bcr/00tPvr/88q+stPzjDfe/Ss3Pq//afH2rQJLNDTZZ1XVy79XbLW4ed1f/h8uhwWxJ7f5XL5l3i2iV03zcI13yzz2fPQAAAFgbChGxpW4saUsUCkNDlTGgHbGpMD0zO7d/cubs6fF0XUR/9BQmp6bL45+V8eCeJB//7K+LjzTED2Xjxl90bSzHh8Zmpsc7WnJgc7nNJ4WhiLe76tp/6o/2DDED/2W+rwXr10LtP+3E77y8ipkBVtXd//+/8tGKZgRYdXXtv9U3/IvL+NwXsAZ4/gdqFv+hH/cMWPtK2jKsa0tq//v9CCD8n3THm9VwoaM5AVab/j+sS4t+r/+eAqXe5qv64s6No2/hA3bF8rKxsUlaHQmkPauOpL5xOXvlv6bQcpsoLO2AvdGeOp1cxknoLQfyru3siZ1tv/hL2Wfl212D36xKO20WWPVbEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwIr4NwAA///eNtoE") executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000f40)=@newtaction={0xe8, 0x30, 0x1, 0x70bd2b, 0x25dfdbde, {}, [{0xd4, 0x1, [@m_bpf={0x58, 0x1, 0x0, 0x0, {{0x8}, {0x30, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x1}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x3, 0xef, 0x1, 0x8000, 0x2}}, @TCA_ACT_BPF_OPS={0xc, 0x4, [{0x16, 0xf2, 0x3, 0x7}]}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x2}}}}, @m_bpf={0x78, 0x2, 0x0, 0x0, {{0x8}, {0x50, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_FD={0x8}, @TCA_ACT_BPF_OPS={0x2c, 0x4, [{0x1ff, 0x5, 0x5, 0x8}, {0x3, 0x6, 0x6d, 0x80}, {0x3, 0x6, 0x4, 0x4000000}, {0xfb, 0x6, 0x7f, 0xa}, {0x3, 0x2, 0x6, 0x1}]}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x8, 0x4, 0xffffffffffffffff, 0x7, 0x3}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}]}]}, 0xe8}, 0x1, 0x0, 0x0, 0xc044}, 0x4000814) r1 = syz_open_dev$evdev(&(0x7f0000000140), 0x2, 0x0) ioctl$EVIOCGKEYCODE_V2(r1, 0x80284504, &(0x7f00000001c0)=""/147) syz_mount_image$f2fs(&(0x7f0000000180), &(0x7f0000000440)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, &(0x7f0000005f80)=ANY=[@ANYBLOB="66617374626f6f742c71756f7461000018bbdecde39739fcd1df176dde746ec834120600000000003b814e50a959736d6572462abc30ef5b65c70f73ecea54b5e5bea9836c319f653557e79a002208ce996dda659bd5ba0f4ce5c2080002223dc60000000000000044cd0a1e3686873600000000005493b4b874cd601d5b9fa9b40fe4d76afc3a989c6d60044e89eb96e44d01a1034e3797ffa86870b82939f41ffa0f3d726f085663c29cbdc4c766a7eb77cc36160191acf5ae7469c82ab4145b595b987d75912a0fcd1c061835294cc0c618aba204f8adaa20c80108d356cd88cc86177056b06e7068c40f807d9e539f8f5b64a8ee0725aa8d00000000007cb6020d90ea79b8027cf75964dd86c2ed2b5e75779677aa8c76b848dd03dab190b5f02ec52830a17b01eaae1c3df076000000000000000000000000000083a48a6b926c668b9b90195018ea3619f9d80a0b894e212178e1a19909d764666264fa29e2c055fd7f8e67c2acfb75f0a8d41692f4542a575ee42ed94a0014fba44985cca9df12fe93bfaccf0122a6e7e593613ac0111701b125cc6799224883d08ce470220a6decad26f0378072a571da000000b1a6bdf03fd56697e348b5b494f6fddb9f56142a47a40ef81690a7eca421bd0ad198afa58ce69d61c29deaa93c0efea0df04f20020ee84075b4e1a2ad43d1be1138de4668e7b6137545708790c501f1ed7f6a571d5000000000000007d2bee8ed5acba62b8ce6eee44e813220ebc37ad7d422bb972c33e626d4d13827d303ee15e254c75ee569a56fa9e", @ANYRES64=0x0, @ANYRES32=r1], 0x21, 0x55bf, &(0x7f0000006ac0)="$eJzs3E2LG3UYAPBnsrt9ty7iwVsHirALTWi2L+jJqi2+YEvx5eBJs0ka0iaZZZOma089eBQPfhNR8OTRz+BBj3oTD4o3oZKZWe32RbtuNsu2vx/MPDP//PPMM0MIPDMhATy1FtM/fkvieByOiLmIOJZEvp2US8SdiAvF3Bci4kREVO5ZknL874EDEXEkIo5Pkhc5k/KlL06NT5779e3fv/3+4PzRL7/5YU9PHNhTL0ZEf63YvtUvYtYp4vVyvDHu5rF/dlzGtS05+lkxfqu9mme41dic18jjmU4xP1u7OZzEa71GcxI73Wv5+NqgOOBw3NnMM3lDer2xnu+32qt57A6zPHZuF8fduF18t90ejoo8rTLfJ3n6GI02YzHe3mgX57N2I4/NwagcL/JmrfbGJI7LWB4umlmvldex+j8v8j7wTndwcyMdt9eH3WyQnqvVX6rVz1fr61mrPWqfrTb6rfNn06VObzKtOmo3+hc6WdbptWvNrL+cLnWazWq9ni5dbK92G4O0Xq+dqZ2unlsut06lb1z5IO210qVJfK07uDnq9obptWw9Ld6xnK7Uzry8nJ6sp+9dvppefffSpctX3//o4odXXr381uvlpAfKSpdWTq+sVOunqyv15afo/D8ti97G+ScPH/7px51dNig84gP2aPO7UwfAPvJA/x/39/+h/wembif9f/9Gub87/X88Tv8f0+z/Jy2V/v+/+9/Ktvrf41PpfxdC/7+L5w87su3+P3dg6nUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADBzPy989Wa+sVjsHy3HnymHniv3k4ioRMTdh5iLA1tyzpV5Fh4xf+G+Gr5LIs8wOcbBcjkSERfK5c9nd/sqAAAAwJPr6zsnPi+69WK1uNcFMUvFTZvKsY+nlC+JiIXFX6aUrTJZPT+lZPnnez42ppQtv4F1aErJiltu89PK9ljmtoRD94SkCJWZlgMAAMzE1k5gtl0IAAAAs/TZv776yszqYMaS2HyUufksOP/l/T8PBA9PVnfv+3E/AAAAsJ8ke10AAAAAsOvy/t///wEAAMCTrfj/PwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgL3bu50ZtIIoD8LPBQP4pKMo9reQGZaSEHHMMFJAmKIG0kAaogUg5pIQVrLBnkbwL0moZYy36Psn2znj18wxweWNpAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKBLf6v1/PfPL78uzdntL5NnNgAAAMAp22o9r/+YNu13qf9D6vqU2kVElBFxqnYfxKiVOUg51Zn/rx6N4U9EnXDoH6fjbUR8Tcfdx64/BQAAALhdm+Vq1lTrzSktAfzrd1RcSbNoU77/limviIhq+j9TWnk4fc4UVv++h/EjU1q9gDXJFNYsuQ1P3xvlekjboHV5mMmi/hLrVtnNcwEAgD61K4EzVQgAAAA34HvfA+Aanpb2xfF0fM84bi7pheCbVgsAAAB4hYq+BwAAAAB0rq7/u9n/b/Ki/f8K+/8BAABAds3+fwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHRpW63nm+Vqdu7+4pk5u/1l8s0IAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgHv25xiFYRgKouAmkZK4M7r/Yc2CXbp2MwOCx99KAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMCd1/nyvuLT2JOMXhuz55Xk26nx69T4d25sMxnr6d8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABzsz0sKhEAQRMGc8b+Tvv9hJUHPIEIENDyqqEUDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAF/0u1/+T0yNM8ncaWPpeCRZu2psXTX2HjSOHoy3fwMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFzs289rHFUcAPA3O9lNU1uMUQJGpUoPerHptrb2KqIED/4JQkg3Nbq12uZgS7Dm4k1y7kX0IogISrzlf+i5gV7qrYccInjyEJlfyWyybX6QzKzN5wNv33ffTt6PmWXJd98sAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAhbX3wquNPI6Th9EsLtoerC/MJPXqtjqxsvRwIilJHA0Xraff2OvYG/GhLGFQvVZ+cma8vokAAADwrDi96xFxkd+HEB41l6eSujGa5v/N4pgk5/8x7yrK27bn/avrCyfylyaK/P/PPx6/tDnQaJyOk3Q6O9ftnN85laEDL/N/7vldjxhKz3z63UucXpDGR4svrjXT8xl9f//+B600HK5itgDAQZwr6jwo/h9K6nadEwPg2BgqJd5F/h+P1jsnAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgCqsLYbnijgKIUwMbcWJ1fWFmX71t0sPJ1bycvnevaVyn0kXzRDC7Fy3c75ntOEjX89gKs7mnc+nu93OzVu3qw7OhBD6vHR3b38e59N/4jGtEEJPy9mX+/TzyR7G2tbPjiB/e4Zqz+FIsr5dD456WqIdJ/z9jUwdb4BDDlpPukyN/PocxaAjlV/33qB47x1+z/v5LDmun6EAAOxHMy9JJvqouTyVtEVjIWz81Jv/v1mKQ0/ev3E3a8mer5Ty/8efXn5QHquc/7e3mk8d9RoH3eT89S8nb92+8/bc9elrnWudL9650H63ffHKpUtXJtPvSiZnQ2PbNyYAAACwH628lPP/kT77/ydLcXjK/n+2JZzl/1/90P6mPFbcP/8/9rY2/eqeCQAAwHHU2oxeeP2fv6M+R0StVvh6en7+Zjt73Hx+IXusdLoHNJyXcv4fj9U9KwAAAKAKa4tRz/7/1VIcnrL/X77//9Qvr/xW7jPO7i24EULonJu50b1a3XIGWu+Pfn+Oj+KHyulArbpXCgAAQF1G8lLe/2+OJfl/Y/OWh0YI4a2zIfyb/4Y/7DH/jz/87tfyWOX7/y9WusrB0xjPzkdaj4cwNF73jAAAAHiWnchLkuz/1Vye+uz3kx+33P8PAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAULX/AgAA//9KES1X") (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x480543, 0x40) (async) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0x2080, 0x0) read(r2, &(0x7f0000000080)=""/148, 0xffffff96) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./dev\x00', 0x1ff) (async, rerun: 64) mount(0x0, &(0x7f00000002c0)='./dev\x00', &(0x7f0000000300)='devtmpfs\x00', 0x0, 0x0) (async, rerun: 64) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r3, 0x107, 0x5, &(0x7f0000000700)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) (async) mremap(&(0x7f00003ff000/0xc00000)=nil, 0xc00000, 0x2000, 0x3, &(0x7f0000000000/0x2000)=nil) (async, rerun: 32) syz_mount_image$ext4(&(0x7f0000000740)='ext4\x00', &(0x7f0000000780)='./file0\x00', 0x10e, &(0x7f00000007c0), 0x3, 0x464, &(0x7f0000000800)="$eJzs3MtvG8UfAPDvbpK26eOX/Ep5tBQIFETEI2nSAj1wAAQSB0BIXMoxJGlVmjaoCRKtKggIlSMq4o44gvgLOMEFASckrnBHlSrUC4WT0Xp360dtN02dONSfj7T2zO7YM+PZsWd2sgmgb41lD0nEzoj4LSJG8mhjgrH86eqV87N/Xzk/m0Sl8safSTXdX1fOz5ZJy9ftKCLjaUT6cRL3tsh36ey5kzMLC/Nnivjk8ql3JpfOnnvyxKmZ4/PH509PHzly+NDUM09PP9WVev4/K+u+9xf37335zYuvzh69+NZP3yRl/ZvqccuGq49jnZI8Uql0LbvNYFddOBnsYUG4KQMRkTXXULX/j8RA1BpvJF76qKeFA9ZVpdDm8EoFuI0l0esSAL1R/tBn899y27jRR+9dfj6fAGX1vlps+ZHBSCOfGA01zW+7aSwijq7880W2RbevQwAAtPBdNv55otX4L4276tL9r1gbGi3WUnZHxB0RsSci7oyopr07Iu65yfybF0muH/+kl9ZUsVXKxn/PFmtbjeO/tEwyOlDEdlUjQ8mxEwvzB4vPZDyGtmbxqQ55fP/ir5+2O1Y//su2LP9yLFiU49Lg1sbXzM0sz9xKnetd/jBi32Cr+ifXVgKSiNj72trzOPHYV/vbHWuufyXp9E7PNUa7sM5U+TLi0bz9V6Kp/qWk8/rk5LZYmD84WZ4V1/v5lwuvt8v/xu2/vrL2397y/L9W/9Gkfr126ebzuPD7J23nNBNrOv9rO7YUz+/NLC+fmYrYkrySF7p+/3TttWW8TJ/Vf/xA6/6/Ow989nVEdQ07O4nvi4j7I+KBou0ejIiHIuJAuwquRPz4wsNvtzu8Gdp/rqn9RxuTNLV/LbAlmve0Dgyc/OHbxnesBVf3/Xe4Ghov9qzm+2815Vrb2QwAAAD/PWlE7IwknbgWTtOJifxv+PfE9nRhcWn58WOL756ey+8RGI2htLzSlV8Pzq+HThXT+jI+3RQ/VFw3/nxguBqfmF1cmOt15aHP7WjT/zN/DPS6dMC6c78W9C/9H/qX/g/9S/+H/tWi/w/3ohzAxmv1+/9BLVgZ2cjCABuqqf9b9oM+Yv4P/Uv/h/5V3/873n8P3E6WhuPGN8kLbObAtrIpNzb3SDdB3Vcb2Bqd0yTr3At2boYPoQyU//uzc+IefzEBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB0yb8BAAD///7G59I=") (async, rerun: 32) mkdir(0x0, 0x25) (async) prlimit64(0x0, 0xe, &(0x7f0000000c80)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000cc0)=0x8) r4 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000d00)=0x2) (async) sched_setscheduler(r4, 0x1, &(0x7f0000000d40)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x9a5eb000) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000d80)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000dc0)=@abs, 0x6e) (async, rerun: 64) sendmmsg$unix(r6, &(0x7f0000000e40), 0x651, 0x0) (rerun: 64) recvmmsg(r5, &(0x7f0000000e80), 0x4000087, 0x2, 0x0) (async) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x1, 0x1010, 0xffffffffffffffff, 0x0) (async, rerun: 32) socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 32) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000ec0), 0x60242, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000f00)={'pimreg\x00', 0x3c32}) executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x401c2, 0x0) ftruncate(r0, 0x8800000) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendfile(r1, r0, 0x0, 0x578410eb) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e22}, 0x1c) listen(r3, 0x81010040) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10) syz_emit_ethernet(0x36, &(0x7f0000000080)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1b}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x3d, 0x28, 0x67, 0x0, 0x2, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2}}}}}}, 0x0) syz_emit_ethernet(0x159, &(0x7f0000000200)={@local, @broadcast, @void, {@ipv4={0x800, @igmp={{0x15, 0x4, 0x2, 0x3e, 0x14b, 0x64, 0x0, 0x8, 0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x10}, @private=0xa010101, {[@ra={0x94, 0x4}, @generic={0x82, 0x10, "cc303838b09d57725c1e05817f05"}, @cipso={0x86, 0xb, 0x2, [{0x7, 0x3, "d4"}, {0x1, 0x2}]}, @cipso={0x86, 0x21, 0x3, [{0x0, 0xf, "79501ec32cab539f0845f7a311"}, {0x6, 0x6, "2ecd4209"}, {0x2, 0x3, "cb"}, {0x6, 0x3, ':'}]}]}}, {0x22, 0x76, 0x0, @rand_addr=0x64010100, "89b9477228dd1ca8f9de87e28572ec7b256b1e9c7c2600fac34689366c71f395662b0ed8b452e17fefdc15cfec95f08e2ecaa21ac08199e0f95df6a0cd2075a5440e0b29b3cc45999a2391c7c1f4335df9396549c6a94646d2bb53b110dc7f7401906e6a15d6e983ba1b1b3b3678946b9a678db824a46e95697492d82e7eb76c1bae1348e6b851e3f4b09d94f8e1874261b8f83cd2f237592336cadefc2fd204fa2fab731c3ff6f54c15b7f1f0875d8c3e41c18e9d0c2ace2bbcb9fcbab24c97be25216511bbd9decd870ba3390d8d82ddfe34380d85352e14161875e840d7a6a80b18730c64f1436a4c924a5d7e41"}}}}}, 0x0) shutdown(r2, 0x0) executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000600), 0x41, 0x0) write$binfmt_aout(r0, &(0x7f0000000680)=ANY=[], 0xbfb3) ioctl$TCSETS(r0, 0x40045431, 0x0) syz_open_pts(r0, 0xa5000) executing program 6: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f0000000000)=0x6) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_int(r1, 0x6, 0x9, &(0x7f0000000140), &(0x7f0000000180)=0x4) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e20, @loopback}, 0x10) r2 = ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) sendmsg$NFT_BATCH(r2, &(0x7f0000000b40)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000b00)={&(0x7f0000000500)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWRULE={0x154, 0x6, 0xa, 0x201, 0x0, 0x0, {0x7, 0x0, 0x4}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_POSITION_ID={0x8, 0xa, 0x1, 0x0, 0x1}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_COMPAT={0x4c, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x8884}, @NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x33}, @NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}]}, @NFTA_RULE_USERDATA={0x5c, 0x7, 0x1, 0x0, "989fe55479d05fe316872127fcae40814d278bc0c1a6704e2b72ed0ba221d490c32156be134a4b21bab95fd152ffe13c22fab767d93e9f14a8226fe9fec98ed973185aa012c80591366a44fb59e918eedda1c1bc128d3ced"}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_COMPAT={0x54, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x890d}, @NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x8917}, @NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x7bf3}, @NFTA_RULE_COMPAT_FLAGS={0x8}, @NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x6004}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x88}, @NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x2e}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x11}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}]}, @NFT_MSG_DELFLOWTABLE={0x28, 0x18, 0xa, 0x801, 0x0, 0x0, {0x1, 0x0, 0x7}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_FLAGS={0x8}]}, @NFT_MSG_DELRULE={0x20, 0x8, 0xa, 0x0, 0x0, 0x0, {0x7, 0x0, 0x1}, [@NFTA_RULE_HANDLE={0xc, 0x3, 0x1, 0x0, 0x1}]}, @NFT_MSG_NEWCHAIN={0xc4, 0x3, 0xa, 0x304, 0x0, 0x0, {0x2, 0x0, 0x2}, [@NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x3}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x4}, @NFTA_CHAIN_COUNTERS={0x7c, 0x8, 0x0, 0x1, [@NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x9}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x9}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x7}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x7fff}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x101}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x10000}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x4}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x8001}, @NFTA_COUNTER_PACKETS={0xc}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x5}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_POLICY={0x8, 0x5, 0x1, 0x0, 0xfffffffffffffffd}, @NFTA_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x1}]}, @NFT_MSG_NEWCHAIN={0xec, 0x3, 0xa, 0x101, 0x0, 0x0, {0x2, 0x0, 0x3}, [@NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x6}, @NFTA_CHAIN_USERDATA={0x68, 0xc, "8048b3b6006f7bbe016cac39f30efa73ec7d40f78ba6f57f1775ff1801a7e7a38082711bded1545850b92ebdff42f7d73367bfb938cd893ceff0b180f4f5841f52d4712bda2d09f0fbc8767e4902b52d9ce542d4097fd8bab9975e2d585d65d7f34a0f75"}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x2}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x7e0126b2}]}, @NFTA_CHAIN_COUNTERS={0x4c, 0x8, 0x0, 0x1, [@NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0xf0}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x31}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x7ff}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x81}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x5}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x6}]}]}, @NFT_MSG_NEWTABLE={0x200, 0x0, 0xa, 0x801, 0x0, 0x0, {0x7, 0x0, 0x6}, [@NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x5}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_USERDATA={0xcb, 0x6, "5da4c46ad78b4c41321fa90c7b450a906047c67d4387d641d9d5597c4ab79b6264c88a5a73fff9722246ef3b1fa9f426ea853d0a7e41aead48d4bdcc2f044ec251c28498c47d809135c2cce8fe553638717869a42ba8ed846f00514d6fa64f5984eca1c1447b53a0b77f073a84086332926fc17e43b9f8b38b94b0be8a29cf0637a61548707906a779279cb7794af8debe10eb02de558281cef636d88d63ed1c2d646e2bb004bac7e71d3889e11e7c7becf367c41b701bbd754f98c58457530ee8d34e68c4680f"}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x2}, @NFTA_TABLE_USERDATA={0xe5, 0x6, "5f3f70ad7646f882e4ce6c9787233144177194edc71c9037f5827af3219a9b3c4cd946a3673a5ccde37d1cc7a6cdb3588396b06135d78cb667f4750ea38b08af63401ba026aa98b7f69e63fd5437dc8da0a2590757ea999019eb816de11555de875dae0449c08c7646370a7ce55b03495224363c84bf61bf9e7fb564f902ab35acfaaf31ef7f9ee9ee71e8e4632c1499bd620f4bc15b249050109396405cf052b9b826eede058ad44d704015d6937327708ad6a895bd918fc06f749e845f69b8276e1d20d6cb1f6a0a993df4f3d91ef9ff18f8eb0629482ff037e346e5699c18f5"}]}, @NFT_MSG_NEWTABLE={0x28, 0x0, 0xa, 0x5, 0x0, 0x0, {0x0, 0x0, 0x8}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x3}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x59c}, 0x1, 0x0, 0x0, 0x801}, 0x40000) sendto$inet(r0, &(0x7f0000000140), 0xffffffffffffff58, 0x20008005, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) ppoll(&(0x7f0000000040)=[{r0, 0xc22}], 0x1, 0x0, 0x0, 0x0) recvfrom(r0, &(0x7f0000000480)=""/110, 0x168f6f3d, 0x734, 0x0, 0xfffffffffffffecb) executing program 3: socket(0x10, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000140)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f0000000340), 0x318, 0x0) recvmmsg(r1, &(0x7f0000000380), 0x10106, 0x2, 0x0) syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000006c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000504000000002e"], 0x0, 0x37}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0900000004000000040000000700000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=r3, @ANYBLOB="0200000001"], 0x48) openat$dir(0xffffffffffffff9c, &(0x7f0000000780)='.\x00', 0x0, 0x104) ioctl$FIDEDUPERANGE(r3, 0xc0189436, &(0x7f0000000900)=ANY=[@ANYBLOB="04a98db454f2ca8dea0c00"/24]) executing program 5: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000000, &(0x7f0000000280)={[{@nodelalloc}, {@jqfmt_vfsv1}, {@errors_remount}, {@nouser_xattr}]}, 0x0, 0x7b9, &(0x7f00000006c0)="$eJzs3c9rG1ceAPDvyHb8I1nshWV3czMsZAMhcpz1JrvQQ0oPpdBAoD03MbJiUstWsOQQG0MTSqGXQlt6KLSXnPsjvfXaH9BT+1/0UBLSxglN6aG4jDSyFVtybMe23PrzgfG892bk977zZjRPmkETwIE1nP7JRRyNiLeTiMGsPImInlqqO+Jcfb1HS4t9EVFIYnn5pZ+S2joPlxYL0fSa1OEs88+I+OqNiBO59fVW5hemxkul4myWH6lOXx2pzC+cvDI9PlmcLM6cGR0bO332v2fP7FysP3+3cOTuO8//+9Nzv77+j9tvfZ3EuTiSLWuOY6cMx3C2TXrSTfiY53a6sg5LOt0AtiU9NLvqR3kcjcHoqqXa6N/LlgEAu+W1iFgGAA6YxPkfAA6YxvcAD5cWC42ps99I7K17z0ZEXz3+R9lUX9KdXbPrq10HHXiYPHZlJImIoR2ofzgiPvz8lWNdWT5th2tpwF64cTMiLg0Nr3//T9bds7BVpzZauNxbmw2vKT5o5x/opC/S8c//Wo3/civjn2gx/umtH7t/f9r62x7/K4Or3J2nrWMj6fjvmfq9bWvGfys3rQ11Zbm/1JrVk1y+UiqeyrZBKs2P1lKtR27HH/z2oF392fjv43S6/+6rH6X1p/PVNXJ3unsff83EeLX7m6cJusm9mzGQJdfEn6z0f9Jm/Hthk3W88P83P2i3LI0/jbcxrY9/dy3fijjWsv9X+zLZ8P7EkdruMNLYKVr47Pv3B9rV39z/6ZTWn853PtLW7t2MGLg/GEmyug3qS1biH0qa79esbL2Ob28Nftlu2ZPjb7n/jx9KXq6lD2Vl18er1dnRiEPJi+vLT6++tpFvrJ/Gf/xfrY//erWt9//0M+GlTcbffffHT7Yf/+5K45/YeP9f0/99WfFqyZMStx9NdbWrf3P9P1ZLHc9K0v5/Ulybadf29mYAAAAAAAAAAAAAAAAAAAAAAAAA2LpcRByJJJdfSedy+Xz9Gd5/i4FcqVypnrhcnpuZiNqzsoeiJ9f4qcvBpt9DHc1+srWRP70m/5+I+GtEvNfbX8vnC+XSRKeDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM4TbP/0/90Nvp1gEAu6av0w0AAPac8z8AHDxbO//371o7AIC94/M/ABw8mz7/X9rddgAAe8fnfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHbZhfPn02n5l6XFQpqfuDY/N1W+dnKiWJnKT88V8oXy7NX8ZLk8WSrmC+Xptv/oRn1WKpevjsXM3PWRarFSHanML1ycLs/NVC9emR6fLF4s9uxZZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACweZX5hanxUqk4+6dI3FgNbIf/c39H4xrYH5u3KdEd+6IZ+zrRG/uiGdtMNL9L9HfgnQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgj+H3AAAA//+0Bxg2") mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x9, @mcast1, 0x48f}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000540)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6, 0x0, 0x3, 0xd}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000580)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) (async) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) (async) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) chdir(&(0x7f0000000f80)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x88040, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x181) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x3000440, 0x0, 0xff, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) (async) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) (async) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) newfstatat(0xffffffffffffff9c, &(0x7f0000000440)='./file0/file1\x00', &(0x7f0000000480), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000fc0)='./file1/file0\x00', 0x140) mount$bind(&(0x7f0000001000)='.\x00', &(0x7f0000001040)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f0000001080)='./bus\x00', &(0x7f00000010c0), 0x40, &(0x7f0000001100)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]}) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000001300)=@raw={'raw\x00', 0x9, 0x3, 0x220, 0x0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0xf0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0xc8, 0xf0, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'lo\x00', {0x0, 0x3e8, 0x5, 0x8, 0x40, 0x3e8, 0x3e8}}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffffffffffff}}}}, 0x280) syz_emit_ethernet(0x2a, &(0x7f0000001580)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) (async) syz_emit_ethernet(0x2a, &(0x7f0000001580)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000015c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001600)='./proc\x00', &(0x7f0000001640)='proc\x00', 0x0, 0x0) (async) mount(0x0, &(0x7f0000001600)='./proc\x00', &(0x7f0000001640)='proc\x00', 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000001680)={0x3, &(0x7f00000016c0)=[{0x2d, 0x0, 0x1, 0x3}, {0xac, 0x0, 0x4, 0x4}, {0x6, 0x0, 0x9}]}) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) (async) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000001700)='./proc/net/ipt_hashlimit/lo\x00', 0x0, 0x0) (async) r2 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./proc/net/ipt_hashlimit/lo\x00', 0x0, 0x0) read$FUSE(r2, &(0x7f0000001740)={0x2020}, 0x2020) accept4$unix(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x80800) (async) r3 = accept4$unix(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x80800) sendto$unix(r3, &(0x7f0000000180)="d1f0fe0a5f25af3efacd9b2e7fc36ae040ec36a45758ab8d80f839b3e16f3766d1e356f49e367e5b78c9c7af5a8377bd9c3218c21f9b4ff0cad585cc52186656ce24f6ab9d4f463041663250d02544c33579f60b6a7a45374b620339107b7c2eeefc3df0e6d951484c32426f6067662aba416c76745057f0a2f6cc701e6be591721ea1f04951338ddd3786", 0x8b, 0x4000, &(0x7f00000002c0)=@file={0x1, './bus\x00'}, 0x6e) (async) sendto$unix(r3, &(0x7f0000000180)="d1f0fe0a5f25af3efacd9b2e7fc36ae040ec36a45758ab8d80f839b3e16f3766d1e356f49e367e5b78c9c7af5a8377bd9c3218c21f9b4ff0cad585cc52186656ce24f6ab9d4f463041663250d02544c33579f60b6a7a45374b620339107b7c2eeefc3df0e6d951484c32426f6067662aba416c76745057f0a2f6cc701e6be591721ea1f04951338ddd3786", 0x8b, 0x4000, &(0x7f00000002c0)=@file={0x1, './bus\x00'}, 0x6e) openat(0xffffffffffffff9c, &(0x7f00000012c0)='./bus/file0\x00', 0x12800, 0x40) executing program 2: r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, 0x0, 0x0) (async, rerun: 64) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'veth1_vlan\x00', 0x200}) (rerun: 64) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newlink={0x28, 0x10, 0x1, 0x70bd28, 0x25dfdbf9, {0x0, 0x0, 0x0, 0x0, 0x4ac00, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x40801}, 0x4000000) executing program 6: capset(&(0x7f0000000000)={0x20071026}, &(0x7f0000000040)={0x208004, 0x21fffc, 0xc, 0x0, 0x2, 0xfffffffe}) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0xf, 0x0, 0x0, 0x8000}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x12, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="180000000800000000000000ab0a0000"], &(0x7f0000000bc0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x8, '\x00', 0x0, @cgroup_sock_addr=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000001, 0x12, 0xffffffffffffffff, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000d80)={0x1, &(0x7f0000000dc0)=[{0x6, 0xf5, 0xe, 0x7ffffffe}]}) syz_kvm_setup_syzos_vm$x86(r0, &(0x7f0000bfd000/0x400000)=nil) executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="2c00000018000106000000000000000002180000fe0300010000000008000400", @ANYRES16=r0], 0x2c}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000006100)='ext4\x00', &(0x7f0000006140)='./file0\x00', 0x9, &(0x7f0000006180)={[{@init_itable_val={'init_itable', 0x3d, 0x6}}]}, 0x0, 0x4ae, &(0x7f0000006500)="$eJzs3VFrXFUeAPD/nSRt2qabdHcfuoXtlm2XtOx2Jmm2bfChVhB9Kqj1PcZkEkImmZCZtE0okuIHEERU8MknXwQ/gCD9CCIU9F1EFNFWH3zQjszkTlpjJhlqmkszvx+c3nPumZn/OZ3MnXvuucwJoGOdiIjLEdEVEWcioj/dn0tTrK6l+uPu3b05UU9J1GpXv08iSfc1XytJt4fSp/VGxEvPR7ya/DFuZXlldrxUKi6m5UJ1bqFQWV45OzM3Pl2cLs6PjAxfGL04en50aMf6eunZr99+44PnLn3yv+tfjn17+rV6s/rSuof7sZPWut7T+L9o6o6IxccRLANdaX96sm4IAABtqZ/j/zUi/t04/++PrsbZHAAAALCX1J7ui1+SiBoAAACwZ+Ua98AmuXx6L0Bf5HL5/No9vH+Pg7lSuVL971R5aX5y7V7ZgejJTc2UikPpvcID0ZPUy8ON/IPyuQ3lkYg4EhFv9R9olPMT5dJk1hc/AAAAoEMc2jD+/6l/bfwPAAAA7DEDWTcAAAAAeOyM/wEAAGDvM/4HAACAPe2FK1fqqdZc/3rfteWl2fK1s5PFymx+bmkiP1FeXMhPl8vTjd/sm9vu9Url8sL/Y37pRqFarFQLleWVsbny0nx1rLGu91jROtEAAACw+4786/YXSUSsPnWgker2pXXG6rC35bJuAJCZrqwbAGSmO+sGAJkxxgeSbep7W1V8+kjharVa7ZGeCAAAPLrBf5j/h05l/h86l/l/6FzN+f/k/voFeacE0CHaH+O3nAEEnnC7PP8PAABkoK+Rklw+vfDXF7lcPh9xuLEsQE8yNVMqDkXEXyLi8/6e/fXycNaNBgAAAAAAAAAAAAAAAAAAAAAAAIAnTK2WNBbjBgAAAPauiNw3Sbr+12D/qb6N1wf2JT/3N7YRcf29q+/cGK9WF4fr+39Y3199N91/LosrGAAAAMBGzXF6cxwPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADvp3t2bE820m3G/eyYiBjaL3x29jW1v9ETEwR+T6H7oeUlEdO1A/NVbEXF0s/hJvVkxkLZiY/xcRBzIOP6hHYgPnex2/fhzebPPXy5ONLabf/660/RntT7+5daPf10tjn+H24xx7M5HhZbxb0Uc694Yv7a/HqEZP2kR/2Sb8V95eWWlVV3t/YjBTb9/kt/FKlTnFgqV5ZWzM3Pj08Xp4vzIyPCF0Yuj50eHClMzpWL676Yx3vznx/e36v/BFvEHtun/qTb7/+udG3f/tkX80yc3f/+PbhG//jfxn/R7oF4/2MyvruUfdvzDz45v1f/JFv3f7v0/3Wb/z7z4+ldtPhQA2AWV5ZXZ8VKpuCgjIyOznsn6yAQAAOy0Byf9WbcEAAAAAAAAAAAAAAAAAAAAOtdu/JxY1n0EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGjHbwEAAP//kRbbrg==") ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f00000069c0)=ANY=[@ANYBLOB="000000004c9002000400000003000100000000000000000000000000000000000000000000000000000012000000000000000000000000000000000000000000000000000500e7ffffff000000000000010000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000ffffffff"]) executing program 34: r0 = syz_mount_image$ext4(&(0x7f0000006100)='ext4\x00', &(0x7f0000006140)='./file0\x00', 0x9, &(0x7f0000006180)={[{@init_itable_val={'init_itable', 0x3d, 0x6}}]}, 0x0, 0x4ae, &(0x7f0000006500)="$eJzs3VFrXFUeAPD/nSRt2qabdHcfuoXtlm2XtOx2Jmm2bfChVhB9Kqj1PcZkEkImmZCZtE0okuIHEERU8MknXwQ/gCD9CCIU9F1EFNFWH3zQjszkTlpjJhlqmkszvx+c3nPumZn/OZ3MnXvuucwJoGOdiIjLEdEVEWcioj/dn0tTrK6l+uPu3b05UU9J1GpXv08iSfc1XytJt4fSp/VGxEvPR7ya/DFuZXlldrxUKi6m5UJ1bqFQWV45OzM3Pl2cLs6PjAxfGL04en50aMf6eunZr99+44PnLn3yv+tfjn17+rV6s/rSuof7sZPWut7T+L9o6o6IxccRLANdaX96sm4IAABtqZ/j/zUi/t04/++PrsbZHAAAALCX1J7ui1+SiBoAAACwZ+Ua98AmuXx6L0Bf5HL5/No9vH+Pg7lSuVL971R5aX5y7V7ZgejJTc2UikPpvcID0ZPUy8ON/IPyuQ3lkYg4EhFv9R9olPMT5dJk1hc/AAAAoEMc2jD+/6l/bfwPAAAA7DEDWTcAAAAAeOyM/wEAAGDvM/4HAACAPe2FK1fqqdZc/3rfteWl2fK1s5PFymx+bmkiP1FeXMhPl8vTjd/sm9vu9Url8sL/Y37pRqFarFQLleWVsbny0nx1rLGu91jROtEAAACw+4786/YXSUSsPnWgker2pXXG6rC35bJuAJCZrqwbAGSmO+sGAJkxxgeSbep7W1V8+kjharVa7ZGeCAAAPLrBf5j/h05l/h86l/l/6FzN+f/k/voFeacE0CHaH+O3nAEEnnC7PP8PAABkoK+Rklw+vfDXF7lcPh9xuLEsQE8yNVMqDkXEXyLi8/6e/fXycNaNBgAAAAAAAAAAAAAAAAAAAAAAAIAnTK2WNBbjBgAAAPauiNw3Sbr+12D/qb6N1wf2JT/3N7YRcf29q+/cGK9WF4fr+39Y3199N91/LosrGAAAAMBGzXF6cxwPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADvp3t2bE820m3G/eyYiBjaL3x29jW1v9ETEwR+T6H7oeUlEdO1A/NVbEXF0s/hJvVkxkLZiY/xcRBzIOP6hHYgPnex2/fhzebPPXy5ONLabf/660/RntT7+5daPf10tjn+H24xx7M5HhZbxb0Uc694Yv7a/HqEZP2kR/2Sb8V95eWWlVV3t/YjBTb9/kt/FKlTnFgqV5ZWzM3Pj08Xp4vzIyPCF0Yuj50eHClMzpWL676Yx3vznx/e36v/BFvEHtun/qTb7/+udG3f/tkX80yc3f/+PbhG//jfxn/R7oF4/2MyvruUfdvzDz45v1f/JFv3f7v0/3Wb/z7z4+ldtPhQA2AWV5ZXZ8VKpuCgjIyOznsn6yAQAAOy0Byf9WbcEAAAAAAAAAAAAAAAAAAAAOtdu/JxY1n0EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGjHbwEAAP//kRbbrg==") ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f00000069c0)=ANY=[@ANYBLOB="000000004c9002000400000003000100000000000000000000000000000000000000000000000000000012000000000000000000000000000000000000000000000000000500e7ffffff000000000000010000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000ffffffff"]) executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct={0x0, 0x2000}]}}, 0x0, 0x26}, 0x20) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_opts(r2, 0x29, 0x3b, 0x0, &(0x7f0000000180)=0xa4) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@ipv4_newroute={0x24, 0x1a, 0x1, 0x0, 0x25dfdbfe, {0x2, 0x20, 0x20, 0x0, 0xfd, 0x2}, [@RTA_SRC={0x8, 0x2, @multicast2}]}, 0x24}}, 0x20004000) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=@newlink={0x54, 0x10, 0xffffff1f, 0x70bd2b, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x11298}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @ip6gretap={{0xe}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x14, 0x7, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}}]}}}, @IFLA_MTU={0x8, 0x4, 0x3193}]}, 0x54}}, 0x4000) executing program 6: r0 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000000), 0x103902, 0x0) pipe2(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$binfmt_misc(r2, &(0x7f00000002c0)="7d9a6cba", 0x4) (async, rerun: 32) socket$inet(0x2, 0x2, 0x0) (async, rerun: 32) splice(r1, 0x0, r0, &(0x7f0000000500)=0x8008, 0x9, 0x0) (async, rerun: 32) ioctl$VHOST_SET_VRING_KICK(r2, 0x4008af20, &(0x7f0000000040)={0x1}) (rerun: 32) executing program 2: r0 = socket$inet6(0xa, 0x2, 0x3a) syz_mount_image$ext4(&(0x7f0000000300)='ext4\x00', &(0x7f0000000500)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x840e, &(0x7f0000000600)={[{@init_itable_val={'init_itable', 0x3d, 0x4}}, {@dioread_nolock}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x6a}}, {@jqfmt_vfsold}, {@nojournal_checksum}, {@grpjquota}]}, 0x3, 0x446, &(0x7f0000000780)="$eJzs289rHFUcAPDv7CZt06YmlvqjaavRKgZ/JE1aaw9eFAUPCoIe6jEm2xK7baSJYEvQKFKPUhCv4lHwL/CkF1FPglc9K4UiubQKwsrszia729383GRr9/OBSd6beZv3vjvzdt+blwmgaw2nP5KI/oj4LSIGKtn6AsOVX7eWFqb+XlqYSqJUeuOvpFzu5tLCVLVo9XX7qpmeiNwnSRxuUu/c5SvnJ4vFwqUsPzZ/4d2xuctXnpm5MHmucK5wceL06ZMnxp87NfFsW+JM47o59MHskUOvvHXttakz197+6ZusvXuiIY42GV7t4OOlUpur66z9Nemkp4MNYUPylW4aveX+PxD5WDl5A/Hyxx1tHLCtSqVS6f7WhxdLwF0siU63AOiM6hd9Ov+tbjs09Lgj3HihMgFK476VbZUjPZHLyvQ2zG/baTgiziz+82W6xfbchwAAqPNdOv55utn4Lxe194XuydZQBiPi3og4EBGnIuJgRNwXUS77QEQ8uMH6GxdJbh//5K5vKrB1Ssd/z2drW/Xjv+roLwbzWW5/Of7e5OxMsXA8e09Gond3mh9fpY7vX/r1s1bHasd/6ZbWXx0LZu243rO7/jXTk/OTW4m51o2PIoZ6msWfLK8EJBFxKCKGNlnHzJNfH2l1bO34V9GGdabSVxFPVM7/YjTEX5Wsvj45tieKheNj1avidj//cvX1VvVvKf42SM//3qbX/3L8g0nteu3cxuu4+vunLec0m73+dyVv1u17f3J+/tJ4xK7k1Uqja/dPNJSbWCmfxj9yrHn/PxAr78ThiEgv4qMR8VBEPJy1/ZGIeDQijq0S/48vPvZO/Z4/+tcf//ZK45/e0PlfSeyKxj3NE/nzP3xbV+ngSnJ95/9kOTWS7VnP59962lUs7N7q2wcAAAD/C7mI6I8kN7qczuVGRyv/w38w9uaKs3PzT52dfe/idOUZgcHozVXvdA3U3A8dz6b11fxEQ/5Edt/483xfOT86NVuc7nTw0OX2tej/qT/znW4dsO08rwXdS/+H7rVW//93h9oB7Dzf/9C9mvT/vk60A9h5zb7/P+xAO4Cd19D/LftBFzH/h+6l/0P30v+hK831xVoPyUvcJYkvjlbOeXv+YOTulLgktiPR6U8mAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA9vgvAAD//+F55Qw=") r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000c00)='cpuset.effective_mems\x00', 0x275a, 0x0) r2 = socket$inet6(0xa, 0x80003, 0xff) r3 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./file1\x00', 0x42, 0x4c) lseek(r3, 0xffffffffffffbff8, 0x3) fadvise64(r3, 0x9, 0x40, 0x0) setsockopt$inet6_int(r2, 0x29, 0x16, &(0x7f0000000c40), 0x4) r4 = socket$inet6(0xa, 0x3, 0xff) r5 = socket$inet6(0xa, 0x80003, 0xff) setsockopt$inet6_int(r5, 0x29, 0x16, &(0x7f0000000c80), 0x4) close(r4) write$binfmt_script(r1, &(0x7f0000000cc0), 0x208e24b) ioctl$EXT4_IOC_GET_ES_CACHE(r1, 0xc020662a, &(0x7f0000000d00)={0xe834, 0x5, 0x4, 0x10}) syz_mount_image$ext4(&(0x7f0000000d40)='ext4\x00', &(0x7f0000000d80)='./file0\x00', 0x248, &(0x7f0000000dc0), 0xfd, 0x4aa, &(0x7f0000000e00)="$eJzs3M9rHFUcAPDv7G6S/k6s9UdrtdEqFn8kTVq1oOAPEDwoCHqoJ1mTtNSmjTQRbCk2SqkXQQveRfAi+Bd48iTqSfCqdykU6aXV08pkZ9Jps7tJ3CTbZD8fmOx7u2/2ve/OzM6b93YSQNcaTP8kEdsi4o+I6I+IUrHA5vqSlrtx7fzYP9fOjyVRq731d5KuFtevnR/LiybZ49Z6ppK+UeliEi81qHf67LmT1cnJiTNZfnjm1AfD02fPPX3iVPX4xPGJ06NHjhw+NPLcs6PPtBXf1sLj9T0fT+3d/do7l98YO3r5vV++TwqNLsbRpuf789Tm5oUeW6HK7hTbC+mk0sGGsCx9EZFurp65478/yhd3zL/WH69+2tHGAauqVqvVRpu/PFsDNrAkOt0CoDPyE316/Zsva9T1uCNcfbl+AZTGfSNb6q9U6uMgffVro+2rVP9gRByd/ffrdIllj0P0rFKrAICN7Me0//NUg/5fJeLeQrkd2dzQQETcFRE7I+LuiNgVEfdEvex9EXF/42oG321S/+Bt+YX9n9KVNsJbVNr/eyGb27q1/zc/CzZQznLb5+LvSY6dmJw4mH0mB6KnL82PNHz3JGI2ffz9i2b1F/t/6ZLWn/cFs3ZcqfQVVrgcEdWZ6krEnrr6ScSeSqP4k6jcjCJ2R8SeJbxfqcFzJ574bu+tz5TnU4vH38IKzDPVvol4vL79Z+O2+HNJ6/nJ4U0xOXFwON8rFvr1t0tvNqu/Hn8pWsffYiKxTen239Jo/39xPv6BpDhfO73gLXoXq+PSn581vaa5uf0jNs09s8j+HxHj1Zlqb/L2LZV/VJ2ZOTMS0Zu8vvD5wgB3ns/Lp/Ef2N/4+N+ZrZPG/0BEpDvxgxHxUETsy9r+cEQ8EhH7W8T/8yuPvt80/n1t7P8rII1/vOH3X7Ptv/xE+eRPPzSrf2nff4fzzFyjxpfw/bfUBrbz2QEAAMB6UYqIbZGUhubTpdLQUP338rtiS2lyanrmyWNTH54er98jMBA9pXykq78wHjqSjQ3n+dEsfyHLH8rGjb8qb57LD41NTY53OnjoclubHP+pv8oNVli9oWigE9yvBd1r+cf/onO+wDrx/8//eg6w3i1yFDf6TR+wQTiLQ/dqdPxfKGaSqP9KHthwnP+he80f/18uoXBh6P/2mzeB9afV+b/Wv4YNAdac/j90pXbu688TEW2t3l4ivo1oXSbpTMPaTHzezuqVNWhhlDr4+fR2ZKOMlju6q1eW+l8t4mztQtuVdvqbCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYGX8FwAA//8Hu913") connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4e24, 0xb, @mcast2, 0x9}, 0x1c) sendto$inet6(r0, &(0x7f00000001c0)="800037bbfa9ba1ce", 0xffe9, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000000200)=[{{0x0, 0x0, &(0x7f0000000300), 0x5a}, 0xfffffffe}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}, 0x3}, {{0x0, 0x0, 0x0}, 0x3}], 0x4, 0x40000000, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0x13, &(0x7f0000000000)=ANY=[@ANYBLOB="18080000000000000000000000400000851000000600000018020000", @ANYRES32=0x0, @ANYBLOB="00000000000000006600000000000000180000000000000000000000000000009500000000000000870a000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a00000000000085000000060000009500000000000000d302e4a9f4dbf845984588e79fcdafe855956803ef412dc93ef4d49df1092e41d4c77249a57590c651bbbdc9983761e1592d36c6c18d885104229f6c8c1ff04ec06627b725a251c468662ef3210268f8177c2f40466a38c914aa42272f23868e9ec385147f6a27e99c2e575213beff04e63b9b36b803b442644fc722bb3848034cfb64be0eadc432b6207665ad00993bc8fab48bba43302c2286e5315cb079bfcb8be391668da8e8fc03856b1eccc66c08c16c6a8bf40d72d3bc0efcc609fba25810"], &(0x7f0000000740)='GPL\x00', 0x2, 0xde, &(0x7f0000000340)=""/222, 0x41000}, 0x94) executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@ipv6_newnexthop={0x20, 0x68, 0x5fb9a818fb7378e9, 0x0, 0x0, {}, [@NHA_OIF={0x8}]}, 0x20}}, 0x0) r1 = openat$kvm(0x0, &(0x7f0000000200), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@ipv6_deladdr={0x18, 0x15, 0x1, 0x70bd28, 0x25dfdbfd, {0xa, 0x18, 0x14, 0xfd}}, 0x18}, 0x1, 0x0, 0x0, 0x800}, 0x0) r4 = syz_kvm_setup_syzos_vm$x86(r2, &(0x7f0000c00000/0x400000)=nil) r5 = syz_kvm_add_vcpu$x86(r4, &(0x7f0000000240)={0x0, &(0x7f0000000700)=[@nested_amd_set_intercept={0x181, 0x0, {0x3, 0xe3, 0x4, 0x1}}, @nested_amd_vmcb_write_mask={0x17c, 0x0, {0x2, @control_area=0x68, 0xc, 0xc3, 0xfff}}, @nested_amd_clgi, @nested_load_code={0x12e, 0x0, {0x0, "66400fe01866baf80cb804b11a88ef66bafc0cb063ee470fc77200450fec3ce8420f01ca65f20f5c170f20d835080000000f22d843f40fc7682e660f38810d0e000000"}}, @uexit={0x0, 0x0, 0xfffffffffffffffd}, @set_irq_handler={0xc8, 0x0, {0x6, 0x1}}, @wr_crn={0x67, 0x0, {0x3, 0x8000000000000001}}], 0x80}) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x0, 0xc, &(0x7f00000003c0)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0xc, &(0x7f0000000500)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2500000000002020207b1af8ff00000000bfa10000"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x60, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x11, 0x14, &(0x7f0000000600)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000007808500000072"], &(0x7f0000000680)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000006c0)={r6}, 0xc) setpriority(0x0, 0xffffffffffffffff, 0x6) ioctl$KVM_RUN(r5, 0xae80, 0x0) executing program 3: r0 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x40200, 0x2, 0x3a}, 0x18) faccessat(r0, &(0x7f00000000c0)='./file0\x00', 0x4a) ioctl$sock_SIOCSIFBR(0xffffffffffffffff, 0x8941, &(0x7f0000000400)=@add_del={0x2, &(0x7f00000003c0)='netdevsim0\x00'}) r1 = socket$inet(0x2, 0x2, 0x6) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000000)={'pimreg\x00', 0x2000}) executing program 7: socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000040)) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000001c0)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000340)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000003c0), 0x318, 0x0) recvmmsg(r1, &(0x7f0000000400), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000440)=0x2) syz_open_dev$loop(0x0, 0x4, 0x901) r3 = gettid() timer_create(0x2, &(0x7f0000000480)={0x0, 0x4000021, 0x800000000004, @tid=r3}, &(0x7f0000000240)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000500)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r4, 0x1, &(0x7f0000000280)={{0x0, 0x3938700}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000600), 0x2982, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x15, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000010000000000000000000000711817000000000095"], &(0x7f0000000740)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x5, '\x00', 0x0, @sk_reuseport=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000780)='/proc/stat\x00', 0x0, 0x0) sendfile(r5, r6, 0x0, 0x20000023896) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000140)={0x1, &(0x7f0000000100)=[{0xa, 0x8, 0x0, 0x10001}]}) futex(0x0, 0x85, 0x0, 0x0, 0x0, 0xb0090199) fsopen(&(0x7f0000000840)='pstore\x00', 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000880), 0x41, 0x0) r7 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r7, 0x89f3, &(0x7f0000000940)={'syztnl0\x00', &(0x7f0000000000)={'gre0\x00', 0x0, 0x0, 0x0, 0x0, 0x6, {{0x6, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x4, 0x0, @multicast2, @broadcast, {[@noop]}}}}}) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETTXFILTER(r0, 0x400454ca, &(0x7f00000000c0)=ANY=[@ANYBLOB="2e42000c371303ed6a33f2ff8689b3f60e"]) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0xf36089824362d598, 0x0) listen(r1, 0x5a) accept4$inet6(r1, &(0x7f0000000140)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000180)=0x1c, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) (async) r3 = socket(0x1e, 0x5, 0x0) setsockopt$packet_tx_ring(r3, 0x10f, 0x87, &(0x7f0000000300)=@req3={0x80000000}, 0xfeda) (async) r4 = socket(0x1e, 0x805, 0x0) sendmsg$tipc(r4, &(0x7f0000000340)={&(0x7f0000000380)=@nameseq={0x1e, 0x1, 0x2, {0x0, 0x40000001, 0x1}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x40004}, 0x84) (async) sendto$inet6(r2, 0x0, 0x0, 0x24040014, &(0x7f00000001c0)={0xa, 0x4e22, 0x7, @empty}, 0x1c) r5 = socket(0x10, 0x803, 0x0) sendmsg$nl_generic(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)={0x1c, 0x5a, 0x1, 0x0, 0x0, {0x2}, [@typed={0x8, 0x1, 0x0, 0x0, @fd}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x0) (async) open(0x0, 0x8501, 0xa0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r6, 0x8923, &(0x7f0000000040)={'team_slave_1\x00', @random="013701329eff"}) executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[], 0x40}, 0x1, 0x0, 0x0, 0x81}, 0x4044014) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) r2 = socket(0x1, 0x5, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000980), &(0x7f00000009c0)=0x5) setsockopt$inet6_group_source_req(r2, 0x29, 0x2e, &(0x7f0000000a00)={0x38, {{0xa, 0x4e24, 0x7f, @loopback, 0x7}}, {{0xa, 0x4e20, 0x3023, @mcast2, 0x1}}}, 0x108) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x10, &(0x7f0000000b40)=0x7, 0x4) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000b80)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000bc0)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000c00)=0x2) sched_setscheduler(r3, 0x1, &(0x7f0000000c40)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f066bbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000c80)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000cc0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000d40), 0x400000000000041, 0x0) recvmmsg(r4, &(0x7f0000000d80), 0x80002c1, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000dc0)={0xe, 0x16, &(0x7f0000000e80)=ANY=[@ANYBLOB="61106400000000006113740000000018bfa00000000000000700000008ffffffd50301001774004095000000000000006916360000000000bf67000000000000350607000fff07201706000020190000160300000ee60060bf050000000000007b650000000000006507f9ff01000000070700004d83dde4c375000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f17540faf80250aa20c669a5e12814cb1cea5d4601d295c45a6a0b9bdb7dd399703cac4f6f3be4b369226066812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05000400c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc206438b8ef4901fd03c16dfda44221b235c8ac86d8a297dff0445a15f21dce431e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20ceddf4d03723f1c932b3a6aa57f1ad2e99e0e67ab93716d20000009f0f53acbb40b4f8e2738270b31562ed834f2af97787f696649a462e7ee4bcf8b07a10fd7ed6735154beb4000000000000000000000000004000bc00f6746a9709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253887a5ad103649afa17690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43ea0ffb567b40407d000000210000000000000000005f37d8703f37ca364a601ae899a56715a0a62a34c1d926a0f6a5480a55c22fe3a5ac00000000000000000000000500002000000000fb79ea00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e14d90deae46e26c596f84eba90000000000000000fffb0000000082fb0d3cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631d22a11dc3c693962895496d4f6e9cc54db6c7205a6b06ff7f0000000000007f31d7c8cc5d325c5379b0363ce8bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a1f37302f3b41eae59809fd05d12f6106f117b062df67d3a6473265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089e0b1c23c0f3cdad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3ff3be4d1458077c2253b0c7c7a1a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631d22bad050e9856b48ae3a03a497c37758537650fe6db89da3c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0af1cb3f1f815f8989d78854ca4d3116dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fc5fb38f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4c6ea9604faf0453bedf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202eeb81f428a5b3c29984864961a57ff52f657a67463d7dbf85ae9321fc2cc17dc4a29b9cba8ded5de8206c812439ab129ae818837ee15620789c524b3baf49a09d8be0fc5beecf153236c19740be9bb7d958d5e87c6c09bf71a894bad62934782cc308e936d7637e07c4a2b4dc87b0da20000d9ef418cf19e7a8c4c328be0ce91798adc2dca87ddd9d064e081383409ed2912c811ae63f03212a5331c2a4ead000000000000000000000000000000000000000000000000001386866b311bd144bc32e059658c9f8342c90c1ade31b78072841b8b5a943d62a44cea6b050c42e3c205fad6a23fb43c93da0f49d911877265e6ee443e37397ecf89021e7f579e8d3a74c12b52938d91e9de07fc8eeeb9505f4a9c26266bf5449484ccc1317c7476"], &(0x7f00000014c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x48) executing program 6: sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x40000c0) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="240000002a000103990000000000000000000000010000000000ffffffffffffff810000", 0x24) (async) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="380000006c0015000000d9fece23b82004000000", @ANYRES32=r1, @ANYBLOB="000080000000000018003480050035"], 0x38}, 0x1, 0x300}, 0x0) (async) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[], 0x38}, 0x1, 0x300, 0x0, 0x14805}, 0xc000) (async) syz_usb_connect(0x0, 0x63, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000404c17aa5600010102030109025100010100c03209040000020806500007050102000200070582020002000904000105080662000705010200020003240107050202000203020002000324030705"], 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x48) (async) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0xd, 0x10, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018210000", @ANYRES32=r2, @ANYBLOB="0000000002000020b705000008000000850000005d00000095", @ANYRES16], &(0x7f00000004c0)='GPL\x00', 0x2, 0x6ad79b3f1a62de5b, &(0x7f0000000500)=""/4106, 0x0, 0x5, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0xfffffffffffffdf8, 0x10, 0x0, 0x34, 0x0, 0x0, 0xfffffffffffffe65}, 0x23) (async) r3 = ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@bloom_filter={0x1e, 0x0, 0x3, 0x2, 0x20000, r3, 0x4e52, '\x00', r4, 0xffffffffffffffff, 0x4, 0x5, 0x0, 0x8}, 0x50) executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000600), 0x41, 0x0) write$binfmt_aout(r0, &(0x7f0000000680)=ANY=[], 0xbfb3) ioctl$TCSETS(r0, 0x40045431, 0x0) syz_open_pts(r0, 0xa5000) executing program 3: r0 = openat$sysfs(0xffffffffffffff9c, 0x0, 0x5171c0, 0x94) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) utime(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000100)=0x6) setxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)=@known='trusted.overlay.redirect\x00', &(0x7f0000000300)='%$-#*..[#\x00', 0xa, 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f066bbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000002940)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r4 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r4, &(0x7f0000000080)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) r5 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r5, &(0x7f0000000380)={&(0x7f0000000140)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x4, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4000884}, 0x4) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="08000000100001082cbd7000ffffe1ff0100010000000000b4d9f544ca263fc14935bff02fc99bd8f21aff2a873a0e828d031d290e36cbe5cca16b781c65d258099af62092caa59973c2476607f9e29108dbc808fe37a60c4ac8d6e17f422a2770a80e75ce94ef5f0898390c1a2d2b202b8a090161f0a4a13aa7733f761c4d83287bd35c8c694a0a46af760aaabc3bac985ae574968171e63b63b1d7d8c310ac6ea6ca836a4c8de89f35d00c8668454e866aa0fcccfcdedb6db224f216b9e5adb36f41532788a0a3a203c82a", @ANYRES32=0x0, @ANYBLOB="fffe01000100000008001b0000000000"], 0x28}}, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x8, &(0x7f0000000100)=0x40049, 0x4) recvmmsg(0xffffffffffffffff, &(0x7f0000000480)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=""/11, 0x17}}], 0x400000000000179, 0x0, 0x0) r7 = fsopen(&(0x7f0000000200)='bpf\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r7, 0x6, 0x0, 0x0, 0x0) r8 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000340)={&(0x7f0000000400)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000504000000002e"], 0x0, 0x37}, 0x20) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0900000004000000040000000700000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=r8, @ANYBLOB="0200000001"], 0x48) r10 = fsmount(r7, 0x1, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000004c0)={{r9}, &(0x7f0000000500), &(0x7f0000000540)=r10}, 0x20) executing program 7: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x6) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async) r2 = socket(0x10, 0x3, 0x2) connect$netlink(r2, &(0x7f0000000200)=@proc={0x10, 0x0, 0x9, 0x400000}, 0xc) (async) r3 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$AUTOFS_IOC_SETTIMEOUT(r2, 0x80049367, &(0x7f0000000240)=0x7) (async) setsockopt$inet6_udp_int(r1, 0x11, 0xa, &(0x7f0000000280)=0x1, 0x4) (async) close_range(r1, r3, 0x0) getsockopt$inet_udp_int(r0, 0x11, 0xb, 0xfffffffffffffffe, &(0x7f0000000000)) (async) r4 = socket$xdp(0x2c, 0x3, 0x0) (async) r5 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r5) mmap$xdp(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x8, 0xa4830, r4, 0x180000000) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000040)) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x3, &(0x7f00000000c0)=[{0x34, 0x0, 0x0, 0x2}, {0x3d}, {0x6}]}) syz_usb_connect$uac1(0x3, 0x77, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x10, 0x200c, 0x1018, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x65, 0x3, 0x1, 0x81, 0xa8, 0xd1, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x6, 0xf}, [@mixer_unit={0x5, 0x24, 0x4, 0x4, 0xff}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0x1, 0x2, 0x4, {0x7, 0x25, 0x1, 0xc, 0x1, 0x7a}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0x2, 0xff, 0x5, {0x7, 0x25, 0x1, 0xc, 0x5, 0x5}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0}) (async) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000007c0)='.