Extracting prog: 2m4.11234731s Minimizing prog: 22m30.942651016s Simplifying prog options: 0s Extracting C: 21.852762031s Simplifying C: 3m38.34288656s extracting reproducer from 126 programs testing a last program of every proc single: executing 76 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-recvmmsg$unix-socket$inet_icmp-ioctl$sock_inet_SIOCGIFPFLAGS-ioctl$NILFS_IOCTL_GET_CPSTAT-ioctl$TIOCL_GETMOUSEREPORTING-socket$inet6_udp-ioctl$sock_SIOCSIFVLAN_GET_VLAN_REALDEV_NAME_CMD-getsockname$packet-socket$nl_route-getpriority-renameat-ioctl$NILFS_IOCTL_GET_SUINFO-getsockopt$SO_COOKIE-ioctl$BTRFS_IOC_DEFRAG-ioctl$PERF_EVENT_IOC_REFRESH-ioctl$XFS_IOC_GETBMAPA-ioctl$XFS_IOC_SCRUBV_METADATA-ioctl$TCSETS-ioctl$GIO_FONTX-ioctl$F2FS_IOC_SEC_TRIM_FILE-readahead-ioctl$GIO_FONT-accept4$packet-setsockopt$packet_rx_ring-ioctl$BTRFS_IOC_SUBVOL_CREATE-setsockopt$packet_int-ioctl$PIO_FONTRESET-syz_open_dev$tty1-ioctl$BTRFS_IOC_QUOTA_RESCAN detailed listing: executing program 0: r0 = socket(0x1, 0x800, 0x45cd) recvmmsg$unix(r0, &(0x7f00000019c0)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000000)=""/173, 0xad}], 0x1, &(0x7f0000000100)=[@cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0x0}}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0xb8}}, {{&(0x7f00000001c0), 0x6e, &(0x7f0000001600)=[{&(0x7f0000000240)=""/161, 0xa1}, {&(0x7f0000000300)=""/36, 0x24}, {&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f0000001340)=""/109, 0x6d}, {&(0x7f00000013c0)=""/198, 0xc6}, {&(0x7f00000014c0)=""/152, 0x98}, {&(0x7f0000001580)=""/125, 0x7d}], 0x7, &(0x7f0000001680)=[@rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x28}}, {{&(0x7f00000016c0), 0x6e, &(0x7f0000001900)=[{&(0x7f0000001740)=""/49, 0x31}, {&(0x7f0000001780)=""/175, 0xaf}, {&(0x7f0000001840)=""/51, 0x33}, {&(0x7f0000001880)=""/76, 0x4c}], 0x4, &(0x7f0000001940)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0x78}}], 0x3, 0x2, &(0x7f0000001a80)={0x0, 0x989680}) r13 = socket$inet_icmp(0x2, 0x2, 0x1) ioctl$sock_inet_SIOCGIFPFLAGS(r13, 0x8935, &(0x7f0000001ac0)={'syz_tun\x00'}) ioctl$NILFS_IOCTL_GET_CPSTAT(r12, 0x80186e83, &(0x7f0000001b00)) ioctl$TIOCL_GETMOUSEREPORTING(r7, 0x541c, &(0x7f0000001b40)) r14 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_GET_VLAN_REALDEV_NAME_CMD(r14, 0x8983, &(0x7f0000001b80)={0x8, 'veth0_macvtap\x00', {'wlan0\x00'}, 0x4}) getsockname$packet(r11, &(0x7f0000001bc0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000001c00)=0x14) r15 = socket$nl_route(0x10, 0x3, 0x0) getpriority(0x0, r1) renameat(r12, &(0x7f0000001c40)='./file0\x00', r10, &(0x7f0000001c80)='./file0\x00') ioctl$NILFS_IOCTL_GET_SUINFO(r4, 0x80186e84, &(0x7f0000001d00)={&(0x7f0000001cc0)=[{0x0, 0x5, 0x2}], 0x1, 0x10, 0x401, 0x7}) getsockopt$SO_COOKIE(r5, 0x1, 0x39, &(0x7f0000001d40), &(0x7f0000001d80)=0x8) ioctl$BTRFS_IOC_DEFRAG(r2, 0x50009402, 0x0) ioctl$PERF_EVENT_IOC_REFRESH(r10, 0x2402, 0xe7) ioctl$XFS_IOC_GETBMAPA(r9, 0xc020582c, &(0x7f0000001dc0)={0x5, 0xffffffffffffffff, 0x100000000, 0x6e, 0x3}) ioctl$XFS_IOC_SCRUBV_METADATA(r6, 0xc0285840, &(0x7f0000001e40)={0x7, 0x3, 0x9, 0x0, 0x8, 0x0, 0x0, &(0x7f0000001e00)}) ioctl$TCSETS(r4, 0x5402, &(0x7f0000001e80)={0x4, 0x7, 0x9, 0x0, 0x1a, "894e06fc67d457fbf1f853c8b9b8a086cab4a4"}) ioctl$GIO_FONTX(r12, 0x4b6b, &(0x7f00000022c0)={0x155, 0x18, &(0x7f0000001ec0)}) ioctl$F2FS_IOC_SEC_TRIM_FILE(r15, 0x4018f514, &(0x7f0000002300)={0x8001, 0x6c, 0x3}) readahead(r3, 0x2, 0x5) ioctl$GIO_FONT(r11, 0x4b60, &(0x7f0000002340)=""/179) r16 = accept4$packet(r8, &(0x7f0000002400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000002440)=0x14, 0x80000) setsockopt$packet_rx_ring(r16, 0x107, 0x5, &(0x7f0000002480)=@req={0x100, 0x5, 0x2}, 0x10) ioctl$BTRFS_IOC_SUBVOL_CREATE(r16, 0x5000940e, &(0x7f00000024c0)={{r10}, "bd3127cf4df17401d17fe8ab990cc9804f98344fd6f7c9d7f0d146f74f47ac07c7917539d2e8dcaa6147a1492e6cbac993a36e9a6d1cfa5c630dec0a918c2fdc75c926950549ef389321181883f8624447b8fe7fe352e6ef9ee2536c81a4791bbd9faf9d1a23103577b51cd4a2bc010739e5d325631b1148346ca21d7855dfde69655f99469755697098caf9050d074ec64f754986256b667cf2340d69de65afc1778969622699a23890b6c7e50637e10123dbffe51cd918a9a79794677625f381c98bac99c4978d55f225b91ff7ea6112d5aecc886647a7f20bf198cb53a2f0948a830e166e7e8346c17a5b73c50d5a5482fa9367f6e1d9680e09b066e7f02854fb577324d8dd755838cd09cab67b4bbb4d8946cfc5c34778cc8018ac6cd83791b8fcd32495a424e43ef46e9f82ba054408a89b0da9605ffd6e06d8f5dcaf7eff7cc619c961e1eb8bd9681cdef592d14f1ee5f458af240d464a13e4876c9884de1956d573c54dcc84211f02ca9daa92357664527ecaacde8edf241955bb499ac828f67bfa5a82b060d3f774910a27e54d6ce9efe7ef2b53f40c692d89dd2117864c3f30912746db0541c4be5c6fdbcd8419737b61b5ee525bd917817b8a2dcd96816df792b41dfc799c87b4346f29fcbc61fccaee2189454fde1b1cc6826e66fe3fd17bf257e511880aa4b9b93f8ca00ab2f1353c8350c03f38a5e5cba77d3da43e8fac426fbcd1bf565508a04686ea8055a820ca4197c7c4761c81c5d849d0d57febd85ee7546189e00afcd2cfc5d7bb8ea55bd036841db0a20cb1ea201a27eeed5c5f57f7822035a7922b2b0bd31611650d2cd51b210f579777f23d6a6f500277ee32e5cdb0f58d2ff6acf151ece81d12692dcd3c9d3d9ecb186e4976a47224abb0373a5a750d25302852861084dd3e37c36497f4b7e6bd4dde8800c0e69dae7402ef39d727be750c25ed26eb2168d085cc23837716e5bd58ad4663d68b996d34b68d9e72eb650877adb93d7d9167b269a6d013a4fd51681cbaff09134d93611bfa4362448af9dd19d7212acdd035b6748958a15ebe6103bd180d981fef4e17931c535bd6268850f5ff8beb03897e61803d74c81c88667957ebbc7fc53a07b40c0142e562cfedb9e9303b79af395ca6834c743fa58f476c7a79d54f75c05a613e9cbcc94fbacadf2afe8077f87a6faae880c35538d1eb2e3f57f9121c34271168d83104b3917a4825a042a9b8b62b9d8cbebdf8a91428c20e47a219ca887ea01ae58ec37161817c9239b7f0047ce97acd46bde19aba737c2c091e2f368f845905508cc579e042bf2669bc7e939235bb93685b9f5de56e0988f0ad5abf700082265b3fe9d1449a06dd5b78e40d68c10fd18635584a507a452c90037487175990a9e4a02b95545e255f914c0931f89b004b0be2328d987e06474761fe4be55781f6a41b7fe839c3a2c87b757d73ed74688a0e7d094a29816268767b1519d01fffce77cf29e5180203000b1f2ba9c2f669b1d7f0636ea71fcbd406f7bee716379b78fe3ecc24b7175211333315dc15ca0d5274d93f190ff903840fc928f4351fad3a95c333120a91428348f83f9906b57cba89a3739c7a56f165a7661af3898baa89641da44c0a9e09cc0a1a72dfa1440c4575b6c5478f1124894423d70b2c6ad7d72c9eb563bbf01a0e573429024ca0ea663125a8e78838d93619a627ede394ada9c64e284f53729d0035e2fe46a78e13eb54287c860fe3661f4ba5ee88808d6dbf08c08fcd5876aa6e7f1613f9645691540d7c95e37c11ab03e8920cefcea710023b44b95a4c0d8a2c346d4d20b4b5dc4d19289395cdf71c500ede4b090c5aa81e18adeff5b031f90f21b3f8a6808388a59f8b732737801ebe001433793c231264f43a35ee688539a2f631c58e1cccab25d0a09d8a85bad56a1fcc52042b2d5d29a6cfaf65a260ef0310fbccb173979feaaf5ddfbb7884e82d40c7bd79a1bbc27efc6e05438a333f21a12015534f300ef7fda4c23494771882a15a8f32390382a9013f0680126e3c230abb1c527bd653579b81d7874fe92f72086a505e2a5d09c39836d83a62d05d7a78c35fdd1880216c66bef83d781581e5a34eac87c547a8f8791799dd088b759fd63ca96b72fa5ab47de95b4940d4a2b38cae4ca27ebd5be1e1d3f575253b3815c067259e258a3b785ddaa29ec956957bd98e2cbe2036dc378d03f9d730d4d478c9f2ecb4ca1c2c2e5370f8406ff65e8a12963a1000112c6d46cb21c7855de0b00a09452c153c6f1e4627c7cd6c6fcc8104f57caae59ec250404f88d64e288350e09c3f407893b86ca7af1ad8e704c9657e25149dd0726517bad843f8bd7c85f34c6c707f700a6c996e5fdcac63550846185f072b8aeba80d36c9c8794ce6884cb6b736a5fd4755f6824059167915f34cec32b052722811e81bce94e118916d776a48045714a61892660cd35291533504e092b7e969c30a86890b0b03db82e28bff152d4ecbd18c1eaf3f5f29ef2c15b9c3ae47d6d549d28652334d16395be3fae8b6b1994368248c078abb7eadff7251bce7540833d33402c7862af6116756ca5ed8d5d44c33213060098908bb96f41f1db87b6c4137dc34efe33d51b61a64dda1268f9f6691653ae9dbae9dd93061c94217f914d3253fab62008214daf79b01ef51153160c2ebdc78d3e456cd6a79912f2ba54c9a20b1d01a97a4cb0ae013ea1977cc9420581804a22eff7b78dc3a850880e5ada3836e60d3a34d45329df8fe77dded24f7361178add3544e342151a71808bb61d25b70fcc632a6fb7768180347b9e323e91113c046fb8a0d6500bead3f28c2a512d62514006b505d86d074d624f6e6061978ba082a4c40a07af40584e58e4867514e7b8e5db5bf71972b501f75e001c2ad29a16d0829ba9c0069cdec653814dbf64c2bbdc2e0c41e4e0a79eb141cc56d89543f9bc1bfc3a30c924cfa190a5f9a1bf52c9b48f9e792943036ca5cc723ed679bec5a1e4a2d7e2559cef08cedc90e5cc273460edf50d3d91146213067b61f9e0f9e9c85