\x02\x00', 0x22000402, &(0x7f0000000580)={[{@noinit_itable}, {@init_itable}, {@noinit_itable}, {@block_validity}, {@min_batch_time={'min_batch_time', 0x3d, 0x6}}, {@grpjquota, 0x2e}, {@mb_optimize_scan}, {@errors_remount}, {@jqfmt_vfsv1}, {@usrquota}, {@usrjquota_path={'usrjquota', 0x3d, '.\x02'}}, {@resgid}, {@nolazytime}, {@data_ordered}], [], 0x2c}, 0x1, 0x4ef, &(0x7f00000025c0)="$eJzs3MtvG8UfAPDv2nn1mbS/6gd9QAMFEVFImrRADxwAgdQLCAkO5RjSUJWmLWqDRKuKBoTKEfEXFI5ISJy4cAIJIeACiCvcUaUK5dLAARmNvZs4iZM4b1p/PpLtmfXszn53d7zjHa8DaFm96SmL2B4Rv0VEdy07u0Bv7WVq8urIX5NXR7KoVF75M6uWuz15daQoWsy3Lc/0lSJKH2Sxv0G9ly5fOTs8NjZ6Mc8PjJ97a+DS5SuPnzk3fHr09Oj5oePHjx0dfOrJoSeaiuPaEu+nuG7ve/fCgb0nXvv4xZFKvP7D52l9t+fv18dR09NUvQsrtkalamZ6R/X54VUu/b9mR106a9vEFWFZyhGRdld7tf13Rzlmdl53vPD+dObbTVpBYN2kc9OueVPL+WspP3sBd6dMG4cWVZzx0/ff4rGR/Y/NduvZ9DxajX8qf/z0Um3blNJ32Z7aN/auOfOV8tf/N1hmKluudaEq3UvUvz0iTk78fSM9ouF1iEVkTZcEAJj2der/PNao/1ea1bfZmY+h9ETE4YjYHRH/i4g90z2hiHsi4t5l1t87Jz+///PLlmUucllS/+/pfGyreNTeKeLKpnM7qvG3Z2+cGRs9km+TvmjvTPnBRer45vlfP1rovd66/l96pPqLvmC+Hjfb5nQ+Tw2PD68i5FluvRexr61R/Nn0SEDaAnsjYt8Klp+22ZlHPzuQ0ju3zX9/6fgXkOUDF6tU+TTikdr+n4g58ddVlWpaaHxyoCvGRo8MFEfFfD/+fP3l+nx7XXpW/F3NxTT3u8hqpP2/dc7xX1t+Hn8pr3DOeO3EMuq4/vuHC0Y1K/5y3JiazOJkvvDamGLpZltnRGyZ2Wzp+O/IXq2mO/Jp7wyPj18cjOjIJ8yaPjRTX5Evyqf4+w41bv+7I/75JJ9vf0Skg/i+iLg/Ig7m6/5ARDwYEYcWif/75x56c/EttILjf42k+E81/PybPv57svrx+hUkyme/+2qh+pv6/Os8Vk315VOa+fxrdgVXs+0AAADgTlGqjkFnpf4iXXdxak9sLY1duDR+uDfePn+qNlbdE+2l4kpXd9310MH82nCRH0rpjpn80YjYVf2l0ZZqvn/kwtiOzQwcqN6rU7T/znxaf3/t9Y/yZq4ZsCGWNY5W/6OzL75c+5UBNpT7NaF1af/QurR/aF3aP7SuRu3/WsTUJqwKsMGaO/9X3G4OdyH9f2hd2j+0rpn27xd/0ELm3xJf/N3KSu70n0nsPrGq2dc9UelelyVPLH+u8jpFGnV/2rFw4SwiVlZFlBYv0xGXr3StUTjpDLVYmeKmlaYXWFqyzDNLbZb2Vf0nRkoczBOdEdHsXNea2Kdrd/wkmct+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAHe3fAAAA///pidwx") program crashed: KASAN: use-after-free Read in incfs_free_mount_info bisect: bisecting 45 programs bisect: split chunks (needed=false): <45> bisect: split chunk #0 of len 45 into 3 parts bisect: testing without sub-chunk 1/3 testing program (duration=37s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 22, 30, 28, 6, 2, 9, 30, 11, 4, 10, 15, 40, 5, 6, 2, 2, 2, 7, 6, 19, 14, 5, 29, 18, 21, 14, 4, 30, 19] detailed listing: executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0xb8) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000000140)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000180)='./file0/file1\x00', 0x20400, 0x20) getdents64(r0, &(0x7f00000001c0)=""/59, 0x3b) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=@newlink={0x4c, 0x10, 0x44b, 0x70bd26, 0x0, {0x7a, 0x0, 0x0, 0x0, 0x1840, 0x42c04}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_QUERY_USE_IFADDR={0x5}, @IFLA_BR_AGEING_TIME={0x8, 0x4, 0x1}, @IFLA_BR_MCAST_SNOOPING={0x5, 0x17, 0x1}]}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20048064}, 0x24) executing program 1: syz_mount_image$vfat(&(0x7f0000000640), &(0x7f0000000680)='./file0\x00', 0x101c0ca, &(0x7f00000006c0)=ANY=[@ANYBLOB="73686f72746e616d653d6d697865642c666d61736b3d30303030303030303030303030303030303030303036362c696f636861727365743d69736f383835392d312c6572726f72733d636f6e74696e75652c756e695f786c6174653d302c696f636861727365743d61736369692c726f6469722c73686f72746e616d653d6d697865642c756e695f786c6174653d302c757466383d302c757466383d302c756e695f786c6174653d312c64656275672c756e695f786c6174653d312c666d61736b3d30303030303030303030303030303030303030303030332c6e6f63617365aec489af6ba9723d4b17106f6d47b9ade1c253d4e3b08066427cae9f41fd1e1dd25a22ec22ad6e8bf6f67e052de91b544f2f4541f87a0c0b36e8d444150b35c110bda57fe7a9c06ba087cc975447082aaf95213301f3e04b70ea67a8aa0d582ca1a9525dba7116d80f126f782a78428b878fc79c0be9ad98cb6950995e6edba78e5301e8c8e69cc85beceb8b54f84a84787815ef9a18f1fe1c81b4c1830102f7e3236e2533e486ecb46ee53991c5bfe6289a474582b2e57741fd8de78f42097851bee74d4201c7767e0e0f4b34523150639b1291441ad01f2f72ed3679d7bca0e8b4e0689f883196af0d0dfe7344f276c1b4bd333882cf7879248ad423e3f21cd0cae2309519f9d40df23cf05d9c8d8f9d07da771ea1e3bcd8478fb989f770da17f700000000000000"], 0x6, 0x2c0, &(0x7f0000000900)="$eJzs3U9rK1UUAPAz+TOJukgWrkRwQBeuHu+9rZsUeQ/ErnxkoS60+FqQJggtFKri2JVbNy78DILgB3HjNxDcCu6sUBiZyaRJ2pg2palof79Fe3vnnLlnboZ2WujJx6+O959nsXfy5a/R7SbRGMQgTpPoRyOmvo4Fg28DAPgvOy2K+KOYWCcviYju5soCADboej//W7PhT3dSFgCwQc/e/+Ddre3tJ+9lWTeejr85Gpa/2ZefJ8e39uLTGMVuPIxenEVUDwrtqJ4WyuHToijyVlbqxxvj/GhYZo4/+rk+/9bv9R8LSv3q4/nTRpX/zvaTR9nEXH5e1vFivf6gXP9x9OLl8+SF/MdL8mOYxpuvz9X/IHrxyyfxWYzieVXELP+rR1n2dvHdn198WJZX5if50bBTxc0UzTt8WQAAAAAAAAAAAAAAAAAAAAAA+J97UPfO6UTVv6ecqvvvNM/KL9qRTfUX+/NM8qetfRb6AxVFkVftcib9dR5mWVbUgbP8VrzSmm8sCAAAAAAAAAAAAAAAAAAAAPfX4fHn+zuj0e7BrQym3QBaEfHXs4ibnmcwN/NarA7u1GvujEaNergY05qfieY0JolYWUZ5Ebe0LVcNXrhUcz344cd1T9i9Oqa9fK3D4+ZNX6/84sz07trfSZbvYSemM9160e/TiFlMGtdcPf2nQ0Wsc/ulSw/11t6N9KVqkK+IiWRVYW/9Ntm5eia5eBVptatL09v1YC79wr1xrfs5upP0y98rEt06AAAAAAAAAAAAAAAAAABgo2b//bvk4MnK1EbR2VhZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHCnZu//v8Ygj4h2fYIrgtM4OPyXLxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIB74O8AAAD//0aWVl0=") r0 = socket$inet6(0xa, 0x3, 0xff) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000bc0)=@filter={'filter\x00', 0xe, 0x4, 0x370, 0xffffffff, 0x0, 0xd0, 0x1a0, 0xffffffff, 0xffffffff, 0x0, 0xd0, 0x2a0, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@ipv6={@empty, @empty, [], [], '\x00', '\x00', {}, {}, 0x6, 0x0, 0x1}, 0x0, 0xd8, 0x100, 0x0, {}, [@common=@inet=@tcp={{0x30}, {[0x0, 0xffff], [0x0, 0xffff], 0x0, 0x2, 0x2}}]}, @common=@inet=@TCPMSS={0x28, 'TCPMSS\x00', 0x0, {0x578}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3d0) r1 = socket$inet6(0xa, 0x3, 0x3c) setsockopt$inet6_IPV6_RTHDR(r1, 0x29, 0x39, &(0x7f0000000fc0)={0x0, 0x2, 0x2, 0x1, 0x0, [@mcast2]}, 0x18) (async, rerun: 64) connect$inet6(r1, &(0x7f0000001000)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, 0x1c) (rerun: 64) writev(r1, &(0x7f0000001040)=[{&(0x7f0000001080)=',', 0x5dc}], 0x1) (async) clock_settime(0x0, &(0x7f00000004c0)={0x7f, 0x2f000000}) (async) syz_mount_image$vfat(&(0x7f0000000080), &(0x7f00000000c0)='./file1\x00', 0x2048c5, &(0x7f0000000100)={[{@utf8}, {@shortname_mixed}, {@utf8no}, {@shortname_win95}, {@uni_xlate}, {@utf8no}, {@shortname_lower}, {@utf8}, {@uni_xlateno}, {}, {@fat=@usefree}, {@shortname_winnt}, {@shortname_win95}, {@shortname_winnt}]}, 0x0, 0x2e0, &(0x7f00000001c0)="$eJzs3E9rG0cYx/Gf/tiSZWzpYAotlA7tpb0stvoGKooNpYIa1yptD4V1tWqFtpLQqioqpfIt17wOk2NOCSR5A77klnvIxQQCufgQoqA/a8uSbEmJnbWj7wcsjfXs4xntzIpnBZ6jn2//VSp4VsGuKxw3Ckv7OpZSnVZfSKHuo/Y7j4satK+vll8++fTHX35dymSzmzvGbGV2v04bY1Y/e/DPf3c+f1Rf/unu6v2YDlO/Hb1IPz386PDjo9e7/l+vSLbZq1Tq9p7rmHzRK1nGbLuO7TmmWPacWt3YpubHC26lWm0au5xfSVRrjucZu9w0Jadp6hVTrzWN/YddLBvLssxKQhMsTTrgponMnJE72NmxM1cyGARh7Jqu1TJ2ZGwwd/A+BgUAAK6X6er/nrAuqv+/n6n+/7PomaJnypVOfX9B/R/WYHxC/S/NUv+jr3p+6IO7R5pHnfo/0b9+z6L+BwAAAAAAAAAAAAAAAAAAAADgJjhut5PtdjvpP/s/MUlxSf7vQY8TV4P5n28D/7gXl9xbjVwj13vuxTMFFeXK0fqC9Kq7Hvp67a3vspvrpiulh26rn99q5CKK+fm+1Pj8jV6+GciPtbSgxGD/aSW1Nj4/PZrfauQW9eUX7Vi/Z0eWknr8uypyle+u69P8/zeM+faH7FD+kvLbwcwJAAAAAACXzTInRu7fu3HL+NuGDMWlUHPw+wElJ3w/MHR/HdUn0UDfOgAAAAAAc8NbVMl2XafmNf+9cQ3NluVvZnspvUtBn4T4tAdHJfVfuTdyTFTXYirHNcKShkMLI6+Mb0TebZafS2evi7Xzpzt2enqDPmNjG+3IyVp99nfvCpgmfeqPkG+u5pMJAAAAwGXzi/5Q0AMBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGCOTbuLmH/822xCNtBdJJh3CQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFwPbwIAAP//Y0QRLg==") (async, rerun: 64) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async, rerun: 64) r3 = eventfd(0x4) (async) socketpair$unix(0x1, 0x1, 0x0, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f00000010c0)='./proc\x00', 0xae4d2f8ed3bfc611) mount(0x0, &(0x7f0000001100)='./proc\x00', &(0x7f0000001140)='proc\x00', 0x0, 0x0) (async, rerun: 64) r4 = openat(0xffffffffffffff9c, &(0x7f0000001180)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) (rerun: 64) write(r4, &(0x7f00000011c0)='7', 0x1) (async) add_key$keyring(&(0x7f0000001200), &(0x7f0000001240)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffb) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000540)='./dev\x00', &(0x7f0000000580)='devtmpfs\x00', 0x0, 0x0) (async, rerun: 32) r5 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./dev/mapper/control\x00', 0x2, 0x0) (rerun: 32) ioctl(r5, 0xc013fd08, &(0x7f0000000600)="04000000000000000000000038010000380100000000000000000000000000003200000000000000000000000000000070") ioctl$VHOST_SET_VRING_CALL(r2, 0x4008af21, &(0x7f0000000040)={0x3, r3}) executing program 6: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) setuid(0xee01) pipe(0x0) r1 = gettid() timer_create(0x1, &(0x7f00000015c0)={0x0, 0x21, 0x4, @tid=r1}, &(0x7f0000001600)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000000)={0x0, 0x0, 0xffffffff, 0x5, r0}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r2, 0x1, &(0x7f0000001680), 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r3 = fsopen(&(0x7f00000016c0)='bpf\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x0) fchdir(r4) rt_tgsigqueueinfo(r0, r0, 0x8, &(0x7f0000001540)={0x2b, 0x8, 0xfffffffb}) syz_clone3(&(0x7f0000000340)={0x801400, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x19}, 0x0, 0x0, 0x0, 0x0}, 0x40) r6 = socket(0x1e, 0x2, 0x0) setsockopt$inet_opts(r6, 0x0, 0x0, &(0x7f0000000140)="3cc9b954afb8781ff73b131b3e5e44b7", 0x10) process_madvise(r5, &(0x7f0000001500)=[{&(0x7f00000002c0)="a1b62cc97ff4ee64b264341a901889763f8b2dcb22e261acc5acc099000145fb65042e1286f1d1c994a3d99915d27940f9f2303e5f72089ab959abd8a148ae50ed529ce4e9faf7a99d656668bd468b6c38a0ad8f8521b14502897a034aec0fd75cf683293006d32aa5ec2d74cf663ddbab436b314025f6", 0x77}, {&(0x7f0000001400)="b2b752c9769d1644c7dd21561fc3148d1a28c0e7cac8d978f4040c70668fc2dba36e8366b1d3a39c0d8eac78fff2ecaaa2d79c69c842f631a2e6df45705d56b1b973cf5e5fb2e92d7a57b6120e3559136da3faef1c345c68a28819a39366c7fe88ea1f258126c6be0da126bb0c42e1d07a1a9eb15faddbfc1b877b0e0d7c280dae37c2651ab3457bf7cd377253ee8a4bac4d1374db2ed286083253fc27c06cb1b6221b4bb4848b5239450d2846eff2cfd19d27483d44866f040c6a8263b78cc58d44eee73d63463f8f0c53a5e3fa642186dd9fdde90f2f892b416810", 0xdc}], 0x2, 0x12, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000001700), 0x40, 0x0) fcntl$lock(r8, 0x11, 0x0) capset(&(0x7f0000000080)={0x20080522}, &(0x7f00000000c0)={0x0, 0x9, 0x10, 0x81, 0xffffffff}) r9 = syz_open_dev$loop(&(0x7f0000000100), 0x40, 0x100) ioctl$BLKFLSBUF(r9, 0x1261, 0x0) mmap(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x2000008, 0x32, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x8, &(0x7f0000000240)=ANY=[@ANYBLOB="180200000a00000100000000ff000000180200000a0000020000000000000000bfa2000000000000b70300004000000085000000450000009500000000000000"], &(0x7f0000000280)='GPL\x00', 0x1, 0x1000, &(0x7f0000000400)=""/4096, 0x0, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$netlink_NETLINK_PKTINFO(r7, 0x10e, 0xc, &(0x7f0000000040)=0x8, 0x4) executing program 6: r0 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'wg2\x00', 0x0}) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000080)) r2 = gettid() timer_create(0x1, &(0x7f0000000180)={0x0, 0x21, 0x4, @tid=r2}, &(0x7f00000001c0)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000200)={0x0, 0x0, 0x3ed4, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r3, 0x1, &(0x7f0000000240)={{0x77359400}}, 0x0) timerfd_create(0x9, 0x800) seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0) sendmsg$tipc(r0, &(0x7f0000000540)={&(0x7f00000002c0)=@nameseq={0x1e, 0x1, 0x1, {0x0, 0x4, 0x1}}, 0x10, &(0x7f0000000400)=[{&(0x7f0000000300)="7c6c56f09ac26487fb14373e523c4893721efcd5b7df56d5c4ea4f9c5475fcc361bf045d1df9e218378f52bc63a517a52171c6d6667e69ca8e27137916351f2ae1caa9ee012d84d334e42a2758a8ad546b6fd61ba6a4649fb78981d0d29ddda27238abb646ddd0ef012b56280139cd6643a20226ee233893176f05c3ac930e2bf8da628cfd1ba5419f9af846a53cb4c360562bdb3d175647408c6839082c9a2f4063235e5884890c4745cde16be96851de93cc7488e9dfec1b5842a01b35da57d4607ec2b09bffec754f59065d92097de1aa5e9058fdbaa794367ef28fda72d12a3edecc1c862004d8aae945", 0xec}], 0x1, &(0x7f0000000440)="7be88c2100bfa061785ce75a1e16da5d8081b8f2e7b9ea1ed3d8cab206b46218560d41bc80012ddbae9af0388610adf6ab5e57d5100986f4b1b357863b793c28e423e73e537b707dc26ea322e83c8fe7aa5982e12f9c9e0a735b491a22cd65b1359a0d45f2d29afe8d1902bf67c915792115d0ba87e1124445f3835f6e5b84c83b5e611a2d7df17486e6eac0259d1ffa40b1011d4d017312dd75367eff1142271fb21e065f9c03ea9992c02b6aa0e3238a9e0fc6c9dbb53ee93e94bfc2dcff9f082bf0fbcd1686663e80a3", 0xcb, 0x4008804}, 0x10) r4 = getpid() sched_setaffinity(r4, 0x0, 0x0) sched_setscheduler(r4, 0x1, &(0x7f0000000580)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000680)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000700), 0x651, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2, 0x50, 0xffffffffffffffff, 0x0) r7 = socket$unix(0x1, 0x2, 0x0) bind$unix(r7, &(0x7f0000000740)=@abs={0x0, 0x0, 0x4e22}, 0x6e) ioctl$int_in(0xffffffffffffffff, 0x5421, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) connect$unix(r7, &(0x7f00000007c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) close(0x3) prctl$PR_SET_MM(0x23, 0x8, &(0x7f0000001000/0x4000)=nil) prctl$PR_SET_MM(0x23, 0x9, &(0x7f0000001000/0x1000)=nil) sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r1, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x4c840) executing program 5: capset(&(0x7f0000000000)={0x20071026}, &(0x7f0000000040)={0x208004, 0x21fffc, 0xc, 0x0, 0x2, 0xfffffffe}) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0xf, 0x0, 0x0, 0x8000}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x12, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="180000000800000000000000ab0a0000"], &(0x7f0000000bc0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x8, '\x00', 0x0, @cgroup_sock_addr=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000001, 0x12, 0xffffffffffffffff, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000d80)={0x1, &(0x7f0000000dc0)=[{0x6, 0xf5, 0xe, 0x7ffffffe}]}) syz_kvm_setup_syzos_vm$x86(r0, &(0x7f0000bfd000/0x400000)=nil) executing program 5: r0 = syz_mount_image$ext4(&(0x7f0000006100)='ext4\x00', &(0x7f0000006140)='./file0\x00', 0x9, &(0x7f0000006180)={[{@init_itable_val={'init_itable', 0x3d, 0x6}}]}, 0x0, 0x4ae, &(0x7f0000006500)="$eJzs3VFrXFUeAPD/nSRt2qabdHcfuoXtlm2XtOx2Jmm2bfChVhB9Kqj1PcZkEkImmZCZtE0okuIHEERU8MknXwQ/gCD9CCIU9F1EFNFWH3zQjszkTlpjJhlqmkszvx+c3nPumZn/OZ3MnXvuucwJoGOdiIjLEdEVEWcioj/dn0tTrK6l+uPu3b05UU9J1GpXv08iSfc1XytJt4fSp/VGxEvPR7ya/DFuZXlldrxUKi6m5UJ1bqFQWV45OzM3Pl2cLs6PjAxfGL04en50aMf6eunZr99+44PnLn3yv+tfjn17+rV6s/rSuof7sZPWut7T+L9o6o6IxccRLANdaX96sm4IAABtqZ/j/zUi/t04/++PrsbZHAAAALCX1J7ui1+SiBoAAACwZ+Ua98AmuXx6L0Bf5HL5/No9vH+Pg7lSuVL971R5aX5y7V7ZgejJTc2UikPpvcID0ZPUy8ON/IPyuQ3lkYg4EhFv9R9olPMT5dJk1hc/AAAAoEMc2jD+/6l/bfwPAAAA7DEDWTcAAAAAeOyM/wEAAGDvM/4HAACAPe2FK1fqqdZc/3rfteWl2fK1s5PFymx+bmkiP1FeXMhPl8vTjd/sm9vu9Url8sL/Y37pRqFarFQLleWVsbny0nx1rLGu91jROtEAAACw+4786/YXSUSsPnWgker2pXXG6rC35bJuAJCZrqwbAGSmO+sGAJkxxgeSbep7W1V8+kjharVa7ZGeCAAAPLrBf5j/h05l/h86l/l/6FzN+f/k/voFeacE0CHaH+O3nAEEnnC7PP8PAABkoK+Rklw+vfDXF7lcPh9xuLEsQE8yNVMqDkXEXyLi8/6e/fXycNaNBgAAAAAAAAAAAAAAAAAAAAAAAIAnTK2WNBbjBgAAAPauiNw3Sbr+12D/qb6N1wf2JT/3N7YRcf29q+/cGK9WF4fr+39Y3199N91/LosrGAAAAMBGzXF6cxwPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADvp3t2bE820m3G/eyYiBjaL3x29jW1v9ETEwR+T6H7oeUlEdO1A/NVbEXF0s/hJvVkxkLZiY/xcRBzIOP6hHYgPnex2/fhzebPPXy5ONLabf/660/RntT7+5daPf10tjn+H24xx7M5HhZbxb0Uc694Yv7a/HqEZP2kR/2Sb8V95eWWlVV3t/YjBTb9/kt/FKlTnFgqV5ZWzM3Pj08Xp4vzIyPCF0Yuj50eHClMzpWL676Yx3vznx/e36v/BFvEHtun/qTb7/+udG3f/tkX80yc3f/+PbhG//jfxn/R7oF4/2MyvruUfdvzDz45v1f/JFv3f7v0/3Wb/z7z4+ldtPhQA2AWV5ZXZ8VKpuCgjIyOznsn6yAQAAOy0Byf9WbcEAAAAAAAAAAAAAAAAAAAAOtdu/JxY1n0EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGjHbwEAAP//kRbbrg==") ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f00000069c0)=ANY=[@ANYBLOB="000000004c900200040000000300010000000000000000000000000000000000000000000000000000000f000000000000000000000000000000000000000000000000000500e7ffffff000000000000010000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000ffffffff"]) executing program 3: r0 = socket$inet_icmp(0x2, 0x2, 0x1) (async) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_GET_PIT2(r2, 0x8070ae9f, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000740)=@security={'security\x00', 0xe, 0x4, 0x340, 0xffffffff, 0x188, 0xb8, 0xb8, 0xffffffff, 0xffffffff, 0x2a8, 0x2a8, 0x2a8, 0xffffffff, 0x4, &(0x7f00000000c0), {[{{@ip={@empty, @remote, 0xff000000, 0xffffffff, 'veth0_macvtap\x00', 'bond_slave_1\x00', {0xff}, {0xff}, 0x6, 0x1, 0x50}, 0x0, 0x70, 0xb8}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x3264, 'syz0\x00', {0xfff}}}}, {{@ip={@multicast1, @multicast1, 0xffffff00, 0xffffffff, 'veth0_to_team\x00', 'netpci0\x00', {}, {}, 0x1, 0x0, 0x6f}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, 0x0, 0x6, [0x1a, 0x9, 0x39, 0x27, 0x24, 0x1a, 0x28, 0x40, 0x32, 0xe, 0x15, 0x19, 0x2e, 0x3c, 0x13, 0x5], 0x1, 0x1, 0x9}}}, {{@uncond, 0x0, 0xc0, 0x120, 0x0, {}, [@common=@osf={{0x50}, {'syz0\x00', 0x0, 0x3, 0x1}}]}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @random="06eaa67f859e", 0x0, 0xa, [0x23, 0x3a, 0x2b, 0xf, 0x35, 0xe, 0x36, 0x34, 0x6, 0x34, 0xd, 0x24, 0x22, 0x2b, 0x22, 0x20], 0x1, 0x18}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3a0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'dvmrp1\x00', 0x1}) (async) ioctl$TUNSETVNETLE(r3, 0x400454dc, &(0x7f0000000100)=0x1) (async) syz_mount_image$ext4(&(0x7f0000000700)='ext4\x00', &(0x7f0000000080)='./file0\x00', 0x800, &(0x7f0000000140)={[{@noauto_da_alloc}, {@errors_remount}, {@dioread_nolock}, {@noinit_itable}]}, 0x4, 0x4e9, &(0x7f0000001140)="$eJzs3E1oXEUcAPD/2yRN+mVjrdXWqqlVDBaTNq22B0EqCh4UxArqMeajxKaNNCnYUmULUg8epOBdPHr14MWDeiniSfBaj4IUivTSVhBX3u57u5vtbtKkm6wxvx9sduZ9zcybNy/zZnY3gHVrIP2TVMJXI2JbRBQaNxiovN26cWHs9o0LY1EslY7/mZR3u5nGM9lhYnMWGSxEFD5JaivqzJ47f3J0enriTBYfnjv1wfDsufPPTvVlS44ePXzo4JHnR55beqGapJeW6+buj2f27Hr13cuvj3Xny/PU6svRLgMx0CwrZU+1O7EO21oXTro7mBGWJL3+0+rqKbf/bdEVC1VecRVzBqy0UqlU6m29ulhqdPGOJcCalUSncwB0Rv6PPn3+zV/NOgIbVqb70XHXj1UegNJy38peEY+XF+bjID0Nz7ftNBAR7xT/+jJ9xQqNQwAA1PvhWHX4Z37/r78yM/L32Ssvpu/3ZXMo/RFxf0Rsj4gHImJHRDwYETsj4qGIeLjh+F0RUVog/YGGeDX96iRU4VobitlS2v97IZvbqvX/5mWgvyuLbY3IO8wTB7JzMhg9vZNT0xMHF0jjx5d//bzVuvr+X/pK08/7glk+rnU3DNCNj86NVkLfvVf8rL4Xv3TXL0bs7m4sf9IdkVRnApKI2BURu5dw3P668NQzX++pRnrmb7d4+ctKTefR2jDPVPoq4ulK/RdjXv3XUkzmzU+eGj0xcWLi9Eh1fnK4L6YnDgxPtszNz79ceqPVukXL/+3vjbu8cuT741nLundp/W+qu/4jn7+tlb8/iUiq87WzS0/j0m+ftnymWe71vyF5qxzOn0s/HJ2bO3MwYkPy2p3LR2r75vH0PYqV8g/ua97+t2f7pGfikYhIL+JHI+KxqDwhpnnfGxFPRMS+Bcr/00tPvr/88q+stPzjDfe/Ss3Pq//afH2rQJLNDTZZ1XVy79XbLW4ed1f/h8uhwWxJ7f5XL5l3i2iV03zcI13yzz2fPQAAAFgbChGxpW4saUsUCkNDlTGgHbGpMD0zO7d/cubs6fF0XUR/9BQmp6bL45+V8eCeJB//7K+LjzTED2Xjxl90bSzHh8Zmpsc7WnJgc7nNJ4WhiLe76tp/6o/2DDED/2W+rwXr10LtP+3E77y8ipkBVtXd//+/8tGKZgRYdXXtv9U3/IvL+NwXsAZ4/gdqFv+hH/cMWPtK2jKsa0tq//v9CCD8n3THm9VwoaM5AVab/j+sS4t+r/+eAqXe5qv64s6No2/hA3bF8rKxsUlaHQmkPauOpL5xOXvlv6bQcpsoLO2AvdGeOp1cxknoLQfyru3siZ1tv/hL2Wfl212D36xKO20WWPVbEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwIr4NwAA///eNtoE") executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000f40)=@newtaction={0xe8, 0x30, 0x1, 0x70bd2b, 0x25dfdbde, {}, [{0xd4, 0x1, [@m_bpf={0x58, 0x1, 0x0, 0x0, {{0x8}, {0x30, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x1}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x3, 0xef, 0x1, 0x8000, 0x2}}, @TCA_ACT_BPF_OPS={0xc, 0x4, [{0x16, 0xf2, 0x3, 0x7}]}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x2}}}}, @m_bpf={0x78, 0x2, 0x0, 0x0, {{0x8}, {0x50, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_FD={0x8}, @TCA_ACT_BPF_OPS={0x2c, 0x4, [{0x1ff, 0x5, 0x5, 0x8}, {0x3, 0x6, 0x6d, 0x80}, {0x3, 0x6, 0x4, 0x4000000}, {0xfb, 0x6, 0x7f, 0xa}, {0x3, 0x2, 0x6, 0x1}]}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x8, 0x4, 0xffffffffffffffff, 0x7, 0x3}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}]}]}, 0xe8}, 0x1, 0x0, 0x0, 0xc044}, 0x4000814) r1 = syz_open_dev$evdev(&(0x7f0000000140), 0x2, 0x0) ioctl$EVIOCGKEYCODE_V2(r1, 0x80284504, &(0x7f00000001c0)=""/147) syz_mount_image$f2fs(&(0x7f0000000180), &(0x7f0000000440)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, &(0x7f0000005f80)=ANY=[@ANYBLOB="66617374626f6f742c71756f7461000018bbdecde39739fcd1df176dde746ec834120600000000003b814e50a959736d6572462abc30ef5b65c70f73ecea54b5e5bea9836c319f653557e79a002208ce996dda659bd5ba0f4ce5c2080002223dc60000000000000044cd0a1e3686873600000000005493b4b874cd601d5b9fa9b40fe4d76afc3a989c6d60044e89eb96e44d01a1034e3797ffa86870b82939f41ffa0f3d726f085663c29cbdc4c766a7eb77cc36160191acf5ae7469c82ab4145b595b987d75912a0fcd1c061835294cc0c618aba204f8adaa20c80108d356cd88cc86177056b06e7068c40f807d9e539f8f5b64a8ee0725aa8d00000000007cb6020d90ea79b8027cf75964dd86c2ed2b5e75779677aa8c76b848dd03dab190b5f02ec52830a17b01eaae1c3df076000000000000000000000000000083a48a6b926c668b9b90195018ea3619f9d80a0b894e212178e1a19909d764666264fa29e2c055fd7f8e67c2acfb75f0a8d41692f4542a575ee42ed94a0014fba44985cca9df12fe93bfaccf0122a6e7e593613ac0111701b125cc6799224883d08ce470220a6decad26f0378072a571da000000b1a6bdf03fd56697e348b5b494f6fddb9f56142a47a40ef81690a7eca421bd0ad198afa58ce69d61c29deaa93c0efea0df04f20020ee84075b4e1a2ad43d1be1138de4668e7b6137545708790c501f1ed7f6a571d5000000000000007d2bee8ed5acba62b8ce6eee44e813220ebc37ad7d422bb972c33e626d4d13827d303ee15e254c75ee569a56fa9e", @ANYRES64=0x0, @ANYRES32=r1], 0x21, 0x55bf, &(0x7f0000006ac0)="$eJzs3E2LG3UYAPBnsrt9ty7iwVsHirALTWi2L+jJqi2+YEvx5eBJs0ka0iaZZZOma089eBQPfhNR8OTRz+BBj3oTD4o3oZKZWe32RbtuNsu2vx/MPDP//PPMM0MIPDMhATy1FtM/fkvieByOiLmIOJZEvp2US8SdiAvF3Bci4kREVO5ZknL874EDEXEkIo5Pkhc5k/KlL06NT5779e3fv/3+4PzRL7/5YU9PHNhTL0ZEf63YvtUvYtYp4vVyvDHu5rF/dlzGtS05+lkxfqu9mme41dic18jjmU4xP1u7OZzEa71GcxI73Wv5+NqgOOBw3NnMM3lDer2xnu+32qt57A6zPHZuF8fduF18t90ejoo8rTLfJ3n6GI02YzHe3mgX57N2I4/NwagcL/JmrfbGJI7LWB4umlmvldex+j8v8j7wTndwcyMdt9eH3WyQnqvVX6rVz1fr61mrPWqfrTb6rfNn06VObzKtOmo3+hc6WdbptWvNrL+cLnWazWq9ni5dbK92G4O0Xq+dqZ2unlsut06lb1z5IO210qVJfK07uDnq9obptWw9Ld6xnK7Uzry8nJ6sp+9dvppefffSpctX3//o4odXXr381uvlpAfKSpdWTq+sVOunqyv15afo/D8ti97G+ScPH/7px51dNig84gP2aPO7UwfAPvJA/x/39/+h/wembif9f/9Gub87/X88Tv8f0+z/Jy2V/v+/+9/Ktvrf41PpfxdC/7+L5w87su3+P3dg6nUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADBzPy989Wa+sVjsHy3HnymHniv3k4ioRMTdh5iLA1tyzpV5Fh4xf+G+Gr5LIs8wOcbBcjkSERfK5c9nd/sqAAAAwJPr6zsnPi+69WK1uNcFMUvFTZvKsY+nlC+JiIXFX6aUrTJZPT+lZPnnez42ppQtv4F1aErJiltu89PK9ljmtoRD94SkCJWZlgMAAMzE1k5gtl0IAAAAs/TZv776yszqYMaS2HyUufksOP/l/T8PBA9PVnfv+3E/AAAAsJ8ke10AAAAAsOvy/t///wEAAMCTrfj/PwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgL3bu50ZtIIoD8LPBQP4pKMo9reQGZaSEHHMMFJAmKIG0kAaogUg5pIQVrLBnkbwL0moZYy36Psn2znj18wxweWNpAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKBLf6v1/PfPL78uzdntL5NnNgAAAMAp22o9r/+YNu13qf9D6vqU2kVElBFxqnYfxKiVOUg51Zn/rx6N4U9EnXDoH6fjbUR8Tcfdx64/BQAAALhdm+Vq1lTrzSktAfzrd1RcSbNoU77/limviIhq+j9TWnk4fc4UVv++h/EjU1q9gDXJFNYsuQ1P3xvlekjboHV5mMmi/hLrVtnNcwEAgD61K4EzVQgAAAA34HvfA+Aanpb2xfF0fM84bi7pheCbVgsAAAB4hYq+BwAAAAB0rq7/u9n/b/Ki/f8K+/8BAABAds3+fwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHRpW63nm+Vqdu7+4pk5u/1l8s0IAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgHv25xiFYRgKouAmkZK4M7r/Yc2CXbp2MwOCx99KAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMCd1/nyvuLT2JOMXhuz55Xk26nx69T4d25sMxnr6d8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABzsz0sKhEAQRMGc8b+Tvv9hJUHPIEIENDyqqEUDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAF/0u1/+T0yNM8ncaWPpeCRZu2psXTX2HjSOHoy3fwMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFzs289rHFUcAPA3O9lNU1uMUQJGpUoPerHptrb2KqIED/4JQkg3Nbq12uZgS7Dm4k1y7kX0IogISrzlf+i5gV7qrYccInjyEJlfyWyybX6QzKzN5wNv33ffTt6PmWXJd98sAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAhbX3wquNPI6Th9EsLtoerC/MJPXqtjqxsvRwIilJHA0Xraff2OvYG/GhLGFQvVZ+cma8vokAAADwrDi96xFxkd+HEB41l6eSujGa5v/N4pgk5/8x7yrK27bn/avrCyfylyaK/P/PPx6/tDnQaJyOk3Q6O9ftnN85laEDL/N/7vldjxhKz3z63UucXpDGR4svrjXT8xl9f//+B600HK5itgDAQZwr6jwo/h9K6nadEwPg2BgqJd5F/h+P1jsnAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgCqsLYbnijgKIUwMbcWJ1fWFmX71t0sPJ1bycvnevaVyn0kXzRDC7Fy3c75ntOEjX89gKs7mnc+nu93OzVu3qw7OhBD6vHR3b38e59N/4jGtEEJPy9mX+/TzyR7G2tbPjiB/e4Zqz+FIsr5dD456WqIdJ/z9jUwdb4BDDlpPukyN/PocxaAjlV/33qB47x1+z/v5LDmun6EAAOxHMy9JJvqouTyVtEVjIWz81Jv/v1mKQ0/ev3E3a8mer5Ty/8efXn5QHquc/7e3mk8d9RoH3eT89S8nb92+8/bc9elrnWudL9650H63ffHKpUtXJtPvSiZnQ2PbNyYAAACwH628lPP/kT77/ydLcXjK/n+2JZzl/1/90P6mPFbcP/8/9rY2/eqeCQAAwHHU2oxeeP2fv6M+R0StVvh6en7+Zjt73Hx+IXusdLoHNJyXcv4fj9U9KwAAAKAKa4tRz/7/1VIcnrL/X77//9Qvr/xW7jPO7i24EULonJu50b1a3XIGWu+Pfn+Oj+KHyulArbpXCgAAQF1G8lLe/2+OJfl/Y/OWh0YI4a2zIfyb/4Y/7DH/jz/87tfyWOX7/y9WusrB0xjPzkdaj4cwNF73jAAAAHiWnchLkuz/1Vye+uz3kx+33P8PAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAULX/AgAA//9KES1X") (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x480543, 0x40) (async) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0x2080, 0x0) read(r2, &(0x7f0000000080)=""/148, 0xffffff96) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./dev\x00', 0x1ff) (async, rerun: 64) mount(0x0, &(0x7f00000002c0)='./dev\x00', &(0x7f0000000300)='devtmpfs\x00', 0x0, 0x0) (async, rerun: 64) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r3, 0x107, 0x5, &(0x7f0000000700)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) (async) mremap(&(0x7f00003ff000/0xc00000)=nil, 0xc00000, 0x2000, 0x3, &(0x7f0000000000/0x2000)=nil) (async, rerun: 32) syz_mount_image$ext4(&(0x7f0000000740)='ext4\x00', &(0x7f0000000780)='./file0\x00', 0x10e, &(0x7f00000007c0), 0x3, 0x464, &(0x7f0000000800)="$eJzs3MtvG8UfAPDvbpK26eOX/Ep5tBQIFETEI2nSAj1wAAQSB0BIXMoxJGlVmjaoCRKtKggIlSMq4o44gvgLOMEFASckrnBHlSrUC4WT0Xp360dtN02dONSfj7T2zO7YM+PZsWd2sgmgb41lD0nEzoj4LSJG8mhjgrH86eqV87N/Xzk/m0Sl8safSTXdX1fOz5ZJy9ftKCLjaUT6cRL3tsh36ey5kzMLC/Nnivjk8ql3JpfOnnvyxKmZ4/PH509PHzly+NDUM09PP9WVev4/K+u+9xf37335zYuvzh69+NZP3yRl/ZvqccuGq49jnZI8Uql0LbvNYFddOBnsYUG4KQMRkTXXULX/j8RA1BpvJF76qKeFA9ZVpdDm8EoFuI0l0esSAL1R/tBn899y27jRR+9dfj6fAGX1vlps+ZHBSCOfGA01zW+7aSwijq7880W2RbevQwAAtPBdNv55otX4L4276tL9r1gbGi3WUnZHxB0RsSci7oyopr07Iu65yfybF0muH/+kl9ZUsVXKxn/PFmtbjeO/tEwyOlDEdlUjQ8mxEwvzB4vPZDyGtmbxqQ55fP/ir5+2O1Y//su2LP9yLFiU49Lg1sbXzM0sz9xKnetd/jBi32Cr+ifXVgKSiNj72trzOPHYV/vbHWuufyXp9E7PNUa7sM5U+TLi0bz9V6Kp/qWk8/rk5LZYmD84WZ4V1/v5lwuvt8v/xu2/vrL2397y/L9W/9Gkfr126ebzuPD7J23nNBNrOv9rO7YUz+/NLC+fmYrYkrySF7p+/3TttWW8TJ/Vf/xA6/6/Ow989nVEdQ07O4nvi4j7I+KBou0ejIiHIuJAuwquRPz4wsNvtzu8Gdp/rqn9RxuTNLV/LbAlmve0Dgyc/OHbxnesBVf3/Xe4Ghov9qzm+2815Vrb2QwAAAD/PWlE7IwknbgWTtOJifxv+PfE9nRhcWn58WOL756ey+8RGI2htLzSlV8Pzq+HThXT+jI+3RQ/VFw3/nxguBqfmF1cmOt15aHP7WjT/zN/DPS6dMC6c78W9C/9H/qX/g/9S/+H/tWi/w/3ohzAxmv1+/9BLVgZ2cjCABuqqf9b9oM+Yv4P/Uv/h/5V3/873n8P3E6WhuPGN8kLbObAtrIpNzb3SDdB3Vcb2Bqd0yTr3At2boYPoQyU//uzc+IefzEBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB0yb8BAAD///7G59I=") (async, rerun: 32) mkdir(0x0, 0x25) (async) prlimit64(0x0, 0xe, &(0x7f0000000c80)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000cc0)=0x8) r4 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000d00)=0x2) (async) sched_setscheduler(r4, 0x1, &(0x7f0000000d40)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x9a5eb000) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000d80)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000dc0)=@abs, 0x6e) (async, rerun: 64) sendmmsg$unix(r6, &(0x7f0000000e40), 0x651, 0x0) (rerun: 64) recvmmsg(r5, &(0x7f0000000e80), 0x4000087, 0x2, 0x0) (async) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x1, 0x1010, 0xffffffffffffffff, 0x0) (async, rerun: 32) socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 32) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000ec0), 0x60242, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000f00)={'pimreg\x00', 0x3c32}) executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x401c2, 0x0) ftruncate(r0, 0x8800000) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendfile(r1, r0, 0x0, 0x578410eb) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e22}, 0x1c) listen(r3, 0x81010040) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10) syz_emit_ethernet(0x36, &(0x7f0000000080)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1b}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x3d, 0x28, 0x67, 0x0, 0x2, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2}}}}}}, 0x0) syz_emit_ethernet(0x159, &(0x7f0000000200)={@local, @broadcast, @void, {@ipv4={0x800, @igmp={{0x15, 0x4, 0x2, 0x3e, 0x14b, 0x64, 0x0, 0x8, 0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x10}, @private=0xa010101, {[@ra={0x94, 0x4}, @generic={0x82, 0x10, "cc303838b09d57725c1e05817f05"}, @cipso={0x86, 0xb, 0x2, [{0x7, 0x3, "d4"}, {0x1, 0x2}]}, @cipso={0x86, 0x21, 0x3, [{0x0, 0xf, "79501ec32cab539f0845f7a311"}, {0x6, 0x6, "2ecd4209"}, {0x2, 0x3, "cb"}, {0x6, 0x3, ':'}]}]}}, {0x22, 0x76, 0x0, @rand_addr=0x64010100, "89b9477228dd1ca8f9de87e28572ec7b256b1e9c7c2600fac34689366c71f395662b0ed8b452e17fefdc15cfec95f08e2ecaa21ac08199e0f95df6a0cd2075a5440e0b29b3cc45999a2391c7c1f4335df9396549c6a94646d2bb53b110dc7f7401906e6a15d6e983ba1b1b3b3678946b9a678db824a46e95697492d82e7eb76c1bae1348e6b851e3f4b09d94f8e1874261b8f83cd2f237592336cadefc2fd204fa2fab731c3ff6f54c15b7f1f0875d8c3e41c18e9d0c2ace2bbcb9fcbab24c97be25216511bbd9decd870ba3390d8d82ddfe34380d85352e14161875e840d7a6a80b18730c64f1436a4c924a5d7e41"}}}}}, 0x0) shutdown(r2, 0x0) executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000600), 0x41, 0x0) write$binfmt_aout(r0, &(0x7f0000000680)=ANY=[], 0xbfb3) ioctl$TCSETS(r0, 0x40045431, 0x0) syz_open_pts(r0, 0xa5000) executing program 6: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f0000000000)=0x6) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_int(r1, 0x6, 0x9, &(0x7f0000000140), &(0x7f0000000180)=0x4) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e20, @loopback}, 0x10) r2 = ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) sendmsg$NFT_BATCH(r2, &(0x7f0000000b40)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000b00)={&(0x7f0000000500)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWRULE={0x154, 0x6, 0xa, 0x201, 0x0, 0x0, {0x7, 0x0, 0x4}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_POSITION_ID={0x8, 0xa, 0x1, 0x0, 0x1}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_COMPAT={0x4c, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x8884}, @NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x33}, @NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}]}, @NFTA_RULE_USERDATA={0x5c, 0x7, 0x1, 0x0, "989fe55479d05fe316872127fcae40814d278bc0c1a6704e2b72ed0ba221d490c32156be134a4b21bab95fd152ffe13c22fab767d93e9f14a8226fe9fec98ed973185aa012c80591366a44fb59e918eedda1c1bc128d3ced"}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_COMPAT={0x54, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x890d}, @NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x8917}, @NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x7bf3}, @NFTA_RULE_COMPAT_FLAGS={0x8}, @NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x6004}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x88}, @NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x2e}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x11}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}]}, @NFT_MSG_DELFLOWTABLE={0x28, 0x18, 0xa, 0x801, 0x0, 0x0, {0x1, 0x0, 0x7}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_FLAGS={0x8}]}, @NFT_MSG_DELRULE={0x20, 0x8, 0xa, 0x0, 0x0, 0x0, {0x7, 0x0, 0x1}, [@NFTA_RULE_HANDLE={0xc, 0x3, 0x1, 0x0, 0x1}]}, @NFT_MSG_NEWCHAIN={0xc4, 0x3, 0xa, 0x304, 0x0, 0x0, {0x2, 0x0, 0x2}, [@NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x3}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x4}, @NFTA_CHAIN_COUNTERS={0x7c, 0x8, 0x0, 0x1, [@NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x9}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x9}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x7}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x7fff}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x101}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x10000}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x4}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x8001}, @NFTA_COUNTER_PACKETS={0xc}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x5}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_POLICY={0x8, 0x5, 0x1, 0x0, 0xfffffffffffffffd}, @NFTA_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x1}]}, @NFT_MSG_NEWCHAIN={0xec, 0x3, 0xa, 0x101, 0x0, 0x0, {0x2, 0x0, 0x3}, [@NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x6}, @NFTA_CHAIN_USERDATA={0x68, 0xc, "8048b3b6006f7bbe016cac39f30efa73ec7d40f78ba6f57f1775ff1801a7e7a38082711bded1545850b92ebdff42f7d73367bfb938cd893ceff0b180f4f5841f52d4712bda2d09f0fbc8767e4902b52d9ce542d4097fd8bab9975e2d585d65d7f34a0f75"}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x2}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x7e0126b2}]}, @NFTA_CHAIN_COUNTERS={0x4c, 0x8, 0x0, 0x1, [@NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0xf0}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x31}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x7ff}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x81}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x5}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x6}]}]}, @NFT_MSG_NEWTABLE={0x200, 0x0, 0xa, 0x801, 0x0, 0x0, {0x7, 0x0, 0x6}, [@NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x5}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_USERDATA={0xcb, 0x6, "5da4c46ad78b4c41321fa90c7b450a906047c67d4387d641d9d5597c4ab79b6264c88a5a73fff9722246ef3b1fa9f426ea853d0a7e41aead48d4bdcc2f044ec251c28498c47d809135c2cce8fe553638717869a42ba8ed846f00514d6fa64f5984eca1c1447b53a0b77f073a84086332926fc17e43b9f8b38b94b0be8a29cf0637a61548707906a779279cb7794af8debe10eb02de558281cef636d88d63ed1c2d646e2bb004bac7e71d3889e11e7c7becf367c41b701bbd754f98c58457530ee8d34e68c4680f"}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x2}, @NFTA_TABLE_USERDATA={0xe5, 0x6, "5f3f70ad7646f882e4ce6c9787233144177194edc71c9037f5827af3219a9b3c4cd946a3673a5ccde37d1cc7a6cdb3588396b06135d78cb667f4750ea38b08af63401ba026aa98b7f69e63fd5437dc8da0a2590757ea999019eb816de11555de875dae0449c08c7646370a7ce55b03495224363c84bf61bf9e7fb564f902ab35acfaaf31ef7f9ee9ee71e8e4632c1499bd620f4bc15b249050109396405cf052b9b826eede058ad44d704015d6937327708ad6a895bd918fc06f749e845f69b8276e1d20d6cb1f6a0a993df4f3d91ef9ff18f8eb0629482ff037e346e5699c18f5"}]}, @NFT_MSG_NEWTABLE={0x28, 0x0, 0xa, 0x5, 0x0, 0x0, {0x0, 0x0, 0x8}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x3}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x59c}, 0x1, 0x0, 0x0, 0x801}, 0x40000) sendto$inet(r0, &(0x7f0000000140), 0xffffffffffffff58, 0x20008005, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) ppoll(&(0x7f0000000040)=[{r0, 0xc22}], 0x1, 0x0, 0x0, 0x0) recvfrom(r0, &(0x7f0000000480)=""/110, 0x168f6f3d, 0x734, 0x0, 0xfffffffffffffecb) executing program 3: socket(0x10, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000140)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f0000000340), 0x318, 0x0) recvmmsg(r1, &(0x7f0000000380), 0x10106, 0x2, 0x0) syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000006c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000504000000002e"], 0x0, 0x37}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0900000004000000040000000700000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=r3, @ANYBLOB="0200000001"], 0x48) openat$dir(0xffffffffffffff9c, &(0x7f0000000780)='.\x00', 0x0, 0x104) ioctl$FIDEDUPERANGE(r3, 0xc0189436, &(0x7f0000000900)=ANY=[@ANYBLOB="04a98db454f2ca8dea0c00"/24]) executing program 5: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000000, &(0x7f0000000280)={[{@nodelalloc}, {@jqfmt_vfsv1}, {@errors_remount}, {@nouser_xattr}]}, 0x0, 0x7b9, &(0x7f00000006c0)="$eJzs3c9rG1ceAPDvyHb8I1nshWV3czMsZAMhcpz1JrvQQ0oPpdBAoD03MbJiUstWsOQQG0MTSqGXQlt6KLSXnPsjvfXaH9BT+1/0UBLSxglN6aG4jDSyFVtybMe23PrzgfG892bk977zZjRPmkETwIE1nP7JRRyNiLeTiMGsPImInlqqO+Jcfb1HS4t9EVFIYnn5pZ+S2joPlxYL0fSa1OEs88+I+OqNiBO59fVW5hemxkul4myWH6lOXx2pzC+cvDI9PlmcLM6cGR0bO332v2fP7FysP3+3cOTuO8//+9Nzv77+j9tvfZ3EuTiSLWuOY6cMx3C2TXrSTfiY53a6sg5LOt0AtiU9NLvqR3kcjcHoqqXa6N/LlgEAu+W1iFgGAA6YxPkfAA6YxvcAD5cWC42ps99I7K17z0ZEXz3+R9lUX9KdXbPrq10HHXiYPHZlJImIoR2ofzgiPvz8lWNdWT5th2tpwF64cTMiLg0Nr3//T9bds7BVpzZauNxbmw2vKT5o5x/opC/S8c//Wo3/civjn2gx/umtH7t/f9r62x7/K4Or3J2nrWMj6fjvmfq9bWvGfys3rQ11Zbm/1JrVk1y+UiqeyrZBKs2P1lKtR27HH/z2oF392fjv43S6/+6rH6X1p/PVNXJ3unsff83EeLX7m6cJusm9mzGQJdfEn6z0f9Jm/Hthk3W88P83P2i3LI0/jbcxrY9/dy3fijjWsv9X+zLZ8P7EkdruMNLYKVr47Pv3B9rV39z/6ZTWn853PtLW7t2MGLg/GEmyug3qS1biH0qa79esbL2Ob28Nftlu2ZPjb7n/jx9KXq6lD2Vl18er1dnRiEPJi+vLT6++tpFvrJ/Gf/xfrY//erWt9//0M+GlTcbffffHT7Yf/+5K45/YeP9f0/99WfFqyZMStx9NdbWrf3P9P1ZLHc9K0v5/Ulybadf29mYAAAAAAAAAAAAAAAAAAAAAAAAA2LpcRByJJJdfSedy+Xz9Gd5/i4FcqVypnrhcnpuZiNqzsoeiJ9f4qcvBpt9DHc1+srWRP70m/5+I+GtEvNfbX8vnC+XSRKeDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM4TbP/0/90Nvp1gEAu6av0w0AAPac8z8AHDxbO//371o7AIC94/M/ABw8mz7/X9rddgAAe8fnfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHbZhfPn02n5l6XFQpqfuDY/N1W+dnKiWJnKT88V8oXy7NX8ZLk8WSrmC+Xptv/oRn1WKpevjsXM3PWRarFSHanML1ycLs/NVC9emR6fLF4s9uxZZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACweZX5hanxUqk4+6dI3FgNbIf/c39H4xrYH5u3KdEd+6IZ+zrRG/uiGdtMNL9L9HfgnQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgj+H3AAAA//+0Bxg2") mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x9, @mcast1, 0x48f}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000540)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6, 0x0, 0x3, 0xd}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000580)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) (async) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) (async) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) chdir(&(0x7f0000000f80)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x88040, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x181) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x3000440, 0x0, 0xff, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) (async) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) (async) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) newfstatat(0xffffffffffffff9c, &(0x7f0000000440)='./file0/file1\x00', &(0x7f0000000480), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000fc0)='./file1/file0\x00', 0x140) mount$bind(&(0x7f0000001000)='.\x00', &(0x7f0000001040)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f0000001080)='./bus\x00', &(0x7f00000010c0), 0x40, &(0x7f0000001100)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]}) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000001300)=@raw={'raw\x00', 0x9, 0x3, 0x220, 0x0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0xf0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0xc8, 0xf0, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'lo\x00', {0x0, 0x3e8, 0x5, 0x8, 0x40, 0x3e8, 0x3e8}}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffffffffffff}}}}, 0x280) syz_emit_ethernet(0x2a, &(0x7f0000001580)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) (async) syz_emit_ethernet(0x2a, &(0x7f0000001580)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000015c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001600)='./proc\x00', &(0x7f0000001640)='proc\x00', 0x0, 0x0) (async) mount(0x0, &(0x7f0000001600)='./proc\x00', &(0x7f0000001640)='proc\x00', 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000001680)={0x3, &(0x7f00000016c0)=[{0x2d, 0x0, 0x1, 0x3}, {0xac, 0x0, 0x4, 0x4}, {0x6, 0x0, 0x9}]}) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) (async) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000001700)='./proc/net/ipt_hashlimit/lo\x00', 0x0, 0x0) (async) r2 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./proc/net/ipt_hashlimit/lo\x00', 0x0, 0x0) read$FUSE(r2, &(0x7f0000001740)={0x2020}, 0x2020) accept4$unix(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x80800) (async) r3 = accept4$unix(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x80800) sendto$unix(r3, &(0x7f0000000180)="d1f0fe0a5f25af3efacd9b2e7fc36ae040ec36a45758ab8d80f839b3e16f3766d1e356f49e367e5b78c9c7af5a8377bd9c3218c21f9b4ff0cad585cc52186656ce24f6ab9d4f463041663250d02544c33579f60b6a7a45374b620339107b7c2eeefc3df0e6d951484c32426f6067662aba416c76745057f0a2f6cc701e6be591721ea1f04951338ddd3786", 0x8b, 0x4000, &(0x7f00000002c0)=@file={0x1, './bus\x00'}, 0x6e) (async) sendto$unix(r3, &(0x7f0000000180)="d1f0fe0a5f25af3efacd9b2e7fc36ae040ec36a45758ab8d80f839b3e16f3766d1e356f49e367e5b78c9c7af5a8377bd9c3218c21f9b4ff0cad585cc52186656ce24f6ab9d4f463041663250d02544c33579f60b6a7a45374b620339107b7c2eeefc3df0e6d951484c32426f6067662aba416c76745057f0a2f6cc701e6be591721ea1f04951338ddd3786", 0x8b, 0x4000, &(0x7f00000002c0)=@file={0x1, './bus\x00'}, 0x6e) openat(0xffffffffffffff9c, &(0x7f00000012c0)='./bus/file0\x00', 0x12800, 0x40) executing program 2: r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, 0x0, 0x0) (async, rerun: 64) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'veth1_vlan\x00', 0x200}) (rerun: 64) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newlink={0x28, 0x10, 0x1, 0x70bd28, 0x25dfdbf9, {0x0, 0x0, 0x0, 0x0, 0x4ac00, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x40801}, 0x4000000) executing program 6: capset(&(0x7f0000000000)={0x20071026}, &(0x7f0000000040)={0x208004, 0x21fffc, 0xc, 0x0, 0x2, 0xfffffffe}) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0xf, 0x0, 0x0, 0x8000}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x12, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="180000000800000000000000ab0a0000"], &(0x7f0000000bc0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x8, '\x00', 0x0, @cgroup_sock_addr=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000001, 0x12, 0xffffffffffffffff, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000d80)={0x1, &(0x7f0000000dc0)=[{0x6, 0xf5, 0xe, 0x7ffffffe}]}) syz_kvm_setup_syzos_vm$x86(r0, &(0x7f0000bfd000/0x400000)=nil) executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="2c00000018000106000000000000000002180000fe0300010000000008000400", @ANYRES16=r0], 0x2c}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000006100)='ext4\x00', &(0x7f0000006140)='./file0\x00', 0x9, &(0x7f0000006180)={[{@init_itable_val={'init_itable', 0x3d, 0x6}}]}, 0x0, 0x4ae, &(0x7f0000006500)="$eJzs3VFrXFUeAPD/nSRt2qabdHcfuoXtlm2XtOx2Jmm2bfChVhB9Kqj1PcZkEkImmZCZtE0okuIHEERU8MknXwQ/gCD9CCIU9F1EFNFWH3zQjszkTlpjJhlqmkszvx+c3nPumZn/OZ3MnXvuucwJoGOdiIjLEdEVEWcioj/dn0tTrK6l+uPu3b05UU9J1GpXv08iSfc1XytJt4fSp/VGxEvPR7ya/DFuZXlldrxUKi6m5UJ1bqFQWV45OzM3Pl2cLs6PjAxfGL04en50aMf6eunZr99+44PnLn3yv+tfjn17+rV6s/rSuof7sZPWut7T+L9o6o6IxccRLANdaX96sm4IAABtqZ/j/zUi/t04/++PrsbZHAAAALCX1J7ui1+SiBoAAACwZ+Ua98AmuXx6L0Bf5HL5/No9vH+Pg7lSuVL971R5aX5y7V7ZgejJTc2UikPpvcID0ZPUy8ON/IPyuQ3lkYg4EhFv9R9olPMT5dJk1hc/AAAAoEMc2jD+/6l/bfwPAAAA7DEDWTcAAAAAeOyM/wEAAGDvM/4HAACAPe2FK1fqqdZc/3rfteWl2fK1s5PFymx+bmkiP1FeXMhPl8vTjd/sm9vu9Url8sL/Y37pRqFarFQLleWVsbny0nx1rLGu91jROtEAAACw+4786/YXSUSsPnWgker2pXXG6rC35bJuAJCZrqwbAGSmO+sGAJkxxgeSbep7W1V8+kjharVa7ZGeCAAAPLrBf5j/h05l/h86l/l/6FzN+f/k/voFeacE0CHaH+O3nAEEnnC7PP8PAABkoK+Rklw+vfDXF7lcPh9xuLEsQE8yNVMqDkXEXyLi8/6e/fXycNaNBgAAAAAAAAAAAAAAAAAAAAAAAIAnTK2WNBbjBgAAAPauiNw3Sbr+12D/qb6N1wf2JT/3N7YRcf29q+/cGK9WF4fr+39Y3199N91/LosrGAAAAMBGzXF6cxwPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADvp3t2bE820m3G/eyYiBjaL3x29jW1v9ETEwR+T6H7oeUlEdO1A/NVbEXF0s/hJvVkxkLZiY/xcRBzIOP6hHYgPnex2/fhzebPPXy5ONLabf/660/RntT7+5daPf10tjn+H24xx7M5HhZbxb0Uc694Yv7a/HqEZP2kR/2Sb8V95eWWlVV3t/YjBTb9/kt/FKlTnFgqV5ZWzM3Pj08Xp4vzIyPCF0Yuj50eHClMzpWL676Yx3vznx/e36v/BFvEHtun/qTb7/+udG3f/tkX80yc3f/+PbhG//jfxn/R7oF4/2MyvruUfdvzDz45v1f/JFv3f7v0/3Wb/z7z4+ldtPhQA2AWV5ZXZ8VKpuCgjIyOznsn6yAQAAOy0Byf9WbcEAAAAAAAAAAAAAAAAAAAAOtdu/JxY1n0EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGjHbwEAAP//kRbbrg==") ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f00000069c0)=ANY=[@ANYBLOB="000000004c9002000400000003000100000000000000000000000000000000000000000000000000000012000000000000000000000000000000000000000000000000000500e7ffffff000000000000010000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000ffffffff"]) executing program 34: r0 = syz_mount_image$ext4(&(0x7f0000006100)='ext4\x00', &(0x7f0000006140)='./file0\x00', 0x9, &(0x7f0000006180)={[{@init_itable_val={'init_itable', 0x3d, 0x6}}]}, 0x0, 0x4ae, &(0x7f0000006500)="$eJzs3VFrXFUeAPD/nSRt2qabdHcfuoXtlm2XtOx2Jmm2bfChVhB9Kqj1PcZkEkImmZCZtE0okuIHEERU8MknXwQ/gCD9CCIU9F1EFNFWH3zQjszkTlpjJhlqmkszvx+c3nPumZn/OZ3MnXvuucwJoGOdiIjLEdEVEWcioj/dn0tTrK6l+uPu3b05UU9J1GpXv08iSfc1XytJt4fSp/VGxEvPR7ya/DFuZXlldrxUKi6m5UJ1bqFQWV45OzM3Pl2cLs6PjAxfGL04en50aMf6eunZr99+44PnLn3yv+tfjn17+rV6s/rSuof7sZPWut7T+L9o6o6IxccRLANdaX96sm4IAABtqZ/j/zUi/t04/++PrsbZHAAAALCX1J7ui1+SiBoAAACwZ+Ua98AmuXx6L0Bf5HL5/No9vH+Pg7lSuVL971R5aX5y7V7ZgejJTc2UikPpvcID0ZPUy8ON/IPyuQ3lkYg4EhFv9R9olPMT5dJk1hc/AAAAoEMc2jD+/6l/bfwPAAAA7DEDWTcAAAAAeOyM/wEAAGDvM/4HAACAPe2FK1fqqdZc/3rfteWl2fK1s5PFymx+bmkiP1FeXMhPl8vTjd/sm9vu9Url8sL/Y37pRqFarFQLleWVsbny0nx1rLGu91jROtEAAACw+4786/YXSUSsPnWgker2pXXG6rC35bJuAJCZrqwbAGSmO+sGAJkxxgeSbep7W1V8+kjharVa7ZGeCAAAPLrBf5j/h05l/h86l/l/6FzN+f/k/voFeacE0CHaH+O3nAEEnnC7PP8PAABkoK+Rklw+vfDXF7lcPh9xuLEsQE8yNVMqDkXEXyLi8/6e/fXycNaNBgAAAAAAAAAAAAAAAAAAAAAAAIAnTK2WNBbjBgAAAPauiNw3Sbr+12D/qb6N1wf2JT/3N7YRcf29q+/cGK9WF4fr+39Y3199N91/LosrGAAAAMBGzXF6cxwPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADvp3t2bE820m3G/eyYiBjaL3x29jW1v9ETEwR+T6H7oeUlEdO1A/NVbEXF0s/hJvVkxkLZiY/xcRBzIOP6hHYgPnex2/fhzebPPXy5ONLabf/660/RntT7+5daPf10tjn+H24xx7M5HhZbxb0Uc694Yv7a/HqEZP2kR/2Sb8V95eWWlVV3t/YjBTb9/kt/FKlTnFgqV5ZWzM3Pj08Xp4vzIyPCF0Yuj50eHClMzpWL676Yx3vznx/e36v/BFvEHtun/qTb7/+udG3f/tkX80yc3f/+PbhG//jfxn/R7oF4/2MyvruUfdvzDz45v1f/JFv3f7v0/3Wb/z7z4+ldtPhQA2AWV5ZXZ8VKpuCgjIyOznsn6yAQAAOy0Byf9WbcEAAAAAAAAAAAAAAAAAAAAOtdu/JxY1n0EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGjHbwEAAP//kRbbrg==") ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f00000069c0)=ANY=[@ANYBLOB="000000004c9002000400000003000100000000000000000000000000000000000000000000000000000012000000000000000000000000000000000000000000000000000500e7ffffff000000000000010000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000ffffffff"]) executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct={0x0, 0x2000}]}}, 0x0, 0x26}, 0x20) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_opts(r2, 0x29, 0x3b, 0x0, &(0x7f0000000180)=0xa4) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@ipv4_newroute={0x24, 0x1a, 0x1, 0x0, 0x25dfdbfe, {0x2, 0x20, 0x20, 0x0, 0xfd, 0x2}, [@RTA_SRC={0x8, 0x2, @multicast2}]}, 0x24}}, 0x20004000) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=@newlink={0x54, 0x10, 0xffffff1f, 0x70bd2b, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x11298}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @ip6gretap={{0xe}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x14, 0x7, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}}]}}}, @IFLA_MTU={0x8, 0x4, 0x3193}]}, 0x54}}, 0x4000) executing program 6: r0 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000000), 0x103902, 0x0) pipe2(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$binfmt_misc(r2, &(0x7f00000002c0)="7d9a6cba", 0x4) (async, rerun: 32) socket$inet(0x2, 0x2, 0x0) (async, rerun: 32) splice(r1, 0x0, r0, &(0x7f0000000500)=0x8008, 0x9, 0x0) (async, rerun: 32) ioctl$VHOST_SET_VRING_KICK(r2, 0x4008af20, &(0x7f0000000040)={0x1}) (rerun: 32) executing program 2: r0 = socket$inet6(0xa, 0x2, 0x3a) syz_mount_image$ext4(&(0x7f0000000300)='ext4\x00', &(0x7f0000000500)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x840e, &(0x7f0000000600)={[{@init_itable_val={'init_itable', 0x3d, 0x4}}, {@dioread_nolock}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x6a}}, {@jqfmt_vfsold}, {@nojournal_checksum}, {@grpjquota}]}, 0x3, 0x446, &(0x7f0000000780)="$eJzs289rHFUcAPDv7CZt06YmlvqjaavRKgZ/JE1aaw9eFAUPCoIe6jEm2xK7baSJYEvQKFKPUhCv4lHwL/CkF1FPglc9K4UiubQKwsrszia729383GRr9/OBSd6beZv3vjvzdt+blwmgaw2nP5KI/oj4LSIGKtn6AsOVX7eWFqb+XlqYSqJUeuOvpFzu5tLCVLVo9XX7qpmeiNwnSRxuUu/c5SvnJ4vFwqUsPzZ/4d2xuctXnpm5MHmucK5wceL06ZMnxp87NfFsW+JM47o59MHskUOvvHXttakz197+6ZusvXuiIY42GV7t4OOlUpur66z9Nemkp4MNYUPylW4aveX+PxD5WDl5A/Hyxx1tHLCtSqVS6f7WhxdLwF0siU63AOiM6hd9Ov+tbjs09Lgj3HihMgFK476VbZUjPZHLyvQ2zG/baTgiziz+82W6xfbchwAAqPNdOv55utn4Lxe194XuydZQBiPi3og4EBGnIuJgRNwXUS77QEQ8uMH6GxdJbh//5K5vKrB1Ssd/z2drW/Xjv+roLwbzWW5/Of7e5OxMsXA8e09Gond3mh9fpY7vX/r1s1bHasd/6ZbWXx0LZu243rO7/jXTk/OTW4m51o2PIoZ6msWfLK8EJBFxKCKGNlnHzJNfH2l1bO34V9GGdabSVxFPVM7/YjTEX5Wsvj45tieKheNj1avidj//cvX1VvVvKf42SM//3qbX/3L8g0nteu3cxuu4+vunLec0m73+dyVv1u17f3J+/tJ4xK7k1Uqja/dPNJSbWCmfxj9yrHn/PxAr78ThiEgv4qMR8VBEPJy1/ZGIeDQijq0S/48vPvZO/Z4/+tcf//ZK45/e0PlfSeyKxj3NE/nzP3xbV+ngSnJ95/9kOTWS7VnP59962lUs7N7q2wcAAAD/C7mI6I8kN7qczuVGRyv/w38w9uaKs3PzT52dfe/idOUZgcHozVXvdA3U3A8dz6b11fxEQ/5Edt/483xfOT86NVuc7nTw0OX2tej/qT/znW4dsO08rwXdS/+H7rVW//93h9oB7Dzf/9C9mvT/vk60A9h5zb7/P+xAO4Cd19D/LftBFzH/h+6l/0P30v+hK831xVoPyUvcJYkvjlbOeXv+YOTulLgktiPR6U8mAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA9vgvAAD//+F55Qw=") r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000c00)='cpuset.effective_mems\x00', 0x275a, 0x0) r2 = socket$inet6(0xa, 0x80003, 0xff) r3 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./file1\x00', 0x42, 0x4c) lseek(r3, 0xffffffffffffbff8, 0x3) fadvise64(r3, 0x9, 0x40, 0x0) setsockopt$inet6_int(r2, 0x29, 0x16, &(0x7f0000000c40), 0x4) r4 = socket$inet6(0xa, 0x3, 0xff) r5 = socket$inet6(0xa, 0x80003, 0xff) setsockopt$inet6_int(r5, 0x29, 0x16, &(0x7f0000000c80), 0x4) close(r4) write$binfmt_script(r1, &(0x7f0000000cc0), 0x208e24b) ioctl$EXT4_IOC_GET_ES_CACHE(r1, 0xc020662a, &(0x7f0000000d00)={0xe834, 0x5, 0x4, 0x10}) syz_mount_image$ext4(&(0x7f0000000d40)='ext4\x00', &(0x7f0000000d80)='./file0\x00', 0x248, &(0x7f0000000dc0), 0xfd, 0x4aa, &(0x7f0000000e00)="$eJzs3M9rHFUcAPDv7G6S/k6s9UdrtdEqFn8kTVq1oOAPEDwoCHqoJ1mTtNSmjTQRbCk2SqkXQQveRfAi+Bd48iTqSfCqdykU6aXV08pkZ9Jps7tJ3CTbZD8fmOx7u2/2ve/OzM6b93YSQNcaTP8kEdsi4o+I6I+IUrHA5vqSlrtx7fzYP9fOjyVRq731d5KuFtevnR/LiybZ49Z6ppK+UeliEi81qHf67LmT1cnJiTNZfnjm1AfD02fPPX3iVPX4xPGJ06NHjhw+NPLcs6PPtBXf1sLj9T0fT+3d/do7l98YO3r5vV++TwqNLsbRpuf789Tm5oUeW6HK7hTbC+mk0sGGsCx9EZFurp65478/yhd3zL/WH69+2tHGAauqVqvVRpu/PFsDNrAkOt0CoDPyE316/Zsva9T1uCNcfbl+AZTGfSNb6q9U6uMgffVro+2rVP9gRByd/ffrdIllj0P0rFKrAICN7Me0//NUg/5fJeLeQrkd2dzQQETcFRE7I+LuiNgVEfdEvex9EXF/42oG321S/+Bt+YX9n9KVNsJbVNr/eyGb27q1/zc/CzZQznLb5+LvSY6dmJw4mH0mB6KnL82PNHz3JGI2ffz9i2b1F/t/6ZLWn/cFs3ZcqfQVVrgcEdWZ6krEnrr6ScSeSqP4k6jcjCJ2R8SeJbxfqcFzJ574bu+tz5TnU4vH38IKzDPVvol4vL79Z+O2+HNJ6/nJ4U0xOXFwON8rFvr1t0tvNqu/Hn8pWsffYiKxTen239Jo/39xPv6BpDhfO73gLXoXq+PSn581vaa5uf0jNs09s8j+HxHj1Zlqb/L2LZV/VJ2ZOTMS0Zu8vvD5wgB3ns/Lp/Ef2N/4+N+ZrZPG/0BEpDvxgxHxUETsy9r+cEQ8EhH7W8T/8yuPvt80/n1t7P8rII1/vOH3X7Ptv/xE+eRPPzSrf2nff4fzzFyjxpfw/bfUBrbz2QEAAMB6UYqIbZGUhubTpdLQUP338rtiS2lyanrmyWNTH54er98jMBA9pXykq78wHjqSjQ3n+dEsfyHLH8rGjb8qb57LD41NTY53OnjoclubHP+pv8oNVli9oWigE9yvBd1r+cf/onO+wDrx/8//eg6w3i1yFDf6TR+wQTiLQ/dqdPxfKGaSqP9KHthwnP+he80f/18uoXBh6P/2mzeB9afV+b/Wv4YNAdac/j90pXbu688TEW2t3l4ivo1oXSbpTMPaTHzezuqVNWhhlDr4+fR2ZKOMlju6q1eW+l8t4mztQtuVdvqbCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYGX8FwAA//8Hu913") connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4e24, 0xb, @mcast2, 0x9}, 0x1c) sendto$inet6(r0, &(0x7f00000001c0)="800037bbfa9ba1ce", 0xffe9, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000000200)=[{{0x0, 0x0, &(0x7f0000000300), 0x5a}, 0xfffffffe}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}, 0x3}, {{0x0, 0x0, 0x0}, 0x3}], 0x4, 0x40000000, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0x13, &(0x7f0000000000)=ANY=[@ANYBLOB="18080000000000000000000000400000851000000600000018020000", @ANYRES32=0x0, @ANYBLOB="00000000000000006600000000000000180000000000000000000000000000009500000000000000870a000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a00000000000085000000060000009500000000000000d302e4a9f4dbf845984588e79fcdafe855956803ef412dc93ef4d49df1092e41d4c77249a57590c651bbbdc9983761e1592d36c6c18d885104229f6c8c1ff04ec06627b725a251c468662ef3210268f8177c2f40466a38c914aa42272f23868e9ec385147f6a27e99c2e575213beff04e63b9b36b803b442644fc722bb3848034cfb64be0eadc432b6207665ad00993bc8fab48bba43302c2286e5315cb079bfcb8be391668da8e8fc03856b1eccc66c08c16c6a8bf40d72d3bc0efcc609fba25810"], &(0x7f0000000740)='GPL\x00', 0x2, 0xde, &(0x7f0000000340)=""/222, 0x41000}, 0x94) executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@ipv6_newnexthop={0x20, 0x68, 0x5fb9a818fb7378e9, 0x0, 0x0, {}, [@NHA_OIF={0x8}]}, 0x20}}, 0x0) r1 = openat$kvm(0x0, &(0x7f0000000200), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@ipv6_deladdr={0x18, 0x15, 0x1, 0x70bd28, 0x25dfdbfd, {0xa, 0x18, 0x14, 0xfd}}, 0x18}, 0x1, 0x0, 0x0, 0x800}, 0x0) r4 = syz_kvm_setup_syzos_vm$x86(r2, &(0x7f0000c00000/0x400000)=nil) r5 = syz_kvm_add_vcpu$x86(r4, &(0x7f0000000240)={0x0, &(0x7f0000000700)=[@nested_amd_set_intercept={0x181, 0x0, {0x3, 0xe3, 0x4, 0x1}}, @nested_amd_vmcb_write_mask={0x17c, 0x0, {0x2, @control_area=0x68, 0xc, 0xc3, 0xfff}}, @nested_amd_clgi, @nested_load_code={0x12e, 0x0, {0x0, "66400fe01866baf80cb804b11a88ef66bafc0cb063ee470fc77200450fec3ce8420f01ca65f20f5c170f20d835080000000f22d843f40fc7682e660f38810d0e000000"}}, @uexit={0x0, 0x0, 0xfffffffffffffffd}, @set_irq_handler={0xc8, 0x0, {0x6, 0x1}}, @wr_crn={0x67, 0x0, {0x3, 0x8000000000000001}}], 0x80}) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x0, 0xc, &(0x7f00000003c0)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0xc, &(0x7f0000000500)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2500000000002020207b1af8ff00000000bfa10000"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x60, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x11, 0x14, &(0x7f0000000600)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000007808500000072"], &(0x7f0000000680)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000006c0)={r6}, 0xc) setpriority(0x0, 0xffffffffffffffff, 0x6) ioctl$KVM_RUN(r5, 0xae80, 0x0) executing program 3: r0 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x40200, 0x2, 0x3a}, 0x18) faccessat(r0, &(0x7f00000000c0)='./file0\x00', 0x4a) ioctl$sock_SIOCSIFBR(0xffffffffffffffff, 0x8941, &(0x7f0000000400)=@add_del={0x2, &(0x7f00000003c0)='netdevsim0\x00'}) r1 = socket$inet(0x2, 0x2, 0x6) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000000)={'pimreg\x00', 0x2000}) executing program 7: socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000040)) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000001c0)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000340)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000003c0), 0x318, 0x0) recvmmsg(r1, &(0x7f0000000400), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000440)=0x2) syz_open_dev$loop(0x0, 0x4, 0x901) r3 = gettid() timer_create(0x2, &(0x7f0000000480)={0x0, 0x4000021, 0x800000000004, @tid=r3}, &(0x7f0000000240)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000500)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r4, 0x1, &(0x7f0000000280)={{0x0, 0x3938700}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000600), 0x2982, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x15, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000010000000000000000000000711817000000000095"], &(0x7f0000000740)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x5, '\x00', 0x0, @sk_reuseport=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000780)='/proc/stat\x00', 0x0, 0x0) sendfile(r5, r6, 0x0, 0x20000023896) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000140)={0x1, &(0x7f0000000100)=[{0xa, 0x8, 0x0, 0x10001}]}) futex(0x0, 0x85, 0x0, 0x0, 0x0, 0xb0090199) fsopen(&(0x7f0000000840)='pstore\x00', 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000880), 0x41, 0x0) r7 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r7, 0x89f3, &(0x7f0000000940)={'syztnl0\x00', &(0x7f0000000000)={'gre0\x00', 0x0, 0x0, 0x0, 0x0, 0x6, {{0x6, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x4, 0x0, @multicast2, @broadcast, {[@noop]}}}}}) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETTXFILTER(r0, 0x400454ca, &(0x7f00000000c0)=ANY=[@ANYBLOB="2e42000c371303ed6a33f2ff8689b3f60e"]) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0xf36089824362d598, 0x0) listen(r1, 0x5a) accept4$inet6(r1, &(0x7f0000000140)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000180)=0x1c, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) (async) r3 = socket(0x1e, 0x5, 0x0) setsockopt$packet_tx_ring(r3, 0x10f, 0x87, &(0x7f0000000300)=@req3={0x80000000}, 0xfeda) (async) r4 = socket(0x1e, 0x805, 0x0) sendmsg$tipc(r4, &(0x7f0000000340)={&(0x7f0000000380)=@nameseq={0x1e, 0x1, 0x2, {0x0, 0x40000001, 0x1}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x40004}, 0x84) (async) sendto$inet6(r2, 0x0, 0x0, 0x24040014, &(0x7f00000001c0)={0xa, 0x4e22, 0x7, @empty}, 0x1c) r5 = socket(0x10, 0x803, 0x0) sendmsg$nl_generic(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)={0x1c, 0x5a, 0x1, 0x0, 0x0, {0x2}, [@typed={0x8, 0x1, 0x0, 0x0, @fd}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x0) (async) open(0x0, 0x8501, 0xa0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r6, 0x8923, &(0x7f0000000040)={'team_slave_1\x00', @random="013701329eff"}) executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[], 0x40}, 0x1, 0x0, 0x0, 0x81}, 0x4044014) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) r2 = socket(0x1, 0x5, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000980), &(0x7f00000009c0)=0x5) setsockopt$inet6_group_source_req(r2, 0x29, 0x2e, &(0x7f0000000a00)={0x38, {{0xa, 0x4e24, 0x7f, @loopback, 0x7}}, {{0xa, 0x4e20, 0x3023, @mcast2, 0x1}}}, 0x108) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x10, &(0x7f0000000b40)=0x7, 0x4) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000b80)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000bc0)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000c00)=0x2) sched_setscheduler(r3, 0x1, &(0x7f0000000c40)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f066bbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000c80)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000cc0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000d40), 0x400000000000041, 0x0) recvmmsg(r4, &(0x7f0000000d80), 0x80002c1, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000dc0)={0xe, 0x16, &(0x7f0000000e80)=ANY=[@ANYBLOB="61106400000000006113740000000018bfa00000000000000700000008ffffffd50301001774004095000000000000006916360000000000bf67000000000000350607000fff07201706000020190000160300000ee60060bf050000000000007b650000000000006507f9ff01000000070700004d83dde4c375000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f17540faf80250aa20c669a5e12814cb1cea5d4601d295c45a6a0b9bdb7dd399703cac4f6f3be4b369226066812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05000400c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc206438b8ef4901fd03c16dfda44221b235c8ac86d8a297dff0445a15f21dce431e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20ceddf4d03723f1c932b3a6aa57f1ad2e99e0e67ab93716d20000009f0f53acbb40b4f8e2738270b31562ed834f2af97787f696649a462e7ee4bcf8b07a10fd7ed6735154beb4000000000000000000000000004000bc00f6746a9709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253887a5ad103649afa17690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43ea0ffb567b40407d000000210000000000000000005f37d8703f37ca364a601ae899a56715a0a62a34c1d926a0f6a5480a55c22fe3a5ac00000000000000000000000500002000000000fb79ea00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e14d90deae46e26c596f84eba90000000000000000fffb0000000082fb0d3cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631d22a11dc3c693962895496d4f6e9cc54db6c7205a6b06ff7f0000000000007f31d7c8cc5d325c5379b0363ce8bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a1f37302f3b41eae59809fd05d12f6106f117b062df67d3a6473265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089e0b1c23c0f3cdad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3ff3be4d1458077c2253b0c7c7a1a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631d22bad050e9856b48ae3a03a497c37758537650fe6db89da3c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0af1cb3f1f815f8989d78854ca4d3116dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fc5fb38f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4c6ea9604faf0453bedf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202eeb81f428a5b3c29984864961a57ff52f657a67463d7dbf85ae9321fc2cc17dc4a29b9cba8ded5de8206c812439ab129ae818837ee15620789c524b3baf49a09d8be0fc5beecf153236c19740be9bb7d958d5e87c6c09bf71a894bad62934782cc308e936d7637e07c4a2b4dc87b0da20000d9ef418cf19e7a8c4c328be0ce91798adc2dca87ddd9d064e081383409ed2912c811ae63f03212a5331c2a4ead000000000000000000000000000000000000000000000000001386866b311bd144bc32e059658c9f8342c90c1ade31b78072841b8b5a943d62a44cea6b050c42e3c205fad6a23fb43c93da0f49d911877265e6ee443e37397ecf89021e7f579e8d3a74c12b52938d91e9de07fc8eeeb9505f4a9c26266bf5449484ccc1317c7476"], &(0x7f00000014c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x48) executing program 6: sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x40000c0) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="240000002a000103990000000000000000000000010000000000ffffffffffffff810000", 0x24) (async) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="380000006c0015000000d9fece23b82004000000", @ANYRES32=r1, @ANYBLOB="000080000000000018003480050035"], 0x38}, 0x1, 0x300}, 0x0) (async) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[], 0x38}, 0x1, 0x300, 0x0, 0x14805}, 0xc000) (async) syz_usb_connect(0x0, 0x63, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000404c17aa5600010102030109025100010100c03209040000020806500007050102000200070582020002000904000105080662000705010200020003240107050202000203020002000324030705"], 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x48) (async) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0xd, 0x10, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018210000", @ANYRES32=r2, @ANYBLOB="0000000002000020b705000008000000850000005d00000095", @ANYRES16], &(0x7f00000004c0)='GPL\x00', 0x2, 0x6ad79b3f1a62de5b, &(0x7f0000000500)=""/4106, 0x0, 0x5, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0xfffffffffffffdf8, 0x10, 0x0, 0x34, 0x0, 0x0, 0xfffffffffffffe65}, 0x23) (async) r3 = ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@bloom_filter={0x1e, 0x0, 0x3, 0x2, 0x20000, r3, 0x4e52, '\x00', r4, 0xffffffffffffffff, 0x4, 0x5, 0x0, 0x8}, 0x50) executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000600), 0x41, 0x0) write$binfmt_aout(r0, &(0x7f0000000680)=ANY=[], 0xbfb3) ioctl$TCSETS(r0, 0x40045431, 0x0) syz_open_pts(r0, 0xa5000) executing program 3: r0 = openat$sysfs(0xffffffffffffff9c, 0x0, 0x5171c0, 0x94) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) utime(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000100)=0x6) setxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)=@known='trusted.overlay.redirect\x00', &(0x7f0000000300)='%$-#*..[#\x00', 0xa, 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f066bbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000002940)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r4 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r4, &(0x7f0000000080)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) r5 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r5, &(0x7f0000000380)={&(0x7f0000000140)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x4, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4000884}, 0x4) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="08000000100001082cbd7000ffffe1ff0100010000000000b4d9f544ca263fc14935bff02fc99bd8f21aff2a873a0e828d031d290e36cbe5cca16b781c65d258099af62092caa59973c2476607f9e29108dbc808fe37a60c4ac8d6e17f422a2770a80e75ce94ef5f0898390c1a2d2b202b8a090161f0a4a13aa7733f761c4d83287bd35c8c694a0a46af760aaabc3bac985ae574968171e63b63b1d7d8c310ac6ea6ca836a4c8de89f35d00c8668454e866aa0fcccfcdedb6db224f216b9e5adb36f41532788a0a3a203c82a", @ANYRES32=0x0, @ANYBLOB="fffe01000100000008001b0000000000"], 0x28}}, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x8, &(0x7f0000000100)=0x40049, 0x4) recvmmsg(0xffffffffffffffff, &(0x7f0000000480)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=""/11, 0x17}}], 0x400000000000179, 0x0, 0x0) r7 = fsopen(&(0x7f0000000200)='bpf\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r7, 0x6, 0x0, 0x0, 0x0) r8 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000340)={&(0x7f0000000400)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000504000000002e"], 0x0, 0x37}, 0x20) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0900000004000000040000000700000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=r8, @ANYBLOB="0200000001"], 0x48) r10 = fsmount(r7, 0x1, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000004c0)={{r9}, &(0x7f0000000500), &(0x7f0000000540)=r10}, 0x20) executing program 7: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x6) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async) r2 = socket(0x10, 0x3, 0x2) connect$netlink(r2, &(0x7f0000000200)=@proc={0x10, 0x0, 0x9, 0x400000}, 0xc) (async) r3 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$AUTOFS_IOC_SETTIMEOUT(r2, 0x80049367, &(0x7f0000000240)=0x7) (async) setsockopt$inet6_udp_int(r1, 0x11, 0xa, &(0x7f0000000280)=0x1, 0x4) (async) close_range(r1, r3, 0x0) getsockopt$inet_udp_int(r0, 0x11, 0xb, 0xfffffffffffffffe, &(0x7f0000000000)) (async) r4 = socket$xdp(0x2c, 0x3, 0x0) (async) r5 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r5) mmap$xdp(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x8, 0xa4830, r4, 0x180000000) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000040)) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x3, &(0x7f00000000c0)=[{0x34, 0x0, 0x0, 0x2}, {0x3d}, {0x6}]}) syz_usb_connect$uac1(0x3, 0x77, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x10, 0x200c, 0x1018, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x65, 0x3, 0x1, 0x81, 0xa8, 0xd1, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x6, 0xf}, [@mixer_unit={0x5, 0x24, 0x4, 0x4, 0xff}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0x1, 0x2, 0x4, {0x7, 0x25, 0x1, 0xc, 0x1, 0x7a}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0x2, 0xff, 0x5, {0x7, 0x25, 0x1, 0xc, 0x5, 0x5}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0}) (async) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000007c0)='.\x02\x00', 0x22000402, &(0x7f0000000580)={[{@noinit_itable}, {@init_itable}, {@noinit_itable}, {@block_validity}, {@min_batch_time={'min_batch_time', 0x3d, 0x6}}, {@grpjquota, 0x2e}, {@mb_optimize_scan}, {@errors_remount}, {@jqfmt_vfsv1}, {@usrquota}, {@usrjquota_path={'usrjquota', 0x3d, '.\x02'}}, {@resgid}, {@nolazytime}, {@data_ordered}], [], 0x2c}, 0x1, 0x4ef, &(0x7f00000025c0)="$eJzs3MtvG8UfAPDv2nn1mbS/6gd9QAMFEVFImrRADxwAgdQLCAkO5RjSUJWmLWqDRKuKBoTKEfEXFI5ISJy4cAIJIeACiCvcUaUK5dLAARmNvZs4iZM4b1p/PpLtmfXszn53d7zjHa8DaFm96SmL2B4Rv0VEdy07u0Bv7WVq8urIX5NXR7KoVF75M6uWuz15daQoWsy3Lc/0lSJKH2Sxv0G9ly5fOTs8NjZ6Mc8PjJ97a+DS5SuPnzk3fHr09Oj5oePHjx0dfOrJoSeaiuPaEu+nuG7ve/fCgb0nXvv4xZFKvP7D52l9t+fv18dR09NUvQsrtkalamZ6R/X54VUu/b9mR106a9vEFWFZyhGRdld7tf13Rzlmdl53vPD+dObbTVpBYN2kc9OueVPL+WspP3sBd6dMG4cWVZzx0/ff4rGR/Y/NduvZ9DxajX8qf/z0Um3blNJ32Z7aN/auOfOV8tf/N1hmKluudaEq3UvUvz0iTk78fSM9ouF1iEVkTZcEAJj2der/PNao/1ea1bfZmY+h9ETE4YjYHRH/i4g90z2hiHsi4t5l1t87Jz+///PLlmUucllS/+/pfGyreNTeKeLKpnM7qvG3Z2+cGRs9km+TvmjvTPnBRer45vlfP1rovd66/l96pPqLvmC+Hjfb5nQ+Tw2PD68i5FluvRexr61R/Nn0SEDaAnsjYt8Klp+22ZlHPzuQ0ju3zX9/6fgXkOUDF6tU+TTikdr+n4g58ddVlWpaaHxyoCvGRo8MFEfFfD/+fP3l+nx7XXpW/F3NxTT3u8hqpP2/dc7xX1t+Hn8pr3DOeO3EMuq4/vuHC0Y1K/5y3JiazOJkvvDamGLpZltnRGyZ2Wzp+O/IXq2mO/Jp7wyPj18cjOjIJ8yaPjRTX5Evyqf4+w41bv+7I/75JJ9vf0Skg/i+iLg/Ig7m6/5ARDwYEYcWif/75x56c/EttILjf42k+E81/PybPv57svrx+hUkyme/+2qh+pv6/Os8Vk315VOa+fxrdgVXs+0AAADgTlGqjkFnpf4iXXdxak9sLY1duDR+uDfePn+qNlbdE+2l4kpXd9310MH82nCRH0rpjpn80YjYVf2l0ZZqvn/kwtiOzQwcqN6rU7T/znxaf3/t9Y/yZq4ZsCGWNY5W/6OzL75c+5UBNpT7NaF1af/QurR/aF3aP7SuRu3/WsTUJqwKsMGaO/9X3G4OdyH9f2hd2j+0rpn27xd/0ELm3xJf/N3KSu70n0nsPrGq2dc9UelelyVPLH+u8jpFGnV/2rFw4SwiVlZFlBYv0xGXr3StUTjpDLVYmeKmlaYXWFqyzDNLbZb2Vf0nRkoczBOdEdHsXNea2Kdrd/wkmct+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAHe3fAAAA///pidwx") program crashed: KASAN: use-after-free Read in incfs_free_mount_info bisect: the chunk can be dropped bisect: testing without sub-chunk 2/3 testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 2, 2, 7, 6, 19, 14, 5, 29, 18, 21, 14, 4, 30, 19] detailed listing: executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="2c00000018000106000000000000000002180000fe0300010000000008000400", @ANYRES16=r0], 0x2c}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000006100)='ext4\x00', &(0x7f0000006140)='./file0\x00', 0x9, &(0x7f0000006180)={[{@init_itable_val={'init_itable', 0x3d, 0x6}}]}, 0x0, 0x4ae, &(0x7f0000006500)="$eJzs3VFrXFUeAPD/nSRt2qabdHcfuoXtlm2XtOx2Jmm2bfChVhB9Kqj1PcZkEkImmZCZtE0okuIHEERU8MknXwQ/gCD9CCIU9F1EFNFWH3zQjszkTlpjJhlqmkszvx+c3nPumZn/OZ3MnXvuucwJoGOdiIjLEdEVEWcioj/dn0tTrK6l+uPu3b05UU9J1GpXv08iSfc1XytJt4fSp/VGxEvPR7ya/DFuZXlldrxUKi6m5UJ1bqFQWV45OzM3Pl2cLs6PjAxfGL04en50aMf6eunZr99+44PnLn3yv+tfjn17+rV6s/rSuof7sZPWut7T+L9o6o6IxccRLANdaX96sm4IAABtqZ/j/zUi/t04/++PrsbZHAAAALCX1J7ui1+SiBoAAACwZ+Ua98AmuXx6L0Bf5HL5/No9vH+Pg7lSuVL971R5aX5y7V7ZgejJTc2UikPpvcID0ZPUy8ON/IPyuQ3lkYg4EhFv9R9olPMT5dJk1hc/AAAAoEMc2jD+/6l/bfwPAAAA7DEDWTcAAAAAeOyM/wEAAGDvM/4HAACAPe2FK1fqqdZc/3rfteWl2fK1s5PFymx+bmkiP1FeXMhPl8vTjd/sm9vu9Url8sL/Y37pRqFarFQLleWVsbny0nx1rLGu91jROtEAAACw+4786/YXSUSsPnWgker2pXXG6rC35bJuAJCZrqwbAGSmO+sGAJkxxgeSbep7W1V8+kjharVa7ZGeCAAAPLrBf5j/h05l/h86l/l/6FzN+f/k/voFeacE0CHaH+O3nAEEnnC7PP8PAABkoK+Rklw+vfDXF7lcPh9xuLEsQE8yNVMqDkXEXyLi8/6e/fXycNaNBgAAAAAAAAAAAAAAAAAAAAAAAIAnTK2WNBbjBgAAAPauiNw3Sbr+12D/qb6N1wf2JT/3N7YRcf29q+/cGK9WF4fr+39Y3199N91/LosrGAAAAMBGzXF6cxwPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADvp3t2bE820m3G/eyYiBjaL3x29jW1v9ETEwR+T6H7oeUlEdO1A/NVbEXF0s/hJvVkxkLZiY/xcRBzIOP6hHYgPnex2/fhzebPPXy5ONLabf/660/RntT7+5daPf10tjn+H24xx7M5HhZbxb0Uc694Yv7a/HqEZP2kR/2Sb8V95eWWlVV3t/YjBTb9/kt/FKlTnFgqV5ZWzM3Pj08Xp4vzIyPCF0Yuj50eHClMzpWL676Yx3vznx/e36v/BFvEHtun/qTb7/+udG3f/tkX80yc3f/+PbhG//jfxn/R7oF4/2MyvruUfdvzDz45v1f/JFv3f7v0/3Wb/z7z4+ldtPhQA2AWV5ZXZ8VKpuCgjIyOznsn6yAQAAOy0Byf9WbcEAAAAAAAAAAAAAAAAAAAAOtdu/JxY1n0EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGjHbwEAAP//kRbbrg==") ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f00000069c0)=ANY=[@ANYBLOB="000000004c9002000400000003000100000000000000000000000000000000000000000000000000000012000000000000000000000000000000000000000000000000000500e7ffffff000000000000010000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000ffffffff"]) executing program 34: r0 = syz_mount_image$ext4(&(0x7f0000006100)='ext4\x00', &(0x7f0000006140)='./file0\x00', 0x9, &(0x7f0000006180)={[{@init_itable_val={'init_itable', 0x3d, 0x6}}]}, 0x0, 0x4ae, &(0x7f0000006500)="$eJzs3VFrXFUeAPD/nSRt2qabdHcfuoXtlm2XtOx2Jmm2bfChVhB9Kqj1PcZkEkImmZCZtE0okuIHEERU8MknXwQ/gCD9CCIU9F1EFNFWH3zQjszkTlpjJhlqmkszvx+c3nPumZn/OZ3MnXvuucwJoGOdiIjLEdEVEWcioj/dn0tTrK6l+uPu3b05UU9J1GpXv08iSfc1XytJt4fSp/VGxEvPR7ya/DFuZXlldrxUKi6m5UJ1bqFQWV45OzM3Pl2cLs6PjAxfGL04en50aMf6eunZr99+44PnLn3yv+tfjn17+rV6s/rSuof7sZPWut7T+L9o6o6IxccRLANdaX96sm4IAABtqZ/j/zUi/t04/++PrsbZHAAAALCX1J7ui1+SiBoAAACwZ+Ua98AmuXx6L0Bf5HL5/No9vH+Pg7lSuVL971R5aX5y7V7ZgejJTc2UikPpvcID0ZPUy8ON/IPyuQ3lkYg4EhFv9R9olPMT5dJk1hc/AAAAoEMc2jD+/6l/bfwPAAAA7DEDWTcAAAAAeOyM/wEAAGDvM/4HAACAPe2FK1fqqdZc/3rfteWl2fK1s5PFymx+bmkiP1FeXMhPl8vTjd/sm9vu9Url8sL/Y37pRqFarFQLleWVsbny0nx1rLGu91jROtEAAACw+4786/YXSUSsPnWgker2pXXG6rC35bJuAJCZrqwbAGSmO+sGAJkxxgeSbep7W1V8+kjharVa7ZGeCAAAPLrBf5j/h05l/h86l/l/6FzN+f/k/voFeacE0CHaH+O3nAEEnnC7PP8PAABkoK+Rklw+vfDXF7lcPh9xuLEsQE8yNVMqDkXEXyLi8/6e/fXycNaNBgAAAAAAAAAAAAAAAAAAAAAAAIAnTK2WNBbjBgAAAPauiNw3Sbr+12D/qb6N1wf2JT/3N7YRcf29q+/cGK9WF4fr+39Y3199N91/LosrGAAAAMBGzXF6cxwPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADvp3t2bE820m3G/eyYiBjaL3x29jW1v9ETEwR+T6H7oeUlEdO1A/NVbEXF0s/hJvVkxkLZiY/xcRBzIOP6hHYgPnex2/fhzebPPXy5ONLabf/660/RntT7+5daPf10tjn+H24xx7M5HhZbxb0Uc694Yv7a/HqEZP2kR/2Sb8V95eWWlVV3t/YjBTb9/kt/FKlTnFgqV5ZWzM3Pj08Xp4vzIyPCF0Yuj50eHClMzpWL676Yx3vznx/e36v/BFvEHtun/qTb7/+udG3f/tkX80yc3f/+PbhG//jfxn/R7oF4/2MyvruUfdvzDz45v1f/JFv3f7v0/3Wb/z7z4+ldtPhQA2AWV5ZXZ8VKpuCgjIyOznsn6yAQAAOy0Byf9WbcEAAAAAAAAAAAAAAAAAAAAOtdu/JxY1n0EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGjHbwEAAP//kRbbrg==") ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f00000069c0)=ANY=[@ANYBLOB="000000004c9002000400000003000100000000000000000000000000000000000000000000000000000012000000000000000000000000000000000000000000000000000500e7ffffff000000000000010000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000ffffffff"]) executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct={0x0, 0x2000}]}}, 0x0, 0x26}, 0x20) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_opts(r2, 0x29, 0x3b, 0x0, &(0x7f0000000180)=0xa4) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@ipv4_newroute={0x24, 0x1a, 0x1, 0x0, 0x25dfdbfe, {0x2, 0x20, 0x20, 0x0, 0xfd, 0x2}, [@RTA_SRC={0x8, 0x2, @multicast2}]}, 0x24}}, 0x20004000) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=@newlink={0x54, 0x10, 0xffffff1f, 0x70bd2b, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x11298}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @ip6gretap={{0xe}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x14, 0x7, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}}]}}}, @IFLA_MTU={0x8, 0x4, 0x3193}]}, 0x54}}, 0x4000) executing program 6: r0 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000000), 0x103902, 0x0) pipe2(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$binfmt_misc(r2, &(0x7f00000002c0)="7d9a6cba", 0x4) (async, rerun: 32) socket$inet(0x2, 0x2, 0x0) (async, rerun: 32) splice(r1, 0x0, r0, &(0x7f0000000500)=0x8008, 0x9, 0x0) (async, rerun: 32) ioctl$VHOST_SET_VRING_KICK(r2, 0x4008af20, &(0x7f0000000040)={0x1}) (rerun: 32) executing program 2: r0 = socket$inet6(0xa, 0x2, 0x3a) syz_mount_image$ext4(&(0x7f0000000300)='ext4\x00', &(0x7f0000000500)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x840e, &(0x7f0000000600)={[{@init_itable_val={'init_itable', 0x3d, 0x4}}, {@dioread_nolock}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x6a}}, {@jqfmt_vfsold}, {@nojournal_checksum}, {@grpjquota}]}, 0x3, 0x446, &(0x7f0000000780)="$eJzs289rHFUcAPDv7CZt06YmlvqjaavRKgZ/JE1aaw9eFAUPCoIe6jEm2xK7baSJYEvQKFKPUhCv4lHwL/CkF1FPglc9K4UiubQKwsrszia729383GRr9/OBSd6beZv3vjvzdt+blwmgaw2nP5KI/oj4LSIGKtn6AsOVX7eWFqb+XlqYSqJUeuOvpFzu5tLCVLVo9XX7qpmeiNwnSRxuUu/c5SvnJ4vFwqUsPzZ/4d2xuctXnpm5MHmucK5wceL06ZMnxp87NfFsW+JM47o59MHskUOvvHXttakz197+6ZusvXuiIY42GV7t4OOlUpur66z9Nemkp4MNYUPylW4aveX+PxD5WDl5A/Hyxx1tHLCtSqVS6f7WhxdLwF0siU63AOiM6hd9Ov+tbjs09Lgj3HihMgFK476VbZUjPZHLyvQ2zG/baTgiziz+82W6xfbchwAAqPNdOv55utn4Lxe194XuydZQBiPi3og4EBGnIuJgRNwXUS77QEQ8uMH6GxdJbh//5K5vKrB1Ssd/z2drW/Xjv+roLwbzWW5/Of7e5OxMsXA8e09Gond3mh9fpY7vX/r1s1bHasd/6ZbWXx0LZu243rO7/jXTk/OTW4m51o2PIoZ6msWfLK8EJBFxKCKGNlnHzJNfH2l1bO34V9GGdabSVxFPVM7/YjTEX5Wsvj45tieKheNj1avidj//cvX1VvVvKf42SM//3qbX/3L8g0nteu3cxuu4+vunLec0m73+dyVv1u17f3J+/tJ4xK7k1Uqja/dPNJSbWCmfxj9yrHn/PxAr78ThiEgv4qMR8VBEPJy1/ZGIeDQijq0S/48vPvZO/Z4/+tcf//ZK45/e0PlfSeyKxj3NE/nzP3xbV+ngSnJ95/9kOTWS7VnP59962lUs7N7q2wcAAAD/C7mI6I8kN7qczuVGRyv/w38w9uaKs3PzT52dfe/idOUZgcHozVXvdA3U3A8dz6b11fxEQ/5Edt/483xfOT86NVuc7nTw0OX2tej/qT/znW4dsO08rwXdS/+H7rVW//93h9oB7Dzf/9C9mvT/vk60A9h5zb7/P+xAO4Cd19D/LftBFzH/h+6l/0P30v+hK831xVoPyUvcJYkvjlbOeXv+YOTulLgktiPR6U8mAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA9vgvAAD//+F55Qw=") r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000c00)='cpuset.effective_mems\x00', 0x275a, 0x0) r2 = socket$inet6(0xa, 0x80003, 0xff) r3 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./file1\x00', 0x42, 0x4c) lseek(r3, 0xffffffffffffbff8, 0x3) fadvise64(r3, 0x9, 0x40, 0x0) setsockopt$inet6_int(r2, 0x29, 0x16, &(0x7f0000000c40), 0x4) r4 = socket$inet6(0xa, 0x3, 0xff) r5 = socket$inet6(0xa, 0x80003, 0xff) setsockopt$inet6_int(r5, 0x29, 0x16, &(0x7f0000000c80), 0x4) close(r4) write$binfmt_script(r1, &(0x7f0000000cc0), 0x208e24b) ioctl$EXT4_IOC_GET_ES_CACHE(r1, 0xc020662a, &(0x7f0000000d00)={0xe834, 0x5, 0x4, 0x10}) syz_mount_image$ext4(&(0x7f0000000d40)='ext4\x00', &(0x7f0000000d80)='./file0\x00', 0x248, &(0x7f0000000dc0), 0xfd, 0x4aa, &(0x7f0000000e00)="$eJzs3M9rHFUcAPDv7G6S/k6s9UdrtdEqFn8kTVq1oOAPEDwoCHqoJ1mTtNSmjTQRbCk2SqkXQQveRfAi+Bd48iTqSfCqdykU6aXV08pkZ9Jps7tJ3CTbZD8fmOx7u2/2ve/OzM6b93YSQNcaTP8kEdsi4o+I6I+IUrHA5vqSlrtx7fzYP9fOjyVRq731d5KuFtevnR/LiybZ49Z6ppK+UeliEi81qHf67LmT1cnJiTNZfnjm1AfD02fPPX3iVPX4xPGJ06NHjhw+NPLcs6PPtBXf1sLj9T0fT+3d/do7l98YO3r5vV++TwqNLsbRpuf789Tm5oUeW6HK7hTbC+mk0sGGsCx9EZFurp65478/yhd3zL/WH69+2tHGAauqVqvVRpu/PFsDNrAkOt0CoDPyE316/Zsva9T1uCNcfbl+AZTGfSNb6q9U6uMgffVro+2rVP9gRByd/ffrdIllj0P0rFKrAICN7Me0//NUg/5fJeLeQrkd2dzQQETcFRE7I+LuiNgVEfdEvex9EXF/42oG321S/+Bt+YX9n9KVNsJbVNr/eyGb27q1/zc/CzZQznLb5+LvSY6dmJw4mH0mB6KnL82PNHz3JGI2ffz9i2b1F/t/6ZLWn/cFs3ZcqfQVVrgcEdWZ6krEnrr6ScSeSqP4k6jcjCJ2R8SeJbxfqcFzJ574bu+tz5TnU4vH38IKzDPVvol4vL79Z+O2+HNJ6/nJ4U0xOXFwON8rFvr1t0tvNqu/Hn8pWsffYiKxTen239Jo/39xPv6BpDhfO73gLXoXq+PSn581vaa5uf0jNs09s8j+HxHj1Zlqb/L2LZV/VJ2ZOTMS0Zu8vvD5wgB3ns/Lp/Ef2N/4+N+ZrZPG/0BEpDvxgxHxUETsy9r+cEQ8EhH7W8T/8yuPvt80/n1t7P8rII1/vOH3X7Ptv/xE+eRPPzSrf2nff4fzzFyjxpfw/bfUBrbz2QEAAMB6UYqIbZGUhubTpdLQUP338rtiS2lyanrmyWNTH54er98jMBA9pXykq78wHjqSjQ3n+dEsfyHLH8rGjb8qb57LD41NTY53OnjoclubHP+pv8oNVli9oWigE9yvBd1r+cf/onO+wDrx/8//eg6w3i1yFDf6TR+wQTiLQ/dqdPxfKGaSqP9KHthwnP+he80f/18uoXBh6P/2mzeB9afV+b/Wv4YNAdac/j90pXbu688TEW2t3l4ivo1oXSbpTMPaTHzezuqVNWhhlDr4+fR2ZKOMlju6q1eW+l8t4mztQtuVdvqbCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYGX8FwAA//8Hu913") connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4e24, 0xb, @mcast2, 0x9}, 0x1c) sendto$inet6(r0, &(0x7f00000001c0)="800037bbfa9ba1ce", 0xffe9, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000000200)=[{{0x0, 0x0, &(0x7f0000000300), 0x5a}, 0xfffffffe}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}, 0x3}, {{0x0, 0x0, 0x0}, 0x3}], 0x4, 0x40000000, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0x13, &(0x7f0000000000)=ANY=[@ANYBLOB="18080000000000000000000000400000851000000600000018020000", @ANYRES32=0x0, @ANYBLOB="00000000000000006600000000000000180000000000000000000000000000009500000000000000870a000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a00000000000085000000060000009500000000000000d302e4a9f4dbf845984588e79fcdafe855956803ef412dc93ef4d49df1092e41d4c77249a57590c651bbbdc9983761e1592d36c6c18d885104229f6c8c1ff04ec06627b725a251c468662ef3210268f8177c2f40466a38c914aa42272f23868e9ec385147f6a27e99c2e575213beff04e63b9b36b803b442644fc722bb3848034cfb64be0eadc432b6207665ad00993bc8fab48bba43302c2286e5315cb079bfcb8be391668da8e8fc03856b1eccc66c08c16c6a8bf40d72d3bc0efcc609fba25810"], &(0x7f0000000740)='GPL\x00', 0x2, 0xde, &(0x7f0000000340)=""/222, 0x41000}, 0x94) executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@ipv6_newnexthop={0x20, 0x68, 0x5fb9a818fb7378e9, 0x0, 0x0, {}, [@NHA_OIF={0x8}]}, 0x20}}, 0x0) r1 = openat$kvm(0x0, &(0x7f0000000200), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@ipv6_deladdr={0x18, 0x15, 0x1, 0x70bd28, 0x25dfdbfd, {0xa, 0x18, 0x14, 0xfd}}, 0x18}, 0x1, 0x0, 0x0, 0x800}, 0x0) r4 = syz_kvm_setup_syzos_vm$x86(r2, &(0x7f0000c00000/0x400000)=nil) r5 = syz_kvm_add_vcpu$x86(r4, &(0x7f0000000240)={0x0, &(0x7f0000000700)=[@nested_amd_set_intercept={0x181, 0x0, {0x3, 0xe3, 0x4, 0x1}}, @nested_amd_vmcb_write_mask={0x17c, 0x0, {0x2, @control_area=0x68, 0xc, 0xc3, 0xfff}}, @nested_amd_clgi, @nested_load_code={0x12e, 0x0, {0x0, "66400fe01866baf80cb804b11a88ef66bafc0cb063ee470fc77200450fec3ce8420f01ca65f20f5c170f20d835080000000f22d843f40fc7682e660f38810d0e000000"}}, @uexit={0x0, 0x0, 0xfffffffffffffffd}, @set_irq_handler={0xc8, 0x0, {0x6, 0x1}}, @wr_crn={0x67, 0x0, {0x3, 0x8000000000000001}}], 0x80}) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x0, 0xc, &(0x7f00000003c0)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0xc, &(0x7f0000000500)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2500000000002020207b1af8ff00000000bfa10000"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x60, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x11, 0x14, &(0x7f0000000600)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000007808500000072"], &(0x7f0000000680)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000006c0)={r6}, 0xc) setpriority(0x0, 0xffffffffffffffff, 0x6) ioctl$KVM_RUN(r5, 0xae80, 0x0) executing program 3: r0 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x40200, 0x2, 0x3a}, 0x18) faccessat(r0, &(0x7f00000000c0)='./file0\x00', 0x4a) ioctl$sock_SIOCSIFBR(0xffffffffffffffff, 0x8941, &(0x7f0000000400)=@add_del={0x2, &(0x7f00000003c0)='netdevsim0\x00'}) r1 = socket$inet(0x2, 0x2, 0x6) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000000)={'pimreg\x00', 0x2000}) executing program 7: socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000040)) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000001c0)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000340)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000003c0), 0x318, 0x0) recvmmsg(r1, &(0x7f0000000400), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000440)=0x2) syz_open_dev$loop(0x0, 0x4, 0x901) r3 = gettid() timer_create(0x2, &(0x7f0000000480)={0x0, 0x4000021, 0x800000000004, @tid=r3}, &(0x7f0000000240)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000500)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r4, 0x1, &(0x7f0000000280)={{0x0, 0x3938700}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000600), 0x2982, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x15, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000010000000000000000000000711817000000000095"], &(0x7f0000000740)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x5, '\x00', 0x0, @sk_reuseport=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000780)='/proc/stat\x00', 0x0, 0x0) sendfile(r5, r6, 0x0, 0x20000023896) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000140)={0x1, &(0x7f0000000100)=[{0xa, 0x8, 0x0, 0x10001}]}) futex(0x0, 0x85, 0x0, 0x0, 0x0, 0xb0090199) fsopen(&(0x7f0000000840)='pstore\x00', 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000880), 0x41, 0x0) r7 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r7, 0x89f3, &(0x7f0000000940)={'syztnl0\x00', &(0x7f0000000000)={'gre0\x00', 0x0, 0x0, 0x0, 0x0, 0x6, {{0x6, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x4, 0x0, @multicast2, @broadcast, {[@noop]}}}}}) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETTXFILTER(r0, 0x400454ca, &(0x7f00000000c0)=ANY=[@ANYBLOB="2e42000c371303ed6a33f2ff8689b3f60e"]) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0xf36089824362d598, 0x0) listen(r1, 0x5a) accept4$inet6(r1, &(0x7f0000000140)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000180)=0x1c, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) (async) r3 = socket(0x1e, 0x5, 0x0) setsockopt$packet_tx_ring(r3, 0x10f, 0x87, &(0x7f0000000300)=@req3={0x80000000}, 0xfeda) (async) r4 = socket(0x1e, 0x805, 0x0) sendmsg$tipc(r4, &(0x7f0000000340)={&(0x7f0000000380)=@nameseq={0x1e, 0x1, 0x2, {0x0, 0x40000001, 0x1}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x40004}, 0x84) (async) sendto$inet6(r2, 0x0, 0x0, 0x24040014, &(0x7f00000001c0)={0xa, 0x4e22, 0x7, @empty}, 0x1c) r5 = socket(0x10, 0x803, 0x0) sendmsg$nl_generic(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)={0x1c, 0x5a, 0x1, 0x0, 0x0, {0x2}, [@typed={0x8, 0x1, 0x0, 0x0, @fd}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x0) (async) open(0x0, 0x8501, 0xa0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r6, 0x8923, &(0x7f0000000040)={'team_slave_1\x00', @random="013701329eff"}) executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[], 0x40}, 0x1, 0x0, 0x0, 0x81}, 0x4044014) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) r2 = socket(0x1, 0x5, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000980), &(0x7f00000009c0)=0x5) setsockopt$inet6_group_source_req(r2, 0x29, 0x2e, &(0x7f0000000a00)={0x38, {{0xa, 0x4e24, 0x7f, @loopback, 0x7}}, {{0xa, 0x4e20, 0x3023, @mcast2, 0x1}}}, 0x108) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x10, &(0x7f0000000b40)=0x7, 0x4) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000b80)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000bc0)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000c00)=0x2) sched_setscheduler(r3, 0x1, &(0x7f0000000c40)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f066bbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000c80)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000cc0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000d40), 0x400000000000041, 0x0) recvmmsg(r4, &(0x7f0000000d80), 0x80002c1, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000dc0)={0xe, 0x16, &(0x7f0000000e80)=ANY=[@ANYBLOB="61106400000000006113740000000018bfa00000000000000700000008ffffffd50301001774004095000000000000006916360000000000bf67000000000000350607000fff07201706000020190000160300000ee60060bf050000000000007b650000000000006507f9ff01000000070700004d83dde4c375000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f17540faf80250aa20c669a5e12814cb1cea5d4601d295c45a6a0b9bdb7dd399703cac4f6f3be4b369226066812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05000400c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc206438b8ef4901fd03c16dfda44221b235c8ac86d8a297dff0445a15f21dce431e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20ceddf4d03723f1c932b3a6aa57f1ad2e99e0e67ab93716d20000009f0f53acbb40b4f8e2738270b31562ed834f2af97787f696649a462e7ee4bcf8b07a10fd7ed6735154beb4000000000000000000000000004000bc00f6746a9709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253887a5ad103649afa17690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43ea0ffb567b40407d000000210000000000000000005f37d8703f37ca364a601ae899a56715a0a62a34c1d926a0f6a5480a55c22fe3a5ac00000000000000000000000500002000000000fb79ea00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e14d90deae46e26c596f84eba90000000000000000fffb0000000082fb0d3cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631d22a11dc3c693962895496d4f6e9cc54db6c7205a6b06ff7f0000000000007f31d7c8cc5d325c5379b0363ce8bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a1f37302f3b41eae59809fd05d12f6106f117b062df67d3a6473265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089e0b1c23c0f3cdad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3ff3be4d1458077c2253b0c7c7a1a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631d22bad050e9856b48ae3a03a497c37758537650fe6db89da3c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0af1cb3f1f815f8989d78854ca4d3116dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fc5fb38f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4c6ea9604faf0453bedf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202eeb81f428a5b3c29984864961a57ff52f657a67463d7dbf85ae9321fc2cc17dc4a29b9cba8ded5de8206c812439ab129ae818837ee15620789c524b3baf49a09d8be0fc5beecf153236c19740be9bb7d958d5e87c6c09bf71a894bad62934782cc308e936d7637e07c4a2b4dc87b0da20000d9ef418cf19e7a8c4c328be0ce91798adc2dca87ddd9d064e081383409ed2912c811ae63f03212a5331c2a4ead000000000000000000000000000000000000000000000000001386866b311bd144bc32e059658c9f8342c90c1ade31b78072841b8b5a943d62a44cea6b050c42e3c205fad6a23fb43c93da0f49d911877265e6ee443e37397ecf89021e7f579e8d3a74c12b52938d91e9de07fc8eeeb9505f4a9c26266bf5449484ccc1317c7476"], &(0x7f00000014c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x48) executing program 6: sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x40000c0) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="240000002a000103990000000000000000000000010000000000ffffffffffffff810000", 0x24) (async) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="380000006c0015000000d9fece23b82004000000", @ANYRES32=r1, @ANYBLOB="000080000000000018003480050035"], 0x38}, 0x1, 0x300}, 0x0) (async) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[], 0x38}, 0x1, 0x300, 0x0, 0x14805}, 0xc000) (async) syz_usb_connect(0x0, 0x63, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000404c17aa5600010102030109025100010100c03209040000020806500007050102000200070582020002000904000105080662000705010200020003240107050202000203020002000324030705"], 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x48) (async) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0xd, 0x10, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018210000", @ANYRES32=r2, @ANYBLOB="0000000002000020b705000008000000850000005d00000095", @ANYRES16], &(0x7f00000004c0)='GPL\x00', 0x2, 0x6ad79b3f1a62de5b, &(0x7f0000000500)=""/4106, 0x0, 0x5, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0xfffffffffffffdf8, 0x10, 0x0, 0x34, 0x0, 0x0, 0xfffffffffffffe65}, 0x23) (async) r3 = ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@bloom_filter={0x1e, 0x0, 0x3, 0x2, 0x20000, r3, 0x4e52, '\x00', r4, 0xffffffffffffffff, 0x4, 0x5, 0x0, 0x8}, 0x50) executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000600), 0x41, 0x0) write$binfmt_aout(r0, &(0x7f0000000680)=ANY=[], 0xbfb3) ioctl$TCSETS(r0, 0x40045431, 0x0) syz_open_pts(r0, 0xa5000) executing program 3: r0 = openat$sysfs(0xffffffffffffff9c, 0x0, 0x5171c0, 0x94) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) utime(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000100)=0x6) setxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)=@known='trusted.overlay.redirect\x00', &(0x7f0000000300)='%$-#*..[#\x00', 0xa, 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f066bbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000002940)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r4 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r4, &(0x7f0000000080)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) r5 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r5, &(0x7f0000000380)={&(0x7f0000000140)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x4, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4000884}, 0x4) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="08000000100001082cbd7000ffffe1ff0100010000000000b4d9f544ca263fc14935bff02fc99bd8f21aff2a873a0e828d031d290e36cbe5cca16b781c65d258099af62092caa59973c2476607f9e29108dbc808fe37a60c4ac8d6e17f422a2770a80e75ce94ef5f0898390c1a2d2b202b8a090161f0a4a13aa7733f761c4d83287bd35c8c694a0a46af760aaabc3bac985ae574968171e63b63b1d7d8c310ac6ea6ca836a4c8de89f35d00c8668454e866aa0fcccfcdedb6db224f216b9e5adb36f41532788a0a3a203c82a", @ANYRES32=0x0, @ANYBLOB="fffe01000100000008001b0000000000"], 0x28}}, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x8, &(0x7f0000000100)=0x40049, 0x4) recvmmsg(0xffffffffffffffff, &(0x7f0000000480)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=""/11, 0x17}}], 0x400000000000179, 0x0, 0x0) r7 = fsopen(&(0x7f0000000200)='bpf\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r7, 0x6, 0x0, 0x0, 0x0) r8 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000340)={&(0x7f0000000400)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000504000000002e"], 0x0, 0x37}, 0x20) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0900000004000000040000000700000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=r8, @ANYBLOB="0200000001"], 0x48) r10 = fsmount(r7, 0x1, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000004c0)={{r9}, &(0x7f0000000500), &(0x7f0000000540)=r10}, 0x20) executing program 7: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x6) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async) r2 = socket(0x10, 0x3, 0x2) connect$netlink(r2, &(0x7f0000000200)=@proc={0x10, 0x0, 0x9, 0x400000}, 0xc) (async) r3 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$AUTOFS_IOC_SETTIMEOUT(r2, 0x80049367, &(0x7f0000000240)=0x7) (async) setsockopt$inet6_udp_int(r1, 0x11, 0xa, &(0x7f0000000280)=0x1, 0x4) (async) close_range(r1, r3, 0x0) getsockopt$inet_udp_int(r0, 0x11, 0xb, 0xfffffffffffffffe, &(0x7f0000000000)) (async) r4 = socket$xdp(0x2c, 0x3, 0x0) (async) r5 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r5) mmap$xdp(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x8, 0xa4830, r4, 0x180000000) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000040)) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x3, &(0x7f00000000c0)=[{0x34, 0x0, 0x0, 0x2}, {0x3d}, {0x6}]}) syz_usb_connect$uac1(0x3, 0x77, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x10, 0x200c, 0x1018, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x65, 0x3, 0x1, 0x81, 0xa8, 0xd1, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x6, 0xf}, [@mixer_unit={0x5, 0x24, 0x4, 0x4, 0xff}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0x1, 0x2, 0x4, {0x7, 0x25, 0x1, 0xc, 0x1, 0x7a}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0x2, 0xff, 0x5, {0x7, 0x25, 0x1, 0xc, 0x5, 0x5}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0}) (async) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000007c0)='.\x02\x00', 0x22000402, &(0x7f0000000580)={[{@noinit_itable}, {@init_itable}, {@noinit_itable}, {@block_validity}, {@min_batch_time={'min_batch_time', 0x3d, 0x6}}, {@grpjquota, 0x2e}, {@mb_optimize_scan}, {@errors_remount}, {@jqfmt_vfsv1}, {@usrquota}, {@usrjquota_path={'usrjquota', 0x3d, '.