059f4b6b707375901c0f36673cf978df72ab152ba2e342841be07069c74f054012d714c1686a26805488cda54dc65ecfc3f584d8598c448f4eacfae913a1b5889b71bab4fe1efcf4f488d3c2ba8752c736aaa277b7713144584934f58ac818abe10a8e0040ce97295b56b3964e29cd998af34889ebf40b19b0a733af7e709374dd18b3b28e168d352c2171f2c185f0d1f2c58c860240bb3b1c3446aea745fdcfb6cb39868a773c52263273ebbe12bc3c9c0bd32e6de13834698f29820fdf91ca96325572840f5a7ecb062f3193dac8a6cdc29e25ee1e4b1047582b6ca713dbdba723d7beaaeaf979a49df93739223e8e6c6167d90953b6a73d870c77814e7bd0ca5dfdd24b630209856fe9f2d3116522b0fbb0b2c13ad14e66f05c6a896d5a82697b67ab1fc200fbff8721a846fc3ee97e638e2e25460c4c10f3ee5f0b87af397e61cfb53923ce5b8863802029be04b60ab04bb24f000d4d0925e895ae96ff26ac8c780df149a05ce9a5e455a75be2af50ac146e142ae80ef5f0760cae53ccfb98056b25c370fd8bff5d4bb61edf4437c2224a50aa8d8d6a235119a7033a33c42641faadd7aa59c4f77e06a11fa30b3075b243a19f8dbff5354a1b85fe7e59b7c6a971d3ec1b2060f70ea2ffa723e0fd1af3b926e75b345064d21fa7ec9b0514e76d3c922a7304da59aeaa79e73671919a18ba020eca60d97b674a22d8a62b68480961d0a7f5b9efbb187d59a23f115b95e9ac084c36771fcff3f83e326ed224e6530743febc54dcae010b519625b5536afb1097e1ea1ec71eedeebd94a11a8916fd89e7fc16d2f9151f50b0d251968f89513ae1fc5b543612a7028fbec5440955561bbb25c590295d408c258f277672d1c1b71af033cdbc3c5a0faba5ad9cf586646d7dd93aab3c96c396c3d20c2390f11dddc5b208ff4c37fa475e57d467e0a97dd6486fa78182f3f614d32e5601696ec8b9b21f08eeb20d2c739169374fed3a04b3837036b71b4ce9e06aafcc17e3aa0f335cc8f835d1082abe20703b98bd15cea5473d74916172d5c5e12ddd6df8da73f33fd3e6ae200e9f5d51bee505275dd39f447a4b1c870cee52083595e2c8731c37ceb1df2a227fe59b8d383409a78eeb5b3017a7b54325fe258b19fa15a0e78478f6624acc9b35d96db36472005c7741baba82db63c264172427e0d32f87ea7ed6933ab3bd10802296d2ff4e2160ec87248644fe65daa5fb9ad5a124e8f4050608ddf6f713f619b9aa1692e9aadfed386dd6dcf02ecd435e0255a7e4961a59149393c3e587bb308522a14b8246a1f1c1d317e9816387afb71a701d5b8a7290f42f26497cf48ba7db8bc36a2e7caef6e6d5aafbc065d858f1811aec4ce6a0994f72c7ae5845ad0bc2f68fbe7bc8b0e81634f6ccc584342f53e0ddffb4735ae05f1e50d5cbdfb4b28c7dc91c60a19339d520cbea2caaa59f15407cf5ca157bdaa0753ed23a4151d1277451878e4da972e4ef24ead23f213021e442b01831249a4711428c4bf8191644a611271e0ffc0d2417a36966242549df5255e9d5049b753144c984e3b5de29af3afcce0c3b78904b4f7d88f4a27928fe7b381110a9b749988f71bdbc1d35ce9d3acc437448cf470d4a07994ad4c1f8240a403b483d14dafdd04fc0fbb84dba321c97f7c26dad18e3fb8fa996df9ddb8036f5f2e112d0f32ca2cf733eb7752fb147d9366165e0c8acb055ecd9a652cb34011aebe0a04d6fad00c5dec97ca232679d27c888416d0407cd4c025995dc70a186c99be10cb9cec6dce6fecb12bc2f76b237b167941cd7b7a88ef7564dd2abc75fac1f1dca0f5cf28740d4d8dfb8d213a7aab444b7507f8d23e67489558d3ab292231d9f71f7b8a540b81c1fa3474bef41547e48d646f2408e4eb71dac6aefdb26d3ee9416ea6f0163ea89188732c4a731113aeefd616e1475be14a06ac1cd7cb87092b0d4ae94c81a015db216215ec48cb36d1bb837a2a4c9a71972004234f32953c758143053c003ac5166e6099a65d86fb33ca5b45594b8532a24bd1d65df5afc6a2649582bef76364267a660bf715336431441fe5718b2e7ced9185c71c987e8fd1f566ae6d089a74dffd0bf0b754a940495bf8e86dc84ddb60d96c00135bd440b5ea39a82979b90328a15c5619243d14ce283fd7aa1ddc6676253c17449e7cf933cd9251006def10aece1f4ae368acada9bcbc1f6319d830039b137a9542e93f69be451a0f255d13eb93660503141519fe5505a0eed9b0d7ea153d29a2bcc4109f1a3b6a61191631996d25ff66ca44234902850bf90cc4e1734be2748052426db506ad802e45248f856f23ce942ce3ffedf5a479384ec05d39cd3474243063ccc9e3f527eb3e756f2118c1687da045072d65421546b636d13768b30e9edbac145b7d71ae5995d3d36e003e7cca0dc2808a59edaa37a6dfe2ae4e0cf5f3aaa6547eccc8b97e78a6fa4eb0ee6faac95ca5c46ee9e7731d823f221c1c8e416b686dc41aa9a8c572b45d86e5a51f31dcdb406780bbc7e7e2744261227f046988735b25eb2772a1d7151041fd88373bb231e31f81ca1d1c15ccacbb03eac28af5175aa7be93b6ef6f77b4c7ddce39f477bf61c3709e9596d3e572bd495a602d6fadd32ab9f1e20ebd49ad9905d82494d637da89d0d7a6d4e9f89ba67697d265619c460fe9f844347d0a026f6ec903aefafd86b93a0e96526cac6d1"}) setsockopt$packet_int(r11, 0x107, 0x13, &(0x7f00000034c0)=0x3, 0x4) ioctl$PIO_FONTRESET(r9, 0x4b6d, 0x0) r17 = syz_open_dev$tty1(0xc, 0x4, 0x2) ioctl$BTRFS_IOC_QUOTA_RESCAN(r17, 0x4040942c, &(0x7f0000003500)={0x0, 0x6, [0x7ff, 0x7fffffffffffffff, 0xf69, 0x8, 0x3, 0x2]}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-socket$unix-sendto$unix-dup3-sendmmsg$inet-socket$inet_icmp_raw-ioctl$F2FS_IOC_GET_PIN_FILE-accept$packet-accept$packet-syz_clone detailed listing: executing program 0: r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$unix(0x1, 0x2, 0x0) sendto$unix(r0, &(0x7f0000000100)="0c3e9d1650937c8e4b61e7ca5e1cd19578469beb2d5f2690718bd319300977705da952fc71f101cfe1f26bbba3319fbb927d856057d8007b3401cc47d8b32eecaae50a7ec4568901e26d7e3f3b5791111d2f399520931f420cdca31b837f3293db7be0d305b5c4537ca8a138571b90c78555342ed1452c4af83b3d913607872c41359d6130825d1c9ba79e6e90a2bec6c9809a43000d2f48fd2c07b4230c0054b0c4660996d9743349d367b66f04fc1142069c75e3ef16a1361f36f700f65aa0a6bc90622bbddb630482cd2f9e", 0xcd, 0x4, &(0x7f0000000200)=@abs={0x0, 0x0, 0x4e21}, 0x6e) r2 = dup3(r1, r0, 0x0) sendmmsg$inet(r2, 0x0, 0x0, 0x8040) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$F2FS_IOC_GET_PIN_FILE(r3, 0x8902, &(0x7f0000000040)) r4 = accept$packet(r2, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000280)=0x14) accept$packet(r4, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000300)=0x14) syz_clone(0x84100100, &(0x7f00000000c0)="b23bd7cc", 0x4, &(0x7f0000000040), &(0x7f0000000080), 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-openat-accept$packet-ioctl$BTRFS_IOC_SNAP_CREATE-pipe2$9p-openat$fuse-dup3-openat$zero-socket$unix-open$dir-socket$packet-getsockopt$IP_SET_OP_GET_FNAME-socket$unix-bind$unix-listen-socket$unix-socket$unix-bind$unix-listen-connect$unix-fcntl$dupfd-accept$packet-ioctl$BTRFS_IOC_QUOTA_RESCAN_STATUS-connect$unix-dup3-openat$dir-ioctl$TCSETAF-connect$unix-accept$inet-signalfd4 detailed listing: executing program 0: socket$inet_tcp(0x2, 0x1, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./file0\x00', 0x4a8c0, 0x1) r1 = accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000000080)) ioctl$BTRFS_IOC_SNAP_CREATE(r1, 0x50009401, &(0x7f00000006c0)={{r0}, "b76f4f267540c7e627cb299a23681f26a7358ac106c223bfad10dc5312171dfd0644ffc01049239fb8a4750ef167c85ef14f9786fe7d35993c2b249220e9d4a545d95bc915db1ded93b313f47eb4ce54e690a084a2421852bff3168feacf95c2a0ba75876ad23d38e04b540103f5f6bfd6f9c5d26304b752fe2ce582bdb1379b5aa0e30a618332488d5b4e171b52b73820aa4393501816513b48d28a9d12b98f28ab0e46474cfc1a95dbd20b080608a565de3df24b6145109f11850ca0a6945f61c836062b7af1de8b37c68472b60639d7fe0c738573f55a2bb13446dbf7e499b33175b2fc04101ec86c515c5927df9472f322139c9986b5bace8d68ed46ffe9d2bd03c5ca9637f38b3e8a847428cb8664b30c362d2a45f6c8129aae5eaea63a1c4607ea9a18238d8dd7bb8235050c20ba058123593eca979ece52c3e79f0fed92f01e166c1870447693fd68bb6e5cc3e017fa6e97ca583bb479bbbe51e598f192b93c5467bcf08c7d5cb4a6d75ce3dd994438310622478938aa437e9713317c46287fcf89a4ab68d21b8bdc1b06309cbbc8ab2d15291c5cfccacf7fb062ef889c3e5312a2222acf2e84f4f6db46138b58e4d26544478dd3a8e5e221f77669095e9e941e4618bceac55b6207f6fad010b25a24e3e1e895e6b48f7973664b9ad1df0944b855821286e6a646b02f9a35f7a35c6a93b44bc0f7196e0b6e3bfa1a2cbae4cb679a2ed0b33c0412ee3e0a2e5f4c74a1107b41da3cfd49981926de29b0c46cb30aa9b31294bd4ac1799174be37e680f6784b809fa701a4282ba1f815630c65984f13bafab884849d70c14523dfc7e238e9f23362b9a82c0a7f51193014322f3e70ae5fb08007de14df26700b3f271d7a42168a7b9e9c5aafc6bef55aea219804487b2ac2ff2dadb835e65f7122ccdeaf7d4dbf3ee793f6adabc6f0ab75751792c0083316b0100fbf4d337fb6d6193dc3f554bb74e9c34514dec67109b446cd6c3c37817f6e1efce6e517ee3640022470f722fd6bba17aadd20b82e962ab1956585671430234202a795c51e84bb7b239d95d06cd34dcfb830e3c2e8295da2b1a3b2e0b06655d2ec791374449f7f0bf7d617c8e03f6fc4c111b394d3699028837acd8b6d1f6673c4cd0acf2d1700afd1e0397e9e0d3d46f1909d71760d71685b32f27c5b9f671452008153818c87562e7935e89a70b58711ec8ab7c12ff59dcaa8037f2a26edf733b17ea81c9f94c73f656c9bf4557992a28c728ecdab27852f07155b3918097658dce5ccca1515efa2bc5e8645c160ce7f70a0d4f54c0413eaf41b96bd03b57b905e691923b38b8d70852a8a616fcb29ccce1132cb70498f55912ab14547f24577ebec3baa4fa3f87eff735f7e0ab719627b7ef8486b7d6882f3fa9ccd663dd5a287f926e9ca51f35cc37baf84712dee128157f8b5a721f9ce353fb8fb3c02d2c3af0c2ad67481417517e7f96e830e3bb40d7089de4dfe1e9f151c3085ca04ca27c908ae65e31beb4d665cb52053d3f6ed3734566afef70af48935bb9124f4e38ca1bf37a66db1cdd3efe63e3d53b8d51fc03b7b6dae466b22961463b94dacba9aff2b94e6217c693edb244559662437904cd85dd1cd64017b4a0e1fad8812c3541b1ee64c0491a87ca75296fae019ad9e847edde12d217b87f2d01881fd45e46bf031e6f8d513e74cd4e74ef876abe28510b0824937e5bbcbe134893ae177a93eabf4823e0b98660a98a8b52de3e44cf53ea9e19694703cfdc77a9d217e3864d29761dd6a6b385b18ff40b9dab4f934834e4de9d25e4069851ccbaec634813cae5fb5d6af8bc05ebdc48afa2de40047e6a2757d348aba4faeb24e6978dda20b229a255fc01e50228e97381a9c3fe2aea8478136448f94b150d3ce71e64496d69d83fd52da25791aa7895aa28fdff3ad147064a7600310637085cf97a59325a44f32357f1bedba3e42395ff4a229126ecb4d94fefe7749ffe40b669165c0dae8049b1c0575d17c35e1b4c8ad2debcf0353f18d94f4bd6decda6e24ae3562f56cae20d7ff69698350f4bdda6a88368457d1f6a7f215ed72de8f50531175e66ede9304b8cd21defe2520387c28deb4741935b039c12d6691c76d20f3e1cd37593c28db0a74f7ab8413f85b4dc05f814db7d4726c562a6e7e22503395febc90308a93ec67709c5eecb1eeb0a72c1e915e4d0abf928047f91b15f0e776d042202a7833d3de1fcdd782394f2111cd742ff60486a0936dca3d87d21589330580da158535a16e6b019683f174cc8352e21332a858f47cb2f9fb1f4850e74255df92b2b75c209a3a1ce245857a587e3e1bb3cedab2c0bc13cd190b59535f6ae4bfa6f33937d3fbf9e11a62976641c187e439b6c81f39f186046cdc70bf176f5ad221ce5ba512283301a68a40dbc1ad6101ee37142dea9b44aeb0d5a6e6082094b735f01e56fc8a8d139157b1b9b395ad78991dfe2b6c61899a86e0796f2f572ab1f177c835539785c6be0e0d6fc0b7eec2e7e4f8c1a7b9eca118260c05c974cfbda566b8a70659642b3e55cbf637818d756872b59a436eb1a78219b7922239e20d953a9cf9ff41d08bdf5f26ad989ca4b4266c20b6ddb474b43d137f00cabf334cac93c89ce77efed902989fd156420eba7a0e99d3838a40c942ff090d407a49876350e0080dca2b3eb959dc0ddbe1703adfda9959d29ecec4d632f337c9c1f61bbdbff074d71f7c321d3b9af18c790624a1559c81b90a3f8976cbb36b34b2a7cb7b0f534c1d8bcbac7e8783fa19b9ff39c5cfe3cb09ba89371209fbc6ab5852f527938746626ab73268ee17df45fcc3bdcaa4bc6ceafb89045d903cbd2044fa6d528122994872d65b17bcc12d38dd851580f5cbb9c2e88c4333abe87c936fed50b753921898a7235525691bc9e033fd0542fc38af4ff96e529e1de51b4a48f774e34705b952119090a6a739ef0f4b189681ae704d32c16f371da6cd47a17a6adb0e6395fbc151ab1f38510cdb4e8a1eb59964683b093ea96c5825e8d36755ff9eea04a2853af3279eb5f3edb9b56c99dae5b15ba09b8e11245acf4ac483ab249064570d6c37f26ba6471081154996362611c246900745eab9baf051232491f9e039268b3df0240cd60c67407fee8694bbfe246847c8cf85c6cbc7d86b3d6e9891eb7c2c036643d66b7c97835344e97306c3014647027637d03dc242764a2abc69b103dc9067e4dda367f5f77d7ea72933241ba15b8bce764337877bd89d92afa6e4dc9adde2f6ea32ce7487aa29f570db88cc807db4dd55d32acb4f23e974eb32f66152353add0d00aa50d798b0f8c09091e272721bdcab17701f1769473afc090e4ae4c4e5b8872e452a168efe903d51c006243cb4adf3c4464457d54f1d48c31c520b6f946e69e7c2231c1f55f5ca6710a09fe5f4ec9ba9b86d8610f3977a2e1582aa5ae26c1af184807de36028604bfd850dea20aca6a9bac7114bd47ce3e2b9da5e2e0f051fec515ac2a866324c73efd2fa0ec730ee4ed5167580fa370ef80cdf2c7512f40e3e20a8d4b34dada8776b84d6fea23508ad9d70ce4d153b0431c6b4751d667fa9550cd8b3cef0504e5dbf4d85969aa76d536f1b602b2f2673a4437767bee7567bf4cbbb8295929ccc7576c7a7a4986b2dfc3cc93a32027cea976f0f12e2e76b0fbdc242ab9520ac31b5d7b3cd3d30c3e26b91e70df7dcab661312b37cbbe4f237c2d3314d4f47cc507cffd903a7ac71fcbbd92ea6a9fdebe0f5a4531fbde3d703182d610e38094d238ac054015b6803c10805a73e67684c69adae165af2f6847c4150f25d965b0b2dfbdd86cfdd1c51a3379851c71f5dcb036eae9281ce3ccccbdffbc6a260d6f3317c472215686cb87277123a2d29fd65d0367891583402eecfa442c3cf2aed9312f3a9677fc8032318680e6a6c585f713e0dcf79f10ef00edb4fbe1f8517e44b6116f30c447d63503863465efcd760e93188844a8a75bba77d7abbb09b4eb2c4e272c9abbe308e6c1c47bca326bf032b2db8f2a2cb0ee86fd7a993c01d7f1c7682ae99b55615591e3c4c8004b8f5bfdd16e2b9b34335210d66496088658c9f05df8a2fb30f078a5b366f4a4f0aebe2f67334589ab6e69d96a4ca2f60d8d09f6dc769c124d0d39a38ab2de47d85f7acf5801aec12893b3876036c58dc40ef5f29dcfb90218875cea29bec61685ba4d058153c46c24ab495a37fe861aedfc6af9a1cc374d3cf357c2f901223539cf27d1eb74dcf5291a9d6d69f359b2e59821fc7cce1d718774c219d988812c9d4c3c267c2287654c262341d149ce98c4dcd80bfbc3b92dc6411ba97b79616cf6b5a94c72e1bf0513a5383823d8abd0806620aac5d205b7e5852a6a9f5539030319586c0bcee51f521d1249cab3def9056746daca3993dc8a06d43f01c751a620d32bb20a748620ed3bd950274482533d3a8460d3ad5303e49dedc8e61d665c1b494b312aa23019672f65e0550012bcce49c87ae6be9fc003e4f51cb93e0946993da4c8a053678d307b73fa9f66d6f9012a6a4deaa57cdb950baff1ae1955366d31c9ac53defae0ddc6d6806656f1eafb7a37121d514154a69f726915e59160858dcb19090c1169391b20d7f48be73328ba53fa1a977a2d0aefaac97dea4ddd996c2ce88757bf7310a6ed19ddee97a6f5f30ceef639fae4531deb3d755aceeb1abab98842d6bcd13aba0de8576b35cb82f414ec644753e05b9a60cf6fa4fc5ea3204c7dbe3d6b2b3b35a41754e3817605b1e2999b46655d1bd25f43c05b9a75ce9b5e5abba72132ed6917c1f3fdb94a07af17e1c369a55a78c370dce65baa7210b33927795bf20bab304855a081c8600106659958473cfc0c600627b4c0ca4528ce8c8b5675d8cc80e26be297527a0b1e9af51cf399eeccfe960d67bf676712886d283bbc1640b10ef72c76663421db8f372227a506ca3bd1567c99e75afbe299a9a99e5562eaecc30078eca5c8ebaefd8f74a78f951e5e6672bebb8ad2d3cf829389ac0bb958a2b0ce671b00337811dc8f5ebab83069d80a7d9106d8a4051d6143088e42ba961f9fac78132c0b65bce775a46b547a23f9c4928cf6e989a06f8abad5f051313c8cfaf907cab2b957e1f6d51cc94bcbaee2900d4f8d9fd6002eb231d85ebc12abb1733f24309d9ee45f5296a74a1e64d4f7740902833b555aafffa0eb9ad3827ec8ffb10ba4b5823c2ae8315e0f098f03e790d59ae7bae994db79697261584d669f091eb9d0db83b9dfac6fa946b4fa4252c365217db9e8f8aade4a4d0f8189badbf8c7e624ac41baa45d1cce0bd91f1a254efcc00293cc904d14da685cd9d510315b4736c199fa07ca2c6224804ce522eed1b81d221aaf0f84dca248250af7125ed9ea6d5e2261cbd4e9ece164517884fdae50c005345579d543a63bb289a32137aee0fdf76dca8ef097985515df941f3cbf02059e08cd7bfb3ab29ead6765e36d04f57a7182d0bcc919eeb4e087cb6e476ca5c285b50086f14e13bda420fb4ecf897d272d7c378cf621bf20de88b7070ecf6e6ca98b6c8a0f0a1c2eea20db461fa171e169fe7110eda4148d4fd22762ca6360706b49a1d0ef5b24af1c3c64aa4f1d44fcffcb3c5f9a8d6bf30db7cdaa727168627a3c6609786b0aba64edd62d2fcbeb27156b6332f049f63c107936d433af69a4cc8046b3db5786344767db1ac555974260945c3c91538a63c0a406c12ca1616eeb82643f3098a8ed7b0625b1a3d14daab48484aa2e1fd1bf3bbee9b400e"}) pipe2$9p(&(0x7f0000000040)={0xffffffffffffffff}, 0x80000) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) dup3(r2, r3, 0x0) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000001640), 0x0, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) open$dir(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x84000, 0x100) r6 = socket$packet(0x11, 0x3, 0x300) getsockopt$IP_SET_OP_GET_FNAME(r6, 0x1, 0x19, 0x0, &(0x7f0000000040)) r7 = socket$unix(0x1, 0x1, 0x0) bind$unix(r7, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r7, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) bind$unix(r9, &(0x7f0000000100)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r9, 0x35bc) connect$unix(r8, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r10 = fcntl$dupfd(r9, 0x0, r8) r11 = accept$packet(r10, 0x0, 0x0) ioctl$BTRFS_IOC_QUOTA_RESCAN_STATUS(r11, 0x8904, &(0x7f0000000000)) connect$unix(r5, &(0x7f0000932000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) dup3(r7, r4, 0x0) r12 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x101340, 0x24) ioctl$TCSETAF(r12, 0x5450, 0x0) connect$unix(r0, &(0x7f00000000c0)=@file={0x0, './file0\x00'}, 0x6e) accept$inet(r4, 0x0, 0x0) signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x6]}, 0x8, 0x800) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open-perf_event_open-socket$unix-openat$binfmt-openat$binfmt-mount$tmpfs-mount$9p_rdma-recvmsg$unix-fchmod-read$FUSE-socket$inet6-write$cgroup_netprio_ifpriomap-write$FUSE_OPEN-write$FUSE_OPEN-setsockopt$SO_BINDTODEVICE-setsockopt$SO_BINDTODEVICE-fcntl$dupfd-setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS-mmap-syz_ublk_setup_io_uring-openat$dir-openat$dir-lsetxattr$trusted_overlay_opaque-lsetxattr$trusted_overlay_opaque-setxattr$trusted_overlay_opaque-syz_io_uring_complete-write$P9_RSTATu-write$P9_RSTATu-signalfd4-ioctl$FS_IOC_GET_ENCRYPTION_PWSALT-inotify_init1-ioctl$F2FS_IOC_COMMIT_ATOMIC_WRITE-syz_open_procfs$userns-close-close-syz_clone-syz_clone-setns