\x02'}}, {@resgid}, {@nolazytime}, {@data_ordered}], [], 0x2c}, 0x1, 0x4ef, &(0x7f00000025c0)="$eJzs3MtvG8UfAPDv2nn1mbS/6gd9QAMFEVFImrRADxwAgdQLCAkO5RjSUJWmLWqDRKuKBoTKEfEXFI5ISJy4cAIJIeACiCvcUaUK5dLAARmNvZs4iZM4b1p/PpLtmfXszn53d7zjHa8DaFm96SmL2B4Rv0VEdy07u0Bv7WVq8urIX5NXR7KoVF75M6uWuz15daQoWsy3Lc/0lSJKH2Sxv0G9ly5fOTs8NjZ6Mc8PjJ97a+DS5SuPnzk3fHr09Oj5oePHjx0dfOrJoSeaiuPaEu+nuG7ve/fCgb0nXvv4xZFKvP7D52l9t+fv18dR09NUvQsrtkalamZ6R/X54VUu/b9mR106a9vEFWFZyhGRdld7tf13Rzlmdl53vPD+dObbTVpBYN2kc9OueVPL+WspP3sBd6dMG4cWVZzx0/ff4rGR/Y/NduvZ9DxajX8qf/z0Um3blNJ32Z7aN/auOfOV8tf/N1hmKluudaEq3UvUvz0iTk78fSM9ouF1iEVkTZcEAJj2der/PNao/1ea1bfZmY+h9ETE4YjYHRH/i4g90z2hiHsi4t5l1t87Jz+///PLlmUucllS/+/pfGyreNTeKeLKpnM7qvG3Z2+cGRs9km+TvmjvTPnBRer45vlfP1rovd66/l96pPqLvmC+Hjfb5nQ+Tw2PD68i5FluvRexr61R/Nn0SEDaAnsjYt8Klp+22ZlHPzuQ0ju3zX9/6fgXkOUDF6tU+TTikdr+n4g58ddVlWpaaHxyoCvGRo8MFEfFfD/+fP3l+nx7XXpW/F3NxTT3u8hqpP2/dc7xX1t+Hn8pr3DOeO3EMuq4/vuHC0Y1K/5y3JiazOJkvvDamGLpZltnRGyZ2Wzp+O/IXq2mO/Jp7wyPj18cjOjIJ8yaPjRTX5Evyqf4+w41bv+7I/75JJ9vf0Skg/i+iLg/Ig7m6/5ARDwYEYcWif/75x56c/EttILjf42k+E81/PybPv57svrx+hUkyme/+2qh+pv6/Os8Vk315VOa+fxrdgVXs+0AAADgTlGqjkFnpf4iXXdxak9sLY1duDR+uDfePn+qNlbdE+2l4kpXd9310MH82nCRH0rpjpn80YjYVf2l0ZZqvn/kwtiOzQwcqN6rU7T/znxaf3/t9Y/yZq4ZsCGWNY5W/6OzL75c+5UBNpT7NaF1af/QurR/aF3aP7SuRu3/WsTUJqwKsMGaO/9X3G4OdyH9f2hd2j+0rpn27xd/0ELm3xJf/N3KSu70n0nsPrGq2dc9UelelyVPLH+u8jpFGnV/2rFw4SwiVlZFlBYv0xGXr3StUTjpDLVYmeKmlaYXWFqyzDNLbZb2Vf0nRkoczBOdEdHsXNea2Kdrd/wkmct+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAHe3fAAAA///pidwx") program did not crash bisect: testing without sub-chunk 3/3 testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 22, 30, 28, 6, 2, 9, 30, 11, 4, 10, 15, 40, 5, 6] detailed listing: executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0xb8) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000000140)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000180)='./file0/file1\x00', 0x20400, 0x20) getdents64(r0, &(0x7f00000001c0)=""/59, 0x3b) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=@newlink={0x4c, 0x10, 0x44b, 0x70bd26, 0x0, {0x7a, 0x0, 0x0, 0x0, 0x1840, 0x42c04}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_QUERY_USE_IFADDR={0x5}, @IFLA_BR_AGEING_TIME={0x8, 0x4, 0x1}, @IFLA_BR_MCAST_SNOOPING={0x5, 0x17, 0x1}]}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20048064}, 0x24) executing program 1: syz_mount_image$vfat(&(0x7f0000000640), &(0x7f0000000680)='./file0\x00', 0x101c0ca, &(0x7f00000006c0)=ANY=[@ANYBLOB="73686f72746e616d653d6d697865642c666d61736b3d30303030303030303030303030303030303030303036362c696f636861727365743d69736f383835392d312c6572726f72733d636f6e74696e75652c756e695f786c6174653d302c696f636861727365743d61736369692c726f6469722c73686f72746e616d653d6d697865642c756e695f786c6174653d302c757466383d302c757466383d302c756e695f786c6174653d312c64656275672c756e695f786c6174653d312c666d61736b3d30303030303030303030303030303030303030303030332c6e6f63617365aec489af6ba9723d4b17106f6d47b9ade1c253d4e3b08066427cae9f41fd1e1dd25a22ec22ad6e8bf6f67e052de91b544f2f4541f87a0c0b36e8d444150b35c110bda57fe7a9c06ba087cc975447082aaf95213301f3e04b70ea67a8aa0d582ca1a9525dba7116d80f126f782a78428b878fc79c0be9ad98cb6950995e6edba78e5301e8c8e69cc85beceb8b54f84a84787815ef9a18f1fe1c81b4c1830102f7e3236e2533e486ecb46ee53991c5bfe6289a474582b2e57741fd8de78f42097851bee74d4201c7767e0e0f4b34523150639b1291441ad01f2f72ed3679d7bca0e8b4e0689f883196af0d0dfe7344f276c1b4bd333882cf7879248ad423e3f21cd0cae2309519f9d40df23cf05d9c8d8f9d07da771ea1e3bcd8478fb989f770da17f700000000000000"], 0x6, 0x2c0, &(0x7f0000000900)="$eJzs3U9rK1UUAPAz+TOJukgWrkRwQBeuHu+9rZsUeQ/ErnxkoS60+FqQJggtFKri2JVbNy78DILgB3HjNxDcCu6sUBiZyaRJ2pg2palof79Fe3vnnLlnboZ2WujJx6+O959nsXfy5a/R7SbRGMQgTpPoRyOmvo4Fg28DAPgvOy2K+KOYWCcviYju5soCADboej//W7PhT3dSFgCwQc/e/+Ddre3tJ+9lWTeejr85Gpa/2ZefJ8e39uLTGMVuPIxenEVUDwrtqJ4WyuHToijyVlbqxxvj/GhYZo4/+rk+/9bv9R8LSv3q4/nTRpX/zvaTR9nEXH5e1vFivf6gXP9x9OLl8+SF/MdL8mOYxpuvz9X/IHrxyyfxWYzieVXELP+rR1n2dvHdn198WJZX5if50bBTxc0UzTt8WQAAAAAAAAAAAAAAAAAAAAAA+J97UPfO6UTVv6ecqvvvNM/KL9qRTfUX+/NM8qetfRb6AxVFkVftcib9dR5mWVbUgbP8VrzSmm8sCAAAAAAAAAAAAAAAAAAAAPfX4fHn+zuj0e7BrQym3QBaEfHXs4ibnmcwN/NarA7u1GvujEaNergY05qfieY0JolYWUZ5Ebe0LVcNXrhUcz344cd1T9i9Oqa9fK3D4+ZNX6/84sz07trfSZbvYSemM9160e/TiFlMGtdcPf2nQ0Wsc/ulSw/11t6N9KVqkK+IiWRVYW/9Ntm5eia5eBVptatL09v1YC79wr1xrfs5upP0y98rEt06AAAAAAAAAAAAAAAAAABgo2b//bvk4MnK1EbR2VhZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHCnZu//v8Ygj4h2fYIrgtM4OPyXLxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIB74O8AAAD//0aWVl0=") r0 = socket$inet6(0xa, 0x3, 0xff) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000bc0)=@filter={'filter\x00', 0xe, 0x4, 0x370, 0xffffffff, 0x0, 0xd0, 0x1a0, 0xffffffff, 0xffffffff, 0x0, 0xd0, 0x2a0, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@ipv6={@empty, @empty, [], [], '\x00', '\x00', {}, {}, 0x6, 0x0, 0x1}, 0x0, 0xd8, 0x100, 0x0, {}, [@common=@inet=@tcp={{0x30}, {[0x0, 0xffff], [0x0, 0xffff], 0x0, 0x2, 0x2}}]}, @common=@inet=@TCPMSS={0x28, 'TCPMSS\x00', 0x0, {0x578}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3d0) r1 = socket$inet6(0xa, 0x3, 0x3c) setsockopt$inet6_IPV6_RTHDR(r1, 0x29, 0x39, &(0x7f0000000fc0)={0x0, 0x2, 0x2, 0x1, 0x0, [@mcast2]}, 0x18) (async, rerun: 64) connect$inet6(r1, &(0x7f0000001000)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, 0x1c) (rerun: 64) writev(r1, &(0x7f0000001040)=[{&(0x7f0000001080)=',', 0x5dc}], 0x1) (async) clock_settime(0x0, &(0x7f00000004c0)={0x7f, 0x2f000000}) (async) syz_mount_image$vfat(&(0x7f0000000080), &(0x7f00000000c0)='./file1\x00', 0x2048c5, &(0x7f0000000100)={[{@utf8}, {@shortname_mixed}, {@utf8no}, {@shortname_win95}, {@uni_xlate}, {@utf8no}, {@shortname_lower}, {@utf8}, {@uni_xlateno}, {}, {@fat=@usefree}, {@shortname_winnt}, {@shortname_win95}, {@shortname_winnt}]}, 0x0, 0x2e0, &(0x7f00000001c0)="$eJzs3E9rG0cYx/Gf/tiSZWzpYAotlA7tpb0stvoGKooNpYIa1yptD4V1tWqFtpLQqioqpfIt17wOk2NOCSR5A77klnvIxQQCufgQoqA/a8uSbEmJnbWj7wcsjfXs4xntzIpnBZ6jn2//VSp4VsGuKxw3Ckv7OpZSnVZfSKHuo/Y7j4satK+vll8++fTHX35dymSzmzvGbGV2v04bY1Y/e/DPf3c+f1Rf/unu6v2YDlO/Hb1IPz386PDjo9e7/l+vSLbZq1Tq9p7rmHzRK1nGbLuO7TmmWPacWt3YpubHC26lWm0au5xfSVRrjucZu9w0Jadp6hVTrzWN/YddLBvLssxKQhMsTTrgponMnJE72NmxM1cyGARh7Jqu1TJ2ZGwwd/A+BgUAAK6X6er/nrAuqv+/n6n+/7PomaJnypVOfX9B/R/WYHxC/S/NUv+jr3p+6IO7R5pHnfo/0b9+z6L+BwAAAAAAAAAAAAAAAAAAAADgJjhut5PtdjvpP/s/MUlxSf7vQY8TV4P5n28D/7gXl9xbjVwj13vuxTMFFeXK0fqC9Kq7Hvp67a3vspvrpiulh26rn99q5CKK+fm+1Pj8jV6+GciPtbSgxGD/aSW1Nj4/PZrfauQW9eUX7Vi/Z0eWknr8uypyle+u69P8/zeM+faH7FD+kvLbwcwJAAAAAACXzTInRu7fu3HL+NuGDMWlUHPw+wElJ3w/MHR/HdUn0UDfOgAAAAAAc8NbVMl2XafmNf+9cQ3NluVvZnspvUtBn4T4tAdHJfVfuTdyTFTXYirHNcKShkMLI6+Mb0TebZafS2evi7Xzpzt2enqDPmNjG+3IyVp99nfvCpgmfeqPkG+u5pMJAAAAwGXzi/5Q0AMBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGCOTbuLmH/822xCNtBdJJh3CQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFwPbwIAAP//Y0QRLg==") (async, rerun: 64) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async, rerun: 64) r3 = eventfd(0x4) (async) socketpair$unix(0x1, 0x1, 0x0, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f00000010c0)='./proc\x00', 0xae4d2f8ed3bfc611) mount(0x0, &(0x7f0000001100)='./proc\x00', &(0x7f0000001140)='proc\x00', 0x0, 0x0) (async, rerun: 64) r4 = openat(0xffffffffffffff9c, &(0x7f0000001180)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) (rerun: 64) write(r4, &(0x7f00000011c0)='7', 0x1) (async) add_key$keyring(&(0x7f0000001200), &(0x7f0000001240)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffb) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000540)='./dev\x00', &(0x7f0000000580)='devtmpfs\x00', 0x0, 0x0) (async, rerun: 32) r5 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./dev/mapper/control\x00', 0x2, 0x0) (rerun: 32) ioctl(r5, 0xc013fd08, &(0x7f0000000600)="04000000000000000000000038010000380100000000000000000000000000003200000000000000000000000000000070") ioctl$VHOST_SET_VRING_CALL(r2, 0x4008af21, &(0x7f0000000040)={0x3, r3}) executing program 6: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) setuid(0xee01) pipe(0x0) r1 = gettid() timer_create(0x1, &(0x7f00000015c0)={0x0, 0x21, 0x4, @tid=r1}, &(0x7f0000001600)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000000)={0x0, 0x0, 0xffffffff, 0x5, r0}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r2, 0x1, &(0x7f0000001680), 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r3 = fsopen(&(0x7f00000016c0)='bpf\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x0) fchdir(r4) rt_tgsigqueueinfo(r0, r0, 0x8, &(0x7f0000001540)={0x2b, 0x8, 0xfffffffb}) syz_clone3(&(0x7f0000000340)={0x801400, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x19}, 0x0, 0x0, 0x0, 0x0}, 0x40) r6 = socket(0x1e, 0x2, 0x0) setsockopt$inet_opts(r6, 0x0, 0x0, &(0x7f0000000140)="3cc9b954afb8781ff73b131b3e5e44b7", 0x10) process_madvise(r5, &(0x7f0000001500)=[{&(0x7f00000002c0)="a1b62cc97ff4ee64b264341a901889763f8b2dcb22e261acc5acc099000145fb65042e1286f1d1c994a3d99915d27940f9f2303e5f72089ab959abd8a148ae50ed529ce4e9faf7a99d656668bd468b6c38a0ad8f8521b14502897a034aec0fd75cf683293006d32aa5ec2d74cf663ddbab436b314025f6", 0x77}, {&(0x7f0000001400)="b2b752c9769d1644c7dd21561fc3148d1a28c0e7cac8d978f4040c70668fc2dba36e8366b1d3a39c0d8eac78fff2ecaaa2d79c69c842f631a2e6df45705d56b1b973cf5e5fb2e92d7a57b6120e3559136da3faef1c345c68a28819a39366c7fe88ea1f258126c6be0da126bb0c42e1d07a1a9eb15faddbfc1b877b0e0d7c280dae37c2651ab3457bf7cd377253ee8a4bac4d1374db2ed286083253fc27c06cb1b6221b4bb4848b5239450d2846eff2cfd19d27483d44866f040c6a8263b78cc58d44eee73d63463f8f0c53a5e3fa642186dd9fdde90f2f892b416810", 0xdc}], 0x2, 0x12, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000001700), 0x40, 0x0) fcntl$lock(r8, 0x11, 0x0) capset(&(0x7f0000000080)={0x20080522}, &(0x7f00000000c0)={0x0, 0x9, 0x10, 0x81, 0xffffffff}) r9 = syz_open_dev$loop(&(0x7f0000000100), 0x40, 0x100) ioctl$BLKFLSBUF(r9, 0x1261, 0x0) mmap(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x2000008, 0x32, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x8, &(0x7f0000000240)=ANY=[@ANYBLOB="180200000a00000100000000ff000000180200000a0000020000000000000000bfa2000000000000b70300004000000085000000450000009500000000000000"], &(0x7f0000000280)='GPL\x00', 0x1, 0x1000, &(0x7f0000000400)=""/4096, 0x0, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$netlink_NETLINK_PKTINFO(r7, 0x10e, 0xc, &(0x7f0000000040)=0x8, 0x4) executing program 6: r0 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'wg2\x00', 0x0}) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000080)) r2 = gettid() timer_create(0x1, &(0x7f0000000180)={0x0, 0x21, 0x4, @tid=r2}, &(0x7f00000001c0)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000200)={0x0, 0x0, 0x3ed4, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r3, 0x1, &(0x7f0000000240)={{0x77359400}}, 0x0) timerfd_create(0x9, 0x800) seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0) sendmsg$tipc(r0, &(0x7f0000000540)={&(0x7f00000002c0)=@nameseq={0x1e, 0x1, 0x1, {0x0, 0x4, 0x1}}, 0x10, &(0x7f0000000400)=[{&(0x7f0000000300)="7c6c56f09ac26487fb14373e523c4893721efcd5b7df56d5c4ea4f9c5475fcc361bf045d1df9e218378f52bc63a517a52171c6d6667e69ca8e27137916351f2ae1caa9ee012d84d334e42a2758a8ad546b6fd61ba6a4649fb78981d0d29ddda27238abb646ddd0ef012b56280139cd6643a20226ee233893176f05c3ac930e2bf8da628cfd1ba5419f9af846a53cb4c360562bdb3d175647408c6839082c9a2f4063235e5884890c4745cde16be96851de93cc7488e9dfec1b5842a01b35da57d4607ec2b09bffec754f59065d92097de1aa5e9058fdbaa794367ef28fda72d12a3edecc1c862004d8aae945", 0xec}], 0x1, &(0x7f0000000440)="7be88c2100bfa061785ce75a1e16da5d8081b8f2e7b9ea1ed3d8cab206b46218560d41bc80012ddbae9af0388610adf6ab5e57d5100986f4b1b357863b793c28e423e73e537b707dc26ea322e83c8fe7aa5982e12f9c9e0a735b491a22cd65b1359a0d45f2d29afe8d1902bf67c915792115d0ba87e1124445f3835f6e5b84c83b5e611a2d7df17486e6eac0259d1ffa40b1011d4d017312dd75367eff1142271fb21e065f9c03ea9992c02b6aa0e3238a9e0fc6c9dbb53ee93e94bfc2dcff9f082bf0fbcd1686663e80a3", 0xcb, 0x4008804}, 0x10) r4 = getpid() sched_setaffinity(r4, 0x0, 0x0) sched_setscheduler(r4, 0x1, &(0x7f0000000580)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000680)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000700), 0x651, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2, 0x50, 0xffffffffffffffff, 0x0) r7 = socket$unix(0x1, 0x2, 0x0) bind$unix(r7, &(0x7f0000000740)=@abs={0x0, 0x0, 0x4e22}, 0x6e) ioctl$int_in(0xffffffffffffffff, 0x5421, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) connect$unix(r7, &(0x7f00000007c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) close(0x3) prctl$PR_SET_MM(0x23, 0x8, &(0x7f0000001000/0x4000)=nil) prctl$PR_SET_MM(0x23, 0x9, &(0x7f0000001000/0x1000)=nil) sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r1, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x4c840) executing program 5: capset(&(0x7f0000000000)={0x20071026}, &(0x7f0000000040)={0x208004, 0x21fffc, 0xc, 0x0, 0x2, 0xfffffffe}) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0xf, 0x0, 0x0, 0x8000}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x12, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="180000000800000000000000ab0a0000"], &(0x7f0000000bc0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x8, '\x00', 0x0, @cgroup_sock_addr=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000001, 0x12, 0xffffffffffffffff, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000d80)={0x1, &(0x7f0000000dc0)=[{0x6, 0xf5, 0xe, 0x7ffffffe}]}) syz_kvm_setup_syzos_vm$x86(r0, &(0x7f0000bfd000/0x400000)=nil) executing program 5: r0 = syz_mount_image$ext4(&(0x7f0000006100)='ext4\x00', &(0x7f0000006140)='./file0\x00', 0x9, &(0x7f0000006180)={[{@init_itable_val={'init_itable', 0x3d, 0x6}}]}, 0x0, 0x4ae, &(0x7f0000006500)="$eJzs3VFrXFUeAPD/nSRt2qabdHcfuoXtlm2XtOx2Jmm2bfChVhB9Kqj1PcZkEkImmZCZtE0okuIHEERU8MknXwQ/gCD9CCIU9F1EFNFWH3zQjszkTlpjJhlqmkszvx+c3nPumZn/OZ3MnXvuucwJoGOdiIjLEdEVEWcioj/dn0tTrK6l+uPu3b05UU9J1GpXv08iSfc1XytJt4fSp/VGxEvPR7ya/DFuZXlldrxUKi6m5UJ1bqFQWV45OzM3Pl2cLs6PjAxfGL04en50aMf6eunZr99+44PnLn3yv+tfjn17+rV6s/rSuof7sZPWut7T+L9o6o6IxccRLANdaX96sm4IAABtqZ/j/zUi/t04/++PrsbZHAAAALCX1J7ui1+SiBoAAACwZ+Ua98AmuXx6L0Bf5HL5/No9vH+Pg7lSuVL971R5aX5y7V7ZgejJTc2UikPpvcID0ZPUy8ON/IPyuQ3lkYg4EhFv9R9olPMT5dJk1hc/AAAAoEMc2jD+/6l/bfwPAAAA7DEDWTcAAAAAeOyM/wEAAGDvM/4HAACAPe2FK1fqqdZc/3rfteWl2fK1s5PFymx+bmkiP1FeXMhPl8vTjd/sm9vu9Url8sL/Y37pRqFarFQLleWVsbny0nx1rLGu91jROtEAAACw+4786/YXSUSsPnWgker2pXXG6rC35bJuAJCZrqwbAGSmO+sGAJkxxgeSbep7W1V8+kjharVa7ZGeCAAAPLrBf5j/h05l/h86l/l/6FzN+f/k/voFeacE0CHaH+O3nAEEnnC7PP8PAABkoK+Rklw+vfDXF7lcPh9xuLEsQE8yNVMqDkXEXyLi8/6e/fXycNaNBgAAAAAAAAAAAAAAAAAAAAAAAIAnTK2WNBbjBgAAAPauiNw3Sbr+12D/qb6N1wf2JT/3N7YRcf29q+/cGK9WF4fr+39Y3199N91/LosrGAAAAMBGzXF6cxwPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADvp3t2bE820m3G/eyYiBjaL3x29jW1v9ETEwR+T6H7oeUlEdO1A/NVbEXF0s/hJvVkxkLZiY/xcRBzIOP6hHYgPnex2/fhzebPPXy5ONLabf/660/RntT7+5daPf10tjn+H24xx7M5HhZbxb0Uc694Yv7a/HqEZP2kR/2Sb8V95eWWlVV3t/YjBTb9/kt/FKlTnFgqV5ZWzM3Pj08Xp4vzIyPCF0Yuj50eHClMzpWL676Yx3vznx/e36v/BFvEHtun/qTb7/+udG3f/tkX80yc3f/+PbhG//jfxn/R7oF4/2MyvruUfdvzDz45v1f/JFv3f7v0/3Wb/z7z4+ldtPhQA2AWV5ZXZ8VKpuCgjIyOznsn6yAQAAOy0Byf9WbcEAAAAAAAAAAAAAAAAAAAAOtdu/JxY1n0EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGjHbwEAAP//kRbbrg==") ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f00000069c0)=ANY=[@ANYBLOB="000000004c900200040000000300010000000000000000000000000000000000000000000000000000000f000000000000000000000000000000000000000000000000000500e7ffffff000000000000010000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000ffffffff"]) executing program 3: r0 = socket$inet_icmp(0x2, 0x2, 0x1) (async) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_GET_PIT2(r2, 0x8070ae9f, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000740)=@security={'security\x00', 0xe, 0x4, 0x340, 0xffffffff, 0x188, 0xb8, 0xb8, 0xffffffff, 0xffffffff, 0x2a8, 0x2a8, 0x2a8, 0xffffffff, 0x4, &(0x7f00000000c0), {[{{@ip={@empty, @remote, 0xff000000, 0xffffffff, 'veth0_macvtap\x00', 'bond_slave_1\x00', {0xff}, {0xff}, 0x6, 0x1, 0x50}, 0x0, 0x70, 0xb8}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x3264, 'syz0\x00', {0xfff}}}}, {{@ip={@multicast1, @multicast1, 0xffffff00, 0xffffffff, 'veth0_to_team\x00', 'netpci0\x00', {}, {}, 0x1, 0x0, 0x6f}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, 0x0, 0x6, [0x1a, 0x9, 0x39, 0x27, 0x24, 0x1a, 0x28, 0x40, 0x32, 0xe, 0x15, 0x19, 0x2e, 0x3c, 0x13, 0x5], 0x1, 0x1, 0x9}}}, {{@uncond, 0x0, 0xc0, 0x120, 0x0, {}, [@common=@osf={{0x50}, {'syz0\x00', 0x0, 0x3, 0x1}}]}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @random="06eaa67f859e", 0x0, 0xa, [0x23, 0x3a, 0x2b, 0xf, 0x35, 0xe, 0x36, 0x34, 0x6, 0x34, 0xd, 0x24, 0x22, 0x2b, 0x22, 0x20], 0x1, 0x18}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3a0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'dvmrp1\x00', 0x1}) (async) ioctl$TUNSETVNETLE(r3, 0x400454dc, &(0x7f0000000100)=0x1) (async) syz_mount_image$ext4(&(0x7f0000000700)='ext4\x00', &(0x7f0000000080)='./file0\x00', 0x800, &(0x7f0000000140)={[{@noauto_da_alloc}, {@errors_remount}, {@dioread_nolock}, {@noinit_itable}]}, 0x4, 0x4e9, &(0x7f0000001140)="$eJzs3E1oXEUcAPD/2yRN+mVjrdXWqqlVDBaTNq22B0EqCh4UxArqMeajxKaNNCnYUmULUg8epOBdPHr14MWDeiniSfBaj4IUivTSVhBX3u57u5vtbtKkm6wxvx9sduZ9zcybNy/zZnY3gHVrIP2TVMJXI2JbRBQaNxiovN26cWHs9o0LY1EslY7/mZR3u5nGM9lhYnMWGSxEFD5JaivqzJ47f3J0enriTBYfnjv1wfDsufPPTvVlS44ePXzo4JHnR55beqGapJeW6+buj2f27Hr13cuvj3Xny/PU6svRLgMx0CwrZU+1O7EO21oXTro7mBGWJL3+0+rqKbf/bdEVC1VecRVzBqy0UqlU6m29ulhqdPGOJcCalUSncwB0Rv6PPn3+zV/NOgIbVqb70XHXj1UegNJy38peEY+XF+bjID0Nz7ftNBAR7xT/+jJ9xQqNQwAA1PvhWHX4Z37/r78yM/L32Ssvpu/3ZXMo/RFxf0Rsj4gHImJHRDwYETsj4qGIeLjh+F0RUVog/YGGeDX96iRU4VobitlS2v97IZvbqvX/5mWgvyuLbY3IO8wTB7JzMhg9vZNT0xMHF0jjx5d//bzVuvr+X/pK08/7glk+rnU3DNCNj86NVkLfvVf8rL4Xv3TXL0bs7m4sf9IdkVRnApKI2BURu5dw3P668NQzX++pRnrmb7d4+ctKTefR2jDPVPoq4ulK/RdjXv3XUkzmzU+eGj0xcWLi9Eh1fnK4L6YnDgxPtszNz79ceqPVukXL/+3vjbu8cuT741nLundp/W+qu/4jn7+tlb8/iUiq87WzS0/j0m+ftnymWe71vyF5qxzOn0s/HJ2bO3MwYkPy2p3LR2r75vH0PYqV8g/ua97+t2f7pGfikYhIL+JHI+KxqDwhpnnfGxFPRMS+Bcr/00tPvr/88q+stPzjDfe/Ss3Pq//afH2rQJLNDTZZ1XVy79XbLW4ed1f/h8uhwWxJ7f5XL5l3i2iV03zcI13yzz2fPQAAAFgbChGxpW4saUsUCkNDlTGgHbGpMD0zO7d/cubs6fF0XUR/9BQmp6bL45+V8eCeJB//7K+LjzTED2Xjxl90bSzHh8Zmpsc7WnJgc7nNJ4WhiLe76tp/6o/2DDED/2W+rwXr10LtP+3E77y8ipkBVtXd//+/8tGKZgRYdXXtv9U3/IvL+NwXsAZ4/gdqFv+hH/cMWPtK2jKsa0tq//v9CCD8n3THm9VwoaM5AVab/j+sS4t+r/+eAqXe5qv64s6No2/hA3bF8rKxsUlaHQmkPauOpL5xOXvlv6bQcpsoLO2AvdGeOp1cxknoLQfyru3siZ1tv/hL2Wfl212D36xKO20WWPVbEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwIr4NwAA///eNtoE") executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000f40)=@newtaction={0xe8, 0x30, 0x1, 0x70bd2b, 0x25dfdbde, {}, [{0xd4, 0x1, [@m_bpf={0x58, 0x1, 0x0, 0x0, {{0x8}, {0x30, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x1}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x3, 0xef, 0x1, 0x8000, 0x2}}, @TCA_ACT_BPF_OPS={0xc, 0x4, [{0x16, 0xf2, 0x3, 0x7}]}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x2}}}}, @m_bpf={0x78, 0x2, 0x0, 0x0, {{0x8}, {0x50, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_FD={0x8}, @TCA_ACT_BPF_OPS={0x2c, 0x4, [{0x1ff, 0x5, 0x5, 0x8}, {0x3, 0x6, 0x6d, 0x80}, {0x3, 0x6, 0x4, 0x4000000}, {0xfb, 0x6, 0x7f, 0xa}, {0x3, 0x2, 0x6, 0x1}]}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x8, 0x4, 0xffffffffffffffff, 0x7, 0x3}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}]}]}, 0xe8}, 0x1, 0x0, 0x0, 0xc044}, 0x4000814) r1 = syz_open_dev$evdev(&(0x7f0000000140), 0x2, 0x0) ioctl$EVIOCGKEYCODE_V2(r1, 0x80284504, &(0x7f00000001c0)=""/147) syz_mount_image$f2fs(&(0x7f0000000180), &(0x7f0000000440)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, &(0x7f0000005f80)=ANY=[@ANYBLOB="66617374626f6f742c71756f7461000018bbdecde39739fcd1df176dde746ec834120600000000003b814e50a959736d6572462abc30ef5b65c70f73ecea54b5e5bea9836c319f653557e79a002208ce996dda659bd5ba0f4ce5c2080002223dc60000000000000044cd0a1e3686873600000000005493b4b874cd601d5b9fa9b40fe4d76afc3a989c6d60044e89eb96e44d01a1034e3797ffa86870b82939f41ffa0f3d726f085663c29cbdc4c766a7eb77cc36160191acf5ae7469c82ab4145b595b987d75912a0fcd1c061835294cc0c618aba204f8adaa20c80108d356cd88cc86177056b06e7068c40f807d9e539f8f5b64a8ee0725aa8d00000000007cb6020d90ea79b8027cf75964dd86c2ed2b5e75779677aa8c76b848dd03dab190b5f02ec52830a17b01eaae1c3df076000000000000000000000000000083a48a6b926c668b9b90195018ea3619f9d80a0b894e212178e1a19909d764666264fa29e2c055fd7f8e67c2acfb75f0a8d41692f4542a575ee42ed94a0014fba44985cca9df12fe93bfaccf0122a6e7e593613ac0111701b125cc6799224883d08ce470220a6decad26f0378072a571da000000b1a6bdf03fd56697e348b5b494f6fddb9f56142a47a40ef81690a7eca421bd0ad198afa58ce69d61c29deaa93c0efea0df04f20020ee84075b4e1a2ad43d1be1138de4668e7b6137545708790c501f1ed7f6a571d5000000000000007d2bee8ed5acba62b8ce6eee44e813220ebc37ad7d422bb972c33e626d4d13827d303ee15e254c75ee569a56fa9e", @ANYRES64=0x0, @ANYRES32=r1], 0x21, 0x55bf, &(0x7f0000006ac0)="$eJzs3E2LG3UYAPBnsrt9ty7iwVsHirALTWi2L+jJqi2+YEvx5eBJs0ka0iaZZZOma089eBQPfhNR8OTRz+BBj3oTD4o3oZKZWe32RbtuNsu2vx/MPDP//PPMM0MIPDMhATy1FtM/fkvieByOiLmIOJZEvp2US8SdiAvF3Bci4kREVO5ZknL874EDEXEkIo5Pkhc5k/KlL06NT5779e3fv/3+4PzRL7/5YU9PHNhTL0ZEf63YvtUvYtYp4vVyvDHu5rF/dlzGtS05+lkxfqu9mme41dic18jjmU4xP1u7OZzEa71GcxI73Wv5+NqgOOBw3NnMM3lDer2xnu+32qt57A6zPHZuF8fduF18t90ejoo8rTLfJ3n6GI02YzHe3mgX57N2I4/NwagcL/JmrfbGJI7LWB4umlmvldex+j8v8j7wTndwcyMdt9eH3WyQnqvVX6rVz1fr61mrPWqfrTb6rfNn06VObzKtOmo3+hc6WdbptWvNrL+cLnWazWq9ni5dbK92G4O0Xq+dqZ2unlsut06lb1z5IO210qVJfK07uDnq9obptWw9Ld6xnK7Uzry8nJ6sp+9dvppefffSpctX3//o4odXXr381uvlpAfKSpdWTq+sVOunqyv15afo/D8ti97G+ScPH/7px51dNig84gP2aPO7UwfAPvJA/x/39/+h/wembif9f/9Gub87/X88Tv8f0+z/Jy2V/v+/+9/Ktvrf41PpfxdC/7+L5w87su3+P3dg6nUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADBzPy989Wa+sVjsHy3HnymHniv3k4ioRMTdh5iLA1tyzpV5Fh4xf+G+Gr5LIs8wOcbBcjkSERfK5c9nd/sqAAAAwJPr6zsnPi+69WK1uNcFMUvFTZvKsY+nlC+JiIXFX6aUrTJZPT+lZPnnez42ppQtv4F1aErJiltu89PK9ljmtoRD94SkCJWZlgMAAMzE1k5gtl0IAAAAs/TZv776yszqYMaS2HyUufksOP/l/T8PBA9PVnfv+3E/AAAAsJ8ke10AAAAAsOvy/t///wEAAMCTrfj/PwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgL3bu50ZtIIoD8LPBQP4pKMo9reQGZaSEHHMMFJAmKIG0kAaogUg5pIQVrLBnkbwL0moZYy36Psn2znj18wxweWNpAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKBLf6v1/PfPL78uzdntL5NnNgAAAMAp22o9r/+YNu13qf9D6vqU2kVElBFxqnYfxKiVOUg51Zn/rx6N4U9EnXDoH6fjbUR8Tcfdx64/BQAAALhdm+Vq1lTrzSktAfzrd1RcSbNoU77/limviIhq+j9TWnk4fc4UVv++h/EjU1q9gDXJFNYsuQ1P3xvlekjboHV5mMmi/hLrVtnNcwEAgD61K4EzVQgAAAA34HvfA+Aanpb2xfF0fM84bi7pheCbVgsAAAB4hYq+BwAAAAB0rq7/u9n/b/Ki/f8K+/8BAABAds3+fwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHRpW63nm+Vqdu7+4pk5u/1l8s0IAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgHv25xiFYRgKouAmkZK4M7r/Yc2CXbp2MwOCx99KAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMCd1/nyvuLT2JOMXhuz55Xk26nx69T4d25sMxnr6d8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABzsz0sKhEAQRMGc8b+Tvv9hJUHPIEIENDyqqEUDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAF/0u1/+T0yNM8ncaWPpeCRZu2psXTX2HjSOHoy3fwMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFzs289rHFUcAPA3O9lNU1uMUQJGpUoPerHptrb2KqIED/4JQkg3Nbq12uZgS7Dm4k1y7kX0IogISrzlf+i5gV7qrYccInjyEJlfyWyybX6QzKzN5wNv33ffTt6PmWXJd98sAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAhbX3wquNPI6Th9EsLtoerC/MJPXqtjqxsvRwIilJHA0Xraff2OvYG/GhLGFQvVZ+cma8vokAAADwrDi96xFxkd+HEB41l6eSujGa5v/N4pgk5/8x7yrK27bn/avrCyfylyaK/P/PPx6/tDnQaJyOk3Q6O9ftnN85laEDL/N/7vldjxhKz3z63UucXpDGR4svrjXT8xl9f//+B600HK5itgDAQZwr6jwo/h9K6nadEwPg2BgqJd5F/h+P1jsnAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgCqsLYbnijgKIUwMbcWJ1fWFmX71t0sPJ1bycvnevaVyn0kXzRDC7Fy3c75ntOEjX89gKs7mnc+nu93OzVu3qw7OhBD6vHR3b38e59N/4jGtEEJPy9mX+/TzyR7G2tbPjiB/e4Zqz+FIsr5dD456WqIdJ/z9jUwdb4BDDlpPukyN/PocxaAjlV/33qB47x1+z/v5LDmun6EAAOxHMy9JJvqouTyVtEVjIWz81Jv/v1mKQ0/ev3E3a8mer5Ty/8efXn5QHquc/7e3mk8d9RoH3eT89S8nb92+8/bc9elrnWudL9650H63ffHKpUtXJtPvSiZnQ2PbNyYAAACwH628lPP/kT77/ydLcXjK/n+2JZzl/1/90P6mPFbcP/8/9rY2/eqeCQAAwHHU2oxeeP2fv6M+R0StVvh6en7+Zjt73Hx+IXusdLoHNJyXcv4fj9U9KwAAAKAKa4tRz/7/1VIcnrL/X77//9Qvr/xW7jPO7i24EULonJu50b1a3XIGWu+Pfn+Oj+KHyulArbpXCgAAQF1G8lLe/2+OJfl/Y/OWh0YI4a2zIfyb/4Y/7DH/jz/87tfyWOX7/y9WusrB0xjPzkdaj4cwNF73jAAAAHiWnchLkuz/1Vye+uz3kx+33P8PAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAULX/AgAA//9KES1X") (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x480543, 0x40) (async) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0x2080, 0x0) read(r2, &(0x7f0000000080)=""/148, 0xffffff96) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./dev\x00', 0x1ff) (async, rerun: 64) mount(0x0, &(0x7f00000002c0)='./dev\x00', &(0x7f0000000300)='devtmpfs\x00', 0x0, 0x0) (async, rerun: 64) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r3, 0x107, 0x5, &(0x7f0000000700)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) (async) mremap(&(0x7f00003ff000/0xc00000)=nil, 0xc00000, 0x2000, 0x3, &(0x7f0000000000/0x2000)=nil) (async, rerun: 32) syz_mount_image$ext4(&(0x7f0000000740)='ext4\x00', &(0x7f0000000780)='./file0\x00', 0x10e, &(0x7f00000007c0), 0x3, 0x464, &(0x7f0000000800)="$eJzs3MtvG8UfAPDvbpK26eOX/Ep5tBQIFETEI2nSAj1wAAQSB0BIXMoxJGlVmjaoCRKtKggIlSMq4o44gvgLOMEFASckrnBHlSrUC4WT0Xp360dtN02dONSfj7T2zO7YM+PZsWd2sgmgb41lD0nEzoj4LSJG8mhjgrH86eqV87N/Xzk/m0Sl8safSTXdX1fOz5ZJy9ftKCLjaUT6cRL3tsh36ey5kzMLC/Nnivjk8ql3JpfOnnvyxKmZ4/PH509PHzly+NDUM09PP9WVev4/K+u+9xf37335zYuvzh69+NZP3yRl/ZvqccuGq49jnZI8Uql0LbvNYFddOBnsYUG4KQMRkTXXULX/j8RA1BpvJF76qKeFA9ZVpdDm8EoFuI0l0esSAL1R/tBn899y27jRR+9dfj6fAGX1vlps+ZHBSCOfGA01zW+7aSwijq7880W2RbevQwAAtPBdNv55otX4L4276tL9r1gbGi3WUnZHxB0RsSci7oyopr07Iu65yfybF0muH/+kl9ZUsVXKxn/PFmtbjeO/tEwyOlDEdlUjQ8mxEwvzB4vPZDyGtmbxqQ55fP/ir5+2O1Y//su2LP9yLFiU49Lg1sbXzM0sz9xKnetd/jBi32Cr+ifXVgKSiNj72trzOPHYV/vbHWuufyXp9E7PNUa7sM5U+TLi0bz9V6Kp/qWk8/rk5LZYmD84WZ4V1/v5lwuvt8v/xu2/vrL2397y/L9W/9Gkfr126ebzuPD7J23nNBNrOv9rO7YUz+/NLC+fmYrYkrySF7p+/3TttWW8TJ/Vf/xA6/6/Ow989nVEdQ07O4nvi4j7I+KBou0ejIiHIuJAuwquRPz4wsNvtzu8Gdp/rqn9RxuTNLV/LbAlmve0Dgyc/OHbxnesBVf3/Xe4Ghov9qzm+2815Vrb2QwAAAD/PWlE7IwknbgWTtOJifxv+PfE9nRhcWn58WOL756ey+8RGI2htLzSlV8Pzq+HThXT+jI+3RQ/VFw3/nxguBqfmF1cmOt15aHP7WjT/zN/DPS6dMC6c78W9C/9H/qX/g/9S/+H/tWi/w/3ohzAxmv1+/9BLVgZ2cjCABuqqf9b9oM+Yv4P/Uv/h/5V3/873n8P3E6WhuPGN8kLbObAtrIpNzb3SDdB3Vcb2Bqd0yTr3At2boYPoQyU//uzc+IefzEBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB0yb8BAAD///7G59I=") (async, rerun: 32) mkdir(0x0, 0x25) (async) prlimit64(0x0, 0xe, &(0x7f0000000c80)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000cc0)=0x8) r4 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000d00)=0x2) (async) sched_setscheduler(r4, 0x1, &(0x7f0000000d40)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x9a5eb000) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000d80)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000dc0)=@abs, 0x6e) (async, rerun: 64) sendmmsg$unix(r6, &(0x7f0000000e40), 0x651, 0x0) (rerun: 64) recvmmsg(r5, &(0x7f0000000e80), 0x4000087, 0x2, 0x0) (async) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x1, 0x1010, 0xffffffffffffffff, 0x0) (async, rerun: 32) socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 32) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000ec0), 0x60242, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000f00)={'pimreg\x00', 0x3c32}) executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x401c2, 0x0) ftruncate(r0, 0x8800000) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendfile(r1, r0, 0x0, 0x578410eb) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e22}, 0x1c) listen(r3, 0x81010040) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10) syz_emit_ethernet(0x36, &(0x7f0000000080)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1b}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x3d, 0x28, 0x67, 0x0, 0x2, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2}}}}}}, 0x0) syz_emit_ethernet(0x159, &(0x7f0000000200)={@local, @broadcast, @void, {@ipv4={0x800, @igmp={{0x15, 0x4, 0x2, 0x3e, 0x14b, 0x64, 0x0, 0x8, 0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x10}, @private=0xa010101, {[@ra={0x94, 0x4}, @generic={0x82, 0x10, "cc303838b09d57725c1e05817f05"}, @cipso={0x86, 0xb, 0x2, [{0x7, 0x3, "d4"}, {0x1, 0x2}]}, @cipso={0x86, 0x21, 0x3, [{0x0, 0xf, "79501ec32cab539f0845f7a311"}, {0x6, 0x6, "2ecd4209"}, {0x2, 0x3, "cb"}, {0x6, 0x3, ':'}]}]}}, {0x22, 0x76, 0x0, @rand_addr=0x64010100, "89b9477228dd1ca8f9de87e28572ec7b256b1e9c7c2600fac34689366c71f395662b0ed8b452e17fefdc15cfec95f08e2ecaa21ac08199e0f95df6a0cd2075a5440e0b29b3cc45999a2391c7c1f4335df9396549c6a94646d2bb53b110dc7f7401906e6a15d6e983ba1b1b3b3678946b9a678db824a46e95697492d82e7eb76c1bae1348e6b851e3f4b09d94f8e1874261b8f83cd2f237592336cadefc2fd204fa2fab731c3ff6f54c15b7f1f0875d8c3e41c18e9d0c2ace2bbcb9fcbab24c97be25216511bbd9decd870ba3390d8d82ddfe34380d85352e14161875e840d7a6a80b18730c64f1436a4c924a5d7e41"}}}}}, 0x0) shutdown(r2, 0x0) executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000600), 0x41, 0x0) write$binfmt_aout(r0, &(0x7f0000000680)=ANY=[], 0xbfb3) ioctl$TCSETS(r0, 0x40045431, 0x0) syz_open_pts(r0, 0xa5000) executing program 6: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f0000000000)=0x6) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_int(r1, 0x6, 0x9, &(0x7f0000000140), &(0x7f0000000180)=0x4) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e20, @loopback}, 0x10) r2 = ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) sendmsg$NFT_BATCH(r2, &(0x7f0000000b40)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000b00)={&(0x7f0000000500)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWRULE={0x154, 0x6, 0xa, 0x201, 0x0, 0x0, {0x7, 0x0, 0x4}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_POSITION_ID={0x8, 0xa, 0x1, 0x0, 0x1}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_COMPAT={0x4c, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x8884}, @NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x33}, @NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}]}, @NFTA_RULE_USERDATA={0x5c, 0x7, 0x1, 0x0, "989fe55479d05fe316872127fcae40814d278bc0c1a6704e2b72ed0ba221d490c32156be134a4b21bab95fd152ffe13c22fab767d93e9f14a8226fe9fec98ed973185aa012c80591366a44fb59e918eedda1c1bc128d3ced"}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_COMPAT={0x54, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x890d}, @NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x8917}, @NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x7bf3}, @NFTA_RULE_COMPAT_FLAGS={0x8}, @NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x6004}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x88}, @NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x2e}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x11}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}]}, @NFT_MSG_DELFLOWTABLE={0x28, 0x18, 0xa, 0x801, 0x0, 0x0, {0x1, 0x0, 0x7}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_FLAGS={0x8}]}, @NFT_MSG_DELRULE={0x20, 0x8, 0xa, 0x0, 0x0, 0x0, {0x7, 0x0, 0x1}, [@NFTA_RULE_HANDLE={0xc, 0x3, 0x1, 0x0, 0x1}]}, @NFT_MSG_NEWCHAIN={0xc4, 0x3, 0xa, 0x304, 0x0, 0x0, {0x2, 0x0, 0x2}, [@NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x3}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x4}, @NFTA_CHAIN_COUNTERS={0x7c, 0x8, 0x0, 0x1, [@NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x9}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x9}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x7}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x7fff}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x101}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x10000}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x4}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x8001}, @NFTA_COUNTER_PACKETS={0xc}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x5}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_POLICY={0x8, 0x5, 0x1, 0x0, 0xfffffffffffffffd}, @NFTA_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x1}]}, @NFT_MSG_NEWCHAIN={0xec, 0x3, 0xa, 0x101, 0x0, 0x0, {0x2, 0x0, 0x3}, [@NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x6}, @NFTA_CHAIN_USERDATA={0x68, 0xc, "8048b3b6006f7bbe016cac39f30efa73ec7d40f78ba6f57f1775ff1801a7e7a38082711bded1545850b92ebdff42f7d73367bfb938cd893ceff0b180f4f5841f52d4712bda2d09f0fbc8767e4902b52d9ce542d4097fd8bab9975e2d585d65d7f34a0f75"}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x2}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x7e0126b2}]}, @NFTA_CHAIN_COUNTERS={0x4c, 0x8, 0x0, 0x1, [@NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0xf0}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x31}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x7ff}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x81}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x5}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x6}]}]}, @NFT_MSG_NEWTABLE={0x200, 0x0, 0xa, 0x801, 0x0, 0x0, {0x7, 0x0, 0x6}, [@NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x5}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_USERDATA={0xcb, 0x6, "5da4c46ad78b4c41321fa90c7b450a906047c67d4387d641d9d5597c4ab79b6264c88a5a73fff9722246ef3b1fa9f426ea853d0a7e41aead48d4bdcc2f044ec251c28498c47d809135c2cce8fe553638717869a42ba8ed846f00514d6fa64f5984eca1c1447b53a0b77f073a84086332926fc17e43b9f8b38b94b0be8a29cf0637a61548707906a779279cb7794af8debe10eb02de558281cef636d88d63ed1c2d646e2bb004bac7e71d3889e11e7c7becf367c41b701bbd754f98c58457530ee8d34e68c4680f"}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x2}, @NFTA_TABLE_USERDATA={0xe5, 0x6, "5f3f70ad7646f882e4ce6c9787233144177194edc71c9037f5827af3219a9b3c4cd946a3673a5ccde37d1cc7a6cdb3588396b06135d78cb667f4750ea38b08af63401ba026aa98b7f69e63fd5437dc8da0a2590757ea999019eb816de11555de875dae0449c08c7646370a7ce55b03495224363c84bf61bf9e7fb564f902ab35acfaaf31ef7f9ee9ee71e8e4632c1499bd620f4bc15b249050109396405cf052b9b826eede058ad44d704015d6937327708ad6a895bd918fc06f749e845f69b8276e1d20d6cb1f6a0a993df4f3d91ef9ff18f8eb0629482ff037e346e5699c18f5"}]}, @NFT_MSG_NEWTABLE={0x28, 0x0, 0xa, 0x5, 0x0, 0x0, {0x0, 0x0, 0x8}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x3}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x59c}, 0x1, 0x0, 0x0, 0x801}, 0x40000) sendto$inet(r0, &(0x7f0000000140), 0xffffffffffffff58, 0x20008005, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) ppoll(&(0x7f0000000040)=[{r0, 0xc22}], 0x1, 0x0, 0x0, 0x0) recvfrom(r0, &(0x7f0000000480)=""/110, 0x168f6f3d, 0x734, 0x0, 0xfffffffffffffecb) executing program 3: socket(0x10, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000140)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f0000000340), 0x318, 0x0) recvmmsg(r1, &(0x7f0000000380), 0x10106, 0x2, 0x0) syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000006c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000504000000002e"], 0x0, 0x37}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0900000004000000040000000700000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=r3, @ANYBLOB="0200000001"], 0x48) openat$dir(0xffffffffffffff9c, &(0x7f0000000780)='.\x00', 0x0, 0x104) ioctl$FIDEDUPERANGE(r3, 0xc0189436, &(0x7f0000000900)=ANY=[@ANYBLOB="04a98db454f2ca8dea0c00"/24]) executing program 5: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000000, &(0x7f0000000280)={[{@nodelalloc}, {@jqfmt_vfsv1}, {@errors_remount}, {@nouser_xattr}]}, 0x0, 0x7b9, &(0x7f00000006c0)="$eJzs3c9rG1ceAPDvyHb8I1nshWV3czMsZAMhcpz1JrvQQ0oPpdBAoD03MbJiUstWsOQQG0MTSqGXQlt6KLSXnPsjvfXaH9BT+1/0UBLSxglN6aG4jDSyFVtybMe23PrzgfG892bk977zZjRPmkETwIE1nP7JRRyNiLeTiMGsPImInlqqO+Jcfb1HS4t9EVFIYnn5pZ+S2joPlxYL0fSa1OEs88+I+OqNiBO59fVW5hemxkul4myWH6lOXx2pzC+cvDI9PlmcLM6cGR0bO332v2fP7FysP3+3cOTuO8//+9Nzv77+j9tvfZ3EuTiSLWuOY6cMx3C2TXrSTfiY53a6sg5LOt0AtiU9NLvqR3kcjcHoqqXa6N/LlgEAu+W1iFgGAA6YxPkfAA6YxvcAD5cWC42ps99I7K17z0ZEXz3+R9lUX9KdXbPrq10HHXiYPHZlJImIoR2ofzgiPvz8lWNdWT5th2tpwF64cTMiLg0Nr3//T9bds7BVpzZauNxbmw2vKT5o5x/opC/S8c//Wo3/civjn2gx/umtH7t/f9r62x7/K4Or3J2nrWMj6fjvmfq9bWvGfys3rQ11Zbm/1JrVk1y+UiqeyrZBKs2P1lKtR27HH/z2oF392fjv43S6/+6rH6X1p/PVNXJ3unsff83EeLX7m6cJusm9mzGQJdfEn6z0f9Jm/Hthk3W88P83P2i3LI0/jbcxrY9/dy3fijjWsv9X+zLZ8P7EkdruMNLYKVr47Pv3B9rV39z/6ZTWn853PtLW7t2MGLg/GEmyug3qS1biH0qa79esbL2Ob28Nftlu2ZPjb7n/jx9KXq6lD2Vl18er1dnRiEPJi+vLT6++tpFvrJ/Gf/xfrY//erWt9//0M+GlTcbffffHT7Yf/+5K45/YeP9f0/99WfFqyZMStx9NdbWrf3P9P1ZLHc9K0v5/Ulybadf29mYAAAAAAAAAAAAAAAAAAAAAAAAA2LpcRByJJJdfSedy+Xz9Gd5/i4FcqVypnrhcnpuZiNqzsoeiJ9f4qcvBpt9DHc1+srWRP70m/5+I+GtEvNfbX8vnC+XSRKeDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM4TbP/0/90Nvp1gEAu6av0w0AAPac8z8AHDxbO//371o7AIC94/M/ABw8mz7/X9rddgAAe8fnfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHbZhfPn02n5l6XFQpqfuDY/N1W+dnKiWJnKT88V8oXy7NX8ZLk8WSrmC+Xptv/oRn1WKpevjsXM3PWRarFSHanML1ycLs/NVC9emR6fLF4s9uxZZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACweZX5hanxUqk4+6dI3FgNbIf/c39H4xrYH5u3KdEd+6IZ+zrRG/uiGdtMNL9L9HfgnQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgj+H3AAAA//+0Bxg2") mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x9, @mcast1, 0x48f}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000540)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6, 0x0, 0x3, 0xd}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000580)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) (async) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) (async) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) chdir(&(0x7f0000000f80)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x88040, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x181) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x3000440, 0x0, 0xff, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) (async) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) (async) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) newfstatat(0xffffffffffffff9c, &(0x7f0000000440)='./file0/file1\x00', &(0x7f0000000480), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000fc0)='./file1/file0\x00', 0x140) mount$bind(&(0x7f0000001000)='.\x00', &(0x7f0000001040)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f0000001080)='./bus\x00', &(0x7f00000010c0), 0x40, &(0x7f0000001100)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]}) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000001300)=@raw={'raw\x00', 0x9, 0x3, 0x220, 0x0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0xf0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0xc8, 0xf0, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'lo\x00', {0x0, 0x3e8, 0x5, 0x8, 0x40, 0x3e8, 0x3e8}}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffffffffffff}}}}, 0x280) syz_emit_ethernet(0x2a, &(0x7f0000001580)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) (async) syz_emit_ethernet(0x2a, &(0x7f0000001580)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000015c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001600)='./proc\x00', &(0x7f0000001640)='proc\x00', 0x0, 0x0) (async) mount(0x0, &(0x7f0000001600)='./proc\x00', &(0x7f0000001640)='proc\x00', 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000001680)={0x3, &(0x7f00000016c0)=[{0x2d, 0x0, 0x1, 0x3}, {0xac, 0x0, 0x4, 0x4}, {0x6, 0x0, 0x9}]}) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) (async) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000001700)='./proc/net/ipt_hashlimit/lo\x00', 0x0, 0x0) (async) r2 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./proc/net/ipt_hashlimit/lo\x00', 0x0, 0x0) read$FUSE(r2, &(0x7f0000001740)={0x2020}, 0x2020) accept4$unix(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x80800) (async) r3 = accept4$unix(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x80800) sendto$unix(r3, &(0x7f0000000180)="d1f0fe0a5f25af3efacd9b2e7fc36ae040ec36a45758ab8d80f839b3e16f3766d1e356f49e367e5b78c9c7af5a8377bd9c3218c21f9b4ff0cad585cc52186656ce24f6ab9d4f463041663250d02544c33579f60b6a7a45374b620339107b7c2eeefc3df0e6d951484c32426f6067662aba416c76745057f0a2f6cc701e6be591721ea1f04951338ddd3786", 0x8b, 0x4000, &(0x7f00000002c0)=@file={0x1, './bus\x00'}, 0x6e) (async) sendto$unix(r3, &(0x7f0000000180)="d1f0fe0a5f25af3efacd9b2e7fc36ae040ec36a45758ab8d80f839b3e16f3766d1e356f49e367e5b78c9c7af5a8377bd9c3218c21f9b4ff0cad585cc52186656ce24f6ab9d4f463041663250d02544c33579f60b6a7a45374b620339107b7c2eeefc3df0e6d951484c32426f6067662aba416c76745057f0a2f6cc701e6be591721ea1f04951338ddd3786", 0x8b, 0x4000, &(0x7f00000002c0)=@file={0x1, './bus\x00'}, 0x6e) openat(0xffffffffffffff9c, &(0x7f00000012c0)='./bus/file0\x00', 0x12800, 0x40) executing program 2: r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, 0x0, 0x0) (async, rerun: 64) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'veth1_vlan\x00', 0x200}) (rerun: 64) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newlink={0x28, 0x10, 0x1, 0x70bd28, 0x25dfdbf9, {0x0, 0x0, 0x0, 0x0, 0x4ac00, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x40801}, 0x4000000) executing program 6: capset(&(0x7f0000000000)={0x20071026}, &(0x7f0000000040)={0x208004, 0x21fffc, 0xc, 0x0, 0x2, 0xfffffffe}) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0xf, 0x0, 0x0, 0x8000}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x12, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="180000000800000000000000ab0a0000"], &(0x7f0000000bc0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x8, '\x00', 0x0, @cgroup_sock_addr=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000001, 0x12, 0xffffffffffffffff, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000d80)={0x1, &(0x7f0000000dc0)=[{0x6, 0xf5, 0xe, 0x7ffffffe}]}) syz_kvm_setup_syzos_vm$x86(r0, &(0x7f0000bfd000/0x400000)=nil) program crashed: KASAN: use-after-free Read in incfs_free_mount_info bisect: the chunk can be dropped bisect: split chunks (needed=true): <15> bisect: split chunk #0 of len 15 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 4, 10, 15, 40, 5, 6] detailed listing: executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x401c2, 0x0) ftruncate(r0, 0x8800000) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendfile(r1, r0, 0x0, 0x578410eb) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e22}, 0x1c) listen(r3, 0x81010040) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10) syz_emit_ethernet(0x36, &(0x7f0000000080)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1b}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x3d, 0x28, 0x67, 0x0, 0x2, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2}}}}}}, 0x0) syz_emit_ethernet(0x159, &(0x7f0000000200)={@local, @broadcast, @void, {@ipv4={0x800, @igmp={{0x15, 0x4, 0x2, 0x3e, 0x14b, 0x64, 0x0, 0x8, 0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x10}, @private=0xa010101, {[@ra={0x94, 0x4}, @generic={0x82, 0x10, "cc303838b09d57725c1e05817f05"}, @cipso={0x86, 0xb, 0x2, [{0x7, 0x3, "d4"}, {0x1, 0x2}]}, @cipso={0x86, 0x21, 0x3, [{0x0, 0xf, "79501ec32cab539f0845f7a311"}, {0x6, 0x6, "2ecd4209"}, {0x2, 0x3, "cb"}, {0x6, 0x3, ':'}]}]}}, {0x22, 0x76, 0x0, @rand_addr=0x64010100, "89b9477228dd1ca8f9de87e28572ec7b256b1e9c7c2600fac34689366c71f395662b0ed8b452e17fefdc15cfec95f08e2ecaa21ac08199e0f95df6a0cd2075a5440e0b29b3cc45999a2391c7c1f4335df9396549c6a94646d2bb53b110dc7f7401906e6a15d6e983ba1b1b3b3678946b9a678db824a46e95697492d82e7eb76c1bae1348e6b851e3f4b09d94f8e1874261b8f83cd2f237592336cadefc2fd204fa2fab731c3ff6f54c15b7f1f0875d8c3e41c18e9d0c2ace2bbcb9fcbab24c97be25216511bbd9decd870ba3390d8d82ddfe34380d85352e14161875e840d7a6a80b18730c64f1436a4c924a5d7e41"}}}}}, 0x0) shutdown(r2, 0x0) executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000600), 0x41, 0x0) write$binfmt_aout(r0, &(0x7f0000000680)=ANY=[], 0xbfb3) ioctl$TCSETS(r0, 0x40045431, 0x0) syz_open_pts(r0, 0xa5000) executing program 6: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f0000000000)=0x6) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_int(r1, 0x6, 0x9, &(0x7f0000000140), &(0x7f0000000180)=0x4) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e20, @loopback}, 0x10) r2 = ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) sendmsg$NFT_BATCH(r2, &(0x7f0000000b40)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000b00)={&(0x7f0000000500)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWRULE={0x154, 0x6, 0xa, 0x201, 0x0, 0x0, {0x7, 0x0, 0x4}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_POSITION_ID={0x8, 0xa, 0x1, 0x0, 0x1}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_COMPAT={0x4c, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x8884}, @NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x33}, @NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}]}, @NFTA_RULE_USERDATA={0x5c, 0x7, 0x1, 0x0, "989fe55479d05fe316872127fcae40814d278bc0c1a6704e2b72ed0ba221d490c32156be134a4b21bab95fd152ffe13c22fab767d93e9f14a8226fe9fec98ed973185aa012c80591366a44fb59e918eedda1c1bc128d3ced"}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_COMPAT={0x54, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x890d}, @NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x8917}, @NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x7bf3}, @NFTA_RULE_COMPAT_FLAGS={0x8}, @NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x6004}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x88}, @NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x2e}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x11}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}]}, @NFT_MSG_DELFLOWTABLE={0x28, 0x18, 0xa, 0x801, 0x0, 0x0, {0x1, 0x0, 0x7}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_FLAGS={0x8}]}, @NFT_MSG_DELRULE={0x20, 0x8, 0xa, 0x0, 0x0, 0x0, {0x7, 0x0, 0x1}, [@NFTA_RULE_HANDLE={0xc, 0x3, 0x1, 0x0, 0x1}]}, @NFT_MSG_NEWCHAIN={0xc4, 0x3, 0xa, 0x304, 0x0, 0x0, {0x2, 0x0, 0x2}, [@NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x3}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x4}, @NFTA_CHAIN_COUNTERS={0x7c, 0x8, 0x0, 0x1, [@NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x9}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x9}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x7}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x7fff}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x101}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x10000}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x4}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x8001}, @NFTA_COUNTER_PACKETS={0xc}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x5}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_POLICY={0x8, 0x5, 0x1, 0x0, 0xfffffffffffffffd}, @NFTA_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x1}]}, @NFT_MSG_NEWCHAIN={0xec, 0x3, 0xa, 0x101, 0x0, 0x0, {0x2, 0x0, 0x3}, [@NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x6}, @NFTA_CHAIN_USERDATA={0x68, 0xc, "8048b3b6006f7bbe016cac39f30efa73ec7d40f78ba6f57f1775ff1801a7e7a38082711bded1545850b92ebdff42f7d73367bfb938cd893ceff0b180f4f5841f52d4712bda2d09f0fbc8767e4902b52d9ce542d4097fd8bab9975e2d585d65d7f34a0f75"}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x2}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x7e0126b2}]}, @NFTA_CHAIN_COUNTERS={0x4c, 0x8, 0x0, 0x1, [@NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0xf0}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x31}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x7ff}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x81}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x5}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x6}]}]}, @NFT_MSG_NEWTABLE={0x200, 0x0, 0xa, 0x801, 0x0, 0x0, {0x7, 0x0, 0x6}, [@NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x5}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_USERDATA={0xcb, 0x6, "5da4c46ad78b4c41321fa90c7b450a906047c67d4387d641d9d5597c4ab79b6264c88a5a73fff9722246ef3b1fa9f426ea853d0a7e41aead48d4bdcc2f044ec251c28498c47d809135c2cce8fe553638717869a42ba8ed846f00514d6fa64f5984eca1c1447b53a0b77f073a84086332926fc17e43b9f8b38b94b0be8a29cf0637a61548707906a779279cb7794af8debe10eb02de558281cef636d88d63ed1c2d646e2bb004bac7e71d3889e11e7c7becf367c41b701bbd754f98c58457530ee8d34e68c4680f"}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x2}, @NFTA_TABLE_USERDATA={0xe5, 0x6, "5f3f70ad7646f882e4ce6c9787233144177194edc71c9037f5827af3219a9b3c4cd946a3673a5ccde37d1cc7a6cdb3588396b06135d78cb667f4750ea38b08af63401ba026aa98b7f69e63fd5437dc8da0a2590757ea999019eb816de11555de875dae0449c08c7646370a7ce55b03495224363c84bf61bf9e7fb564f902ab35acfaaf31ef7f9ee9ee71e8e4632c1499bd620f4bc15b249050109396405cf052b9b826eede058ad44d704015d6937327708ad6a895bd918fc06f749e845f69b8276e1d20d6cb1f6a0a993df4f3d91ef9ff18f8eb0629482ff037e346e5699c18f5"}]}, @NFT_MSG_NEWTABLE={0x28, 0x0, 0xa, 0x5, 0x0, 0x0, {0x0, 0x0, 0x8}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x3}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x59c}, 0x1, 0x0, 0x0, 0x801}, 0x40000) sendto$inet(r0, &(0x7f0000000140), 0xffffffffffffff58, 0x20008005, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) ppoll(&(0x7f0000000040)=[{r0, 0xc22}], 0x1, 0x0, 0x0, 0x0) recvfrom(r0, &(0x7f0000000480)=""/110, 0x168f6f3d, 0x734, 0x0, 0xfffffffffffffecb) executing program 3: socket(0x10, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000140)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f0000000340), 0x318, 0x0) recvmmsg(r1, &(0x7f0000000380), 0x10106, 0x2, 0x0) syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000006c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000504000000002e"], 0x0, 0x37}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0900000004000000040000000700000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=r3, @ANYBLOB="0200000001"], 0x48) openat$dir(0xffffffffffffff9c, &(0x7f0000000780)='.