detailed listing: executing program 0: perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) (async) perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) r0 = socket$unix(0x1, 0x5, 0x0) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) (async) r1 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280), 0x0, 0x0) mount$9p_rdma(&(0x7f00000000c0), &(0x7f0000000180)='./file0\x00', &(0x7f0000000140), 0x8000e0, 0x0) recvmsg$unix(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) fchmod(r2, 0x40) read$FUSE(r2, &(0x7f0000000400)={0x2020, 0x0, 0x0}, 0x2020) r4 = socket$inet6(0x10, 0x3, 0x0) write$cgroup_netprio_ifpriomap(r4, 0x0, 0x0) write$FUSE_OPEN(r2, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r3, {0x0, 0x4}}, 0x20) (async) write$FUSE_OPEN(r2, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r3, {0x0, 0x4}}, 0x20) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='pimreg1\x00', 0x10) (async) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='pimreg1\x00', 0x10) r5 = fcntl$dupfd(r1, 0x406, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r5, 0x6, 0x16, &(0x7f00000002c0)=[@window={0x3, 0x2, 0x8}, @window={0x3, 0x8, 0x1}, @sack_perm, @sack_perm], 0x4) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000008, 0x110, r0, 0x2d2bf000) r6 = syz_ublk_setup_io_uring(0x12e, &(0x7f0000000080)={0x0, 0x591f, 0x400, 0x3, 0x121}, &(0x7f0000000140)=0x0, &(0x7f0000000340), &(0x7f0000000200)) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x341, 0x64) (async) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x341, 0x64) lsetxattr$trusted_overlay_opaque(&(0x7f0000000300)='./file0\x00', &(0x7f00000000c0), 0x0, 0x34, 0x1) (async) lsetxattr$trusted_overlay_opaque(&(0x7f0000000300)='./file0\x00', &(0x7f00000000c0), 0x0, 0x34, 0x1) setxattr$trusted_overlay_opaque(&(0x7f0000000100)='./file0\x00', &(0x7f00000001c0), 0x0, 0x0, 0x2) r8 = syz_io_uring_complete(r7, 0x0) write$P9_RSTATu(r8, 0x0, 0x0) (async) write$P9_RSTATu(r8, 0x0, 0x0) r9 = signalfd4(0xffffffffffffffff, &(0x7f0000000000), 0x8, 0x800) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r9, 0x5450, 0x0) inotify_init1(0x800) ioctl$F2FS_IOC_COMMIT_ATOMIC_WRITE(r6, 0xf502, 0x0) r10 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r10) (async) close(r10) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002480)="cae8e47f01d78da9ed9e37f2cdbdac67efe580476957b9229578a4998e935a5fc16bd413783d28e5e12a94b69bd79918ed3505c3a4606b9a94e3338c18435fc77e27905aa54f5fbbfbc78d8f2c8eb5d4bb79445d1e0160053c3d9501b784243942154b58df2e92dd55e4e9ae6b02e40a899a272ba26a2f0909ddc88c2ff4970a62f993a7b750c69bf03903d85c3d0681ef1825b173aabf8ce659678a895d912905280935a3b30e49c7b62da25f6a4ecae869ae3180c712aa3fb9537e3b73f6f751bab79b9515b3248144857665043417950bbb25cc935fad38734057acc046ec021b4300b8f4518357802fc63c2ea931251b6a5bc65ed3c04753c96a03e5f717fe2a0773d5f0e56160948a40f0035644e8c35dbb2f4ccdf369401de49f11c4cd1dd17f1bf7efe60ff7bd8491f34ee7aabf6965deabfa26a46e6cf5c3664d66df70733329e1752a577f6fb1fed96ef2c6e176ebf5aec857ef3da83043f5182886478c883bcbcc9a6a93cbe0ced125ea6a9e3b") (async) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002480)="cae8e47f01d78da9ed9e37f2cdbdac67efe580476957b9229578a4998e935a5fc16bd413783d28e5e12a94b69bd79918ed3505c3a4606b9a94e3338c18435fc77e27905aa54f5fbbfbc78d8f2c8eb5d4bb79445d1e0160053c3d9501b784243942154b58df2e92dd55e4e9ae6b02e40a899a272ba26a2f0909ddc88c2ff4970a62f993a7b750c69bf03903d85c3d0681ef1825b173aabf8ce659678a895d912905280935a3b30e49c7b62da25f6a4ecae869ae3180c712aa3fb9537e3b73f6f751bab79b9515b3248144857665043417950bbb25cc935fad38734057acc046ec021b4300b8f4518357802fc63c2ea931251b6a5bc65ed3c04753c96a03e5f717fe2a0773d5f0e56160948a40f0035644e8c35dbb2f4ccdf369401de49f11c4cd1dd17f1bf7efe60ff7bd8491f34ee7aabf6965deabfa26a46e6cf5c3664d66df70733329e1752a577f6fb1fed96ef2c6e176ebf5aec857ef3da83043f5182886478c883bcbcc9a6a93cbe0ced125ea6a9e3b") setns(r10, 0x20000000) program crashed: panic: Incrementing non-positive count ADDR on nsfs.Inode single: successfully extracted reproducer found reproducer with 38 syscalls minimizing guilty program testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open-perf_event_open-socket$unix-openat$binfmt-openat$binfmt-mount$tmpfs-mount$9p_rdma-recvmsg$unix-fchmod-read$FUSE-socket$inet6-write$cgroup_netprio_ifpriomap-write$FUSE_OPEN-write$FUSE_OPEN-setsockopt$SO_BINDTODEVICE-setsockopt$SO_BINDTODEVICE-fcntl$dupfd-setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS-mmap-syz_ublk_setup_io_uring-openat$dir-openat$dir-lsetxattr$trusted_overlay_opaque-lsetxattr$trusted_overlay_opaque-setxattr$trusted_overlay_opaque-syz_io_uring_complete-write$P9_RSTATu-write$P9_RSTATu-signalfd4-ioctl$FS_IOC_GET_ENCRYPTION_PWSALT-inotify_init1-ioctl$F2FS_IOC_COMMIT_ATOMIC_WRITE-syz_open_procfs$userns-close-close-syz_clone-syz_clone detailed listing: executing program 0: perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) (async) perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) r0 = socket$unix(0x1, 0x5, 0x0) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) (async) r1 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280), 0x0, 0x0) mount$9p_rdma(&(0x7f00000000c0), &(0x7f0000000180)='./file0\x00', &(0x7f0000000140), 0x8000e0, 0x0) recvmsg$unix(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) fchmod(r2, 0x40) read$FUSE(r2, &(0x7f0000000400)={0x2020, 0x0, 0x0}, 0x2020) r4 = socket$inet6(0x10, 0x3, 0x0) write$cgroup_netprio_ifpriomap(r4, 0x0, 0x0) write$FUSE_OPEN(r2, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r3, {0x0, 0x4}}, 0x20) (async) write$FUSE_OPEN(r2, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r3, {0x0, 0x4}}, 0x20) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='pimreg1\x00', 0x10) (async) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='pimreg1\x00', 0x10) r5 = fcntl$dupfd(r1, 0x406, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r5, 0x6, 0x16, &(0x7f00000002c0)=[@window={0x3, 0x2, 0x8}, @window={0x3, 0x8, 0x1}, @sack_perm, @sack_perm], 0x4) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000008, 0x110, r0, 0x2d2bf000) r6 = syz_ublk_setup_io_uring(0x12e, &(0x7f0000000080)={0x0, 0x591f, 0x400, 0x3, 0x121}, &(0x7f0000000140)=0x0, &(0x7f0000000340), &(0x7f0000000200)) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x341, 0x64) (async) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x341, 0x64) lsetxattr$trusted_overlay_opaque(&(0x7f0000000300)='./file0\x00', &(0x7f00000000c0), 0x0, 0x34, 0x1) (async) lsetxattr$trusted_overlay_opaque(&(0x7f0000000300)='./file0\x00', &(0x7f00000000c0), 0x0, 0x34, 0x1) setxattr$trusted_overlay_opaque(&(0x7f0000000100)='./file0\x00', &(0x7f00000001c0), 0x0, 0x0, 0x2) r8 = syz_io_uring_complete(r7, 0x0) write$P9_RSTATu(r8, 0x0, 0x0) (async) write$P9_RSTATu(r8, 0x0, 0x0) r9 = signalfd4(0xffffffffffffffff, &(0x7f0000000000), 0x8, 0x800) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r9, 0x5450, 0x0) inotify_init1(0x800) ioctl$F2FS_IOC_COMMIT_ATOMIC_WRITE(r6, 0xf502, 0x0) r10 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r10) (async) close(r10) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002480)="cae8e47f01d78da9ed9e37f2cdbdac67efe580476957b9229578a4998e935a5fc16bd413783d28e5e12a94b69bd79918ed3505c3a4606b9a94e3338c18435fc77e27905aa54f5fbbfbc78d8f2c8eb5d4bb79445d1e0160053c3d9501b784243942154b58df2e92dd55e4e9ae6b02e40a899a272ba26a2f0909ddc88c2ff4970a62f993a7b750c69bf03903d85c3d0681ef1825b173aabf8ce659678a895d912905280935a3b30e49c7b62da25f6a4ecae869ae3180c712aa3fb9537e3b73f6f751bab79b9515b3248144857665043417950bbb25cc935fad38734057acc046ec021b4300b8f4518357802fc63c2ea931251b6a5bc65ed3c04753c96a03e5f717fe2a0773d5f0e56160948a40f0035644e8c35dbb2f4ccdf369401de49f11c4cd1dd17f1bf7efe60ff7bd8491f34ee7aabf6965deabfa26a46e6cf5c3664d66df70733329e1752a577f6fb1fed96ef2c6e176ebf5aec857ef3da83043f5182886478c883bcbcc9a6a93cbe0ced125ea6a9e3b") (async) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002480)="cae8e47f01d78da9ed9e37f2cdbdac67efe580476957b9229578a4998e935a5fc16bd413783d28e5e12a94b69bd79918ed3505c3a4606b9a94e3338c18435fc77e27905aa54f5fbbfbc78d8f2c8eb5d4bb79445d1e0160053c3d9501b784243942154b58df2e92dd55e4e9ae6b02e40a899a272ba26a2f0909ddc88c2ff4970a62f993a7b750c69bf03903d85c3d0681ef1825b173aabf8ce659678a895d912905280935a3b30e49c7b62da25f6a4ecae869ae3180c712aa3fb9537e3b73f6f751bab79b9515b3248144857665043417950bbb25cc935fad38734057acc046ec021b4300b8f4518357802fc63c2ea931251b6a5bc65ed3c04753c96a03e5f717fe2a0773d5f0e56160948a40f0035644e8c35dbb2f4ccdf369401de49f11c4cd1dd17f1bf7efe60ff7bd8491f34ee7aabf6965deabfa26a46e6cf5c3664d66df70733329e1752a577f6fb1fed96ef2c6e176ebf5aec857ef3da83043f5182886478c883bcbcc9a6a93cbe0ced125ea6a9e3b") program