\x00', 0x0, 0x104) ioctl$FIDEDUPERANGE(r3, 0xc0189436, &(0x7f0000000900)=ANY=[@ANYBLOB="04a98db454f2ca8dea0c00"/24]) executing program 5: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000000, &(0x7f0000000280)={[{@nodelalloc}, {@jqfmt_vfsv1}, {@errors_remount}, {@nouser_xattr}]}, 0x0, 0x7b9, &(0x7f00000006c0)="$eJzs3c9rG1ceAPDvyHb8I1nshWV3czMsZAMhcpz1JrvQQ0oPpdBAoD03MbJiUstWsOQQG0MTSqGXQlt6KLSXnPsjvfXaH9BT+1/0UBLSxglN6aG4jDSyFVtybMe23PrzgfG892bk977zZjRPmkETwIE1nP7JRRyNiLeTiMGsPImInlqqO+Jcfb1HS4t9EVFIYnn5pZ+S2joPlxYL0fSa1OEs88+I+OqNiBO59fVW5hemxkul4myWH6lOXx2pzC+cvDI9PlmcLM6cGR0bO332v2fP7FysP3+3cOTuO8//+9Nzv77+j9tvfZ3EuTiSLWuOY6cMx3C2TXrSTfiY53a6sg5LOt0AtiU9NLvqR3kcjcHoqqXa6N/LlgEAu+W1iFgGAA6YxPkfAA6YxvcAD5cWC42ps99I7K17z0ZEXz3+R9lUX9KdXbPrq10HHXiYPHZlJImIoR2ofzgiPvz8lWNdWT5th2tpwF64cTMiLg0Nr3//T9bds7BVpzZauNxbmw2vKT5o5x/opC/S8c//Wo3/civjn2gx/umtH7t/f9r62x7/K4Or3J2nrWMj6fjvmfq9bWvGfys3rQ11Zbm/1JrVk1y+UiqeyrZBKs2P1lKtR27HH/z2oF392fjv43S6/+6rH6X1p/PVNXJ3unsff83EeLX7m6cJusm9mzGQJdfEn6z0f9Jm/Hthk3W88P83P2i3LI0/jbcxrY9/dy3fijjWsv9X+zLZ8P7EkdruMNLYKVr47Pv3B9rV39z/6ZTWn853PtLW7t2MGLg/GEmyug3qS1biH0qa79esbL2Ob28Nftlu2ZPjb7n/jx9KXq6lD2Vl18er1dnRiEPJi+vLT6++tpFvrJ/Gf/xfrY//erWt9//0M+GlTcbffffHT7Yf/+5K45/YeP9f0/99WfFqyZMStx9NdbWrf3P9P1ZLHc9K0v5/Ulybadf29mYAAAAAAAAAAAAAAAAAAAAAAAAA2LpcRByJJJdfSedy+Xz9Gd5/i4FcqVypnrhcnpuZiNqzsoeiJ9f4qcvBpt9DHc1+srWRP70m/5+I+GtEvNfbX8vnC+XSRKeDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM4TbP/0/90Nvp1gEAu6av0w0AAPac8z8AHDxbO//371o7AIC94/M/ABw8mz7/X9rddgAAe8fnfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHbZhfPn02n5l6XFQpqfuDY/N1W+dnKiWJnKT88V8oXy7NX8ZLk8WSrmC+Xptv/oRn1WKpevjsXM3PWRarFSHanML1ycLs/NVC9emR6fLF4s9uxZZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACweZX5hanxUqk4+6dI3FgNbIf/c39H4xrYH5u3KdEd+6IZ+zrRG/uiGdtMNL9L9HfgnQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgj+H3AAAA//+0Bxg2") mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x9, @mcast1, 0x48f}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000540)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6, 0x0, 0x3, 0xd}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000580)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) (async) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) (async) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) chdir(&(0x7f0000000f80)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x88040, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x181) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x3000440, 0x0, 0xff, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) (async) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) (async) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) newfstatat(0xffffffffffffff9c, &(0x7f0000000440)='./file0/file1\x00', &(0x7f0000000480), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000fc0)='./file1/file0\x00', 0x140) mount$bind(&(0x7f0000001000)='.\x00', &(0x7f0000001040)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f0000001080)='./bus\x00', &(0x7f00000010c0), 0x40, &(0x7f0000001100)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]}) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000001300)=@raw={'raw\x00', 0x9, 0x3, 0x220, 0x0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0xf0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0xc8, 0xf0, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'lo\x00', {0x0, 0x3e8, 0x5, 0x8, 0x40, 0x3e8, 0x3e8}}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffffffffffff}}}}, 0x280) syz_emit_ethernet(0x2a, &(0x7f0000001580)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) (async) syz_emit_ethernet(0x2a, &(0x7f0000001580)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000015c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001600)='./proc\x00', &(0x7f0000001640)='proc\x00', 0x0, 0x0) (async) mount(0x0, &(0x7f0000001600)='./proc\x00', &(0x7f0000001640)='proc\x00', 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000001680)={0x3, &(0x7f00000016c0)=[{0x2d, 0x0, 0x1, 0x3}, {0xac, 0x0, 0x4, 0x4}, {0x6, 0x0, 0x9}]}) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) (async) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000001700)='./proc/net/ipt_hashlimit/lo\x00', 0x0, 0x0) (async) r2 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./proc/net/ipt_hashlimit/lo\x00', 0x0, 0x0) read$FUSE(r2, &(0x7f0000001740)={0x2020}, 0x2020) accept4$unix(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x80800) (async) r3 = accept4$unix(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x80800) sendto$unix(r3, &(0x7f0000000180)="d1f0fe0a5f25af3efacd9b2e7fc36ae040ec36a45758ab8d80f839b3e16f3766d1e356f49e367e5b78c9c7af5a8377bd9c3218c21f9b4ff0cad585cc52186656ce24f6ab9d4f463041663250d02544c33579f60b6a7a45374b620339107b7c2eeefc3df0e6d951484c32426f6067662aba416c76745057f0a2f6cc701e6be591721ea1f04951338ddd3786", 0x8b, 0x4000, &(0x7f00000002c0)=@file={0x1, './bus\x00'}, 0x6e) (async) sendto$unix(r3, &(0x7f0000000180)="d1f0fe0a5f25af3efacd9b2e7fc36ae040ec36a45758ab8d80f839b3e16f3766d1e356f49e367e5b78c9c7af5a8377bd9c3218c21f9b4ff0cad585cc52186656ce24f6ab9d4f463041663250d02544c33579f60b6a7a45374b620339107b7c2eeefc3df0e6d951484c32426f6067662aba416c76745057f0a2f6cc701e6be591721ea1f04951338ddd3786", 0x8b, 0x4000, &(0x7f00000002c0)=@file={0x1, './bus\x00'}, 0x6e) openat(0xffffffffffffff9c, &(0x7f00000012c0)='./bus/file0\x00', 0x12800, 0x40) executing program 2: r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, 0x0, 0x0) (async, rerun: 64) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'veth1_vlan\x00', 0x200}) (rerun: 64) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newlink={0x28, 0x10, 0x1, 0x70bd28, 0x25dfdbf9, {0x0, 0x0, 0x0, 0x0, 0x4ac00, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x40801}, 0x4000000) executing program 6: capset(&(0x7f0000000000)={0x20071026}, &(0x7f0000000040)={0x208004, 0x21fffc, 0xc, 0x0, 0x2, 0xfffffffe}) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0xf, 0x0, 0x0, 0x8000}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x12, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="180000000800000000000000ab0a0000"], &(0x7f0000000bc0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x8, '\x00', 0x0, @cgroup_sock_addr=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000001, 0x12, 0xffffffffffffffff, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000d80)={0x1, &(0x7f0000000dc0)=[{0x6, 0xf5, 0xe, 0x7ffffffe}]}) syz_kvm_setup_syzos_vm$x86(r0, &(0x7f0000bfd000/0x400000)=nil) program crashed: KASAN: use-after-free Read in incfs_free_mount_info bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <7> bisect: split chunk #0 of len 7 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [40, 5, 6] detailed listing: executing program 5: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000000, &(0x7f0000000280)={[{@nodelalloc}, {@jqfmt_vfsv1}, {@errors_remount}, {@nouser_xattr}]}, 0x0, 0x7b9, &(0x7f00000006c0)="$eJzs3c9rG1ceAPDvyHb8I1nshWV3czMsZAMhcpz1JrvQQ0oPpdBAoD03MbJiUstWsOQQG0MTSqGXQlt6KLSXnPsjvfXaH9BT+1/0UBLSxglN6aG4jDSyFVtybMe23PrzgfG892bk977zZjRPmkETwIE1nP7JRRyNiLeTiMGsPImInlqqO+Jcfb1HS4t9EVFIYnn5pZ+S2joPlxYL0fSa1OEs88+I+OqNiBO59fVW5hemxkul4myWH6lOXx2pzC+cvDI9PlmcLM6cGR0bO332v2fP7FysP3+3cOTuO8//+9Nzv77+j9tvfZ3EuTiSLWuOY6cMx3C2TXrSTfiY53a6sg5LOt0AtiU9NLvqR3kcjcHoqqXa6N/LlgEAu+W1iFgGAA6YxPkfAA6YxvcAD5cWC42ps99I7K17z0ZEXz3+R9lUX9KdXbPrq10HHXiYPHZlJImIoR2ofzgiPvz8lWNdWT5th2tpwF64cTMiLg0Nr3//T9bds7BVpzZauNxbmw2vKT5o5x/opC/S8c//Wo3/civjn2gx/umtH7t/f9r62x7/K4Or3J2nrWMj6fjvmfq9bWvGfys3rQ11Zbm/1JrVk1y+UiqeyrZBKs2P1lKtR27HH/z2oF392fjv43S6/+6rH6X1p/PVNXJ3unsff83EeLX7m6cJusm9mzGQJdfEn6z0f9Jm/Hthk3W88P83P2i3LI0/jbcxrY9/dy3fijjWsv9X+zLZ8P7EkdruMNLYKVr47Pv3B9rV39z/6ZTWn853PtLW7t2MGLg/GEmyug3qS1biH0qa79esbL2Ob28Nftlu2ZPjb7n/jx9KXq6lD2Vl18er1dnRiEPJi+vLT6++tpFvrJ/Gf/xfrY//erWt9//0M+GlTcbffffHT7Yf/+5K45/YeP9f0/99WfFqyZMStx9NdbWrf3P9P1ZLHc9K0v5/Ulybadf29mYAAAAAAAAAAAAAAAAAAAAAAAAA2LpcRByJJJdfSedy+Xz9Gd5/i4FcqVypnrhcnpuZiNqzsoeiJ9f4qcvBpt9DHc1+srWRP70m/5+I+GtEvNfbX8vnC+XSRKeDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM4TbP/0/90Nvp1gEAu6av0w0AAPac8z8AHDxbO//371o7AIC94/M/ABw8mz7/X9rddgAAe8fnfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHbZhfPn02n5l6XFQpqfuDY/N1W+dnKiWJnKT88V8oXy7NX8ZLk8WSrmC+Xptv/oRn1WKpevjsXM3PWRarFSHanML1ycLs/NVC9emR6fLF4s9uxZZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACweZX5hanxUqk4+6dI3FgNbIf/c39H4xrYH5u3KdEd+6IZ+zrRG/uiGdtMNL9L9HfgnQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgj+H3AAAA//+0Bxg2") mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x9, @mcast1, 0x48f}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000540)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6, 0x0, 0x3, 0xd}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000580)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) (async) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) (async) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) chdir(&(0x7f0000000f80)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x88040, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x181) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x3000440, 0x0, 0xff, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) (async) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) (async) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) newfstatat(0xffffffffffffff9c, &(0x7f0000000440)='./file0/file1\x00', &(0x7f0000000480), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000fc0)='./file1/file0\x00', 0x140) mount$bind(&(0x7f0000001000)='.\x00', &(0x7f0000001040)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f0000001080)='./bus\x00', &(0x7f00000010c0), 0x40, &(0x7f0000001100)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]}) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000001300)=@raw={'raw\x00', 0x9, 0x3, 0x220, 0x0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0xf0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0xc8, 0xf0, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'lo\x00', {0x0, 0x3e8, 0x5, 0x8, 0x40, 0x3e8, 0x3e8}}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffffffffffff}}}}, 0x280) syz_emit_ethernet(0x2a, &(0x7f0000001580)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) (async) syz_emit_ethernet(0x2a, &(0x7f0000001580)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000015c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001600)='./proc\x00', &(0x7f0000001640)='proc\x00', 0x0, 0x0) (async) mount(0x0, &(0x7f0000001600)='./proc\x00', &(0x7f0000001640)='proc\x00', 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000001680)={0x3, &(0x7f00000016c0)=[{0x2d, 0x0, 0x1, 0x3}, {0xac, 0x0, 0x4, 0x4}, {0x6, 0x0, 0x9}]}) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) (async) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000001700)='./proc/net/ipt_hashlimit/lo\x00', 0x0, 0x0) (async) r2 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./proc/net/ipt_hashlimit/lo\x00', 0x0, 0x0) read$FUSE(r2, &(0x7f0000001740)={0x2020}, 0x2020) accept4$unix(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x80800) (async) r3 = accept4$unix(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x80800) sendto$unix(r3, &(0x7f0000000180)="d1f0fe0a5f25af3efacd9b2e7fc36ae040ec36a45758ab8d80f839b3e16f3766d1e356f49e367e5b78c9c7af5a8377bd9c3218c21f9b4ff0cad585cc52186656ce24f6ab9d4f463041663250d02544c33579f60b6a7a45374b620339107b7c2eeefc3df0e6d951484c32426f6067662aba416c76745057f0a2f6cc701e6be591721ea1f04951338ddd3786", 0x8b, 0x4000, &(0x7f00000002c0)=@file={0x1, './bus\x00'}, 0x6e) (async) sendto$unix(r3, &(0x7f0000000180)="d1f0fe0a5f25af3efacd9b2e7fc36ae040ec36a45758ab8d80f839b3e16f3766d1e356f49e367e5b78c9c7af5a8377bd9c3218c21f9b4ff0cad585cc52186656ce24f6ab9d4f463041663250d02544c33579f60b6a7a45374b620339107b7c2eeefc3df0e6d951484c32426f6067662aba416c76745057f0a2f6cc701e6be591721ea1f04951338ddd3786", 0x8b, 0x4000, &(0x7f00000002c0)=@file={0x1, './bus\x00'}, 0x6e) openat(0xffffffffffffff9c, &(0x7f00000012c0)='./bus/file0\x00', 0x12800, 0x40) executing program 2: r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, 0x0, 0x0) (async, rerun: 64) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'veth1_vlan\x00', 0x200}) (rerun: 64) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newlink={0x28, 0x10, 0x1, 0x70bd28, 0x25dfdbf9, {0x0, 0x0, 0x0, 0x0, 0x4ac00, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x40801}, 0x4000000) executing program 6: capset(&(0x7f0000000000)={0x20071026}, &(0x7f0000000040)={0x208004, 0x21fffc, 0xc, 0x0, 0x2, 0xfffffffe}) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0xf, 0x0, 0x0, 0x8000}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x12, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="180000000800000000000000ab0a0000"], &(0x7f0000000bc0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x8, '\x00', 0x0, @cgroup_sock_addr=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000001, 0x12, 0xffffffffffffffff, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000d80)={0x1, &(0x7f0000000dc0)=[{0x6, 0xf5, 0xe, 0x7ffffffe}]}) syz_kvm_setup_syzos_vm$x86(r0, &(0x7f0000bfd000/0x400000)=nil) program crashed: KASAN: use-after-free Read in incfs_free_mount_info bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <3> bisect: split chunk #0 of len 3 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): capset-bpf$MAP_CREATE-bpf$PROG_LOAD-mmap-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-syz_kvm_setup_syzos_vm$x86 detailed listing: executing program 6: capset(&(0x7f0000000000)={0x20071026}, &(0x7f0000000040)={0x208004, 0x21fffc, 0xc, 0x0, 0x2, 0xfffffffe}) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0xf, 0x0, 0x0, 0x8000}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x12, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="180000000800000000000000ab0a0000"], &(0x7f0000000bc0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x8, '\x00', 0x0, @cgroup_sock_addr=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000001, 0x12, 0xffffffffffffffff, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000d80)={0x1, &(0x7f0000000dc0)=[{0x6, 0xf5, 0xe, 0x7ffffffe}]}) syz_kvm_setup_syzos_vm$x86(r0, &(0x7f0000bfd000/0x400000)=nil) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [40, 5] detailed listing: executing program 5: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000000, &(0x7f0000000280)={[{@nodelalloc}, {@jqfmt_vfsv1}, {@errors_remount}, {@nouser_xattr}]}, 0x0, 0x7b9, &(0x7f00000006c0)="$eJzs3c9rG1ceAPDvyHb8I1nshWV3czMsZAMhcpz1JrvQQ0oPpdBAoD03MbJiUstWsOQQG0MTSqGXQlt6KLSXnPsjvfXaH9BT+1/0UBLSxglN6aG4jDSyFVtybMe23PrzgfG892bk977zZjRPmkETwIE1nP7JRRyNiLeTiMGsPImInlqqO+Jcfb1HS4t9EVFIYnn5pZ+S2joPlxYL0fSa1OEs88+I+OqNiBO59fVW5hemxkul4myWH6lOXx2pzC+cvDI9PlmcLM6cGR0bO332v2fP7FysP3+3cOTuO8//+9Nzv77+j9tvfZ3EuTiSLWuOY6cMx3C2TXrSTfiY53a6sg5LOt0AtiU9NLvqR3kcjcHoqqXa6N/LlgEAu+W1iFgGAA6YxPkfAA6YxvcAD5cWC42ps99I7K17z0ZEXz3+R9lUX9KdXbPrq10HHXiYPHZlJImIoR2ofzgiPvz8lWNdWT5th2tpwF64cTMiLg0Nr3//T9bds7BVpzZauNxbmw2vKT5o5x/opC/S8c//Wo3/civjn2gx/umtH7t/f9r62x7/K4Or3J2nrWMj6fjvmfq9bWvGfys3rQ11Zbm/1JrVk1y+UiqeyrZBKs2P1lKtR27HH/z2oF392fjv43S6/+6rH6X1p/PVNXJ3unsff83EeLX7m6cJusm9mzGQJdfEn6z0f9Jm/Hthk3W88P83P2i3LI0/jbcxrY9/dy3fijjWsv9X+zLZ8P7EkdruMNLYKVr47Pv3B9rV39z/6ZTWn853PtLW7t2MGLg/GEmyug3qS1biH0qa79esbL2Ob28Nftlu2ZPjb7n/jx9KXq6lD2Vl18er1dnRiEPJi+vLT6++tpFvrJ/Gf/xfrY//erWt9//0M+GlTcbffffHT7Yf/+5K45/YeP9f0/99WfFqyZMStx9NdbWrf3P9P1ZLHc9K0v5/Ulybadf29mYAAAAAAAAAAAAAAAAAAAAAAAAA2LpcRByJJJdfSedy+Xz9Gd5/i4FcqVypnrhcnpuZiNqzsoeiJ9f4qcvBpt9DHc1+srWRP70m/5+I+GtEvNfbX8vnC+XSRKeDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM4TbP/0/90Nvp1gEAu6av0w0AAPac8z8AHDxbO//371o7AIC94/M/ABw8mz7/X9rddgAAe8fnfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHbZhfPn02n5l6XFQpqfuDY/N1W+dnKiWJnKT88V8oXy7NX8ZLk8WSrmC+Xptv/oRn1WKpevjsXM3PWRarFSHanML1ycLs/NVC9emR6fLF4s9uxZZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACweZX5hanxUqk4+6dI3FgNbIf/c39H4xrYH5u3KdEd+6IZ+zrRG/uiGdtMNL9L9HfgnQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgj+H3AAAA//+0Bxg2") mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x9, @mcast1, 0x48f}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000540)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6, 0x0, 0x3, 0xd}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000580)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) (async) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) (async) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) chdir(&(0x7f0000000f80)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x88040, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x181) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x3000440, 0x0, 0xff, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) (async) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) (async) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) newfstatat(0xffffffffffffff9c, &(0x7f0000000440)='./file0/file1\x00', &(0x7f0000000480), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000fc0)='./file1/file0\x00', 0x140) mount$bind(&(0x7f0000001000)='.\x00', &(0x7f0000001040)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f0000001080)='./bus\x00', &(0x7f00000010c0), 0x40, &(0x7f0000001100)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]}) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000001300)=@raw={'raw\x00', 0x9, 0x3, 0x220, 0x0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0xf0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0xc8, 0xf0, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'lo\x00', {0x0, 0x3e8, 0x5, 0x8, 0x40, 0x3e8, 0x3e8}}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffffffffffff}}}}, 0x280) syz_emit_ethernet(0x2a, &(0x7f0000001580)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) (async) syz_emit_ethernet(0x2a, &(0x7f0000001580)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000015c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001600)='./proc\x00', &(0x7f0000001640)='proc\x00', 0x0, 0x0) (async) mount(0x0, &(0x7f0000001600)='./proc\x00', &(0x7f0000001640)='proc\x00', 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000001680)={0x3, &(0x7f00000016c0)=[{0x2d, 0x0, 0x1, 0x3}, {0xac, 0x0, 0x4, 0x4}, {0x6, 0x0, 0x9}]}) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) (async) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000001700)='./proc/net/ipt_hashlimit/lo\x00', 0x0, 0x0) (async) r2 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./proc/net/ipt_hashlimit/lo\x00', 0x0, 0x0) read$FUSE(r2, &(0x7f0000001740)={0x2020}, 0x2020) accept4$unix(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x80800) (async) r3 = accept4$unix(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x80800) sendto$unix(r3, &(0x7f0000000180)="d1f0fe0a5f25af3efacd9b2e7fc36ae040ec36a45758ab8d80f839b3e16f3766d1e356f49e367e5b78c9c7af5a8377bd9c3218c21f9b4ff0cad585cc52186656ce24f6ab9d4f463041663250d02544c33579f60b6a7a45374b620339107b7c2eeefc3df0e6d951484c32426f6067662aba416c76745057f0a2f6cc701e6be591721ea1f04951338ddd3786", 0x8b, 0x4000, &(0x7f00000002c0)=@file={0x1, './bus\x00'}, 0x6e) (async) sendto$unix(r3, &(0x7f0000000180)="d1f0fe0a5f25af3efacd9b2e7fc36ae040ec36a45758ab8d80f839b3e16f3766d1e356f49e367e5b78c9c7af5a8377bd9c3218c21f9b4ff0cad585cc52186656ce24f6ab9d4f463041663250d02544c33579f60b6a7a45374b620339107b7c2eeefc3df0e6d951484c32426f6067662aba416c76745057f0a2f6cc701e6be591721ea1f04951338ddd3786", 0x8b, 0x4000, &(0x7f00000002c0)=@file={0x1, './bus\x00'}, 0x6e) openat(0xffffffffffffff9c, &(0x7f00000012c0)='./bus/file0\x00', 0x12800, 0x40) executing program 2: r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, 0x0, 0x0) (async, rerun: 64) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'veth1_vlan\x00', 0x200}) (rerun: 64) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newlink={0x28, 0x10, 0x1, 0x70bd28, 0x25dfdbf9, {0x0, 0x0, 0x0, 0x0, 0x4ac00, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x40801}, 0x4000000) program crashed: KASAN: use-after-free Read in incfs_free_mount_info bisect: the chunk can be dropped bisect: split chunks (needed=true): <2> bisect: split chunk #0 of len 2 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-setsockopt$netlink_NETLINK_TX_RING-ioctl$sock_inet_SIOCSIFFLAGS-socket$nl_route-sendmsg$nl_route detailed listing: executing program 2: r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, 0x0, 0x0) (async, rerun: 64) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'veth1_vlan\x00', 0x200}) (rerun: 64) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newlink={0x28, 0x10, 0x1, 0x70bd28, 0x25dfdbf9, {0x0, 0x0, 0x0, 0x0, 0x4ac00, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x40801}, 0x4000000) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mkdir-socket$inet6-bind$inet6-setsockopt$inet6_IPV6_FLOWLABEL_MGR-setsockopt$inet6_int-sendmmsg-sendmmsg-mount$incfs-mount$incfs-chdir-openat-mkdirat-syz_mount_image$fuse-mount$overlay-mount$overlay-setxattr$security_capability-setxattr$security_capability-newfstatat-mkdirat-mount$bind-mount$overlay-socket$inet_icmp_raw-setsockopt$IPT_SO_SET_REPLACE-syz_emit_ethernet-syz_emit_ethernet-mkdirat-mount-mount-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-setsockopt$IPT_SO_SET_REPLACE-setsockopt$IPT_SO_SET_REPLACE-openat-openat-read$FUSE-accept4$unix-accept4$unix-sendto$unix-sendto$unix-openat detailed listing: executing program 5: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000000, &(0x7f0000000280)={[{@nodelalloc}, {@jqfmt_vfsv1}, {@errors_remount}, {@nouser_xattr}]}, 0x0, 0x7b9, &(0x7f00000006c0)="$eJzs3c9rG1ceAPDvyHb8I1nshWV3czMsZAMhcpz1JrvQQ0oPpdBAoD03MbJiUstWsOQQG0MTSqGXQlt6KLSXnPsjvfXaH9BT+1/0UBLSxglN6aG4jDSyFVtybMe23PrzgfG892bk977zZjRPmkETwIE1nP7JRRyNiLeTiMGsPImInlqqO+Jcfb1HS4t9EVFIYnn5pZ+S2joPlxYL0fSa1OEs88+I+OqNiBO59fVW5hemxkul4myWH6lOXx2pzC+cvDI9PlmcLM6cGR0bO332v2fP7FysP3+3cOTuO8//+9Nzv77+j9tvfZ3EuTiSLWuOY6cMx3C2TXrSTfiY53a6sg5LOt0AtiU9NLvqR3kcjcHoqqXa6N/LlgEAu+W1iFgGAA6YxPkfAA6YxvcAD5cWC42ps99I7K17z0ZEXz3+R9lUX9KdXbPrq10HHXiYPHZlJImIoR2ofzgiPvz8lWNdWT5th2tpwF64cTMiLg0Nr3//T9bds7BVpzZauNxbmw2vKT5o5x/opC/S8c//Wo3/civjn2gx/umtH7t/f9r62x7/K4Or3J2nrWMj6fjvmfq9bWvGfys3rQ11Zbm/1JrVk1y+UiqeyrZBKs2P1lKtR27HH/z2oF392fjv43S6/+6rH6X1p/PVNXJ3unsff83EeLX7m6cJusm9mzGQJdfEn6z0f9Jm/Hthk3W88P83P2i3LI0/jbcxrY9/dy3fijjWsv9X+zLZ8P7EkdruMNLYKVr47Pv3B9rV39z/6ZTWn853PtLW7t2MGLg/GEmyug3qS1biH0qa79esbL2Ob28Nftlu2ZPjb7n/jx9KXq6lD2Vl18er1dnRiEPJi+vLT6++tpFvrJ/Gf/xfrY//erWt9//0M+GlTcbffffHT7Yf/+5K45/YeP9f0/99WfFqyZMStx9NdbWrf3P9P1ZLHc9K0v5/Ulybadf29mYAAAAAAAAAAAAAAAAAAAAAAAAA2LpcRByJJJdfSedy+Xz9Gd5/i4FcqVypnrhcnpuZiNqzsoeiJ9f4qcvBpt9DHc1+srWRP70m/5+I+GtEvNfbX8vnC+XSRKeDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM4TbP/0/90Nvp1gEAu6av0w0AAPac8z8AHDxbO//371o7AIC94/M/ABw8mz7/X9rddgAAe8fnfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHbZhfPn02n5l6XFQpqfuDY/N1W+dnKiWJnKT88V8oXy7NX8ZLk8WSrmC+Xptv/oRn1WKpevjsXM3PWRarFSHanML1ycLs/NVC9emR6fLF4s9uxZZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACweZX5hanxUqk4+6dI3FgNbIf/c39H4xrYH5u3KdEd+6IZ+zrRG/uiGdtMNL9L9HfgnQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgj+H3AAAA//+0Bxg2") mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x9, @mcast1, 0x48f}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000540)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6, 0x0, 0x3, 0xd}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000580)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) (async) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) (async) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) chdir(&(0x7f0000000f80)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x88040, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x181) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x3000440, 0x0, 0xff, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) (async) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) (async) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) newfstatat(0xffffffffffffff9c, &(0x7f0000000440)='./file0/file1\x00', &(0x7f0000000480), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000fc0)='./file1/file0\x00', 0x140) mount$bind(&(0x7f0000001000)='.\x00', &(0x7f0000001040)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f0000001080)='./bus\x00', &(0x7f00000010c0), 0x40, &(0x7f0000001100)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]}) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000001300)=@raw={'raw\x00', 0x9, 0x3, 0x220, 0x0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0xf0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0xc8, 0xf0, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'lo\x00', {0x0, 0x3e8, 0x5, 0x8, 0x40, 0x3e8, 0x3e8}}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffffffffffff}}}}, 0x280) syz_emit_ethernet(0x2a, &(0x7f0000001580)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) (async) syz_emit_ethernet(0x2a, &(0x7f0000001580)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000015c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001600)='./proc\x00', &(0x7f0000001640)='proc\x00', 0x0, 0x0) (async) mount(0x0, &(0x7f0000001600)='./proc\x00', &(0x7f0000001640)='proc\x00', 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000001680)={0x3, &(0x7f00000016c0)=[{0x2d, 0x0, 0x1, 0x3}, {0xac, 0x0, 0x4, 0x4}, {0x6, 0x0, 0x9}]}) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) (async) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000001700)='./proc/net/ipt_hashlimit/lo\x00', 0x0, 0x0) (async) r2 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./proc/net/ipt_hashlimit/lo\x00', 0x0, 0x0) read$FUSE(r2, &(0x7f0000001740)={0x2020}, 0x2020) accept4$unix(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x80800) (async) r3 = accept4$unix(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x80800) sendto$unix(r3, &(0x7f0000000180)="d1f0fe0a5f25af3efacd9b2e7fc36ae040ec36a45758ab8d80f839b3e16f3766d1e356f49e367e5b78c9c7af5a8377bd9c3218c21f9b4ff0cad585cc52186656ce24f6ab9d4f463041663250d02544c33579f60b6a7a45374b620339107b7c2eeefc3df0e6d951484c32426f6067662aba416c76745057f0a2f6cc701e6be591721ea1f04951338ddd3786", 0x8b, 0x4000, &(0x7f00000002c0)=@file={0x1, './bus\x00'}, 0x6e) (async) sendto$unix(r3, &(0x7f0000000180)="d1f0fe0a5f25af3efacd9b2e7fc36ae040ec36a45758ab8d80f839b3e16f3766d1e356f49e367e5b78c9c7af5a8377bd9c3218c21f9b4ff0cad585cc52186656ce24f6ab9d4f463041663250d02544c33579f60b6a7a45374b620339107b7c2eeefc3df0e6d951484c32426f6067662aba416c76745057f0a2f6cc701e6be591721ea1f04951338ddd3786", 0x8b, 0x4000, &(0x7f00000002c0)=@file={0x1, './bus\x00'}, 0x6e) openat(0xffffffffffffff9c, &(0x7f00000012c0)='./bus/file0\x00', 0x12800, 0x40) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir bisect: the chunk can be dropped bisect: split chunks (needed=true): <1> bisect: split chunk #0 of len 1 into 2 parts bisect: no way to further split the chunk bisect: 1 programs left: executing program 5: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000000, &(0x7f0000000280)={[{@nodelalloc}, {@jqfmt_vfsv1}, {@errors_remount}, {@nouser_xattr}]}, 0x0, 0x7b9, &(0x7f00000006c0)="$eJzs3c9rG1ceAPDvyHb8I1nshWV3czMsZAMhcpz1JrvQQ0oPpdBAoD03MbJiUstWsOQQG0MTSqGXQlt6KLSXnPsjvfXaH9BT+1/0UBLSxglN6aG4jDSyFVtybMe23PrzgfG892bk977zZjRPmkETwIE1nP7JRRyNiLeTiMGsPImInlqqO+Jcfb1HS4t9EVFIYnn5pZ+S2joPlxYL0fSa1OEs88+I+OqNiBO59fVW5hemxkul4myWH6lOXx2pzC+cvDI9PlmcLM6cGR0bO332v2fP7FysP3+3cOTuO8//+9Nzv77+j9tvfZ3EuTiSLWuOY6cMx3C2TXrSTfiY53a6sg5LOt0AtiU9NLvqR3kcjcHoqqXa6N/LlgEAu+W1iFgGAA6YxPkfAA6YxvcAD5cWC42ps99I7K17z0ZEXz3+R9lUX9KdXbPrq10HHXiYPHZlJImIoR2ofzgiPvz8lWNdWT5th2tpwF64cTMiLg0Nr3//T9bds7BVpzZauNxbmw2vKT5o5x/opC/S8c//Wo3/civjn2gx/umtH7t/f9r62x7/K4Or3J2nrWMj6fjvmfq9bWvGfys3rQ11Zbm/1JrVk1y+UiqeyrZBKs2P1lKtR27HH/z2oF392fjv43S6/+6rH6X1p/PVNXJ3unsff83EeLX7m6cJusm9mzGQJdfEn6z0f9Jm/Hthk3W88P83P2i3LI0/jbcxrY9/dy3fijjWsv9X+zLZ8P7EkdruMNLYKVr47Pv3B9rV39z/6ZTWn853PtLW7t2MGLg/GEmyug3qS1biH0qa79esbL2Ob28Nftlu2ZPjb7n/jx9KXq6lD2Vl18er1dnRiEPJi+vLT6++tpFvrJ/Gf/xfrY//erWt9//0M+GlTcbffffHT7Yf/+5K45/YeP9f0/99WfFqyZMStx9NdbWrf3P9P1ZLHc9K0v5/Ulybadf29mYAAAAAAAAAAAAAAAAAAAAAAAAA2LpcRByJJJdfSedy+Xz9Gd5/i4FcqVypnrhcnpuZiNqzsoeiJ9f4qcvBpt9DHc1+srWRP70m/5+I+GtEvNfbX8vnC+XSRKeDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM4TbP/0/90Nvp1gEAu6av0w0AAPac8z8AHDxbO//371o7AIC94/M/ABw8mz7/X9rddgAAe8fnfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHbZhfPn02n5l6XFQpqfuDY/N1W+dnKiWJnKT88V8oXy7NX8ZLk8WSrmC+Xptv/oRn1WKpevjsXM3PWRarFSHanML1ycLs/NVC9emR6fLF4s9uxZZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACweZX5hanxUqk4+6dI3FgNbIf/c39H4xrYH5u3KdEd+6IZ+zrRG/uiGdtMNL9L9HfgnQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgj+H3AAAA//+0Bxg2") mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x9, @mcast1, 0x48f}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000540)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6, 0x0, 0x3, 0xd}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000580)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) (async) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) (async) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) chdir(&(0x7f0000000f80)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x88040, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x181) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x3000440, 0x0, 0xff, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) (async) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) (async) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) newfstatat(0xffffffffffffff9c, &(0x7f0000000440)='./file0/file1\x00', &(0x7f0000000480), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000fc0)='./file1/file0\x00', 0x140) mount$bind(&(0x7f0000001000)='.\x00', &(0x7f0000001040)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f0000001080)='./bus\x00', &(0x7f00000010c0), 0x40, &(0x7f0000001100)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]}) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000001300)=@raw={'raw\x00', 0x9, 0x3, 0x220, 0x0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0xf0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0xc8, 0xf0, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'lo\x00', {0x0, 0x3e8, 0x5, 0x8, 0x40, 0x3e8, 0x3e8}}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffffffffffff}}}}, 0x280) syz_emit_ethernet(0x2a, &(0x7f0000001580)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) (async) syz_emit_ethernet(0x2a, &(0x7f0000001580)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000015c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001600)='./proc\x00', &(0x7f0000001640)='proc\x00', 0x0, 0x0) (async) mount(0x0, &(0x7f0000001600)='./proc\x00', &(0x7f0000001640)='proc\x00', 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000001680)={0x3, &(0x7f00000016c0)=[{0x2d, 0x0, 0x1, 0x3}, {0xac, 0x0, 0x4, 0x4}, {0x6, 0x0, 0x9}]}) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) (async) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000001700)='./proc/net/ipt_hashlimit/lo\x00', 0x0, 0x0) (async) r2 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./proc/net/ipt_hashlimit/lo\x00', 0x0, 0x0) read$FUSE(r2, &(0x7f0000001740)={0x2020}, 0x2020) accept4$unix(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x80800) (async) r3 = accept4$unix(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x80800) sendto$unix(r3, &(0x7f0000000180)="d1f0fe0a5f25af3efacd9b2e7fc36ae040ec36a45758ab8d80f839b3e16f3766d1e356f49e367e5b78c9c7af5a8377bd9c3218c21f9b4ff0cad585cc52186656ce24f6ab9d4f463041663250d02544c33579f60b6a7a45374b620339107b7c2eeefc3df0e6d951484c32426f6067662aba416c76745057f0a2f6cc701e6be591721ea1f04951338ddd3786", 0x8b, 0x4000, &(0x7f00000002c0)=@file={0x1, './bus\x00'}, 0x6e) (async) sendto$unix(r3, &(0x7f0000000180)="d1f0fe0a5f25af3efacd9b2e7fc36ae040ec36a45758ab8d80f839b3e16f3766d1e356f49e367e5b78c9c7af5a8377bd9c3218c21f9b4ff0cad585cc52186656ce24f6ab9d4f463041663250d02544c33579f60b6a7a45374b620339107b7c2eeefc3df0e6d951484c32426f6067662aba416c76745057f0a2f6cc701e6be591721ea1f04951338ddd3786", 0x8b, 0x4000, &(0x7f00000002c0)=@file={0x1, './bus\x00'}, 0x6e) openat(0xffffffffffffff9c, &(0x7f00000012c0)='./bus/file0\x00', 0x12800, 0x40) bisect: trying to concatenate bisect: concatenate 1 entries testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mkdir-socket$inet6-bind$inet6-setsockopt$inet6_IPV6_FLOWLABEL_MGR-setsockopt$inet6_int-sendmmsg-sendmmsg-mount$incfs-mount$incfs-chdir-openat-mkdirat-syz_mount_image$fuse-mount$overlay-mount$overlay-setxattr$security_capability-setxattr$security_capability-newfstatat-mkdirat-mount$bind-mount$overlay-socket$inet_icmp_raw-setsockopt$IPT_SO_SET_REPLACE-syz_emit_ethernet-syz_emit_ethernet-mkdirat-mount-mount-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-setsockopt$IPT_SO_SET_REPLACE-setsockopt$IPT_SO_SET_REPLACE-openat-openat-read$FUSE-accept4$unix-accept4$unix-sendto$unix-sendto$unix-openat detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000000, &(0x7f0000000280)={[{@nodelalloc}, {@jqfmt_vfsv1}, {@errors_remount}, {@nouser_xattr}]}, 0x0, 0x7b9, &(0x7f00000006c0)="$eJzs3c9rG1ceAPDvyHb8I1nshWV3czMsZAMhcpz1JrvQQ0oPpdBAoD03MbJiUstWsOQQG0MTSqGXQlt6KLSXnPsjvfXaH9BT+1/0UBLSxglN6aG4jDSyFVtybMe23PrzgfG892bk977zZjRPmkETwIE1nP7JRRyNiLeTiMGsPImInlqqO+Jcfb1HS4t9EVFIYnn5pZ+S2joPlxYL0fSa1OEs88+I+OqNiBO59fVW5hemxkul4myWH6lOXx2pzC+cvDI9PlmcLM6cGR0bO332v2fP7FysP3+3cOTuO8//+9Nzv77+j9tvfZ3EuTiSLWuOY6cMx3C2TXrSTfiY53a6sg5LOt0AtiU9NLvqR3kcjcHoqqXa6N/LlgEAu+W1iFgGAA6YxPkfAA6YxvcAD5cWC42ps99I7K17z0ZEXz3+R9lUX9KdXbPrq10HHXiYPHZlJImIoR2ofzgiPvz8lWNdWT5th2tpwF64cTMiLg0Nr3//T9bds7BVpzZauNxbmw2vKT5o5x/opC/S8c//Wo3/civjn2gx/umtH7t/f9r62x7/K4Or3J2nrWMj6fjvmfq9bWvGfys3rQ11Zbm/1JrVk1y+UiqeyrZBKs2P1lKtR27HH/z2oF392fjv43S6/+6rH6X1p/PVNXJ3unsff83EeLX7m6cJusm9mzGQJdfEn6z0f9Jm/Hthk3W88P83P2i3LI0/jbcxrY9/dy3fijjWsv9X+zLZ8P7EkdruMNLYKVr47Pv3B9rV39z/6ZTWn853PtLW7t2MGLg/GEmyug3qS1biH0qa79esbL2Ob28Nftlu2ZPjb7n/jx9KXq6lD2Vl18er1dnRiEPJi+vLT6++tpFvrJ/Gf/xfrY//erWt9//0M+GlTcbffffHT7Yf/+5K45/YeP9f0/99WfFqyZMStx9NdbWrf3P9P1ZLHc9K0v5/Ulybadf29mYAAAAAAAAAAAAAAAAAAAAAAAAA2LpcRByJJJdfSedy+Xz9Gd5/i4FcqVypnrhcnpuZiNqzsoeiJ9f4qcvBpt9DHc1+srWRP70m/5+I+GtEvNfbX8vnC+XSRKeDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM4TbP/0/90Nvp1gEAu6av0w0AAPac8z8AHDxbO//371o7AIC94/M/ABw8mz7/X9rddgAAe8fnfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHbZhfPn02n5l6XFQpqfuDY/N1W+dnKiWJnKT88V8oXy7NX8ZLk8WSrmC+Xptv/oRn1WKpevjsXM3PWRarFSHanML1ycLs/NVC9emR6fLF4s9uxZZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACweZX5hanxUqk4+6dI3FgNbIf/c39H4xrYH5u3KdEd+6IZ+zrRG/uiGdtMNL9L9HfgnQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgj+H3AAAA//+0Bxg2") mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x9, @mcast1, 0x48f}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000540)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6, 0x0, 0x3, 0xd}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000580)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) (async) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) (async) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) chdir(&(0x7f0000000f80)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x88040, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x181) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x3000440, 0x0, 0xff, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) (async) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) (async) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) newfstatat(0xffffffffffffff9c, &(0x7f0000000440)='./file0/file1\x00', &(0x7f0000000480), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000fc0)='./file1/file0\x00', 0x140) mount$bind(&(0x7f0000001000)='.\x00', &(0x7f0000001040)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f0000001080)='./bus\x00', &(0x7f00000010c0), 0x40, &(0x7f0000001100)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]}) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000001300)=@raw={'raw\x00', 0x9, 0x3, 0x220, 0x0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0xf0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0xc8, 0xf0, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'lo\x00', {0x0, 0x3e8, 0x5, 0x8, 0x40, 0x3e8, 0x3e8}}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffffffffffff}}}}, 0x280) syz_emit_ethernet(0x2a, &(0x7f0000001580)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) (async) syz_emit_ethernet(0x2a, &(0x7f0000001580)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000015c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001600)='./proc\x00', &(0x7f0000001640)='proc\x00', 0x0, 0x0) (async) mount(0x0, &(0x7f0000001600)='./proc\x00', &(0x7f0000001640)='proc\x00', 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000001680)={0x3, &(0x7f00000016c0)=[{0x2d, 0x0, 0x1, 0x3}, {0xac, 0x0, 0x4, 0x4}, {0x6, 0x0, 0x9}]}) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) (async) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000001700)='./proc/net/ipt_hashlimit/lo\x00', 0x0, 0x0) (async) r2 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./proc/net/ipt_hashlimit/lo\x00', 0x0, 0x0) read$FUSE(r2, &(0x7f0000001740)={0x2020}, 0x2020) accept4$unix(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x80800) (async) r3 = accept4$unix(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x80800) sendto$unix(r3, &(0x7f0000000180)="d1f0fe0a5f25af3efacd9b2e7fc36ae040ec36a45758ab8d80f839b3e16f3766d1e356f49e367e5b78c9c7af5a8377bd9c3218c21f9b4ff0cad585cc52186656ce24f6ab9d4f463041663250d02544c33579f60b6a7a45374b620339107b7c2eeefc3df0e6d951484c32426f6067662aba416c76745057f0a2f6cc701e6be591721ea1f04951338ddd3786", 0x8b, 0x4000, &(0x7f00000002c0)=@file={0x1, './bus\x00'}, 0x6e) (async) sendto$unix(r3, &(0x7f0000000180)="d1f0fe0a5f25af3efacd9b2e7fc36ae040ec36a45758ab8d80f839b3e16f3766d1e356f49e367e5b78c9c7af5a8377bd9c3218c21f9b4ff0cad585cc52186656ce24f6ab9d4f463041663250d02544c33579f60b6a7a45374b620339107b7c2eeefc3df0e6d951484c32426f6067662aba416c76745057f0a2f6cc701e6be591721ea1f04951338ddd3786", 0x8b, 0x4000, &(0x7f00000002c0)=@file={0x1, './bus\x00'}, 0x6e) openat(0xffffffffffffff9c, &(0x7f00000012c0)='./bus/file0\x00', 0x12800, 0x40) program crashed: KASAN: use-after-free Read in incfs_free_mount_info bisect: concatenation succeeded found reproducer with 40 syscalls minimizing guilty program testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mkdir-socket$inet6-bind$inet6-setsockopt$inet6_IPV6_FLOWLABEL_MGR-setsockopt$inet6_int-sendmmsg-sendmmsg-mount$incfs-mount$incfs-chdir-openat-mkdirat-syz_mount_image$fuse-mount$overlay-mount$overlay-setxattr$security_capability-setxattr$security_capability-newfstatat-mkdirat-mount$bind-mount$overlay-socket$inet_icmp_raw-setsockopt$IPT_SO_SET_REPLACE-syz_emit_ethernet-syz_emit_ethernet-mkdirat-mount-mount-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-setsockopt$IPT_SO_SET_REPLACE-setsockopt$IPT_SO_SET_REPLACE-openat-openat-read$FUSE-accept4$unix-accept4$unix-sendto$unix-sendto$unix detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000000, &(0x7f0000000280)={[{@nodelalloc}, {@jqfmt_vfsv1}, {@errors_remount}, {@nouser_xattr}]}, 0x0, 0x7b9, &(0x7f00000006c0)="$eJzs3c9rG1ceAPDvyHb8I1nshWV3czMsZAMhcpz1JrvQQ0oPpdBAoD03MbJiUstWsOQQG0MTSqGXQlt6KLSXnPsjvfXaH9BT+1/0UBLSxglN6aG4jDSyFVtybMe23PrzgfG892bk977zZjRPmkETwIE1nP7JRRyNiLeTiMGsPImInlqqO+Jcfb1HS4t9EVFIYnn5pZ+S2joPlxYL0fSa1OEs88+I+OqNiBO59fVW5hemxkul4myWH6lOXx2pzC+cvDI9PlmcLM6cGR0bO332v2fP7FysP3+3cOTuO8//+9Nzv77+j9tvfZ3EuTiSLWuOY6cMx3C2TXrSTfiY53a6sg5LOt0AtiU9NLvqR3kcjcHoqqXa6N/LlgEAu+W1iFgGAA6YxPkfAA6YxvcAD5cWC42ps99I7K17z0ZEXz3+R9lUX9KdXbPrq10HHXiYPHZlJImIoR2ofzgiPvz8lWNdWT5th2tpwF64cTMiLg0Nr3//T9bds7BVpzZauNxbmw2vKT5o5x/opC/S8c//Wo3/civjn2gx/umtH7t/f9r62x7/K4Or3J2nrWMj6fjvmfq9bWvGfys3rQ11Zbm/1JrVk1y+UiqeyrZBKs2P1lKtR27HH/z2oF392fjv43S6/+6rH6X1p/PVNXJ3unsff83EeLX7m6cJusm9mzGQJdfEn6z0f9Jm/Hthk3W88P83P2i3LI0/jbcxrY9/dy3fijjWsv9X+zLZ8P7EkdruMNLYKVr47Pv3B9rV39z/6ZTWn853PtLW7t2MGLg/GEmyug3qS1biH0qa79esbL2Ob28Nftlu2ZPjb7n/jx9KXq6lD2Vl18er1dnRiEPJi+vLT6++tpFvrJ/Gf/xfrY//erWt9//0M+GlTcbffffHT7Yf/+5K45/YeP9f0/99WfFqyZMStx9NdbWrf3P9P1ZLHc9K0v5/Ulybadf29mYAAAAAAAAAAAAAAAAAAAAAAAAA2LpcRByJJJdfSedy+Xz9Gd5/i4FcqVypnrhcnpuZiNqzsoeiJ9f4qcvBpt9DHc1+srWRP70m/5+I+GtEvNfbX8vnC+XSRKeDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM4TbP/0/90Nvp1gEAu6av0w0AAPac8z8AHDxbO//371o7AIC94/M/ABw8mz7/X9rddgAAe8fnfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHbZhfPn02n5l6XFQpqfuDY/N1W+dnKiWJnKT88V8oXy7NX8ZLk8WSrmC+Xptv/oRn1WKpevjsXM3PWRarFSHanML1ycLs/NVC9emR6fLF4s9uxZZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACweZX5hanxUqk4+6dI3FgNbIf/c39H4xrYH5u3KdEd+6IZ+zrRG/uiGdtMNL9L9HfgnQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgj+H3AAAA//+0Bxg2") mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x9, @mcast1, 0x48f}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000540)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6, 0x0, 0x3, 0xd}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000580)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) (async) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) (async) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) chdir(&(0x7f0000000f80)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x88040, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x181) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x3000440, 0x0, 0xff, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) (async) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) (async) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) newfstatat(0xffffffffffffff9c, &(0x7f0000000440)='./file0/file1\x00', &(0x7f0000000480), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000fc0)='./file1/file0\x00', 0x140) mount$bind(&(0x7f0000001000)='.