did not crash testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open-perf_event_open-socket$unix-openat$binfmt-openat$binfmt-mount$tmpfs-mount$9p_rdma-recvmsg$unix-fchmod-read$FUSE-socket$inet6-write$cgroup_netprio_ifpriomap-write$FUSE_OPEN-write$FUSE_OPEN-setsockopt$SO_BINDTODEVICE-setsockopt$SO_BINDTODEVICE-fcntl$dupfd-setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS-mmap-syz_ublk_setup_io_uring-openat$dir-openat$dir-lsetxattr$trusted_overlay_opaque-lsetxattr$trusted_overlay_opaque-setxattr$trusted_overlay_opaque-syz_io_uring_complete-write$P9_RSTATu-write$P9_RSTATu-signalfd4-ioctl$FS_IOC_GET_ENCRYPTION_PWSALT-inotify_init1-ioctl$F2FS_IOC_COMMIT_ATOMIC_WRITE-syz_open_procfs$userns-close-close-syz_clone-setns detailed listing: executing program 0: perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) (async) perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) r0 = socket$unix(0x1, 0x5, 0x0) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) (async) r1 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280), 0x0, 0x0) mount$9p_rdma(&(0x7f00000000c0), &(0x7f0000000180)='./file0\x00', &(0x7f0000000140), 0x8000e0, 0x0) recvmsg$unix(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) fchmod(r2, 0x40) read$FUSE(r2, &(0x7f0000000400)={0x2020, 0x0, 0x0}, 0x2020) r4 = socket$inet6(0x10, 0x3, 0x0) write$cgroup_netprio_ifpriomap(r4, 0x0, 0x0) write$FUSE_OPEN(r2, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r3, {0x0, 0x4}}, 0x20) (async) write$FUSE_OPEN(r2, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r3, {0x0, 0x4}}, 0x20) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='pimreg1\x00', 0x10) (async) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='pimreg1\x00', 0x10) r5 = fcntl$dupfd(r1, 0x406, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r5, 0x6, 0x16, &(0x7f00000002c0)=[@window={0x3, 0x2, 0x8}, @window={0x3, 0x8, 0x1}, @sack_perm, @sack_perm], 0x4) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000008, 0x110, r0, 0x2d2bf000) r6 = syz_ublk_setup_io_uring(0x12e, &(0x7f0000000080)={0x0, 0x591f, 0x400, 0x3, 0x121}, &(0x7f0000000140)=0x0, &(0x7f0000000340), &(0x7f0000000200)) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x341, 0x64) (async) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x341, 0x64) lsetxattr$trusted_overlay_opaque(&(0x7f0000000300)='./file0\x00', &(0x7f00000000c0), 0x0, 0x34, 0x1) (async) lsetxattr$trusted_overlay_opaque(&(0x7f0000000300)='./file0\x00', &(0x7f00000000c0), 0x0, 0x34, 0x1) setxattr$trusted_overlay_opaque(&(0x7f0000000100)='./file0\x00', &(0x7f00000001c0), 0x0, 0x0, 0x2) r8 = syz_io_uring_complete(r7, 0x0) write$P9_RSTATu(r8, 0x0, 0x0) (async) write$P9_RSTATu(r8, 0x0, 0x0) r9 = signalfd4(0xffffffffffffffff, &(0x7f0000000000), 0x8, 0x800) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r9, 0x5450, 0x0) inotify_init1(0x800) ioctl$F2FS_IOC_COMMIT_ATOMIC_WRITE(r6, 0xf502, 0x0) r10 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r10) (async) close(r10) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002480)="cae8e47f01d78da9ed9e37f2cdbdac67efe580476957b9229578a4998e935a5fc16bd413783d28e5e12a94b69bd79918ed3505c3a4606b9a94e3338c18435fc77e27905aa54f5fbbfbc78d8f2c8eb5d4bb79445d1e0160053c3d9501b784243942154b58df2e92dd55e4e9ae6b02e40a899a272ba26a2f0909ddc88c2ff4970a62f993a7b750c69bf03903d85c3d0681ef1825b173aabf8ce659678a895d912905280935a3b30e49c7b62da25f6a4ecae869ae3180c712aa3fb9537e3b73f6f751bab79b9515b3248144857665043417950bbb25cc935fad38734057acc046ec021b4300b8f4518357802fc63c2ea931251b6a5bc65ed3c04753c96a03e5f717fe2a0773d5f0e56160948a40f0035644e8c35dbb2f4ccdf369401de49f11c4cd1dd17f1bf7efe60ff7bd8491f34ee7aabf6965deabfa26a46e6cf5c3664d66df70733329e1752a577f6fb1fed96ef2c6e176ebf5aec857ef3da83043f5182886478c883bcbcc9a6a93cbe0ced125ea6a9e3b") (async) setns(r10, 0x20000000) program did not crash testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open-perf_event_open-socket$unix-openat$binfmt-openat$binfmt-mount$tmpfs-mount$9p_rdma-recvmsg$unix-fchmod-read$FUSE-socket$inet6-write$cgroup_netprio_ifpriomap-write$FUSE_OPEN-write$FUSE_OPEN-setsockopt$SO_BINDTODEVICE-setsockopt$SO_BINDTODEVICE-fcntl$dupfd-setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS-mmap-syz_ublk_setup_io_uring-openat$dir-openat$dir-lsetxattr$trusted_overlay_opaque-lsetxattr$trusted_overlay_opaque-setxattr$trusted_overlay_opaque-syz_io_uring_complete-write$P9_RSTATu-write$P9_RSTATu-signalfd4-ioctl$FS_IOC_GET_ENCRYPTION_PWSALT-inotify_init1-ioctl$F2FS_IOC_COMMIT_ATOMIC_WRITE-syz_open_procfs$userns-close-close-syz_clone-setns detailed listing: executing program 0: perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) (async) perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) r0 = socket$unix(0x1, 0x5, 0x0) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) (async) r1 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280), 0x0, 0x0) mount$9p_rdma(&(0x7f00000000c0), &(0x7f0000000180)='./file0\x00', &(0x7f0000000140), 0x8000e0, 0x0) recvmsg$unix(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) fchmod(r2, 0x40) read$FUSE(r2, &(0x7f0000000400)={0x2020, 0x0, 0x0}, 0x2020) r4 = socket$inet6(0x10, 0x3, 0x0) write$cgroup_netprio_ifpriomap(r4, 0x0, 0x0) write$FUSE_OPEN(r2, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r3, {0x0, 0x4}}, 0x20) (async) write$FUSE_OPEN(r2, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r3, {0x0, 0x4}}, 0x20) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='pimreg1\x00', 0x10) (async) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='pimreg1\x00', 0x10) r5 = fcntl$dupfd(r1, 0x406, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r5, 0x6, 0x16, &(0x7f00000002c0)=[@window={0x3, 0x2, 0x8}, @window={0x3, 0x8, 0x1}, @sack_perm, @sack_perm], 0x4) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000008, 0x110, r0, 0x2d2bf000) r6 = syz_ublk_setup_io_uring(0x12e, &(0x7f0000000080)={0x0, 0x591f, 0x400, 0x3, 0x121}, &(0x7f0000000140)=0x0, &(0x7f0000000340), &(0x7f0000000200)) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x341, 0x64) (async) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x341, 0x64) lsetxattr$trusted_overlay_opaque(&(0x7f0000000300)='./file0\x00', &(0x7f00000000c0), 0x0, 0x34, 0x1) (async) lsetxattr$trusted_overlay_opaque(&(0x7f0000000300)='./file0\x00', &(0x7f00000000c0), 0x0, 0x34, 0x1) setxattr$trusted_overlay_opaque(&(0x7f0000000100)='./file0\x00', &(0x7f00000001c0), 0x0, 0x0, 0x2) r8 = syz_io_uring_complete(r7, 0x0) write$P9_RSTATu(r8, 0x0, 0x0) (async) write$P9_RSTATu(r8, 0x0, 0x0) r9 = signalfd4(0xffffffffffffffff, &(0x7f0000000000), 0x8, 0x800) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r9, 0x5450, 0x0) inotify_init1(0x800) ioctl$F2FS_IOC_COMMIT_ATOMIC_WRITE(r6, 0xf502, 0x0) r10 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r10) (async) close(r10) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002480)="cae8e47f01d78da9ed9e37f2cdbdac67efe580476957b9229578a4998e935a5fc16bd413783d28e5e12a94b69bd79918ed3505c3a4606b9a94e3338c18435fc77e27905aa54f5fbbfbc78d8f2c8eb5d4bb79445d1e0160053c3d9501b784243942154b58df2e92dd55e4e9ae6b02e40a899a272ba26a2f0909ddc88c2ff4970a62f993a7b750c69bf03903d85c3d0681ef1825b173aabf8ce659678a895d912905280935a3b30e49c7b62da25f6a4ecae869ae3180c712aa3fb9537e3b73f6f751bab79b9515b3248144857665043417950bbb25cc935fad38734057acc046ec021b4300b8f4518357802fc63c2ea931251b6a5bc65ed3c04753c96a03e5f717fe2a0773d5f0e56160948a40f0035644e8c35dbb2f4ccdf369401de49f11c4cd1dd17f1bf7efe60ff7bd8491f34ee7aabf6965deabfa26a46e6cf5c3664d66df70733329e1752a577f6fb1fed96ef2c6e176ebf5aec857ef3da83043f5182886478c883bcbcc9a6a93cbe0ced125ea6a9e3b") setns(r10, 