\x00', &(0x7f0000001040)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f0000001080)='./bus\x00', &(0x7f00000010c0), 0x40, &(0x7f0000001100)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]}) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000001300)=@raw={'raw\x00', 0x9, 0x3, 0x220, 0x0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0xf0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0xc8, 0xf0, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'lo\x00', {0x0, 0x3e8, 0x5, 0x8, 0x40, 0x3e8, 0x3e8}}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffffffffffff}}}}, 0x280) syz_emit_ethernet(0x2a, &(0x7f0000001580)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) (async) syz_emit_ethernet(0x2a, &(0x7f0000001580)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000015c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001600)='./proc\x00', &(0x7f0000001640)='proc\x00', 0x0, 0x0) (async) mount(0x0, &(0x7f0000001600)='./proc\x00', &(0x7f0000001640)='proc\x00', 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000001680)={0x3, &(0x7f00000016c0)=[{0x2d, 0x0, 0x1, 0x3}, {0xac, 0x0, 0x4, 0x4}, {0x6, 0x0, 0x9}]}) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) (async) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000001700)='./proc/net/ipt_hashlimit/lo\x00', 0x0, 0x0) (async) r2 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./proc/net/ipt_hashlimit/lo\x00', 0x0, 0x0) read$FUSE(r2, &(0x7f0000001740)={0x2020}, 0x2020) accept4$unix(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x80800) (async) r3 = accept4$unix(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x80800) sendto$unix(r3, &(0x7f0000000180)="d1f0fe0a5f25af3efacd9b2e7fc36ae040ec36a45758ab8d80f839b3e16f3766d1e356f49e367e5b78c9c7af5a8377bd9c3218c21f9b4ff0cad585cc52186656ce24f6ab9d4f463041663250d02544c33579f60b6a7a45374b620339107b7c2eeefc3df0e6d951484c32426f6067662aba416c76745057f0a2f6cc701e6be591721ea1f04951338ddd3786", 0x8b, 0x4000, &(0x7f00000002c0)=@file={0x1, './bus\x00'}, 0x6e) (async) sendto$unix(r3, &(0x7f0000000180)="d1f0fe0a5f25af3efacd9b2e7fc36ae040ec36a45758ab8d80f839b3e16f3766d1e356f49e367e5b78c9c7af5a8377bd9c3218c21f9b4ff0cad585cc52186656ce24f6ab9d4f463041663250d02544c33579f60b6a7a45374b620339107b7c2eeefc3df0e6d951484c32426f6067662aba416c76745057f0a2f6cc701e6be591721ea1f04951338ddd3786", 0x8b, 0x4000, &(0x7f00000002c0)=@file={0x1, './bus\x00'}, 0x6e) program crashed: KASAN: use-after-free Read in incfs_free_mount_info testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mkdir-socket$inet6-bind$inet6-setsockopt$inet6_IPV6_FLOWLABEL_MGR-setsockopt$inet6_int-sendmmsg-sendmmsg-mount$incfs-mount$incfs-chdir-openat-mkdirat-syz_mount_image$fuse-mount$overlay-mount$overlay-setxattr$security_capability-setxattr$security_capability-newfstatat-mkdirat-mount$bind-mount$overlay-socket$inet_icmp_raw-setsockopt$IPT_SO_SET_REPLACE-syz_emit_ethernet-syz_emit_ethernet-mkdirat-mount-mount-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-setsockopt$IPT_SO_SET_REPLACE-setsockopt$IPT_SO_SET_REPLACE-openat-openat-read$FUSE-accept4$unix-accept4$unix-sendto$unix detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000000, &(0x7f0000000280)={[{@nodelalloc}, {@jqfmt_vfsv1}, {@errors_remount}, {@nouser_xattr}]}, 0x0, 0x7b9, &(0x7f00000006c0)="$eJzs3c9rG1ceAPDvyHb8I1nshWV3czMsZAMhcpz1JrvQQ0oPpdBAoD03MbJiUstWsOQQG0MTSqGXQlt6KLSXnPsjvfXaH9BT+1/0UBLSxglN6aG4jDSyFVtybMe23PrzgfG892bk977zZjRPmkETwIE1nP7JRRyNiLeTiMGsPImInlqqO+Jcfb1HS4t9EVFIYnn5pZ+S2joPlxYL0fSa1OEs88+I+OqNiBO59fVW5hemxkul4myWH6lOXx2pzC+cvDI9PlmcLM6cGR0bO332v2fP7FysP3+3cOTuO8//+9Nzv77+j9tvfZ3EuTiSLWuOY6cMx3C2TXrSTfiY53a6sg5LOt0AtiU9NLvqR3kcjcHoqqXa6N/LlgEAu+W1iFgGAA6YxPkfAA6YxvcAD5cWC42ps99I7K17z0ZEXz3+R9lUX9KdXbPrq10HHXiYPHZlJImIoR2ofzgiPvz8lWNdWT5th2tpwF64cTMiLg0Nr3//T9bds7BVpzZauNxbmw2vKT5o5x/opC/S8c//Wo3/civjn2gx/umtH7t/f9r62x7/K4Or3J2nrWMj6fjvmfq9bWvGfys3rQ11Zbm/1JrVk1y+UiqeyrZBKs2P1lKtR27HH/z2oF392fjv43S6/+6rH6X1p/PVNXJ3unsff83EeLX7m6cJusm9mzGQJdfEn6z0f9Jm/Hthk3W88P83P2i3LI0/jbcxrY9/dy3fijjWsv9X+zLZ8P7EkdruMNLYKVr47Pv3B9rV39z/6ZTWn853PtLW7t2MGLg/GEmyug3qS1biH0qa79esbL2Ob28Nftlu2ZPjb7n/jx9KXq6lD2Vl18er1dnRiEPJi+vLT6++tpFvrJ/Gf/xfrY//erWt9//0M+GlTcbffffHT7Yf/+5K45/YeP9f0/99WfFqyZMStx9NdbWrf3P9P1ZLHc9K0v5/Ulybadf29mYAAAAAAAAAAAAAAAAAAAAAAAAA2LpcRByJJJdfSedy+Xz9Gd5/i4FcqVypnrhcnpuZiNqzsoeiJ9f4qcvBpt9DHc1+srWRP70m/5+I+GtEvNfbX8vnC+XSRKeDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM4TbP/0/90Nvp1gEAu6av0w0AAPac8z8AHDxbO//371o7AIC94/M/ABw8mz7/X9rddgAAe8fnfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHbZhfPn02n5l6XFQpqfuDY/N1W+dnKiWJnKT88V8oXy7NX8ZLk8WSrmC+Xptv/oRn1WKpevjsXM3PWRarFSHanML1ycLs/NVC9emR6fLF4s9uxZZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACweZX5hanxUqk4+6dI3FgNbIf/c39H4xrYH5u3KdEd+6IZ+zrRG/uiGdtMNL9L9HfgnQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgj+H3AAAA//+0Bxg2") mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x9, @mcast1, 0x48f}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000540)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6, 0x0, 0x3, 0xd}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000580)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) (async) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) (async) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) chdir(&(0x7f0000000f80)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x88040, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x181) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x3000440, 0x0, 0xff, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) (async) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) (async) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) newfstatat(0xffffffffffffff9c, &(0x7f0000000440)='./file0/file1\x00', &(0x7f0000000480), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000fc0)='./file1/file0\x00', 0x140) mount$bind(&(0x7f0000001000)='.\x00', &(0x7f0000001040)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f0000001080)='./bus\x00', &(0x7f00000010c0), 0x40, &(0x7f0000001100)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]}) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000001300)=@raw={'raw\x00', 0x9, 0x3, 0x220, 0x0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0xf0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0xc8, 0xf0, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'lo\x00', {0x0, 0x3e8, 0x5, 0x8, 0x40, 0x3e8, 0x3e8}}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffffffffffff}}}}, 0x280) syz_emit_ethernet(0x2a, &(0x7f0000001580)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) (async) syz_emit_ethernet(0x2a, &(0x7f0000001580)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000015c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001600)='./proc\x00', &(0x7f0000001640)='proc\x00', 0x0, 0x0) (async) mount(0x0, &(0x7f0000001600)='./proc\x00', &(0x7f0000001640)='proc\x00', 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000001680)={0x3, &(0x7f00000016c0)=[{0x2d, 0x0, 0x1, 0x3}, {0xac, 0x0, 0x4, 0x4}, {0x6, 0x0, 0x9}]}) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) (async) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000001700)='./proc/net/ipt_hashlimit/lo\x00', 0x0, 0x0) (async) r2 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./proc/net/ipt_hashlimit/lo\x00', 0x0, 0x0) read$FUSE(r2, &(0x7f0000001740)={0x2020}, 0x2020) accept4$unix(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x80800) (async) r3 = accept4$unix(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x80800) sendto$unix(r3, &(0x7f0000000180)="d1f0fe0a5f25af3efacd9b2e7fc36ae040ec36a45758ab8d80f839b3e16f3766d1e356f49e367e5b78c9c7af5a8377bd9c3218c21f9b4ff0cad585cc52186656ce24f6ab9d4f463041663250d02544c33579f60b6a7a45374b620339107b7c2eeefc3df0e6d951484c32426f6067662aba416c76745057f0a2f6cc701e6be591721ea1f04951338ddd3786", 0x8b, 0x4000, &(0x7f00000002c0)=@file={0x1, './bus\x00'}, 0x6e) (async) program crashed: KASAN: use-after-free Read in incfs_free_mount_info testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mkdir-socket$inet6-bind$inet6-setsockopt$inet6_IPV6_FLOWLABEL_MGR-setsockopt$inet6_int-sendmmsg-sendmmsg-mount$incfs-mount$incfs-chdir-openat-mkdirat-syz_mount_image$fuse-mount$overlay-mount$overlay-setxattr$security_capability-setxattr$security_capability-newfstatat-mkdirat-mount$bind-mount$overlay-socket$inet_icmp_raw-setsockopt$IPT_SO_SET_REPLACE-syz_emit_ethernet-syz_emit_ethernet-mkdirat-mount-mount-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-setsockopt$IPT_SO_SET_REPLACE-setsockopt$IPT_SO_SET_REPLACE-openat-openat-read$FUSE-accept4$unix-accept4$unix detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000000, &(0x7f0000000280)={[{@nodelalloc}, {@jqfmt_vfsv1}, {@errors_remount}, {@nouser_xattr}]}, 0x0, 0x7b9, &(0x7f00000006c0)="$eJzs3c9rG1ceAPDvyHb8I1nshWV3czMsZAMhcpz1JrvQQ0oPpdBAoD03MbJiUstWsOQQG0MTSqGXQlt6KLSXnPsjvfXaH9BT+1/0UBLSxglN6aG4jDSyFVtybMe23PrzgfG892bk977zZjRPmkETwIE1nP7JRRyNiLeTiMGsPImInlqqO+Jcfb1HS4t9EVFIYnn5pZ+S2joPlxYL0fSa1OEs88+I+OqNiBO59fVW5hemxkul4myWH6lOXx2pzC+cvDI9PlmcLM6cGR0bO332v2fP7FysP3+3cOTuO8//+9Nzv77+j9tvfZ3EuTiSLWuOY6cMx3C2TXrSTfiY53a6sg5LOt0AtiU9NLvqR3kcjcHoqqXa6N/LlgEAu+W1iFgGAA6YxPkfAA6YxvcAD5cWC42ps99I7K17z0ZEXz3+R9lUX9KdXbPrq10HHXiYPHZlJImIoR2ofzgiPvz8lWNdWT5th2tpwF64cTMiLg0Nr3//T9bds7BVpzZauNxbmw2vKT5o5x/opC/S8c//Wo3/civjn2gx/umtH7t/f9r62x7/K4Or3J2nrWMj6fjvmfq9bWvGfys3rQ11Zbm/1JrVk1y+UiqeyrZBKs2P1lKtR27HH/z2oF392fjv43S6/+6rH6X1p/PVNXJ3unsff83EeLX7m6cJusm9mzGQJdfEn6z0f9Jm/Hthk3W88P83P2i3LI0/jbcxrY9/dy3fijjWsv9X+zLZ8P7EkdruMNLYKVr47Pv3B9rV39z/6ZTWn853PtLW7t2MGLg/GEmyug3qS1biH0qa79esbL2Ob28Nftlu2ZPjb7n/jx9KXq6lD2Vl18er1dnRiEPJi+vLT6++tpFvrJ/Gf/xfrY//erWt9//0M+GlTcbffffHT7Yf/+5K45/YeP9f0/99WfFqyZMStx9NdbWrf3P9P1ZLHc9K0v5/Ulybadf29mYAAAAAAAAAAAAAAAAAAAAAAAAA2LpcRByJJJdfSedy+Xz9Gd5/i4FcqVypnrhcnpuZiNqzsoeiJ9f4qcvBpt9DHc1+srWRP70m/5+I+GtEvNfbX8vnC+XSRKeDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM4TbP/0/90Nvp1gEAu6av0w0AAPac8z8AHDxbO//371o7AIC94/M/ABw8mz7/X9rddgAAe8fnfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHbZhfPn02n5l6XFQpqfuDY/N1W+dnKiWJnKT88V8oXy7NX8ZLk8WSrmC+Xptv/oRn1WKpevjsXM3PWRarFSHanML1ycLs/NVC9emR6fLF4s9uxZZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACweZX5hanxUqk4+6dI3FgNbIf/c39H4xrYH5u3KdEd+6IZ+zrRG/uiGdtMNL9L9HfgnQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgj+H3AAAA//+0Bxg2") mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x9, @mcast1, 0x48f}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000540)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6, 0x0, 0x3, 0xd}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000580)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) (async) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) (async) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) chdir(&(0x7f0000000f80)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x88040, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x181) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x3000440, 0x0, 0xff, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) (async) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) (async) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) newfstatat(0xffffffffffffff9c, &(0x7f0000000440)='./file0/file1\x00', &(0x7f0000000480), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000fc0)='./file1/file0\x00', 0x140) mount$bind(&(0x7f0000001000)='.\x00', &(0x7f0000001040)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f0000001080)='./bus\x00', &(0x7f00000010c0), 0x40, &(0x7f0000001100)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]}) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000001300)=@raw={'raw\x00', 0x9, 0x3, 0x220, 0x0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0xf0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0xc8, 0xf0, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'lo\x00', {0x0, 0x3e8, 0x5, 0x8, 0x40, 0x3e8, 0x3e8}}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffffffffffff}}}}, 0x280) syz_emit_ethernet(0x2a, &(0x7f0000001580)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) (async) syz_emit_ethernet(0x2a, &(0x7f0000001580)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000015c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001600)='./proc\x00', &(0x7f0000001640)='proc\x00', 0x0, 0x0) (async) mount(0x0, &(0x7f0000001600)='./proc\x00', &(0x7f0000001640)='proc\x00', 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000001680)={0x3, &(0x7f00000016c0)=[{0x2d, 0x0, 0x1, 0x3}, {0xac, 0x0, 0x4, 0x4}, {0x6, 0x0, 0x9}]}) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) (async) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000001700)='./proc/net/ipt_hashlimit/lo\x00', 0x0, 0x0) (async) r2 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./proc/net/ipt_hashlimit/lo\x00', 0x0, 0x0) read$FUSE(r2, &(0x7f0000001740)={0x2020}, 0x2020) accept4$unix(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x80800) (async) accept4$unix(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x80800) program crashed: KASAN: use-after-free Read in incfs_free_mount_info testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mkdir-socket$inet6-bind$inet6-setsockopt$inet6_IPV6_FLOWLABEL_MGR-setsockopt$inet6_int-sendmmsg-sendmmsg-mount$incfs-mount$incfs-chdir-openat-mkdirat-syz_mount_image$fuse-mount$overlay-mount$overlay-setxattr$security_capability-setxattr$security_capability-newfstatat-mkdirat-mount$bind-mount$overlay-socket$inet_icmp_raw-setsockopt$IPT_SO_SET_REPLACE-syz_emit_ethernet-syz_emit_ethernet-mkdirat-mount-mount-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-setsockopt$IPT_SO_SET_REPLACE-setsockopt$IPT_SO_SET_REPLACE-openat-openat-read$FUSE-accept4$unix detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000000, &(0x7f0000000280)={[{@nodelalloc}, {@jqfmt_vfsv1}, {@errors_remount}, {@nouser_xattr}]}, 0x0, 0x7b9, &(0x7f00000006c0)="$eJzs3c9rG1ceAPDvyHb8I1nshWV3czMsZAMhcpz1JrvQQ0oPpdBAoD03MbJiUstWsOQQG0MTSqGXQlt6KLSXnPsjvfXaH9BT+1/0UBLSxglN6aG4jDSyFVtybMe23PrzgfG892bk977zZjRPmkETwIE1nP7JRRyNiLeTiMGsPImInlqqO+Jcfb1HS4t9EVFIYnn5pZ+S2joPlxYL0fSa1OEs88+I+OqNiBO59fVW5hemxkul4myWH6lOXx2pzC+cvDI9PlmcLM6cGR0bO332v2fP7FysP3+3cOTuO8//+9Nzv77+j9tvfZ3EuTiSLWuOY6cMx3C2TXrSTfiY53a6sg5LOt0AtiU9NLvqR3kcjcHoqqXa6N/LlgEAu+W1iFgGAA6YxPkfAA6YxvcAD5cWC42ps99I7K17z0ZEXz3+R9lUX9KdXbPrq10HHXiYPHZlJImIoR2ofzgiPvz8lWNdWT5th2tpwF64cTMiLg0Nr3//T9bds7BVpzZauNxbmw2vKT5o5x/opC/S8c//Wo3/civjn2gx/umtH7t/f9r62x7/K4Or3J2nrWMj6fjvmfq9bWvGfys3rQ11Zbm/1JrVk1y+UiqeyrZBKs2P1lKtR27HH/z2oF392fjv43S6/+6rH6X1p/PVNXJ3unsff83EeLX7m6cJusm9mzGQJdfEn6z0f9Jm/Hthk3W88P83P2i3LI0/jbcxrY9/dy3fijjWsv9X+zLZ8P7EkdruMNLYKVr47Pv3B9rV39z/6ZTWn853PtLW7t2MGLg/GEmyug3qS1biH0qa79esbL2Ob28Nftlu2ZPjb7n/jx9KXq6lD2Vl18er1dnRiEPJi+vLT6++tpFvrJ/Gf/xfrY//erWt9//0M+GlTcbffffHT7Yf/+5K45/YeP9f0/99WfFqyZMStx9NdbWrf3P9P1ZLHc9K0v5/Ulybadf29mYAAAAAAAAAAAAAAAAAAAAAAAAA2LpcRByJJJdfSedy+Xz9Gd5/i4FcqVypnrhcnpuZiNqzsoeiJ9f4qcvBpt9DHc1+srWRP70m/5+I+GtEvNfbX8vnC+XSRKeDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM4TbP/0/90Nvp1gEAu6av0w0AAPac8z8AHDxbO//371o7AIC94/M/ABw8mz7/X9rddgAAe8fnfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHbZhfPn02n5l6XFQpqfuDY/N1W+dnKiWJnKT88V8oXy7NX8ZLk8WSrmC+Xptv/oRn1WKpevjsXM3PWRarFSHanML1ycLs/NVC9emR6fLF4s9uxZZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACweZX5hanxUqk4+6dI3FgNbIf/c39H4xrYH5u3KdEd+6IZ+zrRG/uiGdtMNL9L9HfgnQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgj+H3AAAA//+0Bxg2") mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x9, @mcast1, 0x48f}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000540)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6, 0x0, 0x3, 0xd}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000580)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) (async) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) (async) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) chdir(&(0x7f0000000f80)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x88040, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x181) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x3000440, 0x0, 0xff, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) (async) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) (async) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) newfstatat(0xffffffffffffff9c, &(0x7f0000000440)='./file0/file1\x00', &(0x7f0000000480), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000fc0)='./file1/file0\x00', 0x140) mount$bind(&(0x7f0000001000)='.\x00', &(0x7f0000001040)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f0000001080)='./bus\x00', &(0x7f00000010c0), 0x40, &(0x7f0000001100)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]}) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000001300)=@raw={'raw\x00', 0x9, 0x3, 0x220, 0x0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0xf0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0xc8, 0xf0, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'lo\x00', {0x0, 0x3e8, 0x5, 0x8, 0x40, 0x3e8, 0x3e8}}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffffffffffff}}}}, 0x280) syz_emit_ethernet(0x2a, &(0x7f0000001580)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) (async) syz_emit_ethernet(0x2a, &(0x7f0000001580)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000015c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001600)='./proc\x00', &(0x7f0000001640)='proc\x00', 0x0, 0x0) (async) mount(0x0, &(0x7f0000001600)='./proc\x00', &(0x7f0000001640)='proc\x00', 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000001680)={0x3, &(0x7f00000016c0)=[{0x2d, 0x0, 0x1, 0x3}, {0xac, 0x0, 0x4, 0x4}, {0x6, 0x0, 0x9}]}) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) (async) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000001700)='./proc/net/ipt_hashlimit/lo\x00', 0x0, 0x0) (async) r2 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./proc/net/ipt_hashlimit/lo\x00', 0x0, 0x0) read$FUSE(r2, &(0x7f0000001740)={0x2020}, 0x2020) accept4$unix(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x80800) (async) program crashed: KASAN: use-after-free Read in incfs_free_mount_info testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mkdir-socket$inet6-bind$inet6-setsockopt$inet6_IPV6_FLOWLABEL_MGR-setsockopt$inet6_int-sendmmsg-sendmmsg-mount$incfs-mount$incfs-chdir-openat-mkdirat-syz_mount_image$fuse-mount$overlay-mount$overlay-setxattr$security_capability-setxattr$security_capability-newfstatat-mkdirat-mount$bind-mount$overlay-socket$inet_icmp_raw-setsockopt$IPT_SO_SET_REPLACE-syz_emit_ethernet-syz_emit_ethernet-mkdirat-mount-mount-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-setsockopt$IPT_SO_SET_REPLACE-setsockopt$IPT_SO_SET_REPLACE-openat-openat-read$FUSE detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000000, &(0x7f0000000280)={[{@nodelalloc}, {@jqfmt_vfsv1}, {@errors_remount}, {@nouser_xattr}]}, 0x0, 0x7b9, &(0x7f00000006c0)="$eJzs3c9rG1ceAPDvyHb8I1nshWV3czMsZAMhcpz1JrvQQ0oPpdBAoD03MbJiUstWsOQQG0MTSqGXQlt6KLSXnPsjvfXaH9BT+1/0UBLSxglN6aG4jDSyFVtybMe23PrzgfG892bk977zZjRPmkETwIE1nP7JRRyNiLeTiMGsPImInlqqO+Jcfb1HS4t9EVFIYnn5pZ+S2joPlxYL0fSa1OEs88+I+OqNiBO59fVW5hemxkul4myWH6lOXx2pzC+cvDI9PlmcLM6cGR0bO332v2fP7FysP3+3cOTuO8//+9Nzv77+j9tvfZ3EuTiSLWuOY6cMx3C2TXrSTfiY53a6sg5LOt0AtiU9NLvqR3kcjcHoqqXa6N/LlgEAu+W1iFgGAA6YxPkfAA6YxvcAD5cWC42ps99I7K17z0ZEXz3+R9lUX9KdXbPrq10HHXiYPHZlJImIoR2ofzgiPvz8lWNdWT5th2tpwF64cTMiLg0Nr3//T9bds7BVpzZauNxbmw2vKT5o5x/opC/S8c//Wo3/civjn2gx/umtH7t/f9r62x7/K4Or3J2nrWMj6fjvmfq9bWvGfys3rQ11Zbm/1JrVk1y+UiqeyrZBKs2P1lKtR27HH/z2oF392fjv43S6/+6rH6X1p/PVNXJ3unsff83EeLX7m6cJusm9mzGQJdfEn6z0f9Jm/Hthk3W88P83P2i3LI0/jbcxrY9/dy3fijjWsv9X+zLZ8P7EkdruMNLYKVr47Pv3B9rV39z/6ZTWn853PtLW7t2MGLg/GEmyug3qS1biH0qa79esbL2Ob28Nftlu2ZPjb7n/jx9KXq6lD2Vl18er1dnRiEPJi+vLT6++tpFvrJ/Gf/xfrY//erWt9//0M+GlTcbffffHT7Yf/+5K45/YeP9f0/99WfFqyZMStx9NdbWrf3P9P1ZLHc9K0v5/Ulybadf29mYAAAAAAAAAAAAAAAAAAAAAAAAA2LpcRByJJJdfSedy+Xz9Gd5/i4FcqVypnrhcnpuZiNqzsoeiJ9f4qcvBpt9DHc1+srWRP70m/5+I+GtEvNfbX8vnC+XSRKeDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM4TbP/0/90Nvp1gEAu6av0w0AAPac8z8AHDxbO//371o7AIC94/M/ABw8mz7/X9rddgAAe8fnfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHbZhfPn02n5l6XFQpqfuDY/N1W+dnKiWJnKT88V8oXy7NX8ZLk8WSrmC+Xptv/oRn1WKpevjsXM3PWRarFSHanML1ycLs/NVC9emR6fLF4s9uxZZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACweZX5hanxUqk4+6dI3FgNbIf/c39H4xrYH5u3KdEd+6IZ+zrRG/uiGdtMNL9L9HfgnQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgj+H3AAAA//+0Bxg2") mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x9, @mcast1, 0x48f}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000540)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6, 0x0, 0x3, 0xd}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000580)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) (async) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) (async) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) chdir(&(0x7f0000000f80)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x88040, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x181) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x3000440, 0x0, 0xff, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) (async) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) (async) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) newfstatat(0xffffffffffffff9c, &(0x7f0000000440)='./file0/file1\x00', &(0x7f0000000480), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000fc0)='./file1/file0\x00', 0x140) mount$bind(&(0x7f0000001000)='.\x00', &(0x7f0000001040)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f0000001080)='./bus\x00', &(0x7f00000010c0), 0x40, &(0x7f0000001100)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]}) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000001300)=@raw={'raw\x00', 0x9, 0x3, 0x220, 0x0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0xf0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0xc8, 0xf0, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'lo\x00', {0x0, 0x3e8, 0x5, 0x8, 0x40, 0x3e8, 0x3e8}}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffffffffffff}}}}, 0x280) syz_emit_ethernet(0x2a, &(0x7f0000001580)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) (async) syz_emit_ethernet(0x2a, &(0x7f0000001580)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000015c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001600)='./proc\x00', &(0x7f0000001640)='proc\x00', 0x0, 0x0) (async) mount(0x0, &(0x7f0000001600)='./proc\x00', &(0x7f0000001640)='proc\x00', 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000001680)={0x3, &(0x7f00000016c0)=[{0x2d, 0x0, 0x1, 0x3}, {0xac, 0x0, 0x4, 0x4}, {0x6, 0x0, 0x9}]}) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) (async) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000001700)='./proc/net/ipt_hashlimit/lo\x00', 0x0, 0x0) (async) r2 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./proc/net/ipt_hashlimit/lo\x00', 0x0, 0x0) read$FUSE(r2, &(0x7f0000001740)={0x2020}, 0x2020) program crashed: KASAN: use-after-free Read in incfs_free_mount_info testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mkdir-socket$inet6-bind$inet6-setsockopt$inet6_IPV6_FLOWLABEL_MGR-setsockopt$inet6_int-sendmmsg-sendmmsg-mount$incfs-mount$incfs-chdir-openat-mkdirat-syz_mount_image$fuse-mount$overlay-mount$overlay-setxattr$security_capability-setxattr$security_capability-newfstatat-mkdirat-mount$bind-mount$overlay-socket$inet_icmp_raw-setsockopt$IPT_SO_SET_REPLACE-syz_emit_ethernet-syz_emit_ethernet-mkdirat-mount-mount-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-setsockopt$IPT_SO_SET_REPLACE-setsockopt$IPT_SO_SET_REPLACE-openat-openat detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000000, &(0x7f0000000280)={[{@nodelalloc}, {@jqfmt_vfsv1}, {@errors_remount}, {@nouser_xattr}]}, 0x0, 0x7b9, &(0x7f00000006c0)="$eJzs3c9rG1ceAPDvyHb8I1nshWV3czMsZAMhcpz1JrvQQ0oPpdBAoD03MbJiUstWsOQQG0MTSqGXQlt6KLSXnPsjvfXaH9BT+1/0UBLSxglN6aG4jDSyFVtybMe23PrzgfG892bk977zZjRPmkETwIE1nP7JRRyNiLeTiMGsPImInlqqO+Jcfb1HS4t9EVFIYnn5pZ+S2joPlxYL0fSa1OEs88+I+OqNiBO59fVW5hemxkul4myWH6lOXx2pzC+cvDI9PlmcLM6cGR0bO332v2fP7FysP3+3cOTuO8//+9Nzv77+j9tvfZ3EuTiSLWuOY6cMx3C2TXrSTfiY53a6sg5LOt0AtiU9NLvqR3kcjcHoqqXa6N/LlgEAu+W1iFgGAA6YxPkfAA6YxvcAD5cWC42ps99I7K17z0ZEXz3+R9lUX9KdXbPrq10HHXiYPHZlJImIoR2ofzgiPvz8lWNdWT5th2tpwF64cTMiLg0Nr3//T9bds7BVpzZauNxbmw2vKT5o5x/opC/S8c//Wo3/civjn2gx/umtH7t/f9r62x7/K4Or3J2nrWMj6fjvmfq9bWvGfys3rQ11Zbm/1JrVk1y+UiqeyrZBKs2P1lKtR27HH/z2oF392fjv43S6/+6rH6X1p/PVNXJ3unsff83EeLX7m6cJusm9mzGQJdfEn6z0f9Jm/Hthk3W88P83P2i3LI0/jbcxrY9/dy3fijjWsv9X+zLZ8P7EkdruMNLYKVr47Pv3B9rV39z/6ZTWn853PtLW7t2MGLg/GEmyug3qS1biH0qa79esbL2Ob28Nftlu2ZPjb7n/jx9KXq6lD2Vl18er1dnRiEPJi+vLT6++tpFvrJ/Gf/xfrY//erWt9//0M+GlTcbffffHT7Yf/+5K45/YeP9f0/99WfFqyZMStx9NdbWrf3P9P1ZLHc9K0v5/Ulybadf29mYAAAAAAAAAAAAAAAAAAAAAAAAA2LpcRByJJJdfSedy+Xz9Gd5/i4FcqVypnrhcnpuZiNqzsoeiJ9f4qcvBpt9DHc1+srWRP70m/5+I+GtEvNfbX8vnC+XSRKeDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM4TbP/0/90Nvp1gEAu6av0w0AAPac8z8AHDxbO//371o7AIC94/M/ABw8mz7/X9rddgAAe8fnfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHbZhfPn02n5l6XFQpqfuDY/N1W+dnKiWJnKT88V8oXy7NX8ZLk8WSrmC+Xptv/oRn1WKpevjsXM3PWRarFSHanML1ycLs/NVC9emR6fLF4s9uxZZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACweZX5hanxUqk4+6dI3FgNbIf/c39H4xrYH5u3KdEd+6IZ+zrRG/uiGdtMNL9L9HfgnQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgj+H3AAAA//+0Bxg2") mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x9, @mcast1, 0x48f}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000540)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6, 0x0, 0x3, 0xd}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000580)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) (async) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) (async) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) chdir(&(0x7f0000000f80)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x88040, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x181) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x3000440, 0x0, 0xff, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) (async) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) (async) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) newfstatat(0xffffffffffffff9c, &(0x7f0000000440)='./file0/file1\x00', &(0x7f0000000480), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000fc0)='./file1/file0\x00', 0x140) mount$bind(&(0x7f0000001000)='.\x00', &(0x7f0000001040)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f0000001080)='./bus\x00', &(0x7f00000010c0), 0x40, &(0x7f0000001100)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]}) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000001300)=@raw={'raw\x00', 0x9, 0x3, 0x220, 0x0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0xf0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0xc8, 0xf0, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'lo\x00', {0x0, 0x3e8, 0x5, 0x8, 0x40, 0x3e8, 0x3e8}}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffffffffffff}}}}, 0x280) syz_emit_ethernet(0x2a, &(0x7f0000001580)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) (async) syz_emit_ethernet(0x2a, &(0x7f0000001580)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000015c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001600)='./proc\x00', &(0x7f0000001640)='proc\x00', 0x0, 0x0) (async) mount(0x0, &(0x7f0000001600)='./proc\x00', &(0x7f0000001640)='proc\x00', 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000001680)={0x3, &(0x7f00000016c0)=[{0x2d, 0x0, 0x1, 0x3}, {0xac, 0x0, 0x4, 0x4}, {0x6, 0x0, 0x9}]}) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) (async) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000001700)='./proc/net/ipt_hashlimit/lo\x00', 0x0, 0x0) (async) openat(0xffffffffffffff9c, &(0x7f0000001700)='./proc/net/ipt_hashlimit/lo\x00', 0x0, 0x0) program crashed: KASAN: use-after-free Read in incfs_free_mount_info testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mkdir-socket$inet6-bind$inet6-setsockopt$inet6_IPV6_FLOWLABEL_MGR-setsockopt$inet6_int-sendmmsg-sendmmsg-mount$incfs-mount$incfs-chdir-openat-mkdirat-syz_mount_image$fuse-mount$overlay-mount$overlay-setxattr$security_capability-setxattr$security_capability-newfstatat-mkdirat-mount$bind-mount$overlay-socket$inet_icmp_raw-setsockopt$IPT_SO_SET_REPLACE-syz_emit_ethernet-syz_emit_ethernet-mkdirat-mount-mount-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-setsockopt$IPT_SO_SET_REPLACE-setsockopt$IPT_SO_SET_REPLACE-openat detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000000, &(0x7f0000000280)={[{@nodelalloc}, {@jqfmt_vfsv1}, {@errors_remount}, {@nouser_xattr}]}, 0x0, 0x7b9, &(0x7f00000006c0)="$eJzs3c9rG1ceAPDvyHb8I1nshWV3czMsZAMhcpz1JrvQQ0oPpdBAoD03MbJiUstWsOQQG0MTSqGXQlt6KLSXnPsjvfXaH9BT+1/0UBLSxglN6aG4jDSyFVtybMe23PrzgfG892bk977zZjRPmkETwIE1nP7JRRyNiLeTiMGsPImInlqqO+Jcfb1HS4t9EVFIYnn5pZ+S2joPlxYL0fSa1OEs88+I+OqNiBO59fVW5hemxkul4myWH6lOXx2pzC+cvDI9PlmcLM6cGR0bO332v2fP7FysP3+3cOTuO8//+9Nzv77+j9tvfZ3EuTiSLWuOY6cMx3C2TXrSTfiY53a6sg5LOt0AtiU9NLvqR3kcjcHoqqXa6N/LlgEAu+W1iFgGAA6YxPkfAA6YxvcAD5cWC42ps99I7K17z0ZEXz3+R9lUX9KdXbPrq10HHXiYPHZlJImIoR2ofzgiPvz8lWNdWT5th2tpwF64cTMiLg0Nr3//T9bds7BVpzZauNxbmw2vKT5o5x/opC/S8c//Wo3/civjn2gx/umtH7t/f9r62x7/K4Or3J2nrWMj6fjvmfq9bWvGfys3rQ11Zbm/1JrVk1y+UiqeyrZBKs2P1lKtR27HH/z2oF392fjv43S6/+6rH6X1p/PVNXJ3unsff83EeLX7m6cJusm9mzGQJdfEn6z0f9Jm/Hthk3W88P83P2i3LI0/jbcxrY9/dy3fijjWsv9X+zLZ8P7EkdruMNLYKVr47Pv3B9rV39z/6ZTWn853PtLW7t2MGLg/GEmyug3qS1biH0qa79esbL2Ob28Nftlu2ZPjb7n/jx9KXq6lD2Vl18er1dnRiEPJi+vLT6++tpFvrJ/Gf/xfrY//erWt9//0M+GlTcbffffHT7Yf/+5K45/YeP9f0/99WfFqyZMStx9NdbWrf3P9P1ZLHc9K0v5/Ulybadf29mYAAAAAAAAAAAAAAAAAAAAAAAAA2LpcRByJJJdfSedy+Xz9Gd5/i4FcqVypnrhcnpuZiNqzsoeiJ9f4qcvBpt9DHc1+srWRP70m/5+I+GtEvNfbX8vnC+XSRKeDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM4TbP/0/90Nvp1gEAu6av0w0AAPac8z8AHDxbO//371o7AIC94/M/ABw8mz7/X9rddgAAe8fnfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHbZhfPn02n5l6XFQpqfuDY/N1W+dnKiWJnKT88V8oXy7NX8ZLk8WSrmC+Xptv/oRn1WKpevjsXM3PWRarFSHanML1ycLs/NVC9emR6fLF4s9uxZZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACweZX5hanxUqk4+6dI3FgNbIf/c39H4xrYH5u3KdEd+6IZ+zrRG/uiGdtMNL9L9HfgnQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgj+H3AAAA//+0Bxg2") mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x9, @mcast1, 0x48f}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000540)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6, 0x0, 0x3, 0xd}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000580)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) (async) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) (async) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) chdir(&(0x7f0000000f80)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x88040, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x181) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x3000440, 0x0, 0xff, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) (async) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) (async) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) newfstatat(0xffffffffffffff9c, &(0x7f0000000440)='./file0/file1\x00', &(0x7f0000000480), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000fc0)='./file1/file0\x00', 0x140) mount$bind(&(0x7f0000001000)='.\x00', &(0x7f0000001040)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f0000001080)='./bus\x00', &(0x7f00000010c0), 0x40, &(0x7f0000001100)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]}) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000001300)=@raw={'raw\x00', 0x9, 0x3, 0x220, 0x0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0xf0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0xc8, 0xf0, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'lo\x00', {0x0, 0x3e8, 0x5, 0x8, 0x40, 0x3e8, 0x3e8}}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffffffffffff}}}}, 0x280) syz_emit_ethernet(0x2a, &(0x7f0000001580)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) (async) syz_emit_ethernet(0x2a, &(0x7f0000001580)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000015c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001600)='./proc\x00', &(0x7f0000001640)='proc\x00', 0x0, 0x0) (async) mount(0x0, &(0x7f0000001600)='./proc\x00', &(0x7f0000001640)='proc\x00', 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000001680)={0x3, &(0x7f00000016c0)=[{0x2d, 0x0, 0x1, 0x3}, {0xac, 0x0, 0x4, 0x4}, {0x6, 0x0, 0x9}]}) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) (async) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000001700)='./proc/net/ipt_hashlimit/lo\x00', 0x0, 0x0) (async) program crashed: KASAN: use-after-free Read in incfs_free_mount_info testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mkdir-socket$inet6-bind$inet6-setsockopt$inet6_IPV6_FLOWLABEL_MGR-setsockopt$inet6_int-sendmmsg-sendmmsg-mount$incfs-mount$incfs-chdir-openat-mkdirat-syz_mount_image$fuse-mount$overlay-mount$overlay-setxattr$security_capability-setxattr$security_capability-newfstatat-mkdirat-mount$bind-mount$overlay-socket$inet_icmp_raw-setsockopt$IPT_SO_SET_REPLACE-syz_emit_ethernet-syz_emit_ethernet-mkdirat-mount-mount-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-setsockopt$IPT_SO_SET_REPLACE-setsockopt$IPT_SO_SET_REPLACE detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000000, &(0x7f0000000280)={[{@nodelalloc}, {@jqfmt_vfsv1}, {@errors_remount}, {@nouser_xattr}]}, 0x0, 0x7b9, &(0x7f00000006c0)="$eJzs3c9rG1ceAPDvyHb8I1nshWV3czMsZAMhcpz1JrvQQ0oPpdBAoD03MbJiUstWsOQQG0MTSqGXQlt6KLSXnPsjvfXaH9BT+1/0UBLSxglN6aG4jDSyFVtybMe23PrzgfG892bk977zZjRPmkETwIE1nP7JRRyNiLeTiMGsPImInlqqO+Jcfb1HS4t9EVFIYnn5pZ+S2joPlxYL0fSa1OEs88+I+OqNiBO59fVW5hemxkul4myWH6lOXx2pzC+cvDI9PlmcLM6cGR0bO332v2fP7FysP3+3cOTuO8//+9Nzv77+j9tvfZ3EuTiSLWuOY6cMx3C2TXrSTfiY53a6sg5LOt0AtiU9NLvqR3kcjcHoqqXa6N/LlgEAu+W1iFgGAA6YxPkfAA6YxvcAD5cWC42ps99I7K17z0ZEXz3+R9lUX9KdXbPrq10HHXiYPHZlJImIoR2ofzgiPvz8lWNdWT5th2tpwF64cTMiLg0Nr3//T9bds7BVpzZauNxbmw2vKT5o5x/opC/S8c//Wo3/civjn2gx/umtH7t/f9r62x7/K4Or3J2nrWMj6fjvmfq9bWvGfys3rQ11Zbm/1JrVk1y+UiqeyrZBKs2P1lKtR27HH/z2oF392fjv43S6/+6rH6X1p/PVNXJ3unsff83EeLX7m6cJusm9mzGQJdfEn6z0f9Jm/Hthk3W88P83P2i3LI0/jbcxrY9/dy3fijjWsv9X+zLZ8P7EkdruMNLYKVr47Pv3B9rV39z/6ZTWn853PtLW7t2MGLg/GEmyug3qS1biH0qa79esbL2Ob28Nftlu2ZPjb7n/jx9KXq6lD2Vl18er1dnRiEPJi+vLT6++tpFvrJ/Gf/xfrY//erWt9//0M+GlTcbffffHT7Yf/+5K45/YeP9f0/99WfFqyZMStx9NdbWrf3P9P1ZLHc9K0v5/Ulybadf29mYAAAAAAAAAAAAAAAAAAAAAAAAA2LpcRByJJJdfSedy+Xz9Gd5/i4FcqVypnrhcnpuZiNqzsoeiJ9f4qcvBpt9DHc1+srWRP70m/5+I+GtEvNfbX8vnC+XSRKeDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM4TbP/0/90Nvp1gEAu6av0w0AAPac8z8AHDxbO//371o7AIC94/M/ABw8mz7/X9rddgAAe8fnfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHbZhfPn02n5l6XFQpqfuDY/N1W+dnKiWJnKT88V8oXy7NX8ZLk8WSrmC+Xptv/oRn1WKpevjsXM3PWRarFSHanML1ycLs/NVC9emR6fLF4s9uxZZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACweZX5hanxUqk4+6dI3FgNbIf/c39H4xrYH5u3KdEd+6IZ+zrRG/uiGdtMNL9L9HfgnQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgj+H3AAAA//+0Bxg2") mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x9, @mcast1, 0x48f}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000540)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6, 0x0, 0x3, 0xd}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000580)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) (async) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) (async) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) chdir(&(0x7f0000000f80)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x88040, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x181) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x3000440, 0x0, 0xff, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) (async) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) (async) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) newfstatat(0xffffffffffffff9c, &(0x7f0000000440)='./file0/file1\x00', &(0x7f0000000480), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000fc0)='./file1/file0\x00', 0x140) mount$bind(&(0x7f0000001000)='.\x00', &(0x7f0000001040)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f0000001080)='./bus\x00', &(0x7f00000010c0), 0x40, &(0x7f0000001100)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]}) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000001300)=@raw={'raw\x00', 0x9, 0x3, 0x220, 0x0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0xf0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0xc8, 0xf0, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'lo\x00', {0x0, 0x3e8, 0x5, 0x8, 0x40, 0x3e8, 0x3e8}}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffffffffffff}}}}, 0x280) syz_emit_ethernet(0x2a, &(0x7f0000001580)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) (async) syz_emit_ethernet(0x2a, &(0x7f0000001580)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000015c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001600)='./proc\x00', &(0x7f0000001640)='proc\x00', 0x0, 0x0) (async) mount(0x0, &(0x7f0000001600)='./proc\x00', &(0x7f0000001640)='proc\x00', 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000001680)={0x3, &(0x7f00000016c0)=[{0x2d, 0x0, 0x1, 0x3}, {0xac, 0x0, 0x4, 0x4}, {0x6, 0x0, 0x9}]}) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) (async) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) program crashed: KASAN: use-after-free Read in incfs_free_mount_info testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mkdir-socket$inet6-bind$inet6-setsockopt$inet6_IPV6_FLOWLABEL_MGR-setsockopt$inet6_int-sendmmsg-sendmmsg-mount$incfs-mount$incfs-chdir-openat-mkdirat-syz_mount_image$fuse-mount$overlay-mount$overlay-setxattr$security_capability-setxattr$security_capability-newfstatat-mkdirat-mount$bind-mount$overlay-socket$inet_icmp_raw-setsockopt$IPT_SO_SET_REPLACE-syz_emit_ethernet-syz_emit_ethernet-mkdirat-mount-mount-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-setsockopt$IPT_SO_SET_REPLACE detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000000, &(0x7f0000000280)={[{@nodelalloc}, {@jqfmt_vfsv1}, {@errors_remount}, {@nouser_xattr}]}, 0x0, 0x7b9, &(0x7f00000006c0)="$eJzs3c9rG1ceAPDvyHb8I1nshWV3czMsZAMhcpz1JrvQQ0oPpdBAoD03MbJiUstWsOQQG0MTSqGXQlt6KLSXnPsjvfXaH9BT+1/0UBLSxglN6aG4jDSyFVtybMe23PrzgfG892bk977zZjRPmkETwIE1nP7JRRyNiLeTiMGsPImInlqqO+Jcfb1HS4t9EVFIYnn5pZ+S2joPlxYL0fSa1OEs88+I+OqNiBO59fVW5hemxkul4myWH6lOXx2pzC+cvDI9PlmcLM6cGR0bO332v2fP7FysP3+3cOTuO8//+9Nzv77+j9tvfZ3EuTiSLWuOY6cMx3C2TXrSTfiY53a6sg5LOt0AtiU9NLvqR3kcjcHoqqXa6N/LlgEAu+W1iFgGAA6YxPkfAA6YxvcAD5cWC42ps99I7K17z0ZEXz3+R9lUX9KdXbPrq10HHXiYPHZlJImIoR2ofzgiPvz8lWNdWT5th2tpwF64cTMiLg0Nr3//T9bds7BVpzZauNxbmw2vKT5o5x/opC/S8c//Wo3/civjn2gx/umtH7t/f9r62x7/K4Or3J2nrWMj6fjvmfq9bWvGfys3rQ11Zbm/1JrVk1y+UiqeyrZBKs2P1lKtR27HH/z2oF392fjv43S6/+6rH6X1p/PVNXJ3unsff83EeLX7m6cJusm9mzGQJdfEn6z0f9Jm/Hthk3W88P83P2i3LI0/jbcxrY9/dy3fijjWsv9X+zLZ8P7EkdruMNLYKVr47Pv3B9rV39z/6ZTWn853PtLW7t2MGLg/GEmyug3qS1biH0qa79esbL2Ob28Nftlu2ZPjb7n/jx9KXq6lD2Vl18er1dnRiEPJi+vLT6++tpFvrJ/Gf/xfrY//erWt9//0M+GlTcbffffHT7Yf/+5K45/YeP9f0/99WfFqyZMStx9NdbWrf3P9P1ZLHc9K0v5/Ulybadf29mYAAAAAAAAAAAAAAAAAAAAAAAAA2LpcRByJJJdfSedy+Xz9Gd5/i4FcqVypnrhcnpuZiNqzsoeiJ9f4qcvBpt9DHc1+srWRP70m/5+I+GtEvNfbX8vnC+XSRKeDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM4TbP/0/90Nvp1gEAu6av0w0AAPac8z8AHDxbO//371o7AIC94/M/ABw8mz7/X9rddgAAe8fnfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHbZhfPn02n5l6XFQpqfuDY/N1W+dnKiWJnKT88V8oXy7NX8ZLk8WSrmC+Xptv/oRn1WKpevjsXM3PWRarFSHanML1ycLs/NVC9emR6fLF4s9uxZZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACweZX5hanxUqk4+6dI3FgNbIf/c39H4xrYH5u3KdEd+6IZ+zrRG/uiGdtMNL9L9HfgnQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgj+H3AAAA//+0Bxg2") mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x9, @mcast1, 0x48f}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000540)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6, 0x0, 0x3, 0xd}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000580)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) (async) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) (async) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) chdir(&(0x7f0000000f80)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x88040, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x181) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x3000440, 0x0, 0xff, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) (async) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) (async) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) newfstatat(0xffffffffffffff9c, &(0x7f0000000440)='./file0/file1\x00', &(0x7f0000000480), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000fc0)='./file1/file0\x00', 0x140) mount$bind(&(0x7f0000001000)='.\x00', &(0x7f0000001040)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f0000001080)='./bus\x00', &(0x7f00000010c0), 0x40, &(0x7f0000001100)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]}) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000001300)=@raw={'raw\x00', 0x9, 0x3, 0x220, 0x0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0xf0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0xc8, 0xf0, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'lo\x00', {0x0, 0x3e8, 0x5, 0x8, 0x40, 0x3e8, 0x3e8}}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffffffffffff}}}}, 0x280) syz_emit_ethernet(0x2a, &(0x7f0000001580)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) (async) syz_emit_ethernet(0x2a, &(0x7f0000001580)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000015c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001600)='./proc\x00', &(0x7f0000001640)='proc\x00', 0x0, 0x0) (async) mount(0x0, &(0x7f0000001600)='./proc\x00', &(0x7f0000001640)='proc\x00', 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000001680)={0x3, &(0x7f00000016c0)=[{0x2d, 0x0, 0x1, 0x3}, {0xac, 0x0, 0x4, 0x4}, {0x6, 0x0, 0x9}]}) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) (async) program crashed: KASAN: use-after-free Read in incfs_free_mount_info testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mkdir-socket$inet6-bind$inet6-setsockopt$inet6_IPV6_FLOWLABEL_MGR-setsockopt$inet6_int-sendmmsg-sendmmsg-mount$incfs-mount$incfs-chdir-openat-mkdirat-syz_mount_image$fuse-mount$overlay-mount$overlay-setxattr$security_capability-setxattr$security_capability-newfstatat-mkdirat-mount$bind-mount$overlay-socket$inet_icmp_raw-setsockopt$IPT_SO_SET_REPLACE-syz_emit_ethernet-syz_emit_ethernet-mkdirat-mount-mount-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000000, &(0x7f0000000280)={[{@nodelalloc}, {@jqfmt_vfsv1}, {@errors_remount}, {@nouser_xattr}]}, 0x0, 0x7b9, &(0x7f00000006c0)="$eJzs3c9rG1ceAPDvyHb8I1nshWV3czMsZAMhcpz1JrvQQ0oPpdBAoD03MbJiUstWsOQQG0MTSqGXQlt6KLSXnPsjvfXaH9BT+1/0UBLSxglN6aG4jDSyFVtybMe23PrzgfG892bk977zZjRPmkETwIE1nP7JRRyNiLeTiMGsPImInlqqO+Jcfb1HS4t9EVFIYnn5pZ+S2joPlxYL0fSa1OEs88+I+OqNiBO59fVW5hemxkul4myWH6lOXx2pzC+cvDI9PlmcLM6cGR0bO332v2fP7FysP3+3cOTuO8//+9Nzv77+j9tvfZ3EuTiSLWuOY6cMx3C2TXrSTfiY53a6sg5LOt0AtiU9NLvqR3kcjcHoqqXa6N/LlgEAu+W1iFgGAA6YxPkfAA6YxvcAD5cWC42ps99I7K17z0ZEXz3+R9lUX9KdXbPrq10HHXiYPHZlJImIoR2ofzgiPvz8lWNdWT5th2tpwF64cTMiLg0Nr3//T9bds7BVpzZauNxbmw2vKT5o5x/opC/S8c//Wo3/civjn2gx/umtH7t/f9r62x7/K4Or3J2nrWMj6fjvmfq9bWvGfys3rQ11Zbm/1JrVk1y+UiqeyrZBKs2P1lKtR27HH/z2oF392fjv43S6/+6rH6X1p/PVNXJ3unsff83EeLX7m6cJusm9mzGQJdfEn6z0f9Jm/Hthk3W88P83P2i3LI0/jbcxrY9/dy3fijjWsv9X+zLZ8P7EkdruMNLYKVr47Pv3B9rV39z/6ZTWn853PtLW7t2MGLg/GEmyug3qS1biH0qa79esbL2Ob28Nftlu2ZPjb7n/jx9KXq6lD2Vl18er1dnRiEPJi+vLT6++tpFvrJ/Gf/xfrY//erWt9//0M+GlTcbffffHT7Yf/+5K45/YeP9f0/99WfFqyZMStx9NdbWrf3P9P1ZLHc9K0v5/Ulybadf29mYAAAAAAAAAAAAAAAAAAAAAAAAA2LpcRByJJJdfSedy+Xz9Gd5/i4FcqVypnrhcnpuZiNqzsoeiJ9f4qcvBpt9DHc1+srWRP70m/5+I+GtEvNfbX8vnC+XSRKeDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM4TbP/0/90Nvp1gEAu6av0w0AAPac8z8AHDxbO//371o7AIC94/M/ABw8mz7/X9rddgAAe8fnfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHbZhfPn02n5l6XFQpqfuDY/N1W+dnKiWJnKT88V8oXy7NX8ZLk8WSrmC+Xptv/oRn1WKpevjsXM3PWRarFSHanML1ycLs/NVC9emR6fLF4s9uxZZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACweZX5hanxUqk4+6dI3FgNbIf/c39H4xrYH5u3KdEd+6IZ+zrRG/uiGdtMNL9L9HfgnQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgj+H3AAAA//+0Bxg2") mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x9, @mcast1, 0x48f}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000540)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6, 0x0, 0x3, 0xd}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000580)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) (async) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) (async) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) chdir(&(0x7f0000000f80)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x88040, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x181) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x3000440, 0x0, 0xff, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) (async) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) (async) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) newfstatat(0xffffffffffffff9c, &(0x7f0000000440)='./file0/file1\x00', &(0x7f0000000480), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000fc0)='./file1/file0\x00', 0x140) mount$bind(&(0x7f0000001000)='.\x00', &(0x7f0000001040)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f0000001080)='./bus\x00', &(0x7f00000010c0), 0x40, &(0x7f0000001100)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]}) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000001300)=@raw={'raw\x00', 0x9, 0x3, 0x220, 0x0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0xf0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0xc8, 0xf0, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'lo\x00', {0x0, 0x3e8, 0x5, 0x8, 0x40, 0x3e8, 0x3e8}}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffffffffffff}}}}, 0x280) syz_emit_ethernet(0x2a, &(0x7f0000001580)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) (async) syz_emit_ethernet(0x2a, &(0x7f0000001580)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000015c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001600)='./proc\x00', &(0x7f0000001640)='proc\x00', 0x0, 0x0) (async) mount(0x0, &(0x7f0000001600)='./proc\x00', &(0x7f0000001640)='proc\x00', 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000001680)={0x3, &(0x7f00000016c0)=[{0x2d, 0x0, 0x1, 0x3}, {0xac, 0x0, 0x4, 0x4}, {0x6, 0x0, 0x9}]}) program crashed: KASAN: use-after-free Read in incfs_free_mount_info testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mkdir-socket$inet6-bind$inet6-setsockopt$inet6_IPV6_FLOWLABEL_MGR-setsockopt$inet6_int-sendmmsg-sendmmsg-mount$incfs-mount$incfs-chdir-openat-mkdirat-syz_mount_image$fuse-mount$overlay-mount$overlay-setxattr$security_capability-setxattr$security_capability-newfstatat-mkdirat-mount$bind-mount$overlay-socket$inet_icmp_raw-setsockopt$IPT_SO_SET_REPLACE-syz_emit_ethernet-syz_emit_ethernet-mkdirat-mount-mount detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000000, &(0x7f0000000280)={[{@nodelalloc}, {@jqfmt_vfsv1}, {@errors_remount}, {@nouser_xattr}]}, 0x0, 0x7b9, &(0x7f00000006c0)="$eJzs3c9rG1ceAPDvyHb8I1nshWV3czMsZAMhcpz1JrvQQ0oPpdBAoD03MbJiUstWsOQQG0MTSqGXQlt6KLSXnPsjvfXaH9BT+1/0UBLSxglN6aG4jDSyFVtybMe23PrzgfG892bk977zZjRPmkETwIE1nP7JRRyNiLeTiMGsPImInlqqO+Jcfb1HS4t9EVFIYnn5pZ+S2joPlxYL0fSa1OEs88+I+OqNiBO59fVW5hemxkul4myWH6lOXx2pzC+cvDI9PlmcLM6cGR0bO332v2fP7FysP3+3cOTuO8//+9Nzv77+j9tvfZ3EuTiSLWuOY6cMx3C2TXrSTfiY53a6sg5LOt0AtiU9NLvqR3kcjcHoqqXa6N/LlgEAu+W1iFgGAA6YxPkfAA6YxvcAD5cWC42ps99I7K17z0ZEXz3+R9lUX9KdXbPrq10HHXiYPHZlJImIoR2ofzgiPvz8lWNdWT5th2tpwF64cTMiLg0Nr3//T9bds7BVpzZauNxbmw2vKT5o5x/opC/S8c//Wo3/civjn2gx/umtH7t/f9r62x7/K4Or3J2nrWMj6fjvmfq9bWvGfys3rQ11Zbm/1JrVk1y+UiqeyrZBKs2P1lKtR27HH/z2oF392fjv43S6/+6rH6X1p/PVNXJ3unsff83EeLX7m6cJusm9mzGQJdfEn6z0f9Jm/Hthk3W88P83P2i3LI0/jbcxrY9/dy3fijjWsv9X+zLZ8P7EkdruMNLYKVr47Pv3B9rV39z/6ZTWn853PtLW7t2MGLg/GEmyug3qS1biH0qa79esbL2Ob28Nftlu2ZPjb7n/jx9KXq6lD2Vl18er1dnRiEPJi+vLT6++tpFvrJ/Gf/xfrY//erWt9//0M+GlTcbffffHT7Yf/+5K45/YeP9f0/99WfFqyZMStx9NdbWrf3P9P1ZLHc9K0v5/Ulybadf29mYAAAAAAAAAAAAAAAAAAAAAAAAA2LpcRByJJJdfSedy+Xz9Gd5/i4FcqVypnrhcnpuZiNqzsoeiJ9f4qcvBpt9DHc1+srWRP70m/5+I+GtEvNfbX8vnC+XSRKeDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM4TbP/0/90Nvp1gEAu6av0w0AAPac8z8AHDxbO//371o7AIC94/M/ABw8mz7/X9rddgAAe8fnfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHbZhfPn02n5l6XFQpqfuDY/N1W+dnKiWJnKT88V8oXy7NX8ZLk8WSrmC+Xptv/oRn1WKpevjsXM3PWRarFSHanML1ycLs/NVC9emR6fLF4s9uxZZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACweZX5hanxUqk4+6dI3FgNbIf/c39H4xrYH5u3KdEd+6IZ+zrRG/uiGdtMNL9L9HfgnQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgj+H3AAAA//+0Bxg2") mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x9, @mcast1, 0x48f}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000540)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6, 0x0, 0x3, 0xd}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000580)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) (async) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) (async) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) chdir(&(0x7f0000000f80)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x88040, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x181) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x3000440, 0x0, 0xff, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) (async) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) (async) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) newfstatat(0xffffffffffffff9c, &(0x7f0000000440)='./file0/file1\x00', &(0x7f0000000480), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000fc0)='./file1/file0\x00', 0x140) mount$bind(&(0x7f0000001000)='.\x00', &(0x7f0000001040)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f0000001080)='./bus\x00', &(0x7f00000010c0), 0x40, &(0x7f0000001100)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]}) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000001300)=@raw={'raw\x00', 0x9, 0x3, 0x220, 0x0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0xf0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0xc8, 0xf0, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'lo\x00', {0x0, 0x3e8, 0x5, 0x8, 0x40, 0x3e8, 0x3e8}}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffffffffffff}}}}, 0x280) syz_emit_ethernet(0x2a, &(0x7f0000001580)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) (async) syz_emit_ethernet(0x2a, &(0x7f0000001580)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000015c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001600)='./proc\x00', &(0x7f0000001640)='proc\x00', 0x0, 0x0) (async) mount(0x0, &(0x7f0000001600)='./proc\x00', &(0x7f0000001640)='proc\x00', 0x0, 0x0) program crashed: KASAN: use-after-free Read in incfs_free_mount_info testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mkdir-socket$inet6-bind$inet6-setsockopt$inet6_IPV6_FLOWLABEL_MGR-setsockopt$inet6_int-sendmmsg-sendmmsg-mount$incfs-mount$incfs-chdir-openat-mkdirat-syz_mount_image$fuse-mount$overlay-mount$overlay-setxattr$security_capability-setxattr$security_capability-newfstatat-mkdirat-mount$bind-mount$overlay-socket$inet_icmp_raw-setsockopt$IPT_SO_SET_REPLACE-syz_emit_ethernet-syz_emit_ethernet-mkdirat-mount detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000000, &(0x7f0000000280)={[{@nodelalloc}, {@jqfmt_vfsv1}, {@errors_remount}, {@nouser_xattr}]}, 0x0, 0x7b9, &(0x7f00000006c0)="$eJzs3c9rG1ceAPDvyHb8I1nshWV3czMsZAMhcpz1JrvQQ0oPpdBAoD03MbJiUstWsOQQG0MTSqGXQlt6KLSXnPsjvfXaH9BT+1/0UBLSxglN6aG4jDSyFVtybMe23PrzgfG892bk977zZjRPmkETwIE1nP7JRRyNiLeTiMGsPImInlqqO+Jcfb1HS4t9EVFIYnn5pZ+S2joPlxYL0fSa1OEs88+I+OqNiBO59fVW5hemxkul4myWH6lOXx2pzC+cvDI9PlmcLM6cGR0bO332v2fP7FysP3+3cOTuO8//+9Nzv77+j9tvfZ3EuTiSLWuOY6cMx3C2TXrSTfiY53a6sg5LOt0AtiU9NLvqR3kcjcHoqqXa6N/LlgEAu+W1iFgGAA6YxPkfAA6YxvcAD5cWC42ps99I7K17z0ZEXz3+R9lUX9KdXbPrq10HHXiYPHZlJImIoR2ofzgiPvz8lWNdWT5th2tpwF64cTMiLg0Nr3//T9bds7BVpzZauNxbmw2vKT5o5x/opC/S8c//Wo3/civjn2gx/umtH7t/f9r62x7/K4Or3J2nrWMj6fjvmfq9bWvGfys3rQ11Zbm/1JrVk1y+UiqeyrZBKs2P1lKtR27HH/z2oF392fjv43S6/+6rH6X1p/PVNXJ3unsff83EeLX7m6cJusm9mzGQJdfEn6z0f9Jm/Hthk3W88P83P2i3LI0/jbcxrY9/dy3fijjWsv9X+zLZ8P7EkdruMNLYKVr47Pv3B9rV39z/6ZTWn853PtLW7t2MGLg/GEmyug3qS1biH0qa79esbL2Ob28Nftlu2ZPjb7n/jx9KXq6lD2Vl18er1dnRiEPJi+vLT6++tpFvrJ/Gf/xfrY//erWt9//0M+GlTcbffffHT7Yf/+5K45/YeP9f0/99WfFqyZMStx9NdbWrf3P9P1ZLHc9K0v5/Ulybadf29mYAAAAAAAAAAAAAAAAAAAAAAAAA2LpcRByJJJdfSedy+Xz9Gd5/i4FcqVypnrhcnpuZiNqzsoeiJ9f4qcvBpt9DHc1+srWRP70m/5+I+GtEvNfbX8vnC+XSRKeDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM4TbP/0/90Nvp1gEAu6av0w0AAPac8z8AHDxbO//371o7AIC94/M/ABw8mz7/X9rddgAAe8fnfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHbZhfPn02n5l6XFQpqfuDY/N1W+dnKiWJnKT88V8oXy7NX8ZLk8WSrmC+Xptv/oRn1WKpevjsXM3PWRarFSHanML1ycLs/NVC9emR6fLF4s9uxZZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACweZX5hanxUqk4+6dI3FgNbIf/c39H4xrYH5u3KdEd+6IZ+zrRG/uiGdtMNL9L9HfgnQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgj+H3AAAA//+0Bxg2") mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x9, @mcast1, 0x48f}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000540)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6, 0x0, 0x3, 0xd}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000580)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) (async) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) (async) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) chdir(&(0x7f0000000f80)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x88040, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x181) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x3000440, 0x0, 0xff, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) (async) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) (async) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) newfstatat(0xffffffffffffff9c, &(0x7f0000000440)='./file0/file1\x00', &(0x7f0000000480), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000fc0)='./file1/file0\x00', 0x140) mount$bind(&(0x7f0000001000)='.\x00', &(0x7f0000001040)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f0000001080)='./bus\x00', &(0x7f00000010c0), 0x40, &(0x7f0000001100)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]}) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000001300)=@raw={'raw\x00', 0x9, 0x3, 0x220, 0x0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0xf0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0xc8, 0xf0, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'lo\x00', {0x0, 0x3e8, 0x5, 0x8, 0x40, 0x3e8, 0x3e8}}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffffffffffff}}}}, 0x280) syz_emit_ethernet(0x2a, &(0x7f0000001580)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) (async) syz_emit_ethernet(0x2a, &(0x7f0000001580)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000015c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000001600)='./proc\x00', &(0x7f0000001640)='proc\x00', 0x0, 0x0) (async) program crashed: KASAN: use-after-free Read in incfs_free_mount_info testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mkdir-socket$inet6-bind$inet6-setsockopt$inet6_IPV6_FLOWLABEL_MGR-setsockopt$inet6_int-sendmmsg-sendmmsg-mount$incfs-mount$incfs-chdir-openat-mkdirat-syz_mount_image$fuse-mount$overlay-mount$overlay-setxattr$security_capability-setxattr$security_capability-newfstatat-mkdirat-mount$bind-mount$overlay-socket$inet_icmp_raw-setsockopt$IPT_SO_SET_REPLACE-syz_emit_ethernet-syz_emit_ethernet-mkdirat detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000000, &(0x7f0000000280)={[{@nodelalloc}, {@jqfmt_vfsv1}, {@errors_remount}, {@nouser_xattr}]}, 0x0, 0x7b9, &(0x7f00000006c0)="$eJzs3c9rG1ceAPDvyHb8I1nshWV3czMsZAMhcpz1JrvQQ0oPpdBAoD03MbJiUstWsOQQG0MTSqGXQlt6KLSXnPsjvfXaH9BT+1/0UBLSxglN6aG4jDSyFVtybMe23PrzgfG892bk977zZjRPmkETwIE1nP7JRRyNiLeTiMGsPImInlqqO+Jcfb1HS4t9EVFIYnn5pZ+S2joPlxYL0fSa1OEs88+I+OqNiBO59fVW5hemxkul4myWH6lOXx2pzC+cvDI9PlmcLM6cGR0bO332v2fP7FysP3+3cOTuO8//+9Nzv77+j9tvfZ3EuTiSLWuOY6cMx3C2TXrSTfiY53a6sg5LOt0AtiU9NLvqR3kcjcHoqqXa6N/LlgEAu+W1iFgGAA6YxPkfAA6YxvcAD5cWC42ps99I7K17z0ZEXz3+R9lUX9KdXbPrq10HHXiYPHZlJImIoR2ofzgiPvz8lWNdWT5th2tpwF64cTMiLg0Nr3//T9bds7BVpzZauNxbmw2vKT5o5x/opC/S8c//Wo3/civjn2gx/umtH7t/f9r62x7/K4Or3J2nrWMj6fjvmfq9bWvGfys3rQ11Zbm/1JrVk1y+UiqeyrZBKs2P1lKtR27HH/z2oF392fjv43S6/+6rH6X1p/PVNXJ3unsff83EeLX7m6cJusm9mzGQJdfEn6z0f9Jm/Hthk3W88P83P2i3LI0/jbcxrY9/dy3fijjWsv9X+zLZ8P7EkdruMNLYKVr47Pv3B9rV39z/6ZTWn853PtLW7t2MGLg/GEmyug3qS1biH0qa79esbL2Ob28Nftlu2ZPjb7n/jx9KXq6lD2Vl18er1dnRiEPJi+vLT6++tpFvrJ/Gf/xfrY//erWt9//0M+GlTcbffffHT7Yf/+5K45/YeP9f0/99WfFqyZMStx9NdbWrf3P9P1ZLHc9K0v5/Ulybadf29mYAAAAAAAAAAAAAAAAAAAAAAAAA2LpcRByJJJdfSedy+Xz9Gd5/i4FcqVypnrhcnpuZiNqzsoeiJ9f4qcvBpt9DHc1+srWRP70m/5+I+GtEvNfbX8vnC+XSRKeDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM4TbP/0/90Nvp1gEAu6av0w0AAPac8z8AHDxbO//371o7AIC94/M/ABw8mz7/X9rddgAAe8fnfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHbZhfPn02n5l6XFQpqfuDY/N1W+dnKiWJnKT88V8oXy7NX8ZLk8WSrmC+Xptv/oRn1WKpevjsXM3PWRarFSHanML1ycLs/NVC9emR6fLF4s9uxZZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACweZX5hanxUqk4+6dI3FgNbIf/c39H4xrYH5u3KdEd+6IZ+zrRG/uiGdtMNL9L9HfgnQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgj+H3AAAA//+0Bxg2") mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x9, @mcast1, 0x48f}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000540)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6, 0x0, 0x3, 0xd}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000580)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) (async) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) (async) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) chdir(&(0x7f0000000f80)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x88040, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x181) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x3000440, 0x0, 0xff, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) (async) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) (async) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) newfstatat(0xffffffffffffff9c, &(0x7f0000000440)='./file0/file1\x00', &(0x7f0000000480), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000fc0)='./file1/file0\x00', 0x140) mount$bind(&(0x7f0000001000)='.\x00', &(0x7f0000001040)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f0000001080)='./bus\x00', &(0x7f00000010c0), 0x40, &(0x7f0000001100)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]}) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000001300)=@raw={'raw\x00', 0x9, 0x3, 0x220, 0x0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0xf0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0xc8, 0xf0, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'lo\x00', {0x0, 0x3e8, 0x5, 0x8, 0x40, 0x3e8, 0x3e8}}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffffffffffff}}}}, 0x280) syz_emit_ethernet(0x2a, &(0x7f0000001580)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) (async) syz_emit_ethernet(0x2a, &(0x7f0000001580)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000015c0)='./proc\x00', 0x1ff) program crashed: KASAN: use-after-free Read in incfs_free_mount_info testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mkdir-socket$inet6-bind$inet6-setsockopt$inet6_IPV6_FLOWLABEL_MGR-setsockopt$inet6_int-sendmmsg-sendmmsg-mount$incfs-mount$incfs-chdir-openat-mkdirat-syz_mount_image$fuse-mount$overlay-mount$overlay-setxattr$security_capability-setxattr$security_capability-newfstatat-mkdirat-mount$bind-mount$overlay-socket$inet_icmp_raw-setsockopt$IPT_SO_SET_REPLACE-syz_emit_ethernet-syz_emit_ethernet detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000000, &(0x7f0000000280)={[{@nodelalloc}, {@jqfmt_vfsv1}, {@errors_remount}, {@nouser_xattr}]}, 0x0, 0x7b9, &(0x7f00000006c0)="$eJzs3c9rG1ceAPDvyHb8I1nshWV3czMsZAMhcpz1JrvQQ0oPpdBAoD03MbJiUstWsOQQG0MTSqGXQlt6KLSXnPsjvfXaH9BT+1/0UBLSxglN6aG4jDSyFVtybMe23PrzgfG892bk977zZjRPmkETwIE1nP7JRRyNiLeTiMGsPImInlqqO+Jcfb1HS4t9EVFIYnn5pZ+S2joPlxYL0fSa1OEs88+I+OqNiBO59fVW5hemxkul4myWH6lOXx2pzC+cvDI9PlmcLM6cGR0bO332v2fP7FysP3+3cOTuO8//+9Nzv77+j9tvfZ3EuTiSLWuOY6cMx3C2TXrSTfiY53a6sg5LOt0AtiU9NLvqR3kcjcHoqqXa6N/LlgEAu+W1iFgGAA6YxPkfAA6YxvcAD5cWC42ps99I7K17z0ZEXz3+R9lUX9KdXbPrq10HHXiYPHZlJImIoR2ofzgiPvz8lWNdWT5th2tpwF64cTMiLg0Nr3//T9bds7BVpzZauNxbmw2vKT5o5x/opC/S8c//Wo3/civjn2gx/umtH7t/f9r62x7/K4Or3J2nrWMj6fjvmfq9bWvGfys3rQ11Zbm/1JrVk1y+UiqeyrZBKs2P1lKtR27HH/z2oF392fjv43S6/+6rH6X1p/PVNXJ3unsff83EeLX7m6cJusm9mzGQJdfEn6z0f9Jm/Hthk3W88P83P2i3LI0/jbcxrY9/dy3fijjWsv9X+zLZ8P7EkdruMNLYKVr47Pv3B9rV39z/6ZTWn853PtLW7t2MGLg/GEmyug3qS1biH0qa79esbL2Ob28Nftlu2ZPjb7n/jx9KXq6lD2Vl18er1dnRiEPJi+vLT6++tpFvrJ/Gf/xfrY//erWt9//0M+GlTcbffffHT7Yf/+5K45/YeP9f0/99WfFqyZMStx9NdbWrf3P9P1ZLHc9K0v5/Ulybadf29mYAAAAAAAAAAAAAAAAAAAAAAAAA2LpcRByJJJdfSedy+Xz9Gd5/i4FcqVypnrhcnpuZiNqzsoeiJ9f4qcvBpt9DHc1+srWRP70m/5+I+GtEvNfbX8vnC+XSRKeDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM4TbP/0/90Nvp1gEAu6av0w0AAPac8z8AHDxbO//371o7AIC94/M/ABw8mz7/X9rddgAAe8fnfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHbZhfPn02n5l6XFQpqfuDY/N1W+dnKiWJnKT88V8oXy7NX8ZLk8WSrmC+Xptv/oRn1WKpevjsXM3PWRarFSHanML1ycLs/NVC9emR6fLF4s9uxZZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACweZX5hanxUqk4+6dI3FgNbIf/c39H4xrYH5u3KdEd+6IZ+zrRG/uiGdtMNL9L9HfgnQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgj+H3AAAA//+0Bxg2") mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x9, @mcast1, 0x48f}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000540)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6, 0x0, 0x3, 0xd}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000580)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) (async) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) (async) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) chdir(&(0x7f0000000f80)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x88040, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x181) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x3000440, 0x0, 0xff, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) (async) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) (async) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) newfstatat(0xffffffffffffff9c, &(0x7f0000000440)='./file0/file1\x00', &(0x7f0000000480), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000fc0)='./file1/file0\x00', 0x140) mount$bind(&(0x7f0000001000)='.\x00', &(0x7f0000001040)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f0000001080)='./bus\x00', &(0x7f00000010c0), 0x40, &(0x7f0000001100)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]}) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000001300)=@raw={'raw\x00', 0x9, 0x3, 0x220, 0x0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0xf0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0xc8, 0xf0, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'lo\x00', {0x0, 0x3e8, 0x5, 0x8, 0x40, 0x3e8, 0x3e8}}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffffffffffff}}}}, 0x280) syz_emit_ethernet(0x2a, &(0x7f0000001580)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) (async) syz_emit_ethernet(0x2a, &(0x7f0000001580)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) program crashed: KASAN: use-after-free Read in incfs_free_mount_info testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mkdir-socket$inet6-bind$inet6-setsockopt$inet6_IPV6_FLOWLABEL_MGR-setsockopt$inet6_int-sendmmsg-sendmmsg-mount$incfs-mount$incfs-chdir-openat-mkdirat-syz_mount_image$fuse-mount$overlay-mount$overlay-setxattr$security_capability-setxattr$security_capability-newfstatat-mkdirat-mount$bind-mount$overlay-socket$inet_icmp_raw-setsockopt$IPT_SO_SET_REPLACE-syz_emit_ethernet detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000000, &(0x7f0000000280)={[{@nodelalloc}, {@jqfmt_vfsv1}, {@errors_remount}, {@nouser_xattr}]}, 0x0, 0x7b9, &(0x7f00000006c0)="$eJzs3c9rG1ceAPDvyHb8I1nshWV3czMsZAMhcpz1JrvQQ0oPpdBAoD03MbJiUstWsOQQG0MTSqGXQlt6KLSXnPsjvfXaH9BT+1/0UBLSxglN6aG4jDSyFVtybMe23PrzgfG892bk977zZjRPmkETwIE1nP7JRRyNiLeTiMGsPImInlqqO+Jcfb1HS4t9EVFIYnn5pZ+S2joPlxYL0fSa1OEs88+I+OqNiBO59fVW5hemxkul4myWH6lOXx2pzC+cvDI9PlmcLM6cGR0bO332v2fP7FysP3+3cOTuO8//+9Nzv77+j9tvfZ3EuTiSLWuOY6cMx3C2TXrSTfiY53a6sg5LOt0AtiU9NLvqR3kcjcHoqqXa6N/LlgEAu+W1iFgGAA6YxPkfAA6YxvcAD5cWC42ps99I7K17z0ZEXz3+R9lUX9KdXbPrq10HHXiYPHZlJImIoR2ofzgiPvz8lWNdWT5th2tpwF64cTMiLg0Nr3//T9bds7BVpzZauNxbmw2vKT5o5x/opC/S8c//Wo3/civjn2gx/umtH7t/f9r62x7/K4Or3J2nrWMj6fjvmfq9bWvGfys3rQ11Zbm/1JrVk1y+UiqeyrZBKs2P1lKtR27HH/z2oF392fjv43S6/+6rH6X1p/PVNXJ3unsff83EeLX7m6cJusm9mzGQJdfEn6z0f9Jm/Hthk3W88P83P2i3LI0/jbcxrY9/dy3fijjWsv9X+zLZ8P7EkdruMNLYKVr47Pv3B9rV39z/6ZTWn853PtLW7t2MGLg/GEmyug3qS1biH0qa79esbL2Ob28Nftlu2ZPjb7n/jx9KXq6lD2Vl18er1dnRiEPJi+vLT6++tpFvrJ/Gf/xfrY//erWt9//0M+GlTcbffffHT7Yf/+5K45/YeP9f0/99WfFqyZMStx9NdbWrf3P9P1ZLHc9K0v5/Ulybadf29mYAAAAAAAAAAAAAAAAAAAAAAAAA2LpcRByJJJdfSedy+Xz9Gd5/i4FcqVypnrhcnpuZiNqzsoeiJ9f4qcvBpt9DHc1+srWRP70m/5+I+GtEvNfbX8vnC+XSRKeDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM4TbP/0/90Nvp1gEAu6av0w0AAPac8z8AHDxbO//371o7AIC94/M/ABw8mz7/X9rddgAAe8fnfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHbZhfPn02n5l6XFQpqfuDY/N1W+dnKiWJnKT88V8oXy7NX8ZLk8WSrmC+Xptv/oRn1WKpevjsXM3PWRarFSHanML1ycLs/NVC9emR6fLF4s9uxZZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACweZX5hanxUqk4+6dI3FgNbIf/c39H4xrYH5u3KdEd+6IZ+zrRG/uiGdtMNL9L9HfgnQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgj+H3AAAA//+0Bxg2") mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x9, @mcast1, 0x48f}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000540)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6, 0x0, 0x3, 0xd}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000580)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) (async) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) (async) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) chdir(&(0x7f0000000f80)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x88040, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x181) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x3000440, 0x0, 0xff, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) (async) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) (async) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) newfstatat(0xffffffffffffff9c, &(0x7f0000000440)='./file0/file1\x00', &(0x7f0000000480), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000fc0)='./file1/file0\x00', 0x140) mount$bind(&(0x7f0000001000)='.\x00', &(0x7f0000001040)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f0000001080)='./bus\x00', &(0x7f00000010c0), 0x40, &(0x7f0000001100)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]}) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000001300)=@raw={'raw\x00', 0x9, 0x3, 0x220, 0x0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0xf0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0xc8, 0xf0, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'lo\x00', {0x0, 0x3e8, 0x5, 0x8, 0x40, 0x3e8, 0x3e8}}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffffffffffff}}}}, 0x280) syz_emit_ethernet(0x2a, &(0x7f0000001580)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010300, @local}, @info_reply={0xd, 0x0, 0x0, 0xfffe}}}}}, 0x0) (async) program crashed: KASAN: use-after-free Read in incfs_free_mount_info testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mkdir-socket$inet6-bind$inet6-setsockopt$inet6_IPV6_FLOWLABEL_MGR-setsockopt$inet6_int-sendmmsg-sendmmsg-mount$incfs-mount$incfs-chdir-openat-mkdirat-syz_mount_image$fuse-mount$overlay-mount$overlay-setxattr$security_capability-setxattr$security_capability-newfstatat-mkdirat-mount$bind-mount$overlay-socket$inet_icmp_raw-setsockopt$IPT_SO_SET_REPLACE detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000000, &(0x7f0000000280)={[{@nodelalloc}, {@jqfmt_vfsv1}, {@errors_remount}, {@nouser_xattr}]}, 0x0, 0x7b9, &(0x7f00000006c0)="$eJzs3c9rG1ceAPDvyHb8I1nshWV3czMsZAMhcpz1JrvQQ0oPpdBAoD03MbJiUstWsOQQG0MTSqGXQlt6KLSXnPsjvfXaH9BT+1/0UBLSxglN6aG4jDSyFVtybMe23PrzgfG892bk977zZjRPmkETwIE1nP7JRRyNiLeTiMGsPImInlqqO+Jcfb1HS4t9EVFIYnn5pZ+S2joPlxYL0fSa1OEs88+I+OqNiBO59fVW5hemxkul4myWH6lOXx2pzC+cvDI9PlmcLM6cGR0bO332v2fP7FysP3+3cOTuO8//+9Nzv77+j9tvfZ3EuTiSLWuOY6cMx3C2TXrSTfiY53a6sg5LOt0AtiU9NLvqR3kcjcHoqqXa6N/LlgEAu+W1iFgGAA6YxPkfAA6YxvcAD5cWC42ps99I7K17z0ZEXz3+R9lUX9KdXbPrq10HHXiYPHZlJImIoR2ofzgiPvz8lWNdWT5th2tpwF64cTMiLg0Nr3//T9bds7BVpzZauNxbmw2vKT5o5x/opC/S8c//Wo3/civjn2gx/umtH7t/f9r62x7/K4Or3J2nrWMj6fjvmfq9bWvGfys3rQ11Zbm/1JrVk1y+UiqeyrZBKs2P1lKtR27HH/z2oF392fjv43S6/+6rH6X1p/PVNXJ3unsff83EeLX7m6cJusm9mzGQJdfEn6z0f9Jm/Hthk3W88P83P2i3LI0/jbcxrY9/dy3fijjWsv9X+zLZ8P7EkdruMNLYKVr47Pv3B9rV39z/6ZTWn853PtLW7t2MGLg/GEmyug3qS1biH0qa79esbL2Ob28Nftlu2ZPjb7n/jx9KXq6lD2Vl18er1dnRiEPJi+vLT6++tpFvrJ/Gf/xfrY//erWt9//0M+GlTcbffffHT7Yf/+5K45/YeP9f0/99WfFqyZMStx9NdbWrf3P9P1ZLHc9K0v5/Ulybadf29mYAAAAAAAAAAAAAAAAAAAAAAAAA2LpcRByJJJdfSedy+Xz9Gd5/i4FcqVypnrhcnpuZiNqzsoeiJ9f4qcvBpt9DHc1+srWRP70m/5+I+GtEvNfbX8vnC+XSRKeDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM4TbP/0/90Nvp1gEAu6av0w0AAPac8z8AHDxbO//371o7AIC94/M/ABw8mz7/X9rddgAAe8fnfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHbZhfPn02n5l6XFQpqfuDY/N1W+dnKiWJnKT88V8oXy7NX8ZLk8WSrmC+Xptv/oRn1WKpevjsXM3PWRarFSHanML1ycLs/NVC9emR6fLF4s9uxZZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACweZX5hanxUqk4+6dI3FgNbIf/c39H4xrYH5u3KdEd+6IZ+zrRG/uiGdtMNL9L9HfgnQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgj+H3AAAA//+0Bxg2") mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x9, @mcast1, 0x48f}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000540)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6, 0x0, 0x3, 0xd}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000580)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) (async) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) (async) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) chdir(&(0x7f0000000f80)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x88040, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x181) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x3000440, 0x0, 0xff, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) (async) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) (async) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) newfstatat(0xffffffffffffff9c, &(0x7f0000000440)='./file0/file1\x00', &(0x7f0000000480), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000fc0)='./file1/file0\x00', 0x140) mount$bind(&(0x7f0000001000)='.\x00', &(0x7f0000001040)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f0000001080)='./bus\x00', &(0x7f00000010c0), 0x40, &(0x7f0000001100)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]}) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000001300)=@raw={'raw\x00', 0x9, 0x3, 0x220, 0x0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0xf0, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0xc8, 0xf0, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'lo\x00', {0x0, 0x3e8, 0x5, 0x8, 0x40, 0x3e8, 0x3e8}}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffffffffffff}}}}, 0x280) program crashed: KASAN: use-after-free Read in incfs_free_mount_info testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mkdir-socket$inet6-bind$inet6-setsockopt$inet6_IPV6_FLOWLABEL_MGR-setsockopt$inet6_int-sendmmsg-sendmmsg-mount$incfs-mount$incfs-chdir-openat-mkdirat-syz_mount_image$fuse-mount$overlay-mount$overlay-setxattr$security_capability-setxattr$security_capability-newfstatat-mkdirat-mount$bind-mount$overlay-socket$inet_icmp_raw detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000000, &(0x7f0000000280)={[{@nodelalloc}, {@jqfmt_vfsv1}, {@errors_remount}, {@nouser_xattr}]}, 0x0, 0x7b9, &(0x7f00000006c0)="$eJzs3c9rG1ceAPDvyHb8I1nshWV3czMsZAMhcpz1JrvQQ0oPpdBAoD03MbJiUstWsOQQG0MTSqGXQlt6KLSXnPsjvfXaH9BT+1/0UBLSxglN6aG4jDSyFVtybMe23PrzgfG892bk977zZjRPmkETwIE1nP7JRRyNiLeTiMGsPImInlqqO+Jcfb1HS4t9EVFIYnn5pZ+S2joPlxYL0fSa1OEs88+I+OqNiBO59fVW5hemxkul4myWH6lOXx2pzC+cvDI9PlmcLM6cGR0bO332v2fP7FysP3+3cOTuO8//+9Nzv77+j9tvfZ3EuTiSLWuOY6cMx3C2TXrSTfiY53a6sg5LOt0AtiU9NLvqR3kcjcHoqqXa6N/LlgEAu+W1iFgGAA6YxPkfAA6YxvcAD5cWC42ps99I7K17z0ZEXz3+R9lUX9KdXbPrq10HHXiYPHZlJImIoR2ofzgiPvz8lWNdWT5th2tpwF64cTMiLg0Nr3//T9bds7BVpzZauNxbmw2vKT5o5x/opC/S8c//Wo3/civjn2gx/umtH7t/f9r62x7/K4Or3J2nrWMj6fjvmfq9bWvGfys3rQ11Zbm/1JrVk1y+UiqeyrZBKs2P1lKtR27HH/z2oF392fjv43S6/+6rH6X1p/PVNXJ3unsff83EeLX7m6cJusm9mzGQJdfEn6z0f9Jm/Hthk3W88P83P2i3LI0/jbcxrY9/dy3fijjWsv9X+zLZ8P7EkdruMNLYKVr47Pv3B9rV39z/6ZTWn853PtLW7t2MGLg/GEmyug3qS1biH0qa79esbL2Ob28Nftlu2ZPjb7n/jx9KXq6lD2Vl18er1dnRiEPJi+vLT6++tpFvrJ/Gf/xfrY//erWt9//0M+GlTcbffffHT7Yf/+5K45/YeP9f0/99WfFqyZMStx9NdbWrf3P9P1ZLHc9K0v5/Ulybadf29mYAAAAAAAAAAAAAAAAAAAAAAAAA2LpcRByJJJdfSedy+Xz9Gd5/i4FcqVypnrhcnpuZiNqzsoeiJ9f4qcvBpt9DHc1+srWRP70m/5+I+GtEvNfbX8vnC+XSRKeDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM4TbP/0/90Nvp1gEAu6av0w0AAPac8z8AHDxbO//371o7AIC94/M/ABw8mz7/X9rddgAAe8fnfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHbZhfPn02n5l6XFQpqfuDY/N1W+dnKiWJnKT88V8oXy7NX8ZLk8WSrmC+Xptv/oRn1WKpevjsXM3PWRarFSHanML1ycLs/NVC9emR6fLF4s9uxZZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACweZX5hanxUqk4+6dI3FgNbIf/c39H4xrYH5u3KdEd+6IZ+zrRG/uiGdtMNL9L9HfgnQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgj+H3AAAA//+0Bxg2") mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x9, @mcast1, 0x48f}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000540)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6, 0x0, 0x3, 0xd}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000580)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) (async) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) (async) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) chdir(&(0x7f0000000f80)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x88040, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x181) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x3000440, 0x0, 0xff, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) (async) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) (async) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) newfstatat(0xffffffffffffff9c, &(0x7f0000000440)='./file0/file1\x00', &(0x7f0000000480), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000fc0)='./file1/file0\x00', 0x140) mount$bind(&(0x7f0000001000)='.\x00', &(0x7f0000001040)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f0000001080)='./bus\x00', &(0x7f00000010c0), 0x40, &(0x7f0000001100)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]}) socket$inet_icmp_raw(0x2, 0x3, 0x1) program crashed: KASAN: use-after-free Read in incfs_free_mount_info testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mkdir-socket$inet6-bind$inet6-setsockopt$inet6_IPV6_FLOWLABEL_MGR-setsockopt$inet6_int-sendmmsg-sendmmsg-mount$incfs-mount$incfs-chdir-openat-mkdirat-syz_mount_image$fuse-mount$overlay-mount$overlay-setxattr$security_capability-setxattr$security_capability-newfstatat-mkdirat-mount$bind-mount$overlay detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000000, &(0x7f0000000280)={[{@nodelalloc}, {@jqfmt_vfsv1}, {@errors_remount}, {@nouser_xattr}]}, 0x0, 0x7b9, &(0x7f00000006c0)="$eJzs3c9rG1ceAPDvyHb8I1nshWV3czMsZAMhcpz1JrvQQ0oPpdBAoD03MbJiUstWsOQQG0MTSqGXQlt6KLSXnPsjvfXaH9BT+1/0UBLSxglN6aG4jDSyFVtybMe23PrzgfG892bk977zZjRPmkETwIE1nP7JRRyNiLeTiMGsPImInlqqO+Jcfb1HS4t9EVFIYnn5pZ+S2joPlxYL0fSa1OEs88+I+OqNiBO59fVW5hemxkul4myWH6lOXx2pzC+cvDI9PlmcLM6cGR0bO332v2fP7FysP3+3cOTuO8//+9Nzv77+j9tvfZ3EuTiSLWuOY6cMx3C2TXrSTfiY53a6sg5LOt0AtiU9NLvqR3kcjcHoqqXa6N/LlgEAu+W1iFgGAA6YxPkfAA6YxvcAD5cWC42ps99I7K17z0ZEXz3+R9lUX9KdXbPrq10HHXiYPHZlJImIoR2ofzgiPvz8lWNdWT5th2tpwF64cTMiLg0Nr3//T9bds7BVpzZauNxbmw2vKT5o5x/opC/S8c//Wo3/civjn2gx/umtH7t/f9r62x7/K4Or3J2nrWMj6fjvmfq9bWvGfys3rQ11Zbm/1JrVk1y+UiqeyrZBKs2P1lKtR27HH/z2oF392fjv43S6/+6rH6X1p/PVNXJ3unsff83EeLX7m6cJusm9mzGQJdfEn6z0f9Jm/Hthk3W88P83P2i3LI0/jbcxrY9/dy3fijjWsv9X+zLZ8P7EkdruMNLYKVr47Pv3B9rV39z/6ZTWn853PtLW7t2MGLg/GEmyug3qS1biH0qa79esbL2Ob28Nftlu2ZPjb7n/jx9KXq6lD2Vl18er1dnRiEPJi+vLT6++tpFvrJ/Gf/xfrY//erWt9//0M+GlTcbffffHT7Yf/+5K45/YeP9f0/99WfFqyZMStx9NdbWrf3P9P1ZLHc9K0v5/Ulybadf29mYAAAAAAAAAAAAAAAAAAAAAAAAA2LpcRByJJJdfSedy+Xz9Gd5/i4FcqVypnrhcnpuZiNqzsoeiJ9f4qcvBpt9DHc1+srWRP70m/5+I+GtEvNfbX8vnC+XSRKeDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM4TbP/0/90Nvp1gEAu6av0w0AAPac8z8AHDxbO//371o7AIC94/M/ABw8mz7/X9rddgAAe8fnfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHbZhfPn02n5l6XFQpqfuDY/N1W+dnKiWJnKT88V8oXy7NX8ZLk8WSrmC+Xptv/oRn1WKpevjsXM3PWRarFSHanML1ycLs/NVC9emR6fLF4s9uxZZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACweZX5hanxUqk4+6dI3FgNbIf/c39H4xrYH5u3KdEd+6IZ+zrRG/uiGdtMNL9L9HfgnQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgj+H3AAAA//+0Bxg2") mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x9, @mcast1, 0x48f}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000540)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6, 0x0, 0x3, 0xd}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000580)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) (async) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) (async) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) chdir(&(0x7f0000000f80)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x88040, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x181) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x3000440, 0x0, 0xff, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) (async) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) (async) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) newfstatat(0xffffffffffffff9c, &(0x7f0000000440)='./file0/file1\x00', &(0x7f0000000480), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000fc0)='./file1/file0\x00', 0x140) mount$bind(&(0x7f0000001000)='.\x00', &(0x7f0000001040)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f0000001080)='./bus\x00', &(0x7f00000010c0), 0x40, &(0x7f0000001100)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]}) program crashed: KASAN: use-after-free Read in incfs_free_mount_info testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mkdir-socket$inet6-bind$inet6-setsockopt$inet6_IPV6_FLOWLABEL_MGR-setsockopt$inet6_int-sendmmsg-sendmmsg-mount$incfs-mount$incfs-chdir-openat-mkdirat-syz_mount_image$fuse-mount$overlay-mount$overlay-setxattr$security_capability-setxattr$security_capability-newfstatat-mkdirat-mount$bind detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000000, &(0x7f0000000280)={[{@nodelalloc}, {@jqfmt_vfsv1}, {@errors_remount}, {@nouser_xattr}]}, 0x0, 0x7b9, &(0x7f00000006c0)="$eJzs3c9rG1ceAPDvyHb8I1nshWV3czMsZAMhcpz1JrvQQ0oPpdBAoD03MbJiUstWsOQQG0MTSqGXQlt6KLSXnPsjvfXaH9BT+1/0UBLSxglN6aG4jDSyFVtybMe23PrzgfG892bk977zZjRPmkETwIE1nP7JRRyNiLeTiMGsPImInlqqO+Jcfb1HS4t9EVFIYnn5pZ+S2joPlxYL0fSa1OEs88+I+OqNiBO59fVW5hemxkul4myWH6lOXx2pzC+cvDI9PlmcLM6cGR0bO332v2fP7FysP3+3cOTuO8//+9Nzv77+j9tvfZ3EuTiSLWuOY6cMx3C2TXrSTfiY53a6sg5LOt0AtiU9NLvqR3kcjcHoqqXa6N/LlgEAu+W1iFgGAA6YxPkfAA6YxvcAD5cWC42ps99I7K17z0ZEXz3+R9lUX9KdXbPrq10HHXiYPHZlJImIoR2ofzgiPvz8lWNdWT5th2tpwF64cTMiLg0Nr3//T9bds7BVpzZauNxbmw2vKT5o5x/opC/S8c//Wo3/civjn2gx/umtH7t/f9r62x7/K4Or3J2nrWMj6fjvmfq9bWvGfys3rQ11Zbm/1JrVk1y+UiqeyrZBKs2P1lKtR27HH/z2oF392fjv43S6/+6rH6X1p/PVNXJ3unsff83EeLX7m6cJusm9mzGQJdfEn6z0f9Jm/Hthk3W88P83P2i3LI0/jbcxrY9/dy3fijjWsv9X+zLZ8P7EkdruMNLYKVr47Pv3B9rV39z/6ZTWn853PtLW7t2MGLg/GEmyug3qS1biH0qa79esbL2Ob28Nftlu2ZPjb7n/jx9KXq6lD2Vl18er1dnRiEPJi+vLT6++tpFvrJ/Gf/xfrY//erWt9//0M+GlTcbffffHT7Yf/+5K45/YeP9f0/99WfFqyZMStx9NdbWrf3P9P1ZLHc9K0v5/Ulybadf29mYAAAAAAAAAAAAAAAAAAAAAAAAA2LpcRByJJJdfSedy+Xz9Gd5/i4FcqVypnrhcnpuZiNqzsoeiJ9f4qcvBpt9DHc1+srWRP70m/5+I+GtEvNfbX8vnC+XSRKeDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM4TbP/0/90Nvp1gEAu6av0w0AAPac8z8AHDxbO//371o7AIC94/M/ABw8mz7/X9rddgAAe8fnfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHbZhfPn02n5l6XFQpqfuDY/N1W+dnKiWJnKT88V8oXy7NX8ZLk8WSrmC+Xptv/oRn1WKpevjsXM3PWRarFSHanML1ycLs/NVC9emR6fLF4s9uxZZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACweZX5hanxUqk4+6dI3FgNbIf/c39H4xrYH5u3KdEd+6IZ+zrRG/uiGdtMNL9L9HfgnQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgj+H3AAAA//+0Bxg2") mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x9, @mcast1, 0x48f}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000540)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6, 0x0, 0x3, 0xd}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000580)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) (async) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) (async) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) chdir(&(0x7f0000000f80)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x88040, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x181) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x3000440, 0x0, 0xff, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) (async) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) (async) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) newfstatat(0xffffffffffffff9c, &(0x7f0000000440)='./file0/file1\x00', &(0x7f0000000480), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000fc0)='./file1/file0\x00', 0x140) mount$bind(&(0x7f0000001000)='.\x00', &(0x7f0000001040)='./file1/file0\x00', 0x0, 0x1085408, 0x0) program crashed: KASAN: use-after-free Read in incfs_free_mount_info testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mkdir-socket$inet6-bind$inet6-setsockopt$inet6_IPV6_FLOWLABEL_MGR-setsockopt$inet6_int-sendmmsg-sendmmsg-mount$incfs-mount$incfs-chdir-openat-mkdirat-syz_mount_image$fuse-mount$overlay-mount$overlay-setxattr$security_capability-setxattr$security_capability-newfstatat-mkdirat detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000000, &(0x7f0000000280)={[{@nodelalloc}, {@jqfmt_vfsv1}, {@errors_remount}, {@nouser_xattr}]}, 0x0, 0x7b9, &(0x7f00000006c0)="$eJzs3c9rG1ceAPDvyHb8I1nshWV3czMsZAMhcpz1JrvQQ0oPpdBAoD03MbJiUstWsOQQG0MTSqGXQlt6KLSXnPsjvfXaH9BT+1/0UBLSxglN6aG4jDSyFVtybMe23PrzgfG892bk977zZjRPmkETwIE1nP7JRRyNiLeTiMGsPImInlqqO+Jcfb1HS4t9EVFIYnn5pZ+S2joPlxYL0fSa1OEs88+I+OqNiBO59fVW5hemxkul4myWH6lOXx2pzC+cvDI9PlmcLM6cGR0bO332v2fP7FysP3+3cOTuO8//+9Nzv77+j9tvfZ3EuTiSLWuOY6cMx3C2TXrSTfiY53a6sg5LOt0AtiU9NLvqR3kcjcHoqqXa6N/LlgEAu+W1iFgGAA6YxPkfAA6YxvcAD5cWC42ps99I7K17z0ZEXz3+R9lUX9KdXbPrq10HHXiYPHZlJImIoR2ofzgiPvz8lWNdWT5th2tpwF64cTMiLg0Nr3//T9bds7BVpzZauNxbmw2vKT5o5x/opC/S8c//Wo3/civjn2gx/umtH7t/f9r62x7/K4Or3J2nrWMj6fjvmfq9bWvGfys3rQ11Zbm/1JrVk1y+UiqeyrZBKs2P1lKtR27HH/z2oF392fjv43S6/+6rH6X1p/PVNXJ3unsff83EeLX7m6cJusm9mzGQJdfEn6z0f9Jm/Hthk3W88P83P2i3LI0/jbcxrY9/dy3fijjWsv9X+zLZ8P7EkdruMNLYKVr47Pv3B9rV39z/6ZTWn853PtLW7t2MGLg/GEmyug3qS1biH0qa79esbL2Ob28Nftlu2ZPjb7n/jx9KXq6lD2Vl18er1dnRiEPJi+vLT6++tpFvrJ/Gf/xfrY//erWt9//0M+GlTcbffffHT7Yf/+5K45/YeP9f0/99WfFqyZMStx9NdbWrf3P9P1ZLHc9K0v5/Ulybadf29mYAAAAAAAAAAAAAAAAAAAAAAAAA2LpcRByJJJdfSedy+Xz9Gd5/i4FcqVypnrhcnpuZiNqzsoeiJ9f4qcvBpt9DHc1+srWRP70m/5+I+GtEvNfbX8vnC+XSRKeDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM4TbP/0/90Nvp1gEAu6av0w0AAPac8z8AHDxbO//371o7AIC94/M/ABw8mz7/X9rddgAAe8fnfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHbZhfPn02n5l6XFQpqfuDY/N1W+dnKiWJnKT88V8oXy7NX8ZLk8WSrmC+Xptv/oRn1WKpevjsXM3PWRarFSHanML1ycLs/NVC9emR6fLF4s9uxZZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACweZX5hanxUqk4+6dI3FgNbIf/c39H4xrYH5u3KdEd+6IZ+zrRG/uiGdtMNL9L9HfgnQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgj+H3AAAA//+0Bxg2") mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x9, @mcast1, 0x48f}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000540)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6, 0x0, 0x3, 0xd}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000580)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) (async) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) (async) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) chdir(&(0x7f0000000f80)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x88040, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x181) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x3000440, 0x0, 0xff, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) (async) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) (async) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) newfstatat(0xffffffffffffff9c, &(0x7f0000000440)='./file0/file1\x00', &(0x7f0000000480), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000fc0)='./file1/file0\x00', 0x140) program crashed: KASAN: use-after-free Read in incfs_free_mount_info testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mkdir-socket$inet6-bind$inet6-setsockopt$inet6_IPV6_FLOWLABEL_MGR-setsockopt$inet6_int-sendmmsg-sendmmsg-mount$incfs-mount$incfs-chdir-openat-mkdirat-syz_mount_image$fuse-mount$overlay-mount$overlay-setxattr$security_capability-setxattr$security_capability-newfstatat detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000000, &(0x7f0000000280)={[{@nodelalloc}, {@jqfmt_vfsv1}, {@errors_remount}, {@nouser_xattr}]}, 0x0, 0x7b9, &(0x7f00000006c0)="$eJzs3c9rG1ceAPDvyHb8I1nshWV3czMsZAMhcpz1JrvQQ0oPpdBAoD03MbJiUstWsOQQG0MTSqGXQlt6KLSXnPsjvfXaH9BT+1/0UBLSxglN6aG4jDSyFVtybMe23PrzgfG892bk977zZjRPmkETwIE1nP7JRRyNiLeTiMGsPImInlqqO+Jcfb1HS4t9EVFIYnn5pZ+S2joPlxYL0fSa1OEs88+I+OqNiBO59fVW5hemxkul4myWH6lOXx2pzC+cvDI9PlmcLM6cGR0bO332v2fP7FysP3+3cOTuO8//+9Nzv77+j9tvfZ3EuTiSLWuOY6cMx3C2TXrSTfiY53a6sg5LOt0AtiU9NLvqR3kcjcHoqqXa6N/LlgEAu+W1iFgGAA6YxPkfAA6YxvcAD5cWC42ps99I7K17z0ZEXz3+R9lUX9KdXbPrq10HHXiYPHZlJImIoR2ofzgiPvz8lWNdWT5th2tpwF64cTMiLg0Nr3//T9bds7BVpzZauNxbmw2vKT5o5x/opC/S8c//Wo3/civjn2gx/umtH7t/f9r62x7/K4Or3J2nrWMj6fjvmfq9bWvGfys3rQ11Zbm/1JrVk1y+UiqeyrZBKs2P1lKtR27HH/z2oF392fjv43S6/+6rH6X1p/PVNXJ3unsff83EeLX7m6cJusm9mzGQJdfEn6z0f9Jm/Hthk3W88P83P2i3LI0/jbcxrY9/dy3fijjWsv9X+zLZ8P7EkdruMNLYKVr47Pv3B9rV39z/6ZTWn853PtLW7t2MGLg/GEmyug3qS1biH0qa79esbL2Ob28Nftlu2ZPjb7n/jx9KXq6lD2Vl18er1dnRiEPJi+vLT6++tpFvrJ/Gf/xfrY//erWt9//0M+GlTcbffffHT7Yf/+5K45/YeP9f0/99WfFqyZMStx9NdbWrf3P9P1ZLHc9K0v5/Ulybadf29mYAAAAAAAAAAAAAAAAAAAAAAAAA2LpcRByJJJdfSedy+Xz9Gd5/i4FcqVypnrhcnpuZiNqzsoeiJ9f4qcvBpt9DHc1+srWRP70m/5+I+GtEvNfbX8vnC+XSRKeDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM4TbP/0/90Nvp1gEAu6av0w0AAPac8z8AHDxbO//371o7AIC94/M/ABw8mz7/X9rddgAAe8fnfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHbZhfPn02n5l6XFQpqfuDY/N1W+dnKiWJnKT88V8oXy7NX8ZLk8WSrmC+Xptv/oRn1WKpevjsXM3PWRarFSHanML1ycLs/NVC9emR6fLF4s9uxZZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACweZX5hanxUqk4+6dI3FgNbIf/c39H4xrYH5u3KdEd+6IZ+zrRG/uiGdtMNL9L9HfgnQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgj+H3AAAA//+0Bxg2") mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x9, @mcast1, 0x48f}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000540)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6, 0x0, 0x3, 0xd}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000580)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) (async) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) (async) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) chdir(&(0x7f0000000f80)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x88040, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x181) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x3000440, 0x0, 0xff, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) (async) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) (async) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) newfstatat(0xffffffffffffff9c, &(0x7f0000000440)='./file0/file1\x00', &(0x7f0000000480), 0x0) program crashed: KASAN: use-after-free Read in incfs_free_mount_info testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mkdir-socket$inet6-bind$inet6-setsockopt$inet6_IPV6_FLOWLABEL_MGR-setsockopt$inet6_int-sendmmsg-sendmmsg-mount$incfs-mount$incfs-chdir-openat-mkdirat-syz_mount_image$fuse-mount$overlay-mount$overlay-setxattr$security_capability-setxattr$security_capability detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000000, &(0x7f0000000280)={[{@nodelalloc}, {@jqfmt_vfsv1}, {@errors_remount}, {@nouser_xattr}]}, 0x0, 0x7b9, &(0x7f00000006c0)="$eJzs3c9rG1ceAPDvyHb8I1nshWV3czMsZAMhcpz1JrvQQ0oPpdBAoD03MbJiUstWsOQQG0MTSqGXQlt6KLSXnPsjvfXaH9BT+1/0UBLSxglN6aG4jDSyFVtybMe23PrzgfG892bk977zZjRPmkETwIE1nP7JRRyNiLeTiMGsPImInlqqO+Jcfb1HS4t9EVFIYnn5pZ+S2joPlxYL0fSa1OEs88+I+OqNiBO59fVW5hemxkul4myWH6lOXx2pzC+cvDI9PlmcLM6cGR0bO332v2fP7FysP3+3cOTuO8//+9Nzv77+j9tvfZ3EuTiSLWuOY6cMx3C2TXrSTfiY53a6sg5LOt0AtiU9NLvqR3kcjcHoqqXa6N/LlgEAu+W1iFgGAA6YxPkfAA6YxvcAD5cWC42ps99I7K17z0ZEXz3+R9lUX9KdXbPrq10HHXiYPHZlJImIoR2ofzgiPvz8lWNdWT5th2tpwF64cTMiLg0Nr3//T9bds7BVpzZauNxbmw2vKT5o5x/opC/S8c//Wo3/civjn2gx/umtH7t/f9r62x7/K4Or3J2nrWMj6fjvmfq9bWvGfys3rQ11Zbm/1JrVk1y+UiqeyrZBKs2P1lKtR27HH/z2oF392fjv43S6/+6rH6X1p/PVNXJ3unsff83EeLX7m6cJusm9mzGQJdfEn6z0f9Jm/Hthk3W88P83P2i3LI0/jbcxrY9/dy3fijjWsv9X+zLZ8P7EkdruMNLYKVr47Pv3B9rV39z/6ZTWn853PtLW7t2MGLg/GEmyug3qS1biH0qa79esbL2Ob28Nftlu2ZPjb7n/jx9KXq6lD2Vl18er1dnRiEPJi+vLT6++tpFvrJ/Gf/xfrY//erWt9//0M+GlTcbffffHT7Yf/+5K45/YeP9f0/99WfFqyZMStx9NdbWrf3P9P1ZLHc9K0v5/Ulybadf29mYAAAAAAAAAAAAAAAAAAAAAAAAA2LpcRByJJJdfSedy+Xz9Gd5/i4FcqVypnrhcnpuZiNqzsoeiJ9f4qcvBpt9DHc1+srWRP70m/5+I+GtEvNfbX8vnC+XSRKeDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM4TbP/0/90Nvp1gEAu6av0w0AAPac8z8AHDxbO//371o7AIC94/M/ABw8mz7/X9rddgAAe8fnfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHbZhfPn02n5l6XFQpqfuDY/N1W+dnKiWJnKT88V8oXy7NX8ZLk8WSrmC+Xptv/oRn1WKpevjsXM3PWRarFSHanML1ycLs/NVC9emR6fLF4s9uxZZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACweZX5hanxUqk4+6dI3FgNbIf/c39H4xrYH5u3KdEd+6IZ+zrRG/uiGdtMNL9L9HfgnQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgj+H3AAAA//+0Bxg2") mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x9, @mcast1, 0x48f}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000540)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6, 0x0, 0x3, 0xd}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000580)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) (async) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) (async) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) chdir(&(0x7f0000000f80)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x88040, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x181) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x3000440, 0x0, 0xff, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) (async) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) (async) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) program crashed: KASAN: use-after-free Read in incfs_free_mount_info testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mkdir-socket$inet6-bind$inet6-setsockopt$inet6_IPV6_FLOWLABEL_MGR-setsockopt$inet6_int-sendmmsg-sendmmsg-mount$incfs-mount$incfs-chdir-openat-mkdirat-syz_mount_image$fuse-mount$overlay-mount$overlay-setxattr$security_capability detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000000, &(0x7f0000000280)={[{@nodelalloc}, {@jqfmt_vfsv1}, {@errors_remount}, {@nouser_xattr}]}, 0x0, 0x7b9, &(0x7f00000006c0)="$eJzs3c9rG1ceAPDvyHb8I1nshWV3czMsZAMhcpz1JrvQQ0oPpdBAoD03MbJiUstWsOQQG0MTSqGXQlt6KLSXnPsjvfXaH9BT+1/0UBLSxglN6aG4jDSyFVtybMe23PrzgfG892bk977zZjRPmkETwIE1nP7JRRyNiLeTiMGsPImInlqqO+Jcfb1HS4t9EVFIYnn5pZ+S2joPlxYL0fSa1OEs88+I+OqNiBO59fVW5hemxkul4myWH6lOXx2pzC+cvDI9PlmcLM6cGR0bO332v2fP7FysP3+3cOTuO8//+9Nzv77+j9tvfZ3EuTiSLWuOY6cMx3C2TXrSTfiY53a6sg5LOt0AtiU9NLvqR3kcjcHoqqXa6N/LlgEAu+W1iFgGAA6YxPkfAA6YxvcAD5cWC42ps99I7K17z0ZEXz3+R9lUX9KdXbPrq10HHXiYPHZlJImIoR2ofzgiPvz8lWNdWT5th2tpwF64cTMiLg0Nr3//T9bds7BVpzZauNxbmw2vKT5o5x/opC/S8c//Wo3/civjn2gx/umtH7t/f9r62x7/K4Or3J2nrWMj6fjvmfq9bWvGfys3rQ11Zbm/1JrVk1y+UiqeyrZBKs2P1lKtR27HH/z2oF392fjv43S6/+6rH6X1p/PVNXJ3unsff83EeLX7m6cJusm9mzGQJdfEn6z0f9Jm/Hthk3W88P83P2i3LI0/jbcxrY9/dy3fijjWsv9X+zLZ8P7EkdruMNLYKVr47Pv3B9rV39z/6ZTWn853PtLW7t2MGLg/GEmyug3qS1biH0qa79esbL2Ob28Nftlu2ZPjb7n/jx9KXq6lD2Vl18er1dnRiEPJi+vLT6++tpFvrJ/Gf/xfrY//erWt9//0M+GlTcbffffHT7Yf/+5K45/YeP9f0/99WfFqyZMStx9NdbWrf3P9P1ZLHc9K0v5/Ulybadf29mYAAAAAAAAAAAAAAAAAAAAAAAAA2LpcRByJJJdfSedy+Xz9Gd5/i4FcqVypnrhcnpuZiNqzsoeiJ9f4qcvBpt9DHc1+srWRP70m/5+I+GtEvNfbX8vnC+XSRKeDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM4TbP/0/90Nvp1gEAu6av0w0AAPac8z8AHDxbO//371o7AIC94/M/ABw8mz7/X9rddgAAe8fnfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHbZhfPn02n5l6XFQpqfuDY/N1W+dnKiWJnKT88V8oXy7NX8ZLk8WSrmC+Xptv/oRn1WKpevjsXM3PWRarFSHanML1ycLs/NVC9emR6fLF4s9uxZZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACweZX5hanxUqk4+6dI3FgNbIf/c39H4xrYH5u3KdEd+6IZ+zrRG/uiGdtMNL9L9HfgnQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgj+H3AAAA//+0Bxg2") mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x9, @mcast1, 0x48f}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000540)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6, 0x0, 0x3, 0xd}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000580)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) (async) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) (async) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) chdir(&(0x7f0000000f80)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x88040, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x181) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x3000440, 0x0, 0xff, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) (async) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) setxattr$security_capability(&(0x7f00000003c0)='./file0/file1\x00', &(0x7f0000000400), 0x0, 0x0, 0x2) (async) program crashed: KASAN: use-after-free Read in incfs_free_mount_info testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mkdir-socket$inet6-bind$inet6-setsockopt$inet6_IPV6_FLOWLABEL_MGR-setsockopt$inet6_int-sendmmsg-sendmmsg-mount$incfs-mount$incfs-chdir-openat-mkdirat-syz_mount_image$fuse-mount$overlay-mount$overlay detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000000, &(0x7f0000000280)={[{@nodelalloc}, {@jqfmt_vfsv1}, {@errors_remount}, {@nouser_xattr}]}, 0x0, 0x7b9, &(0x7f00000006c0)="$eJzs3c9rG1ceAPDvyHb8I1nshWV3czMsZAMhcpz1JrvQQ0oPpdBAoD03MbJiUstWsOQQG0MTSqGXQlt6KLSXnPsjvfXaH9BT+1/0UBLSxglN6aG4jDSyFVtybMe23PrzgfG892bk977zZjRPmkETwIE1nP7JRRyNiLeTiMGsPImInlqqO+Jcfb1HS4t9EVFIYnn5pZ+S2joPlxYL0fSa1OEs88+I+OqNiBO59fVW5hemxkul4myWH6lOXx2pzC+cvDI9PlmcLM6cGR0bO332v2fP7FysP3+3cOTuO8//+9Nzv77+j9tvfZ3EuTiSLWuOY6cMx3C2TXrSTfiY53a6sg5LOt0AtiU9NLvqR3kcjcHoqqXa6N/LlgEAu+W1iFgGAA6YxPkfAA6YxvcAD5cWC42ps99I7K17z0ZEXz3+R9lUX9KdXbPrq10HHXiYPHZlJImIoR2ofzgiPvz8lWNdWT5th2tpwF64cTMiLg0Nr3//T9bds7BVpzZauNxbmw2vKT5o5x/opC/S8c//Wo3/civjn2gx/umtH7t/f9r62x7/K4Or3J2nrWMj6fjvmfq9bWvGfys3rQ11Zbm/1JrVk1y+UiqeyrZBKs2P1lKtR27HH/z2oF392fjv43S6/+6rH6X1p/PVNXJ3unsff83EeLX7m6cJusm9mzGQJdfEn6z0f9Jm/Hthk3W88P83P2i3LI0/jbcxrY9/dy3fijjWsv9X+zLZ8P7EkdruMNLYKVr47Pv3B9rV39z/6ZTWn853PtLW7t2MGLg/GEmyug3qS1biH0qa79esbL2Ob28Nftlu2ZPjb7n/jx9KXq6lD2Vl18er1dnRiEPJi+vLT6++tpFvrJ/Gf/xfrY//erWt9//0M+GlTcbffffHT7Yf/+5K45/YeP9f0/99WfFqyZMStx9NdbWrf3P9P1ZLHc9K0v5/Ulybadf29mYAAAAAAAAAAAAAAAAAAAAAAAAA2LpcRByJJJdfSedy+Xz9Gd5/i4FcqVypnrhcnpuZiNqzsoeiJ9f4qcvBpt9DHc1+srWRP70m/5+I+GtEvNfbX8vnC+XSRKeDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM4TbP/0/90Nvp1gEAu6av0w0AAPac8z8AHDxbO//371o7AIC94/M/ABw8mz7/X9rddgAAe8fnfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHbZhfPn02n5l6XFQpqfuDY/N1W+dnKiWJnKT88V8oXy7NX8ZLk8WSrmC+Xptv/oRn1WKpevjsXM3PWRarFSHanML1ycLs/NVC9emR6fLF4s9uxZZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACweZX5hanxUqk4+6dI3FgNbIf/c39H4xrYH5u3KdEd+6IZ+zrRG/uiGdtMNL9L9HfgnQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgj+H3AAAA//+0Bxg2") mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x9, @mcast1, 0x48f}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000540)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6, 0x0, 0x3, 0xd}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000580)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) (async) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) (async) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) chdir(&(0x7f0000000f80)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x88040, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x181) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x3000440, 0x0, 0xff, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) (async) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) program crashed: KASAN: use-after-free Read in incfs_free_mount_info testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mkdir-socket$inet6-bind$inet6-setsockopt$inet6_IPV6_FLOWLABEL_MGR-setsockopt$inet6_int-sendmmsg-sendmmsg-mount$incfs-mount$incfs-chdir-openat-mkdirat-syz_mount_image$fuse-mount$overlay detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000000, &(0x7f0000000280)={[{@nodelalloc}, {@jqfmt_vfsv1}, {@errors_remount}, {@nouser_xattr}]}, 0x0, 0x7b9, &(0x7f00000006c0)="$eJzs3c9rG1ceAPDvyHb8I1nshWV3czMsZAMhcpz1JrvQQ0oPpdBAoD03MbJiUstWsOQQG0MTSqGXQlt6KLSXnPsjvfXaH9BT+1/0UBLSxglN6aG4jDSyFVtybMe23PrzgfG892bk977zZjRPmkETwIE1nP7JRRyNiLeTiMGsPImInlqqO+Jcfb1HS4t9EVFIYnn5pZ+S2joPlxYL0fSa1OEs88+I+OqNiBO59fVW5hemxkul4myWH6lOXx2pzC+cvDI9PlmcLM6cGR0bO332v2fP7FysP3+3cOTuO8//+9Nzv77+j9tvfZ3EuTiSLWuOY6cMx3C2TXrSTfiY53a6sg5LOt0AtiU9NLvqR3kcjcHoqqXa6N/LlgEAu+W1iFgGAA6YxPkfAA6YxvcAD5cWC42ps99I7K17z0ZEXz3+R9lUX9KdXbPrq10HHXiYPHZlJImIoR2ofzgiPvz8lWNdWT5th2tpwF64cTMiLg0Nr3//T9bds7BVpzZauNxbmw2vKT5o5x/opC/S8c//Wo3/civjn2gx/umtH7t/f9r62x7/K4Or3J2nrWMj6fjvmfq9bWvGfys3rQ11Zbm/1JrVk1y+UiqeyrZBKs2P1lKtR27HH/z2oF392fjv43S6/+6rH6X1p/PVNXJ3unsff83EeLX7m6cJusm9mzGQJdfEn6z0f9Jm/Hthk3W88P83P2i3LI0/jbcxrY9/dy3fijjWsv9X+zLZ8P7EkdruMNLYKVr47Pv3B9rV39z/6ZTWn853PtLW7t2MGLg/GEmyug3qS1biH0qa79esbL2Ob28Nftlu2ZPjb7n/jx9KXq6lD2Vl18er1dnRiEPJi+vLT6++tpFvrJ/Gf/xfrY//erWt9//0M+GlTcbffffHT7Yf/+5K45/YeP9f0/99WfFqyZMStx9NdbWrf3P9P1ZLHc9K0v5/Ulybadf29mYAAAAAAAAAAAAAAAAAAAAAAAAA2LpcRByJJJdfSedy+Xz9Gd5/i4FcqVypnrhcnpuZiNqzsoeiJ9f4qcvBpt9DHc1+srWRP70m/5+I+GtEvNfbX8vnC+XSRKeDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM4TbP/0/90Nvp1gEAu6av0w0AAPac8z8AHDxbO//371o7AIC94/M/ABw8mz7/X9rddgAAe8fnfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHbZhfPn02n5l6XFQpqfuDY/N1W+dnKiWJnKT88V8oXy7NX8ZLk8WSrmC+Xptv/oRn1WKpevjsXM3PWRarFSHanML1ycLs/NVC9emR6fLF4s9uxZZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACweZX5hanxUqk4+6dI3FgNbIf/c39H4xrYH5u3KdEd+6IZ+zrRG/uiGdtMNL9L9HfgnQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgj+H3AAAA//+0Bxg2") mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x9, @mcast1, 0x48f}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000540)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6, 0x0, 0x3, 0xd}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000580)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) (async) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) (async) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) chdir(&(0x7f0000000f80)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x88040, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x181) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x3000440, 0x0, 0xff, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) (async) program crashed: KASAN: use-after-free Read in incfs_free_mount_info testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mkdir-socket$inet6-bind$inet6-setsockopt$inet6_IPV6_FLOWLABEL_MGR-setsockopt$inet6_int-sendmmsg-sendmmsg-mount$incfs-mount$incfs-chdir-openat-mkdirat-syz_mount_image$fuse detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000000, &(0x7f0000000280)={[{@nodelalloc}, {@jqfmt_vfsv1}, {@errors_remount}, {@nouser_xattr}]}, 0x0, 0x7b9, &(0x7f00000006c0)="$eJzs3c9rG1ceAPDvyHb8I1nshWV3czMsZAMhcpz1JrvQQ0oPpdBAoD03MbJiUstWsOQQG0MTSqGXQlt6KLSXnPsjvfXaH9BT+1/0UBLSxglN6aG4jDSyFVtybMe23PrzgfG892bk977zZjRPmkETwIE1nP7JRRyNiLeTiMGsPImInlqqO+Jcfb1HS4t9EVFIYnn5pZ+S2joPlxYL0fSa1OEs88+I+OqNiBO59fVW5hemxkul4myWH6lOXx2pzC+cvDI9PlmcLM6cGR0bO332v2fP7FysP3+3cOTuO8//+9Nzv77+j9tvfZ3EuTiSLWuOY6cMx3C2TXrSTfiY53a6sg5LOt0AtiU9NLvqR3kcjcHoqqXa6N/LlgEAu+W1iFgGAA6YxPkfAA6YxvcAD5cWC42ps99I7K17z0ZEXz3+R9lUX9KdXbPrq10HHXiYPHZlJImIoR2ofzgiPvz8lWNdWT5th2tpwF64cTMiLg0Nr3//T9bds7BVpzZauNxbmw2vKT5o5x/opC/S8c//Wo3/civjn2gx/umtH7t/f9r62x7/K4Or3J2nrWMj6fjvmfq9bWvGfys3rQ11Zbm/1JrVk1y+UiqeyrZBKs2P1lKtR27HH/z2oF392fjv43S6/+6rH6X1p/PVNXJ3unsff83EeLX7m6cJusm9mzGQJdfEn6z0f9Jm/Hthk3W88P83P2i3LI0/jbcxrY9/dy3fijjWsv9X+zLZ8P7EkdruMNLYKVr47Pv3B9rV39z/6ZTWn853PtLW7t2MGLg/GEmyug3qS1biH0qa79esbL2Ob28Nftlu2ZPjb7n/jx9KXq6lD2Vl18er1dnRiEPJi+vLT6++tpFvrJ/Gf/xfrY//erWt9//0M+GlTcbffffHT7Yf/+5K45/YeP9f0/99WfFqyZMStx9NdbWrf3P9P1ZLHc9K0v5/Ulybadf29mYAAAAAAAAAAAAAAAAAAAAAAAAA2LpcRByJJJdfSedy+Xz9Gd5/i4FcqVypnrhcnpuZiNqzsoeiJ9f4qcvBpt9DHc1+srWRP70m/5+I+GtEvNfbX8vnC+XSRKeDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM4TbP/0/90Nvp1gEAu6av0w0AAPac8z8AHDxbO//371o7AIC94/M/ABw8mz7/X9rddgAAe8fnfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHbZhfPn02n5l6XFQpqfuDY/N1W+dnKiWJnKT88V8oXy7NX8ZLk8WSrmC+Xptv/oRn1WKpevjsXM3PWRarFSHanML1ycLs/NVC9emR6fLF4s9uxZZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACweZX5hanxUqk4+6dI3FgNbIf/c39H4xrYH5u3KdEd+6IZ+zrRG/uiGdtMNL9L9HfgnQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgj+H3AAAA//+0Bxg2") mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x9, @mcast1, 0x48f}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000540)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6, 0x0, 0x3, 0xd}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000580)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) (async) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) (async) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) chdir(&(0x7f0000000f80)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x88040, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x181) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x3000440, 0x0, 0xff, 0x0, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mkdir-socket$inet6-bind$inet6-setsockopt$inet6_IPV6_FLOWLABEL_MGR-setsockopt$inet6_int-sendmmsg-sendmmsg-mount$incfs-mount$incfs-chdir-openat-mkdirat detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000000, &(0x7f0000000280)={[{@nodelalloc}, {@jqfmt_vfsv1}, {@errors_remount}, {@nouser_xattr}]}, 0x0, 0x7b9, &(0x7f00000006c0)="$eJzs3c9rG1ceAPDvyHb8I1nshWV3czMsZAMhcpz1JrvQQ0oPpdBAoD03MbJiUstWsOQQG0MTSqGXQlt6KLSXnPsjvfXaH9BT+1/0UBLSxglN6aG4jDSyFVtybMe23PrzgfG892bk977zZjRPmkETwIE1nP7JRRyNiLeTiMGsPImInlqqO+Jcfb1HS4t9EVFIYnn5pZ+S2joPlxYL0fSa1OEs88+I+OqNiBO59fVW5hemxkul4myWH6lOXx2pzC+cvDI9PlmcLM6cGR0bO332v2fP7FysP3+3cOTuO8//+9Nzv77+j9tvfZ3EuTiSLWuOY6cMx3C2TXrSTfiY53a6sg5LOt0AtiU9NLvqR3kcjcHoqqXa6N/LlgEAu+W1iFgGAA6YxPkfAA6YxvcAD5cWC42ps99I7K17z0ZEXz3+R9lUX9KdXbPrq10HHXiYPHZlJImIoR2ofzgiPvz8lWNdWT5th2tpwF64cTMiLg0Nr3//T9bds7BVpzZauNxbmw2vKT5o5x/opC/S8c//Wo3/civjn2gx/umtH7t/f9r62x7/K4Or3J2nrWMj6fjvmfq9bWvGfys3rQ11Zbm/1JrVk1y+UiqeyrZBKs2P1lKtR27HH/z2oF392fjv43S6/+6rH6X1p/PVNXJ3unsff83EeLX7m6cJusm9mzGQJdfEn6z0f9Jm/Hthk3W88P83P2i3LI0/jbcxrY9/dy3fijjWsv9X+zLZ8P7EkdruMNLYKVr47Pv3B9rV39z/6ZTWn853PtLW7t2MGLg/GEmyug3qS1biH0qa79esbL2Ob28Nftlu2ZPjb7n/jx9KXq6lD2Vl18er1dnRiEPJi+vLT6++tpFvrJ/Gf/xfrY//erWt9//0M+GlTcbffffHT7Yf/+5K45/YeP9f0/99WfFqyZMStx9NdbWrf3P9P1ZLHc9K0v5/Ulybadf29mYAAAAAAAAAAAAAAAAAAAAAAAAA2LpcRByJJJdfSedy+Xz9Gd5/i4FcqVypnrhcnpuZiNqzsoeiJ9f4qcvBpt9DHc1+srWRP70m/5+I+GtEvNfbX8vnC+XSRKeDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM4TbP/0/90Nvp1gEAu6av0w0AAPac8z8AHDxbO//371o7AIC94/M/ABw8mz7/X9rddgAAe8fnfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHbZhfPn02n5l6XFQpqfuDY/N1W+dnKiWJnKT88V8oXy7NX8ZLk8WSrmC+Xptv/oRn1WKpevjsXM3PWRarFSHanML1ycLs/NVC9emR6fLF4s9uxZZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACweZX5hanxUqk4+6dI3FgNbIf/c39H4xrYH5u3KdEd+6IZ+zrRG/uiGdtMNL9L9HfgnQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgj+H3AAAA//+0Bxg2") mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x9, @mcast1, 0x48f}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000540)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6, 0x0, 0x3, 0xd}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000580)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) (async) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) (async) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) chdir(&(0x7f0000000f80)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x88040, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x181) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mkdir-socket$inet6-bind$inet6-setsockopt$inet6_IPV6_FLOWLABEL_MGR-setsockopt$inet6_int-sendmmsg-sendmmsg-mount$incfs-mount$incfs-chdir-openat detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000000, &(0x7f0000000280)={[{@nodelalloc}, {@jqfmt_vfsv1}, {@errors_remount}, {@nouser_xattr}]}, 0x0, 0x7b9, &(0x7f00000006c0)="$eJzs3c9rG1ceAPDvyHb8I1nshWV3czMsZAMhcpz1JrvQQ0oPpdBAoD03MbJiUstWsOQQG0MTSqGXQlt6KLSXnPsjvfXaH9BT+1/0UBLSxglN6aG4jDSyFVtybMe23PrzgfG892bk977zZjRPmkETwIE1nP7JRRyNiLeTiMGsPImInlqqO+Jcfb1HS4t9EVFIYnn5pZ+S2joPlxYL0fSa1OEs88+I+OqNiBO59fVW5hemxkul4myWH6lOXx2pzC+cvDI9PlmcLM6cGR0bO332v2fP7FysP3+3cOTuO8//+9Nzv77+j9tvfZ3EuTiSLWuOY6cMx3C2TXrSTfiY53a6sg5LOt0AtiU9NLvqR3kcjcHoqqXa6N/LlgEAu+W1iFgGAA6YxPkfAA6YxvcAD5cWC42ps99I7K17z0ZEXz3+R9lUX9KdXbPrq10HHXiYPHZlJImIoR2ofzgiPvz8lWNdWT5th2tpwF64cTMiLg0Nr3//T9bds7BVpzZauNxbmw2vKT5o5x/opC/S8c//Wo3/civjn2gx/umtH7t/f9r62x7/K4Or3J2nrWMj6fjvmfq9bWvGfys3rQ11Zbm/1JrVk1y+UiqeyrZBKs2P1lKtR27HH/z2oF392fjv43S6/+6rH6X1p/PVNXJ3unsff83EeLX7m6cJusm9mzGQJdfEn6z0f9Jm/Hthk3W88P83P2i3LI0/jbcxrY9/dy3fijjWsv9X+zLZ8P7EkdruMNLYKVr47Pv3B9rV39z/6ZTWn853PtLW7t2MGLg/GEmyug3qS1biH0qa79esbL2Ob28Nftlu2ZPjb7n/jx9KXq6lD2Vl18er1dnRiEPJi+vLT6++tpFvrJ/Gf/xfrY//erWt9//0M+GlTcbffffHT7Yf/+5K45/YeP9f0/99WfFqyZMStx9NdbWrf3P9P1ZLHc9K0v5/Ulybadf29mYAAAAAAAAAAAAAAAAAAAAAAAAA2LpcRByJJJdfSedy+Xz9Gd5/i4FcqVypnrhcnpuZiNqzsoeiJ9f4qcvBpt9DHc1+srWRP70m/5+I+GtEvNfbX8vnC+XSRKeDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM4TbP/0/90Nvp1gEAu6av0w0AAPac8z8AHDxbO//371o7AIC94/M/ABw8mz7/X9rddgAAe8fnfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHbZhfPn02n5l6XFQpqfuDY/N1W+dnKiWJnKT88V8oXy7NX8ZLk8WSrmC+Xptv/oRn1WKpevjsXM3PWRarFSHanML1ycLs/NVC9emR6fLF4s9uxZZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACweZX5hanxUqk4+6dI3FgNbIf/c39H4xrYH5u3KdEd+6IZ+zrRG/uiGdtMNL9L9HfgnQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgj+H3AAAA//+0Bxg2") mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x9, @mcast1, 0x48f}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000540)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6, 0x0, 0x3, 0xd}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000580)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) (async) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) (async) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) chdir(&(0x7f0000000f80)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x88040, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mkdir-socket$inet6-bind$inet6-setsockopt$inet6_IPV6_FLOWLABEL_MGR-setsockopt$inet6_int-sendmmsg-sendmmsg-mount$incfs-mount$incfs-chdir detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000000, &(0x7f0000000280)={[{@nodelalloc}, {@jqfmt_vfsv1}, {@errors_remount}, {@nouser_xattr}]}, 0x0, 0x7b9, &(0x7f00000006c0)="$eJzs3c9rG1ceAPDvyHb8I1nshWV3czMsZAMhcpz1JrvQQ0oPpdBAoD03MbJiUstWsOQQG0MTSqGXQlt6KLSXnPsjvfXaH9BT+1/0UBLSxglN6aG4jDSyFVtybMe23PrzgfG892bk977zZjRPmkETwIE1nP7JRRyNiLeTiMGsPImInlqqO+Jcfb1HS4t9EVFIYnn5pZ+S2joPlxYL0fSa1OEs88+I+OqNiBO59fVW5hemxkul4myWH6lOXx2pzC+cvDI9PlmcLM6cGR0bO332v2fP7FysP3+3cOTuO8//+9Nzv77+j9tvfZ3EuTiSLWuOY6cMx3C2TXrSTfiY53a6sg5LOt0AtiU9NLvqR3kcjcHoqqXa6N/LlgEAu+W1iFgGAA6YxPkfAA6YxvcAD5cWC42ps99I7K17z0ZEXz3+R9lUX9KdXbPrq10HHXiYPHZlJImIoR2ofzgiPvz8lWNdWT5th2tpwF64cTMiLg0Nr3//T9bds7BVpzZauNxbmw2vKT5o5x/opC/S8c//Wo3/civjn2gx/umtH7t/f9r62x7/K4Or3J2nrWMj6fjvmfq9bWvGfys3rQ11Zbm/1JrVk1y+UiqeyrZBKs2P1lKtR27HH/z2oF392fjv43S6/+6rH6X1p/PVNXJ3unsff83EeLX7m6cJusm9mzGQJdfEn6z0f9Jm/Hthk3W88P83P2i3LI0/jbcxrY9/dy3fijjWsv9X+zLZ8P7EkdruMNLYKVr47Pv3B9rV39z/6ZTWn853PtLW7t2MGLg/GEmyug3qS1biH0qa79esbL2Ob28Nftlu2ZPjb7n/jx9KXq6lD2Vl18er1dnRiEPJi+vLT6++tpFvrJ/Gf/xfrY//erWt9//0M+GlTcbffffHT7Yf/+5K45/YeP9f0/99WfFqyZMStx9NdbWrf3P9P1ZLHc9K0v5/Ulybadf29mYAAAAAAAAAAAAAAAAAAAAAAAAA2LpcRByJJJdfSedy+Xz9Gd5/i4FcqVypnrhcnpuZiNqzsoeiJ9f4qcvBpt9DHc1+srWRP70m/5+I+GtEvNfbX8vnC+XSRKeDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM4TbP/0/90Nvp1gEAu6av0w0AAPac8z8AHDxbO//371o7AIC94/M/ABw8mz7/X9rddgAAe8fnfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHbZhfPn02n5l6XFQpqfuDY/N1W+dnKiWJnKT88V8oXy7NX8ZLk8WSrmC+Xptv/oRn1WKpevjsXM3PWRarFSHanML1ycLs/NVC9emR6fLF4s9uxZZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACweZX5hanxUqk4+6dI3FgNbIf/c39H4xrYH5u3KdEd+6IZ+zrRG/uiGdtMNL9L9HfgnQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgj+H3AAAA//+0Bxg2") mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x9, @mcast1, 0x48f}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000540)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6, 0x0, 0x3, 0xd}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000580)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) (async) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) (async) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) chdir(&(0x7f0000000f80)='./bus\x00') program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mkdir-socket$inet6-bind$inet6-setsockopt$inet6_IPV6_FLOWLABEL_MGR-setsockopt$inet6_int-sendmmsg-sendmmsg-mount$incfs-mount$incfs detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000000, &(0x7f0000000280)={[{@nodelalloc}, {@jqfmt_vfsv1}, {@errors_remount}, {@nouser_xattr}]}, 0x0, 0x7b9, &(0x7f00000006c0)="$eJzs3c9rG1ceAPDvyHb8I1nshWV3czMsZAMhcpz1JrvQQ0oPpdBAoD03MbJiUstWsOQQG0MTSqGXQlt6KLSXnPsjvfXaH9BT+1/0UBLSxglN6aG4jDSyFVtybMe23PrzgfG892bk977zZjRPmkETwIE1nP7JRRyNiLeTiMGsPImInlqqO+Jcfb1HS4t9EVFIYnn5pZ+S2joPlxYL0fSa1OEs88+I+OqNiBO59fVW5hemxkul4myWH6lOXx2pzC+cvDI9PlmcLM6cGR0bO332v2fP7FysP3+3cOTuO8//+9Nzv77+j9tvfZ3EuTiSLWuOY6cMx3C2TXrSTfiY53a6sg5LOt0AtiU9NLvqR3kcjcHoqqXa6N/LlgEAu+W1iFgGAA6YxPkfAA6YxvcAD5cWC42ps99I7K17z0ZEXz3+R9lUX9KdXbPrq10HHXiYPHZlJImIoR2ofzgiPvz8lWNdWT5th2tpwF64cTMiLg0Nr3//T9bds7BVpzZauNxbmw2vKT5o5x/opC/S8c//Wo3/civjn2gx/umtH7t/f9r62x7/K4Or3J2nrWMj6fjvmfq9bWvGfys3rQ11Zbm/1JrVk1y+UiqeyrZBKs2P1lKtR27HH/z2oF392fjv43S6/+6rH6X1p/PVNXJ3unsff83EeLX7m6cJusm9mzGQJdfEn6z0f9Jm/Hthk3W88P83P2i3LI0/jbcxrY9/dy3fijjWsv9X+zLZ8P7EkdruMNLYKVr47Pv3B9rV39z/6ZTWn853PtLW7t2MGLg/GEmyug3qS1biH0qa79esbL2Ob28Nftlu2ZPjb7n/jx9KXq6lD2Vl18er1dnRiEPJi+vLT6++tpFvrJ/Gf/xfrY//erWt9//0M+GlTcbffffHT7Yf/+5K45/YeP9f0/99WfFqyZMStx9NdbWrf3P9P1ZLHc9K0v5/Ulybadf29mYAAAAAAAAAAAAAAAAAAAAAAAAA2LpcRByJJJdfSedy+Xz9Gd5/i4FcqVypnrhcnpuZiNqzsoeiJ9f4qcvBpt9DHc1+srWRP70m/5+I+GtEvNfbX8vnC+XSRKeDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM4TbP/0/90Nvp1gEAu6av0w0AAPac8z8AHDxbO//371o7AIC94/M/ABw8mz7/X9rddgAAe8fnfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHbZhfPn02n5l6XFQpqfuDY/N1W+dnKiWJnKT88V8oXy7NX8ZLk8WSrmC+Xptv/oRn1WKpevjsXM3PWRarFSHanML1ycLs/NVC9emR6fLF4s9uxZZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACweZX5hanxUqk4+6dI3FgNbIf/c39H4xrYH5u3KdEd+6IZ+zrRG/uiGdtMNL9L9HfgnQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgj+H3AAAA//+0Bxg2") mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x9, @mcast1, 0x48f}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000540)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6, 0x0, 0x3, 0xd}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000580)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) (async) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) (async) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mkdir-socket$inet6-bind$inet6-setsockopt$inet6_IPV6_FLOWLABEL_MGR-setsockopt$inet6_int-sendmmsg-sendmmsg-mount$incfs detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000000, &(0x7f0000000280)={[{@nodelalloc}, {@jqfmt_vfsv1}, {@errors_remount}, {@nouser_xattr}]}, 0x0, 0x7b9, &(0x7f00000006c0)="$eJzs3c9rG1ceAPDvyHb8I1nshWV3czMsZAMhcpz1JrvQQ0oPpdBAoD03MbJiUstWsOQQG0MTSqGXQlt6KLSXnPsjvfXaH9BT+1/0UBLSxglN6aG4jDSyFVtybMe23PrzgfG892bk977zZjRPmkETwIE1nP7JRRyNiLeTiMGsPImInlqqO+Jcfb1HS4t9EVFIYnn5pZ+S2joPlxYL0fSa1OEs88+I+OqNiBO59fVW5hemxkul4myWH6lOXx2pzC+cvDI9PlmcLM6cGR0bO332v2fP7FysP3+3cOTuO8//+9Nzv77+j9tvfZ3EuTiSLWuOY6cMx3C2TXrSTfiY53a6sg5LOt0AtiU9NLvqR3kcjcHoqqXa6N/LlgEAu+W1iFgGAA6YxPkfAA6YxvcAD5cWC42ps99I7K17z0ZEXz3+R9lUX9KdXbPrq10HHXiYPHZlJImIoR2ofzgiPvz8lWNdWT5th2tpwF64cTMiLg0Nr3//T9bds7BVpzZauNxbmw2vKT5o5x/opC/S8c//Wo3/civjn2gx/umtH7t/f9r62x7/K4Or3J2nrWMj6fjvmfq9bWvGfys3rQ11Zbm/1JrVk1y+UiqeyrZBKs2P1lKtR27HH/z2oF392fjv43S6/+6rH6X1p/PVNXJ3unsff83EeLX7m6cJusm9mzGQJdfEn6z0f9Jm/Hthk3W88P83P2i3LI0/jbcxrY9/dy3fijjWsv9X+zLZ8P7EkdruMNLYKVr47Pv3B9rV39z/6ZTWn853PtLW7t2MGLg/GEmyug3qS1biH0qa79esbL2Ob28Nftlu2ZPjb7n/jx9KXq6lD2Vl18er1dnRiEPJi+vLT6++tpFvrJ/Gf/xfrY//erWt9//0M+GlTcbffffHT7Yf/+5K45/YeP9f0/99WfFqyZMStx9NdbWrf3P9P1ZLHc9K0v5/Ulybadf29mYAAAAAAAAAAAAAAAAAAAAAAAAA2LpcRByJJJdfSedy+Xz9Gd5/i4FcqVypnrhcnpuZiNqzsoeiJ9f4qcvBpt9DHc1+srWRP70m/5+I+GtEvNfbX8vnC+XSRKeDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM4TbP/0/90Nvp1gEAu6av0w0AAPac8z8AHDxbO//371o7AIC94/M/ABw8mz7/X9rddgAAe8fnfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHbZhfPn02n5l6XFQpqfuDY/N1W+dnKiWJnKT88V8oXy7NX8ZLk8WSrmC+Xptv/oRn1WKpevjsXM3PWRarFSHanML1ycLs/NVC9emR6fLF4s9uxZZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACweZX5hanxUqk4+6dI3FgNbIf/c39H4xrYH5u3KdEd+6IZ+zrRG/uiGdtMNL9L9HfgnQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgj+H3AAAA//+0Bxg2") mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x9, @mcast1, 0x48f}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000540)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6, 0x0, 0x3, 0xd}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000580)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) (async) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) (async) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mkdir-socket$inet6-bind$inet6-setsockopt$inet6_IPV6_FLOWLABEL_MGR-setsockopt$inet6_int-sendmmsg-sendmmsg detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000000, &(0x7f0000000280)={[{@nodelalloc}, {@jqfmt_vfsv1}, {@errors_remount}, {@nouser_xattr}]}, 0x0, 0x7b9, &(0x7f00000006c0)="$eJzs3c9rG1ceAPDvyHb8I1nshWV3czMsZAMhcpz1JrvQQ0oPpdBAoD03MbJiUstWsOQQG0MTSqGXQlt6KLSXnPsjvfXaH9BT+1/0UBLSxglN6aG4jDSyFVtybMe23PrzgfG892bk977zZjRPmkETwIE1nP7JRRyNiLeTiMGsPImInlqqO+Jcfb1HS4t9EVFIYnn5pZ+S2joPlxYL0fSa1OEs88+I+OqNiBO59fVW5hemxkul4myWH6lOXx2pzC+cvDI9PlmcLM6cGR0bO332v2fP7FysP3+3cOTuO8//+9Nzv77+j9tvfZ3EuTiSLWuOY6cMx3C2TXrSTfiY53a6sg5LOt0AtiU9NLvqR3kcjcHoqqXa6N/LlgEAu+W1iFgGAA6YxPkfAA6YxvcAD5cWC42ps99I7K17z0ZEXz3+R9lUX9KdXbPrq10HHXiYPHZlJImIoR2ofzgiPvz8lWNdWT5th2tpwF64cTMiLg0Nr3//T9bds7BVpzZauNxbmw2vKT5o5x/opC/S8c//Wo3/civjn2gx/umtH7t/f9r62x7/K4Or3J2nrWMj6fjvmfq9bWvGfys3rQ11Zbm/1JrVk1y+UiqeyrZBKs2P1lKtR27HH/z2oF392fjv43S6/+6rH6X1p/PVNXJ3unsff83EeLX7m6cJusm9mzGQJdfEn6z0f9Jm/Hthk3W88P83P2i3LI0/jbcxrY9/dy3fijjWsv9X+zLZ8P7EkdruMNLYKVr47Pv3B9rV39z/6ZTWn853PtLW7t2MGLg/GEmyug3qS1biH0qa79esbL2Ob28Nftlu2ZPjb7n/jx9KXq6lD2Vl18er1dnRiEPJi+vLT6++tpFvrJ/Gf/xfrY//erWt9//0M+GlTcbffffHT7Yf/+5K45/YeP9f0/99WfFqyZMStx9NdbWrf3P9P1ZLHc9K0v5/Ulybadf29mYAAAAAAAAAAAAAAAAAAAAAAAAA2LpcRByJJJdfSedy+Xz9Gd5/i4FcqVypnrhcnpuZiNqzsoeiJ9f4qcvBpt9DHc1+srWRP70m/5+I+GtEvNfbX8vnC+XSRKeDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM4TbP/0/90Nvp1gEAu6av0w0AAPac8z8AHDxbO//371o7AIC94/M/ABw8mz7/X9rddgAAe8fnfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHbZhfPn02n5l6XFQpqfuDY/N1W+dnKiWJnKT88V8oXy7NX8ZLk8WSrmC+Xptv/oRn1WKpevjsXM3PWRarFSHanML1ycLs/NVC9emR6fLF4s9uxZZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACweZX5hanxUqk4+6dI3FgNbIf/c39H4xrYH5u3KdEd+6IZ+zrRG/uiGdtMNL9L9HfgnQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgj+H3AAAA//+0Bxg2") mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x9, @mcast1, 0x48f}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000540)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6, 0x0, 0x3, 0xd}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000580)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) (async) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mkdir-socket$inet6-bind$inet6-setsockopt$inet6_IPV6_FLOWLABEL_MGR-setsockopt$inet6_int-sendmmsg-mount$incfs detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000000, &(0x7f0000000280)={[{@nodelalloc}, {@jqfmt_vfsv1}, {@errors_remount}, {@nouser_xattr}]}, 0x0, 0x7b9, &(0x7f00000006c0)="$eJzs3c9rG1ceAPDvyHb8I1nshWV3czMsZAMhcpz1JrvQQ0oPpdBAoD03MbJiUstWsOQQG0MTSqGXQlt6KLSXnPsjvfXaH9BT+1/0UBLSxglN6aG4jDSyFVtybMe23PrzgfG892bk977zZjRPmkETwIE1nP7JRRyNiLeTiMGsPImInlqqO+Jcfb1HS4t9EVFIYnn5pZ+S2joPlxYL0fSa1OEs88+I+OqNiBO59fVW5hemxkul4myWH6lOXx2pzC+cvDI9PlmcLM6cGR0bO332v2fP7FysP3+3cOTuO8//+9Nzv77+j9tvfZ3EuTiSLWuOY6cMx3C2TXrSTfiY53a6sg5LOt0AtiU9NLvqR3kcjcHoqqXa6N/LlgEAu+W1iFgGAA6YxPkfAA6YxvcAD5cWC42ps99I7K17z0ZEXz3+R9lUX9KdXbPrq10HHXiYPHZlJImIoR2ofzgiPvz8lWNdWT5th2tpwF64cTMiLg0Nr3//T9bds7BVpzZauNxbmw2vKT5o5x/opC/S8c//Wo3/civjn2gx/umtH7t/f9r62x7/K4Or3J2nrWMj6fjvmfq9bWvGfys3rQ11Zbm/1JrVk1y+UiqeyrZBKs2P1lKtR27HH/z2oF392fjv43S6/+6rH6X1p/PVNXJ3unsff83EeLX7m6cJusm9mzGQJdfEn6z0f9Jm/Hthk3W88P83P2i3LI0/jbcxrY9/dy3fijjWsv9X+zLZ8P7EkdruMNLYKVr47Pv3B9rV39z/6ZTWn853PtLW7t2MGLg/GEmyug3qS1biH0qa79esbL2Ob28Nftlu2ZPjb7n/jx9KXq6lD2Vl18er1dnRiEPJi+vLT6++tpFvrJ/Gf/xfrY//erWt9//0M+GlTcbffffHT7Yf/+5K45/YeP9f0/99WfFqyZMStx9NdbWrf3P9P1ZLHc9K0v5/Ulybadf29mYAAAAAAAAAAAAAAAAAAAAAAAAA2LpcRByJJJdfSedy+Xz9Gd5/i4FcqVypnrhcnpuZiNqzsoeiJ9f4qcvBpt9DHc1+srWRP70m/5+I+GtEvNfbX8vnC+XSRKeDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM4TbP/0/90Nvp1gEAu6av0w0AAPac8z8AHDxbO//371o7AIC94/M/ABw8mz7/X9rddgAAe8fnfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHbZhfPn02n5l6XFQpqfuDY/N1W+dnKiWJnKT88V8oXy7NX8ZLk8WSrmC+Xptv/oRn1WKpevjsXM3PWRarFSHanML1ycLs/NVC9emR6fLF4s9uxZZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACweZX5hanxUqk4+6dI3FgNbIf/c39H4xrYH5u3KdEd+6IZ+zrRG/uiGdtMNL9L9HfgnQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgj+H3AAAA//+0Bxg2") mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x9, @mcast1, 0x48f}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000540)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6, 0x0, 0x3, 0xd}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000580)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000600)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) (async) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) (async) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mkdir-socket$inet6-bind$inet6-setsockopt$inet6_IPV6_FLOWLABEL_MGR-setsockopt$inet6_int-mount$incfs detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000000, &(0x7f0000000280)={[{@nodelalloc}, {@jqfmt_vfsv1}, {@errors_remount}, {@nouser_xattr}]}, 0x0, 0x7b9, &(0x7f00000006c0)="$eJzs3c9rG1ceAPDvyHb8I1nshWV3czMsZAMhcpz1JrvQQ0oPpdBAoD03MbJiUstWsOQQG0MTSqGXQlt6KLSXnPsjvfXaH9BT+1/0UBLSxglN6aG4jDSyFVtybMe23PrzgfG892bk977zZjRPmkETwIE1nP7JRRyNiLeTiMGsPImInlqqO+Jcfb1HS4t9EVFIYnn5pZ+S2joPlxYL0fSa1OEs88+I+OqNiBO59fVW5hemxkul4myWH6lOXx2pzC+cvDI9PlmcLM6cGR0bO332v2fP7FysP3+3cOTuO8//+9Nzv77+j9tvfZ3EuTiSLWuOY6cMx3C2TXrSTfiY53a6sg5LOt0AtiU9NLvqR3kcjcHoqqXa6N/LlgEAu+W1iFgGAA6YxPkfAA6YxvcAD5cWC42ps99I7K17z0ZEXz3+R9lUX9KdXbPrq10HHXiYPHZlJImIoR2ofzgiPvz8lWNdWT5th2tpwF64cTMiLg0Nr3//T9bds7BVpzZauNxbmw2vKT5o5x/opC/S8c//Wo3/civjn2gx/umtH7t/f9r62x7/K4Or3J2nrWMj6fjvmfq9bWvGfys3rQ11Zbm/1JrVk1y+UiqeyrZBKs2P1lKtR27HH/z2oF392fjv43S6/+6rH6X1p/PVNXJ3unsff83EeLX7m6cJusm9mzGQJdfEn6z0f9Jm/Hthk3W88P83P2i3LI0/jbcxrY9/dy3fijjWsv9X+zLZ8P7EkdruMNLYKVr47Pv3B9rV39z/6ZTWn853PtLW7t2MGLg/GEmyug3qS1biH0qa79esbL2Ob28Nftlu2ZPjb7n/jx9KXq6lD2Vl18er1dnRiEPJi+vLT6++tpFvrJ/Gf/xfrY//erWt9//0M+GlTcbffffHT7Yf/+5K45/YeP9f0/99WfFqyZMStx9NdbWrf3P9P1ZLHc9K0v5/Ulybadf29mYAAAAAAAAAAAAAAAAAAAAAAAAA2LpcRByJJJdfSedy+Xz9Gd5/i4FcqVypnrhcnpuZiNqzsoeiJ9f4qcvBpt9DHc1+srWRP70m/5+I+GtEvNfbX8vnC+XSRKeDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM4TbP/0/90Nvp1gEAu6av0w0AAPac8z8AHDxbO//371o7AIC94/M/ABw8mz7/X9rddgAAe8fnfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHbZhfPn02n5l6XFQpqfuDY/N1W+dnKiWJnKT88V8oXy7NX8ZLk8WSrmC+Xptv/oRn1WKpevjsXM3PWRarFSHanML1ycLs/NVC9emR6fLF4s9uxZZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACweZX5hanxUqk4+6dI3FgNbIf/c39H4xrYH5u3KdEd+6IZ+zrRG/uiGdtMNL9L9HfgnQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgj+H3AAAA//+0Bxg2") mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x9, @mcast1, 0x48f}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000540)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6, 0x0, 0x3, 0xd}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000580)=0xffffffc3, 0x4) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) (async) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mkdir-socket$inet6-bind$inet6-setsockopt$inet6_IPV6_FLOWLABEL_MGR-mount$incfs detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000000, &(0x7f0000000280)={[{@nodelalloc}, {@jqfmt_vfsv1}, {@errors_remount}, {@nouser_xattr}]}, 0x0, 0x7b9, &(0x7f00000006c0)="$eJzs3c9rG1ceAPDvyHb8I1nshWV3czMsZAMhcpz1JrvQQ0oPpdBAoD03MbJiUstWsOQQG0MTSqGXQlt6KLSXnPsjvfXaH9BT+1/0UBLSxglN6aG4jDSyFVtybMe23PrzgfG892bk977zZjRPmkETwIE1nP7JRRyNiLeTiMGsPImInlqqO+Jcfb1HS4t9EVFIYnn5pZ+S2joPlxYL0fSa1OEs88+I+OqNiBO59fVW5hemxkul4myWH6lOXx2pzC+cvDI9PlmcLM6cGR0bO332v2fP7FysP3+3cOTuO8//+9Nzv77+j9tvfZ3EuTiSLWuOY6cMx3C2TXrSTfiY53a6sg5LOt0AtiU9NLvqR3kcjcHoqqXa6N/LlgEAu+W1iFgGAA6YxPkfAA6YxvcAD5cWC42ps99I7K17z0ZEXz3+R9lUX9KdXbPrq10HHXiYPHZlJImIoR2ofzgiPvz8lWNdWT5th2tpwF64cTMiLg0Nr3//T9bds7BVpzZauNxbmw2vKT5o5x/opC/S8c//Wo3/civjn2gx/umtH7t/f9r62x7/K4Or3J2nrWMj6fjvmfq9bWvGfys3rQ11Zbm/1JrVk1y+UiqeyrZBKs2P1lKtR27HH/z2oF392fjv43S6/+6rH6X1p/PVNXJ3unsff83EeLX7m6cJusm9mzGQJdfEn6z0f9Jm/Hthk3W88P83P2i3LI0/jbcxrY9/dy3fijjWsv9X+zLZ8P7EkdruMNLYKVr47Pv3B9rV39z/6ZTWn853PtLW7t2MGLg/GEmyug3qS1biH0qa79esbL2Ob28Nftlu2ZPjb7n/jx9KXq6lD2Vl18er1dnRiEPJi+vLT6++tpFvrJ/Gf/xfrY//erWt9//0M+GlTcbffffHT7Yf/+5K45/YeP9f0/99WfFqyZMStx9NdbWrf3P9P1ZLHc9K0v5/Ulybadf29mYAAAAAAAAAAAAAAAAAAAAAAAAA2LpcRByJJJdfSedy+Xz9Gd5/i4FcqVypnrhcnpuZiNqzsoeiJ9f4qcvBpt9DHc1+srWRP70m/5+I+GtEvNfbX8vnC+XSRKeDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM4TbP/0/90Nvp1gEAu6av0w0AAPac8z8AHDxbO//371o7AIC94/M/ABw8mz7/X9rddgAAe8fnfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHbZhfPn02n5l6XFQpqfuDY/N1W+dnKiWJnKT88V8oXy7NX8ZLk8WSrmC+Xptv/oRn1WKpevjsXM3PWRarFSHanML1ycLs/NVC9emR6fLF4s9uxZZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACweZX5hanxUqk4+6dI3FgNbIf/c39H4xrYH5u3KdEd+6IZ+zrRG/uiGdtMNL9L9HfgnQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgj+H3AAAA//+0Bxg2") mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x9, @mcast1, 0x48f}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000540)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6, 0x0, 0x3, 0xd}, 0x20) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) (async) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mkdir-socket$inet6-bind$inet6-mount$incfs detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000000, &(0x7f0000000280)={[{@nodelalloc}, {@jqfmt_vfsv1}, {@errors_remount}, {@nouser_xattr}]}, 0x0, 0x7b9, &(0x7f00000006c0)="$eJzs3c9rG1ceAPDvyHb8I1nshWV3czMsZAMhcpz1JrvQQ0oPpdBAoD03MbJiUstWsOQQG0MTSqGXQlt6KLSXnPsjvfXaH9BT+1/0UBLSxglN6aG4jDSyFVtybMe23PrzgfG892bk977zZjRPmkETwIE1nP7JRRyNiLeTiMGsPImInlqqO+Jcfb1HS4t9EVFIYnn5pZ+S2joPlxYL0fSa1OEs88+I+OqNiBO59fVW5hemxkul4myWH6lOXx2pzC+cvDI9PlmcLM6cGR0bO332v2fP7FysP3+3cOTuO8//+9Nzv77+j9tvfZ3EuTiSLWuOY6cMx3C2TXrSTfiY53a6sg5LOt0AtiU9NLvqR3kcjcHoqqXa6N/LlgEAu+W1iFgGAA6YxPkfAA6YxvcAD5cWC42ps99I7K17z0ZEXz3+R9lUX9KdXbPrq10HHXiYPHZlJImIoR2ofzgiPvz8lWNdWT5th2tpwF64cTMiLg0Nr3//T9bds7BVpzZauNxbmw2vKT5o5x/opC/S8c//Wo3/civjn2gx/umtH7t/f9r62x7/K4Or3J2nrWMj6fjvmfq9bWvGfys3rQ11Zbm/1JrVk1y+UiqeyrZBKs2P1lKtR27HH/z2oF392fjv43S6/+6rH6X1p/PVNXJ3unsff83EeLX7m6cJusm9mzGQJdfEn6z0f9Jm/Hthk3W88P83P2i3LI0/jbcxrY9/dy3fijjWsv9X+zLZ8P7EkdruMNLYKVr47Pv3B9rV39z/6ZTWn853PtLW7t2MGLg/GEmyug3qS1biH0qa79esbL2Ob28Nftlu2ZPjb7n/jx9KXq6lD2Vl18er1dnRiEPJi+vLT6++tpFvrJ/Gf/xfrY//erWt9//0M+GlTcbffffHT7Yf/+5K45/YeP9f0/99WfFqyZMStx9NdbWrf3P9P1ZLHc9K0v5/Ulybadf29mYAAAAAAAAAAAAAAAAAAAAAAAAA2LpcRByJJJdfSedy+Xz9Gd5/i4FcqVypnrhcnpuZiNqzsoeiJ9f4qcvBpt9DHc1+srWRP70m/5+I+GtEvNfbX8vnC+XSRKeDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM4TbP/0/90Nvp1gEAu6av0w0AAPac8z8AHDxbO//371o7AIC94/M/ABw8mz7/X9rddgAAe8fnfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHbZhfPn02n5l6XFQpqfuDY/N1W+dnKiWJnKT88V8oXy7NX8ZLk8WSrmC+Xptv/oRn1WKpevjsXM3PWRarFSHanML1ycLs/NVC9emR6fLF4s9uxZZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACweZX5hanxUqk4+6dI3FgNbIf/c39H4xrYH5u3KdEd+6IZ+zrRG/uiGdtMNL9L9HfgnQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgj+H3AAAA//+0Bxg2") mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x9, @mcast1, 0x48f}, 0x1c) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) (async) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mkdir-socket$inet6-mount$incfs detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000000, &(0x7f0000000280)={[{@nodelalloc}, {@jqfmt_vfsv1}, {@errors_remount}, {@nouser_xattr}]}, 0x0, 0x7b9, &(0x7f00000006c0)="$eJzs3c9rG1ceAPDvyHb8I1nshWV3czMsZAMhcpz1JrvQQ0oPpdBAoD03MbJiUstWsOQQG0MTSqGXQlt6KLSXnPsjvfXaH9BT+1/0UBLSxglN6aG4jDSyFVtybMe23PrzgfG892bk977zZjRPmkETwIE1nP7JRRyNiLeTiMGsPImInlqqO+Jcfb1HS4t9EVFIYnn5pZ+S2joPlxYL0fSa1OEs88+I+OqNiBO59fVW5hemxkul4myWH6lOXx2pzC+cvDI9PlmcLM6cGR0bO332v2fP7FysP3+3cOTuO8//+9Nzv77+j9tvfZ3EuTiSLWuOY6cMx3C2TXrSTfiY53a6sg5LOt0AtiU9NLvqR3kcjcHoqqXa6N/LlgEAu+W1iFgGAA6YxPkfAA6YxvcAD5cWC42ps99I7K17z0ZEXz3+R9lUX9KdXbPrq10HHXiYPHZlJImIoR2ofzgiPvz8lWNdWT5th2tpwF64cTMiLg0Nr3//T9bds7BVpzZauNxbmw2vKT5o5x/opC/S8c//Wo3/civjn2gx/umtH7t/f9r62x7/K4Or3J2nrWMj6fjvmfq9bWvGfys3rQ11Zbm/1JrVk1y+UiqeyrZBKs2P1lKtR27HH/z2oF392fjv43S6/+6rH6X1p/PVNXJ3unsff83EeLX7m6cJusm9mzGQJdfEn6z0f9Jm/Hthk3W88P83P2i3LI0/jbcxrY9/dy3fijjWsv9X+zLZ8P7EkdruMNLYKVr47Pv3B9rV39z/6ZTWn853PtLW7t2MGLg/GEmyug3qS1biH0qa79esbL2Ob28Nftlu2ZPjb7n/jx9KXq6lD2Vl18er1dnRiEPJi+vLT6++tpFvrJ/Gf/xfrY//erWt9//0M+GlTcbffffHT7Yf/+5K45/YeP9f0/99WfFqyZMStx9NdbWrf3P9P1ZLHc9K0v5/Ulybadf29mYAAAAAAAAAAAAAAAAAAAAAAAAA2LpcRByJJJdfSedy+Xz9Gd5/i4FcqVypnrhcnpuZiNqzsoeiJ9f4qcvBpt9DHc1+srWRP70m/5+I+GtEvNfbX8vnC+XSRKeDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM4TbP/0/90Nvp1gEAu6av0w0AAPac8z8AHDxbO//371o7AIC94/M/ABw8mz7/X9rddgAAe8fnfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHbZhfPn02n5l6XFQpqfuDY/N1W+dnKiWJnKT88V8oXy7NX8ZLk8WSrmC+Xptv/oRn1WKpevjsXM3PWRarFSHanML1ycLs/NVC9emR6fLF4s9uxZZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACweZX5hanxUqk4+6dI3FgNbIf/c39H4xrYH5u3KdEd+6IZ+zrRG/uiGdtMNL9L9HfgnQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgj+H3AAAA//+0Bxg2") mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) socket$inet6(0xa, 0x3, 0x5) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) (async) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mkdir-mount$incfs detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000000, &(0x7f0000000280)={[{@nodelalloc}, {@jqfmt_vfsv1}, {@errors_remount}, {@nouser_xattr}]}, 0x0, 0x7b9, &(0x7f00000006c0)="$eJzs3c9rG1ceAPDvyHb8I1nshWV3czMsZAMhcpz1JrvQQ0oPpdBAoD03MbJiUstWsOQQG0MTSqGXQlt6KLSXnPsjvfXaH9BT+1/0UBLSxglN6aG4jDSyFVtybMe23PrzgfG892bk977zZjRPmkETwIE1nP7JRRyNiLeTiMGsPImInlqqO+Jcfb1HS4t9EVFIYnn5pZ+S2joPlxYL0fSa1OEs88+I+OqNiBO59fVW5hemxkul4myWH6lOXx2pzC+cvDI9PlmcLM6cGR0bO332v2fP7FysP3+3cOTuO8//+9Nzv77+j9tvfZ3EuTiSLWuOY6cMx3C2TXrSTfiY53a6sg5LOt0AtiU9NLvqR3kcjcHoqqXa6N/LlgEAu+W1iFgGAA6YxPkfAA6YxvcAD5cWC42ps99I7K17z0ZEXz3+R9lUX9KdXbPrq10HHXiYPHZlJImIoR2ofzgiPvz8lWNdWT5th2tpwF64cTMiLg0Nr3//T9bds7BVpzZauNxbmw2vKT5o5x/opC/S8c//Wo3/civjn2gx/umtH7t/f9r62x7/K4Or3J2nrWMj6fjvmfq9bWvGfys3rQ11Zbm/1JrVk1y+UiqeyrZBKs2P1lKtR27HH/z2oF392fjv43S6/+6rH6X1p/PVNXJ3unsff83EeLX7m6cJusm9mzGQJdfEn6z0f9Jm/Hthk3W88P83P2i3LI0/jbcxrY9/dy3fijjWsv9X+zLZ8P7EkdruMNLYKVr47Pv3B9rV39z/6ZTWn853PtLW7t2MGLg/GEmyug3qS1biH0qa79esbL2Ob28Nftlu2ZPjb7n/jx9KXq6lD2Vl18er1dnRiEPJi+vLT6++tpFvrJ/Gf/xfrY//erWt9//0M+GlTcbffffHT7Yf/+5K45/YeP9f0/99WfFqyZMStx9NdbWrf3P9P1ZLHc9K0v5/Ulybadf29mYAAAAAAAAAAAAAAAAAAAAAAAAA2LpcRByJJJdfSedy+Xz9Gd5/i4FcqVypnrhcnpuZiNqzsoeiJ9f4qcvBpt9DHc1+srWRP70m/5+I+GtEvNfbX8vnC+XSRKeDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM4TbP/0/90Nvp1gEAu6av0w0AAPac8z8AHDxbO//371o7AIC94/M/ABw8mz7/X9rddgAAe8fnfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHbZhfPn02n5l6XFQpqfuDY/N1W+dnKiWJnKT88V8oXy7NX8ZLk8WSrmC+Xptv/oRn1WKpevjsXM3PWRarFSHanML1ycLs/NVC9emR6fLF4s9uxZZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACweZX5hanxUqk4+6dI3FgNbIf/c39H4xrYH5u3KdEd+6IZ+zrRG/uiGdtMNL9L9HfgnQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgj+H3AAAA//+0Bxg2") mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) (async) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mount$incfs detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000000, &(0x7f0000000280)={[{@nodelalloc}, {@jqfmt_vfsv1}, {@errors_remount}, {@nouser_xattr}]}, 0x0, 0x7b9, &(0x7f00000006c0)="$eJzs3c9rG1ceAPDvyHb8I1nshWV3czMsZAMhcpz1JrvQQ0oPpdBAoD03MbJiUstWsOQQG0MTSqGXQlt6KLSXnPsjvfXaH9BT+1/0UBLSxglN6aG4jDSyFVtybMe23PrzgfG892bk977zZjRPmkETwIE1nP7JRRyNiLeTiMGsPImInlqqO+Jcfb1HS4t9EVFIYnn5pZ+S2joPlxYL0fSa1OEs88+I+OqNiBO59fVW5hemxkul4myWH6lOXx2pzC+cvDI9PlmcLM6cGR0bO332v2fP7FysP3+3cOTuO8//+9Nzv77+j9tvfZ3EuTiSLWuOY6cMx3C2TXrSTfiY53a6sg5LOt0AtiU9NLvqR3kcjcHoqqXa6N/LlgEAu+W1iFgGAA6YxPkfAA6YxvcAD5cWC42ps99I7K17z0ZEXz3+R9lUX9KdXbPrq10HHXiYPHZlJImIoR2ofzgiPvz8lWNdWT5th2tpwF64cTMiLg0Nr3//T9bds7BVpzZauNxbmw2vKT5o5x/opC/S8c//Wo3/civjn2gx/umtH7t/f9r62x7/K4Or3J2nrWMj6fjvmfq9bWvGfys3rQ11Zbm/1JrVk1y+UiqeyrZBKs2P1lKtR27HH/z2oF392fjv43S6/+6rH6X1p/PVNXJ3unsff83EeLX7m6cJusm9mzGQJdfEn6z0f9Jm/Hthk3W88P83P2i3LI0/jbcxrY9/dy3fijjWsv9X+zLZ8P7EkdruMNLYKVr47Pv3B9rV39z/6ZTWn853PtLW7t2MGLg/GEmyug3qS1biH0qa79esbL2Ob28Nftlu2ZPjb7n/jx9KXq6lD2Vl18er1dnRiEPJi+vLT6++tpFvrJ/Gf/xfrY//erWt9//0M+GlTcbffffHT7Yf/+5K45/YeP9f0/99WfFqyZMStx9NdbWrf3P9P1ZLHc9K0v5/Ulybadf29mYAAAAAAAAAAAAAAAAAAAAAAAAA2LpcRByJJJdfSedy+Xz9Gd5/i4FcqVypnrhcnpuZiNqzsoeiJ9f4qcvBpt9DHc1+srWRP70m/5+I+GtEvNfbX8vnC+XSRKeDBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDM4TbP/0/90Nvp1gEAu6av0w0AAPac8z8AHDxbO//371o7AIC94/M/ABw8mz7/X9rddgAAe8fnfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHbZhfPn02n5l6XFQpqfuDY/N1W+dnKiWJnKT88V8oXy7NX8ZLk8WSrmC+Xptv/oRn1WKpevjsXM3PWRarFSHanML1ycLs/NVC9emR6fLF4s9uxZZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACweZX5hanxUqk4+6dI3FgNbIf/c39H4xrYH5u3KdEd+6IZ+zrRG/uiGdtMNL9L9HfgnQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgj+H3AAAA//+0Bxg2") mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) (async) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) (async) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(0x0, 0x0) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) mount$incfs(0x0, &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) mount$incfs(&(0x7f0000000ec0)='.\x00', 0x0, &(0x7f0000000f40), 0xc002, 0x0) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', 0x0, 0xc002, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir simplifying C reproducer testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program did not crash testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program did not crash testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program did not crash testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir validation run: crashed=true testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir validation run: crashed=true testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f0000000e80)='./bus\x00', 0x0) mount$incfs(&(0x7f0000000ec0)='.\x00', &(0x7f0000000f00)='./bus\x00', &(0x7f0000000f40), 0xc002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir validation run: crashed=true reproducing took 1h19m49.608419778s repro crashed as (corrupted=false): RSP: 002b:00007ffceae564b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007faf3c0c8797 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffceae56570 RBP: 00007ffceae56570 R08: 00007ffceae57570 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffceae57600 R13: 00007faf3c15df63 R14: 000000000000610c R15: 00007ffceae57640 ---[ end trace b0543bdb73abdb5c ]--- ================================================================== BUG: KASAN: null-ptr-deref in instrument_atomic_read_write include/linux/instrumented.h:101 [inline] BUG: KASAN: null-ptr-deref in atomic_inc_return include/asm-generic/atomic-instrumented.h:250 [inline] BUG: KASAN: null-ptr-deref in ihold+0x20/0x60 fs/inode.c:423 Write of size 4 at addr 0000000000000170 by task syz-executor/364 CPU: 1 PID: 364 Comm: syz-executor Tainted: G W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 Call Trace: __dump_stack+0x21/0x24 lib/dump_stack.c:77 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118 __kasan_report mm/kasan/report.c:439 [inline] kasan_report+0xbd/0x140 mm/kasan/report.c:452 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37 instrument_atomic_read_write include/linux/instrumented.h:101 [inline] atomic_inc_return include/asm-generic/atomic-instrumented.h:250 [inline] ihold+0x20/0x60 fs/inode.c:423 d_delete_notify include/linux/fsnotify.h:264 [inline] vfs_rmdir+0x2d5/0x3c0 fs/namei.c:3915 incfs_kill_sb+0xf7/0x200 fs/incfs/vfs.c:1975 deactivate_locked_super+0xa0/0x100 fs/super.c:335 deactivate_super+0xaf/0xe0 fs/super.c:366 cleanup_mnt+0x44f/0x500 fs/namespace.c:1123 __cleanup_mnt+0x19/0x20 fs/namespace.c:1130 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:175 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:202 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:277 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7faf3c0c8797 Code: a2 c7 05 5c 9f 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffceae564b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007faf3c0c8797 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffceae56570 RBP: 00007ffceae56570 R08: 00007ffceae57570 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffceae57600 R13: 00007faf3c15df63 R14: 000000000000610c R15: 00007ffceae57640 ================================================================== BUG: kernel NULL pointer dereference, address: 0000000000000170 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 10ede9067 P4D 10ede9067 PUD 0 Oops: 0002 [#1] PREEMPT SMP KASAN CPU: 0 PID: 364 Comm: syz-executor Tainted: G B W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:165 [inline] RIP: 0010:arch_atomic_inc_return include/linux/atomic-arch-fallback.h:286 [inline] RIP: 0010:atomic_inc_return include/asm-generic/atomic-instrumented.h:251 [inline] RIP: 0010:ihold+0x26/0x60 fs/inode.c:423 Code: 00 00 00 00 55 48 89 e5 41 56 53 48 89 fb e8 51 5e b7 ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 20 ee f1 ff 41 be 01 00 00 00 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 d1 RSP: 0018:ffffc90000c17d38 EFLAGS: 00010246 RAX: ffff88810d45e400 RBX: 0000000000000000 RCX: ffff88810d45e400 RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00000000ffffffff RBP: ffffc90000c17d48 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffffbfff0dcfa48 R12: dffffc0000000000 R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 FS: 00005555943f5500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000170 CR3: 000000010c6e5000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: d_delete_notify include/linux/fsnotify.h:264 [inline] vfs_rmdir+0x2d5/0x3c0 fs/namei.c:3915 incfs_kill_sb+0xf7/0x200 fs/incfs/vfs.c:1975 deactivate_locked_super+0xa0/0x100 fs/super.c:335 deactivate_super+0xaf/0xe0 fs/super.c:366 cleanup_mnt+0x44f/0x500 fs/namespace.c:1123 __cleanup_mnt+0x19/0x20 fs/namespace.c:1130 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:175 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:202 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:277 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7faf3c0c8797 Code: a2 c7 05 5c 9f 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffceae564b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007faf3c0c8797 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffceae56570 RBP: 00007ffceae56570 R08: 00007ffceae57570 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffceae57600 R13: 00007faf3c15df63 R14: 000000000000610c R15: 00007ffceae57640 Modules linked in: CR2: 0000000000000170 ---[ end trace b0543bdb73abdb5d ]--- RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:165 [inline] RIP: 0010:arch_atomic_inc_return include/linux/atomic-arch-fallback.h:286 [inline] RIP: 0010:atomic_inc_return include/asm-generic/atomic-instrumented.h:251 [inline] RIP: 0010:ihold+0x26/0x60 fs/inode.c:423 Code: 00 00 00 00 55 48 89 e5 41 56 53 48 89 fb e8 51 5e b7 ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 20 ee f1 ff 41 be 01 00 00 00 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 d1 RSP: 0018:ffffc90000c17d38 EFLAGS: 00010246 RAX: ffff88810d45e400 RBX: 0000000000000000 RCX: ffff88810d45e400 RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00000000ffffffff RBP: ffffc90000c17d48 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffffbfff0dcfa48 R12: dffffc0000000000 R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 FS: 00005555943f5500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000170 CR3: 000000010c6e5000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 00 00 add %al,(%rax) 2: 00 00 add %al,(%rax) 4: 55 push %rbp 5: 48 89 e5 mov %rsp,%rbp 8: 41 56 push %r14 a: 53 push %rbx b: 48 89 fb mov %rdi,%rbx e: e8 51 5e b7 ff call 0xffb75e64 13: 48 8d bb 70 01 00 00 lea 0x170(%rbx),%rdi 1a: be 04 00 00 00 mov $0x4,%esi 1f: e8 20 ee f1 ff call 0xfff1ee44 24: 41 be 01 00 00 00 mov $0x1,%r14d * 2a: f0 44 0f c1 b3 70 01 lock xadd %r14d,0x170(%rbx) <-- trapping instruction 31: 00 00 33: 41 ff c6 inc %r14d 36: bf 02 00 00 00 mov $0x2,%edi 3b: 44 89 f6 mov %r14d,%esi 3e: e8 .byte 0xe8 3f: d1 .byte 0xd1 final repro crashed as (corrupted=false): RSP: 002b:00007ffceae564b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007faf3c0c8797 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffceae56570 RBP: 00007ffceae56570 R08: 00007ffceae57570 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffceae57600 R13: 00007faf3c15df63 R14: 000000000000610c R15: 00007ffceae57640 ---[ end trace b0543bdb73abdb5c ]--- ================================================================== BUG: KASAN: null-ptr-deref in instrument_atomic_read_write include/linux/instrumented.h:101 [inline] BUG: KASAN: null-ptr-deref in atomic_inc_return include/asm-generic/atomic-instrumented.h:250 [inline] BUG: KASAN: null-ptr-deref in ihold+0x20/0x60 fs/inode.c:423 Write of size 4 at addr 0000000000000170 by task syz-executor/364 CPU: 1 PID: 364 Comm: syz-executor Tainted: G W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 Call Trace: __dump_stack+0x21/0x24 lib/dump_stack.c:77 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118 __kasan_report mm/kasan/report.c:439 [inline] kasan_report+0xbd/0x140 mm/kasan/report.c:452 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37 instrument_atomic_read_write include/linux/instrumented.h:101 [inline] atomic_inc_return include/asm-generic/atomic-instrumented.h:250 [inline] ihold+0x20/0x60 fs/inode.c:423 d_delete_notify include/linux/fsnotify.h:264 [inline] vfs_rmdir+0x2d5/0x3c0 fs/namei.c:3915 incfs_kill_sb+0xf7/0x200 fs/incfs/vfs.c:1975 deactivate_locked_super+0xa0/0x100 fs/super.c:335 deactivate_super+0xaf/0xe0 fs/super.c:366 cleanup_mnt+0x44f/0x500 fs/namespace.c:1123 __cleanup_mnt+0x19/0x20 fs/namespace.c:1130 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:175 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:202 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:277 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7faf3c0c8797 Code: a2 c7 05 5c 9f 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffceae564b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007faf3c0c8797 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffceae56570 RBP: 00007ffceae56570 R08: 00007ffceae57570 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffceae57600 R13: 00007faf3c15df63 R14: 000000000000610c R15: 00007ffceae57640 ================================================================== BUG: kernel NULL pointer dereference, address: 0000000000000170 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 10ede9067 P4D 10ede9067 PUD 0 Oops: 0002 [#1] PREEMPT SMP KASAN CPU: 0 PID: 364 Comm: syz-executor Tainted: G B W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:165 [inline] RIP: 0010:arch_atomic_inc_return include/linux/atomic-arch-fallback.h:286 [inline] RIP: 0010:atomic_inc_return include/asm-generic/atomic-instrumented.h:251 [inline] RIP: 0010:ihold+0x26/0x60 fs/inode.c:423 Code: 00 00 00 00 55 48 89 e5 41 56 53 48 89 fb e8 51 5e b7 ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 20 ee f1 ff 41 be 01 00 00 00 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 d1 RSP: 0018:ffffc90000c17d38 EFLAGS: 00010246 RAX: ffff88810d45e400 RBX: 0000000000000000 RCX: ffff88810d45e400 RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00000000ffffffff RBP: ffffc90000c17d48 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffffbfff0dcfa48 R12: dffffc0000000000 R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 FS: 00005555943f5500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000170 CR3: 000000010c6e5000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: d_delete_notify include/linux/fsnotify.h:264 [inline] vfs_rmdir+0x2d5/0x3c0 fs/namei.c:3915 incfs_kill_sb+0xf7/0x200 fs/incfs/vfs.c:1975 deactivate_locked_super+0xa0/0x100 fs/super.c:335 deactivate_super+0xaf/0xe0 fs/super.c:366 cleanup_mnt+0x44f/0x500 fs/namespace.c:1123 __cleanup_mnt+0x19/0x20 fs/namespace.c:1130 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:175 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:202 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:277 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7faf3c0c8797 Code: a2 c7 05 5c 9f 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffceae564b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007faf3c0c8797 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffceae56570 RBP: 00007ffceae56570 R08: 00007ffceae57570 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffceae57600 R13: 00007faf3c15df63 R14: 000000000000610c R15: 00007ffceae57640 Modules linked in: CR2: 0000000000000170 ---[ end trace b0543bdb73abdb5d ]--- RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:165 [inline] RIP: 0010:arch_atomic_inc_return include/linux/atomic-arch-fallback.h:286 [inline] RIP: 0010:atomic_inc_return include/asm-generic/atomic-instrumented.h:251 [inline] RIP: 0010:ihold+0x26/0x60 fs/inode.c:423 Code: 00 00 00 00 55 48 89 e5 41 56 53 48 89 fb e8 51 5e b7 ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 20 ee f1 ff 41 be 01 00 00 00 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 d1 RSP: 0018:ffffc90000c17d38 EFLAGS: 00010246 RAX: ffff88810d45e400 RBX: 0000000000000000 RCX: ffff88810d45e400 RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00000000ffffffff RBP: ffffc90000c17d48 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffffbfff0dcfa48 R12: dffffc0000000000 R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 FS: 00005555943f5500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000170 CR3: 000000010c6e5000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 00 00 add %al,(%rax) 2: 00 00 add %al,(%rax) 4: 55 push %rbp 5: 48 89 e5 mov %rsp,%rbp 8: 41 56 push %r14 a: 53 push %rbx b: 48 89 fb mov %rdi,%rbx e: e8 51 5e b7 ff call 0xffb75e64 13: 48 8d bb 70 01 00 00 lea 0x170(%rbx),%rdi 1a: be 04 00 00 00 mov $0x4,%esi 1f: e8 20 ee f1 ff call 0xfff1ee44 24: 41 be 01 00 00 00 mov $0x1,%r14d * 2a: f0 44 0f c1 b3 70 01 lock xadd %r14d,0x170(%rbx) <-- trapping instruction 31: 00 00 33: 41 ff c6 inc %r14d 36: bf 02 00 00 00 mov $0x2,%edi 3b: 44 89 f6 mov %r14d,%esi 3e: e8 .byte 0xe8 3f: d1 .byte 0xd1