0x20000000) program crashed: panic: Incrementing non-positive count ADDR on nsfs.Inode testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open-perf_event_open-socket$unix-openat$binfmt-openat$binfmt-mount$tmpfs-mount$9p_rdma-recvmsg$unix-fchmod-read$FUSE-socket$inet6-write$cgroup_netprio_ifpriomap-write$FUSE_OPEN-write$FUSE_OPEN-setsockopt$SO_BINDTODEVICE-setsockopt$SO_BINDTODEVICE-fcntl$dupfd-setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS-mmap-syz_ublk_setup_io_uring-openat$dir-openat$dir-lsetxattr$trusted_overlay_opaque-lsetxattr$trusted_overlay_opaque-setxattr$trusted_overlay_opaque-syz_io_uring_complete-write$P9_RSTATu-write$P9_RSTATu-signalfd4-ioctl$FS_IOC_GET_ENCRYPTION_PWSALT-inotify_init1-ioctl$F2FS_IOC_COMMIT_ATOMIC_WRITE-syz_open_procfs$userns-close-syz_clone-setns detailed listing: executing program 0: perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) (async) perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) r0 = socket$unix(0x1, 0x5, 0x0) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) (async) r1 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280), 0x0, 0x0) mount$9p_rdma(&(0x7f00000000c0), &(0x7f0000000180)='./file0\x00', &(0x7f0000000140), 0x8000e0, 0x0) recvmsg$unix(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) fchmod(r2, 0x40) read$FUSE(r2, &(0x7f0000000400)={0x2020, 0x0, 0x0}, 0x2020) r4 = socket$inet6(0x10, 0x3, 0x0) write$cgroup_netprio_ifpriomap(r4, 0x0, 0x0) write$FUSE_OPEN(r2, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r3, {0x0, 0x4}}, 0x20) (async) write$FUSE_OPEN(r2, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r3, {0x0, 0x4}}, 0x20) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='pimreg1\x00', 0x10) (async) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='pimreg1\x00', 0x10) r5 = fcntl$dupfd(r1, 0x406, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r5, 0x6, 0x16, &(0x7f00000002c0)=[@window={0x3, 0x2, 0x8}, @window={0x3, 0x8, 0x1}, @sack_perm, @sack_perm], 0x4) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000008, 0x110, r0, 0x2d2bf000) r6 = syz_ublk_setup_io_uring(0x12e, &(0x7f0000000080)={0x0, 0x591f, 0x400, 0x3, 0x121}, &(0x7f0000000140)=0x0, &(0x7f0000000340), &(0x7f0000000200)) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x341, 0x64) (async) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x341, 0x64) lsetxattr$trusted_overlay_opaque(&(0x7f0000000300)='./file0\x00', &(0x7f00000000c0), 0x0, 0x34, 0x1) (async) lsetxattr$trusted_overlay_opaque(&(0x7f0000000300)='./file0\x00', &(0x7f00000000c0), 0x0, 0x34, 0x1) setxattr$trusted_overlay_opaque(&(0x7f0000000100)='./file0\x00', &(0x7f00000001c0), 0x0, 0x0, 0x2) r8 = syz_io_uring_complete(r7, 0x0) write$P9_RSTATu(r8, 0x0, 0x0) (async) write$P9_RSTATu(r8, 0x0, 0x0) r9 = signalfd4(0xffffffffffffffff, &(0x7f0000000000), 0x8, 0x800) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r9, 0x5450, 0x0) inotify_init1(0x800) ioctl$F2FS_IOC_COMMIT_ATOMIC_WRITE(r6, 0xf502, 0x0) r10 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r10) (async) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002480)="cae8e47f01d78da9ed9e37f2cdbdac67efe580476957b9229578a4998e935a5fc16bd413783d28e5e12a94b69bd79918ed3505c3a4606b9a94e3338c18435fc77e27905aa54f5fbbfbc78d8f2c8eb5d4bb79445d1e0160053c3d9501b784243942154b58df2e92dd55e4e9ae6b02e40a899a272ba26a2f0909ddc88c2ff4970a62f993a7b750c69bf03903d85c3d0681ef1825b173aabf8ce659678a895d912905280935a3b30e49c7b62da25f6a4ecae869ae3180c712aa3fb9537e3b73f6f751bab79b9515b3248144857665043417950bbb25cc935fad38734057acc046ec021b4300b8f4518357802fc63c2ea931251b6a5bc65ed3c04753c96a03e5f717fe2a0773d5f0e56160948a40f0035644e8c35dbb2f4ccdf369401de49f11c4cd1dd17f1bf7efe60ff7bd8491f34ee7aabf6965deabfa26a46e6cf5c3664d66df70733329e1752a577f6fb1fed96ef2c6e176ebf5aec857ef3da83043f5182886478c883bcbcc9a6a93cbe0ced125ea6a9e3b") setns(r10, 0x20000000) program did not crash testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open-perf_event_open-socket$unix-openat$binfmt-openat$binfmt-mount$tmpfs-mount$9p_rdma-recvmsg$unix-fchmod-read$FUSE-socket$inet6-write$cgroup_netprio_ifpriomap-write$FUSE_OPEN-write$FUSE_OPEN-setsockopt$SO_BINDTODEVICE-setsockopt$SO_BINDTODEVICE-fcntl$dupfd-setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS-mmap-syz_ublk_setup_io_uring-openat$dir-openat$dir-lsetxattr$trusted_overlay_opaque-lsetxattr$trusted_overlay_opaque-setxattr$trusted_overlay_opaque-syz_io_uring_complete-write$P9_RSTATu-write$P9_RSTATu-signalfd4-ioctl$FS_IOC_GET_ENCRYPTION_PWSALT-inotify_init1-ioctl$F2FS_IOC_COMMIT_ATOMIC_WRITE-syz_open_procfs$userns-close-syz_clone-setns detailed listing: executing program 0: perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) (async) perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) r0 = socket$unix(0x1, 0x5, 0x0) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) (async) r1 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280), 0x0, 0x0) mount$9p_rdma(&(0x7f00000000c0), &(0x7f0000000180)='./file0\x00', &(0x7f0000000140), 0x8000e0, 0x0) recvmsg$unix(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) fchmod(r2, 0x40) read$FUSE(r2, &(0x7f0000000400)={0x2020, 0x0, 0x0}, 0x2020) r4 = socket$inet6(0x10, 0x3, 0x0) write$cgroup_netprio_ifpriomap(r4, 0x0, 0x0) write$FUSE_OPEN(r2, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r3, {0x0, 0x4}}, 0x20) (async) write$FUSE_OPEN(r2, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r3, {0x0, 0x4}}, 0x20) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='pimreg1\x00', 0x10) (async) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='pimreg1\x00', 0x10) r5 = fcntl$dupfd(r1, 0x406, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r5, 0x6, 0x16, &(0x7f00000002c0)=[@window={0x3, 0x2, 0x8}, @window={0x3, 0x8, 0x1}, @sack_perm, @sack_perm], 0x4) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000008, 0x110, r0, 0x2d2bf000) r6 = syz_ublk_setup_io_uring(0x12e, &(0x7f0000000080)={0x0, 0x591f, 0x400, 0x3, 0x121}, &(0x7f0000000140)=0x0, &(0x7f0000000340), &(0x7f0000000200)) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x341, 0x64) (async) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x341, 0x64) lsetxattr$trusted_overlay_opaque(&(0x7f0000000300)='./file0\x00', &(0x7f00000000c0), 0x0, 0x34, 0x1) (async) lsetxattr$trusted_overlay_opaque(&(0x7f0000000300)='./file0\x00', &(0x7f00000000c0), 0x0, 0x34, 0x1) setxattr$trusted_overlay_opaque(&(0x7f0000000100)='./file0\x00', &(0x7f00000001c0), 0x0, 0x0, 0x2) r8 = syz_io_uring_complete(r7, 0x0) write$P9_RSTATu(r8, 0x0, 0x0) (async) write$P9_RSTATu(r8, 0x0, 0x0) r9 = signalfd4(0xffffffffffffffff, &(0x7f0000000000), 0x8, 0x800) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r9, 0x5450, 0x0) inotify_init1(0x800) ioctl$F2FS_IOC_COMMIT_ATOMIC_WRITE(r6, 0xf502, 0x0) r10 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r10) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002480)="cae8e47f01d78da9ed9e37f2cdbdac67efe580476957b9229578a4998e935a5fc16bd413783d28e5e12a94b69bd79918ed3505c3a4606b9a94e3338c18435fc77e27905aa54f5fbbfbc78d8f2c8eb5d4bb79445d1e0160053c3d9501b784243942154b58df2e92dd55e4e9ae6b02e40a899a272ba26a2f0909ddc88c2ff4970a62f993a7b750c69bf03903d85c3d0681ef1825b173aabf8ce659678a895d912905280935a3b30e49c7b62da25f6a4ecae869ae3180c712aa3fb9537e3b73f6f751bab79b9515b3248144857665043417950bbb25cc935fad38734057acc046ec021b4300b8f4518357802fc63c2ea931251b6a5bc65ed3c04753c96a03e5f717fe2a0773d5f0e56160948a40f0035644e8c35dbb2f4ccdf369401de49f11c4cd1dd17f1bf7efe60ff7bd8491f34ee7aabf6965deabfa26a46e6cf5c3664d66df70733329e1752a577f6fb1fed96ef2c6e176ebf5aec857ef3da83043f5182886478c883bcbcc9a6a93cbe0ced125ea6a9e3b") setns(r10, 0x20000000) program crashed: panic: Incrementing non-positive count ADDR on nsfs.Inode testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open-perf_event_open-socket$unix-openat$binfmt-openat$binfmt-mount$tmpfs-mount$9p_rdma-recvmsg$unix-fchmod-read$FUSE-socket$inet6-write$cgroup_netprio_ifpriomap-write$FUSE_OPEN-write$FUSE_OPEN-setsockopt$SO_BINDTODEVICE-setsockopt$SO_BINDTODEVICE-fcntl$dupfd-setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS-mmap-syz_ublk_setup_io_uring-openat$dir-openat$dir-lsetxattr$trusted_overlay_opaque-lsetxattr$trusted_overlay_opaque-setxattr$trusted_overlay_opaque-syz_io_uring_complete-write$P9_RSTATu-write$P9_RSTATu-signalfd4-ioctl$FS_IOC_GET_ENCRYPTION_PWSALT-inotify_init1-ioctl$F2FS_IOC_COMMIT_ATOMIC_WRITE-close-syz_clone-setns detailed listing: executing program 0: perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) (async) perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) r0 = socket$unix(0x1, 0x5, 0x0) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) (async) r1 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280), 0x0, 0x0) mount$9p_rdma(&(0x7f00000000c0), &(0x7f0000000180)='./file0\x00', &(0x7f0000000140), 0x8000e0, 0x0) recvmsg$unix(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) fchmod(r2, 0x40) read$FUSE(r2, &(0x7f0000000400)={0x2020, 0x0, 0x0}, 0x2020) r4 = socket$inet6(0x10, 0x3, 0x0) write$cgroup_netprio_ifpriomap(r4, 0x0, 0x0) write$FUSE_OPEN(r2, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r3, {0x0, 0x4}}, 0x20) (async) write$FUSE_OPEN(r2, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r3, {0x0, 0x4}}, 0x20) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='pimreg1\x00', 0x10) (async) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='pimreg1\x00', 0x10) r5 = fcntl$dupfd(r1, 0x406, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r5, 0x6, 0x16, &(0x7f00000002c0)=[@window={0x3, 0x2, 0x8}, @window={0x3, 0x8, 0x1}, @sack_perm, @sack_perm], 0x4) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000008, 0x110, r0, 0x2d2bf000) r6 = syz_ublk_setup_io_uring(0x12e, &(0x7f0000000080)={0x0, 0x591f, 0x400, 0x3, 0x121}, &(0x7f0000000140)=0x0, &(0x7f0000000340), &(0x7f0000000200)) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x341, 0x64) (async) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x341, 0x64) lsetxattr$trusted_overlay_opaque(&(0x7f0000000300)='./file0\x00', &(0x7f00000000c0), 0x0, 0x34, 0x1) (async) lsetxattr$trusted_overlay_opaque(&(0x7f0000000300)='./file0\x00', &(0x7f00000000c0), 0x0, 0x34, 0x1) setxattr$trusted_overlay_opaque(&(0x7f0000000100)='./file0\x00', &(0x7f00000001c0), 0x0, 0x0, 0x2) r8 = syz_io_uring_complete(r7, 0x0) write$P9_RSTATu(r8, 0x0, 0x0) (async) write$P9_RSTATu(r8, 0x0, 0x0) r9 = signalfd4(0xffffffffffffffff, &(0x7f0000000000), 0x8, 0x800) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r9, 0x5450, 0x0) inotify_init1(0x800) ioctl$F2FS_IOC_COMMIT_ATOMIC_WRITE(r6, 0xf502, 0x0) close(0xffffffffffffffff) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002480)="cae8e47f01d78da9ed9e37f2cdbdac67efe580476957b9229578a4998e935a5fc16bd413783d28e5e12a94b69bd79918ed3505c3a4606b9a94e3338c18435fc77e27905aa54f5fbbfbc78d8f2c8eb5d4bb79445d1e0160053c3d9501b784243942154b58df2e92dd55e4e9ae6b02e40a899a272ba26a2f0909ddc88c2ff4970a62f993a7b750c69bf03903d85c3d0681ef1825b173aabf8ce659678a895d912905280935a3b30e49c7b62da25f6a4ecae869ae3180c712aa3fb9537e3b73f6f751bab79b9515b3248144857665043417950bbb25cc935fad38734057acc046ec021b4300b8f4518357802fc63c2ea931251b6a5bc65ed3c04753c96a03e5f717fe2a0773d5f0e56160948a40f0035644e8c35dbb2f4ccdf369401de49f11c4cd1dd17f1bf7efe60ff7bd8491f34ee7aabf6965deabfa26a46e6cf5c3664d66df70733329e1752a577f6fb1fed96ef2c6e176ebf5aec857ef3da83043f5182886478c883bcbcc9a6a93cbe0ced125ea6a9e3b") setns(0xffffffffffffffff, 0x20000000) program did not crash testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open-perf_event_open-socket$unix-openat$binfmt-openat$binfmt-mount$tmpfs-mount$9p_rdma-recvmsg$unix-fchmod-read$FUSE-socket$inet6-write$cgroup_netprio_ifpriomap-write$FUSE_OPEN-write$FUSE_OPEN-setsockopt$SO_BINDTODEVICE-setsockopt$SO_BINDTODEVICE-fcntl$dupfd-setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS-mmap-syz_ublk_setup_io_uring-openat$dir-openat$dir-lsetxattr$trusted_overlay_opaque-lsetxattr$trusted_overlay_opaque-setxattr$trusted_overlay_opaque-syz_io_uring_complete-write$P9_RSTATu-write$P9_RSTATu-signalfd4-ioctl$FS_IOC_GET_ENCRYPTION_PWSALT-inotify_init1-syz_open_procfs$userns-close-syz_clone-setns detailed listing: executing program 0: perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) (async) perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) r0 = socket$unix(0x1, 0x5, 0x0) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) (async) r1 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280), 0x0, 0x0) mount$9p_rdma(&(0x7f00000000c0), &(0x7f0000000180)='./file0\x00', &(0x7f0000000140), 0x8000e0, 0x0) recvmsg$unix(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) fchmod(r2, 0x40) read$FUSE(r2, &(0x7f0000000400)={0x2020, 0x0, 0x0}, 0x2020) r4 = socket$inet6(0x10, 0x3, 0x0) write$cgroup_netprio_ifpriomap(r4, 0x0, 0x0) write$FUSE_OPEN(r2, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r3, {0x0, 0x4}}, 0x20) (async) write$FUSE_OPEN(r2, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r3, {0x0, 0x4}}, 0x20) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='pimreg1\x00', 0x10) (async) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='pimreg1\x00', 0x10) r5 = fcntl$dupfd(r1, 0x406, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r5, 0x6, 0x16, &(0x7f00000002c0)=[@window={0x3, 0x2, 0x8}, @window={0x3, 0x8, 0x1}, @sack_perm, @sack_perm], 0x4) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000008, 0x110, r0, 0x2d2bf000) syz_ublk_setup_io_uring(0x12e, &(0x7f0000000080)={0x0, 0x591f, 0x400, 0x3, 0x121}, &(0x7f0000000140)=0x0, &(0x7f0000000340), &(0x7f0000000200)) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x341, 0x64) (async) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x341, 0x64) lsetxattr$trusted_overlay_opaque(&(0x7f0000000300)='./file0\x00', &(0x7f00000000c0), 0x0, 0x34, 0x1) (async) lsetxattr$trusted_overlay_opaque(&(0x7f0000000300)='./file0\x00', &(0x7f00000000c0), 0x0, 0x34, 0x1) setxattr$trusted_overlay_opaque(&(0x7f0000000100)='./file0\x00', &(0x7f00000001c0), 0x0, 0x0, 0x2) r7 = syz_io_uring_complete(r6, 0x0) write$P9_RSTATu(r7, 0x0, 0x0) (async) write$P9_RSTATu(r7, 0x0, 0x0) r8 = signalfd4(0xffffffffffffffff, &(0x7f0000000000), 0x8, 0x800) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r8, 0x5450, 0x0) inotify_init1(0x800) r9 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r9) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002480)="cae8e47f01d78da9ed9e37f2cdbdac67efe580476957b9229578a4998e935a5fc16bd413783d28e5e12a94b69bd79918ed3505c3a4606b9a94e3338c18435fc77e27905aa54f5fbbfbc78d8f2c8eb5d4bb79445d1e0160053c3d9501b784243942154b58df2e92dd55e4e9ae6b02e40a899a272ba26a2f0909ddc88c2ff4970a62f993a7b750c69bf03903d85c3d0681ef1825b173aabf8ce659678a895d912905280935a3b30e49c7b62da25f6a4ecae869ae3180c712aa3fb9537e3b73f6f751bab79b9515b3248144857665043417950bbb25cc935fad38734057acc046ec021b4300b8f4518357802fc63c2ea931251b6a5bc65ed3c04753c96a03e5f717fe2a0773d5f0e56160948a40f0035644e8c35dbb2f4ccdf369401de49f11c4cd1dd17f1bf7efe60ff7bd8491f34ee7aabf6965deabfa26a46e6cf5c3664d66df70733329e1752a577f6fb1fed96ef2c6e176ebf5aec857ef3da83043f5182886478c883bcbcc9a6a93cbe0ced125ea6a9e3b") setns(r9, 0x20000000) program crashed: panic: Incrementing non-positive count ADDR on nsfs.Inode testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open-perf_event_open-socket$unix-openat$binfmt-openat$binfmt-mount$tmpfs-mount$9p_rdma-recvmsg$unix-fchmod-read$FUSE-socket$inet6-write$cgroup_netprio_ifpriomap-write$FUSE_OPEN-write$FUSE_OPEN-setsockopt$SO_BINDTODEVICE-setsockopt$SO_BINDTODEVICE-fcntl$dupfd-setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS-mmap-syz_ublk_setup_io_uring-openat$dir-openat$dir-lsetxattr$trusted_overlay_opaque-lsetxattr$trusted_overlay_opaque-setxattr$trusted_overlay_opaque-syz_io_uring_complete-write$P9_RSTATu-write$P9_RSTATu-signalfd4-ioctl$FS_IOC_GET_ENCRYPTION_PWSALT-syz_open_procfs$userns-close-syz_clone-setns detailed listing: executing program 0: perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) (async) perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) r0 = socket$unix(0x1, 0x5, 0x0) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) (async) r1 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280), 0x0, 0x0) mount$9p_rdma(&(0x7f00000000c0), &(0x7f0000000180)='./file0\x00', &(0x7f0000000140), 0x8000e0, 0x0) recvmsg$unix(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) fchmod(r2, 0x40) read$FUSE(r2, &(0x7f0000000400)={0x2020, 0x0, 0x0}, 0x2020) r4 = socket$inet6(0x10, 0x3, 0x0) write$cgroup_netprio_ifpriomap(r4, 0x0, 0x0) write$FUSE_OPEN(r2, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r3, {0x0, 0x4}}, 0x20) (async) write$FUSE_OPEN(r2, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r3, {0x0, 0x4}}, 0x20) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='pimreg1\x00', 0x10) (async) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='pimreg1\x00', 0x10) r5 = fcntl$dupfd(r1, 0x406, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r5, 0x6, 0x16, &(0x7f00000002c0)=[@window={0x3, 0x2, 0x8}, @window={0x3, 0x8, 0x1}, @sack_perm, @sack_perm], 0x4) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000008, 0x110, r0, 0x2d2bf000) syz_ublk_setup_io_uring(0x12e, &(0x7f0000000080)={0x0, 0x591f, 0x400, 0x3, 0x121}, &(0x7f0000000140)=0x0, &(0x7f0000000340), &(0x7f0000000200)) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x341, 0x64) (async) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x341, 0x64) lsetxattr$trusted_overlay_opaque(&(0x7f0000000300)='./file0\x00', &(0x7f00000000c0), 0x0, 0x34, 0x1) (async) lsetxattr$trusted_overlay_opaque(&(0x7f0000000300)='./file0\x00', &(0x7f00000000c0), 0x0, 0x34, 0x1) setxattr$trusted_overlay_opaque(&(0x7f0000000100)='./file0\x00', &(0x7f00000001c0), 0x0, 0x0, 0x2) r7 = syz_io_uring_complete(r6, 0x0) write$P9_RSTATu(r7, 0x0, 0x0) (async) write$P9_RSTATu(r7, 0x0, 0x0) r8 = signalfd4(0xffffffffffffffff, &(0x7f0000000000), 0x8, 0x800) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r8, 0x5450, 0x0) r9 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r9) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002480)="cae8e47f01d78da9ed9e37f2cdbdac67efe580476957b9229578a4998e935a5fc16bd413783d28e5e12a94b69bd79918ed3505c3a4606b9a94e3338c18435fc77e27905aa54f5fbbfbc78d8f2c8eb5d4bb79445d1e0160053c3d9501b784243942154b58df2e92dd55e4e9ae6b02e40a899a272ba26a2f0909ddc88c2ff4970a62f993a7b750c69bf03903d85c3d0681ef1825b173aabf8ce659678a895d912905280935a3b30e49c7b62da25f6a4ecae869ae3180c712aa3fb9537e3b73f6f751bab79b9515b3248144857665043417950bbb25cc935fad38734057acc046ec021b4300b8f4518357802fc63c2ea931251b6a5bc65ed3c04753c96a03e5f717fe2a0773d5f0e56160948a40f0035644e8c35dbb2f4ccdf369401de49f11c4cd1dd17f1bf7efe60ff7bd8491f34ee7aabf6965deabfa26a46e6cf5c3664d66df70733329e1752a577f6fb1fed96ef2c6e176ebf5aec857ef3da83043f5182886478c883bcbcc9a6a93cbe0ced125ea6a9e3b") setns(r9, 0x20000000) program crashed: panic: Incrementing non-positive count ADDR on nsfs.Inode testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open-perf_event_open-socket$unix-openat$binfmt-openat$binfmt-mount$tmpfs-mount$9p_rdma-recvmsg$unix-fchmod-read$FUSE-socket$inet6-write$cgroup_netprio_ifpriomap-write$FUSE_OPEN-write$FUSE_OPEN-setsockopt$SO_BINDTODEVICE-setsockopt$SO_BINDTODEVICE-fcntl$dupfd-setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS-mmap-syz_ublk_setup_io_uring-openat$dir-openat$dir-lsetxattr$trusted_overlay_opaque-lsetxattr$trusted_overlay_opaque-setxattr$trusted_overlay_opaque-syz_io_uring_complete-write$P9_RSTATu-write$P9_RSTATu-signalfd4-syz_open_procfs$userns-close-syz_clone-setns detailed listing: executing program 0: perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) (async) perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) r0 = socket$unix(0x1, 0x5, 0x0) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) (async) r1 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280), 0x0, 0x0) mount$9p_rdma(&(0x7f00000000c0), &(0x7f0000000180)='./file0\x00', &(0x7f0000000140), 0x8000e0, 0x0) recvmsg$unix(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) fchmod(r2, 0x40) read$FUSE(r2, &(0x7f0000000400)={0x2020, 0x0, 0x0}, 0x2020) r4 = socket$inet6(0x10, 0x3, 0x0) write$cgroup_netprio_ifpriomap(r4, 0x0, 0x0) write$FUSE_OPEN(r2, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r3, {0x0, 0x4}}, 0x20) (async) write$FUSE_OPEN(r2, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r3, {0x0, 0x4}}, 0x20) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='pimreg1\x00', 0x10) (async) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='pimreg1\x00', 0x10) r5 = fcntl$dupfd(r1, 0x406, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r5, 0x6, 0x16, &(0x7f00000002c0)=[@window={0x3, 0x2, 0x8}, @window={0x3, 0x8, 0x1}, @sack_perm, @sack_perm], 0x4) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000008, 0x110, r0, 0x2d2bf000) syz_ublk_setup_io_uring(0x12e, &(0x7f0000000080)={0x0, 0x591f, 0x400, 0x3, 0x121}, &(0x7f0000000140)=0x0, &(0x7f0000000340), &(0x7f0000000200)) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x341, 0x64) (async) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x341, 0x64) lsetxattr$trusted_overlay_opaque(&(0x7f0000000300)='./file0\x00', &(0x7f00000000c0), 0x0, 0x34, 0x1) (async) lsetxattr$trusted_overlay_opaque(&(0x7f0000000300)='./file0\x00', &(0x7f00000000c0), 0x0, 0x34, 0x1) setxattr$trusted_overlay_opaque(&(0x7f0000000100)='./file0\x00', &(0x7f00000001c0), 0x0, 0x0, 0x2) r7 = syz_io_uring_complete(r6, 0x0) write$P9_RSTATu(r7, 0x0, 0x0) (async) write$P9_RSTATu(r7, 0x0, 0x0) signalfd4(0xffffffffffffffff, &(0x7f0000000000), 0x8, 0x800) r8 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r8) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002480)="cae8e47f01d78da9ed9e37f2cdbdac67efe580476957b9229578a4998e935a5fc16bd413783d28e5e12a94b69bd79918ed3505c3a4606b9a94e3338c18435fc77e27905aa54f5fbbfbc78d8f2c8eb5d4bb79445d1e0160053c3d9501b784243942154b58df2e92dd55e4e9ae6b02e40a899a272ba26a2f0909ddc88c2ff4970a62f993a7b750c69bf03903d85c3d0681ef1825b173aabf8ce659678a895d912905280935a3b30e49c7b62da25f6a4ecae869ae3180c712aa3fb9537e3b73f6f751bab79b9515b3248144857665043417950bbb25cc935fad38734057acc046ec021b4300b8f4518357802fc63c2ea931251b6a5bc65ed3c04753c96a03e5f717fe2a0773d5f0e56160948a40f0035644e8c35dbb2f4ccdf369401de49f11c4cd1dd17f1bf7efe60ff7bd8491f34ee7aabf6965deabfa26a46e6cf5c3664d66df70733329e1752a577f6fb1fed96ef2c6e176ebf5aec857ef3da83043f5182886478c883bcbcc9a6a93cbe0ced125ea6a9e3b") setns(r8, 0x20000000) program crashed: panic: Incrementing non-positive count ADDR on nsfs.Inode testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open-perf_event_open-socket$unix-openat$binfmt-openat$binfmt-mount$tmpfs-mount$9p_rdma-recvmsg$unix-fchmod-read$FUSE-socket$inet6-write$cgroup_netprio_ifpriomap-write$FUSE_OPEN-write$FUSE_OPEN-setsockopt$SO_BINDTODEVICE-setsockopt$SO_BINDTODEVICE-fcntl$dupfd-setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS-mmap-syz_ublk_setup_io_uring-openat$dir-openat$dir-lsetxattr$trusted_overlay_opaque-lsetxattr$trusted_overlay_opaque-setxattr$trusted_overlay_opaque-syz_io_uring_complete-write$P9_RSTATu-write$P9_RSTATu-syz_open_procfs$userns-close-syz_clone-setns detailed listing: executing program 0: perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) (async) perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) r0 = socket$unix(0x1, 0x5, 0x0) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) (async) r1 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280), 0x0, 0x0) mount$9p_rdma(&(0x7f00000000c0), &(0x7f0000000180)='./file0\x00', &(0x7f0000000140), 0x8000e0, 0x0) recvmsg$unix(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) fchmod(r2, 0x40) read$FUSE(r2, &(0x7f0000000400)={0x2020, 0x0, 0x0}, 0x2020) r4 = socket$inet6(0x10, 0x3, 0x0) write$cgroup_netprio_ifpriomap(r4, 0x0, 0x0) write$FUSE_OPEN(r2, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r3, {0x0, 0x4}}, 0x20) (async) write$FUSE_OPEN(r2, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r3, {0x0, 0x4}}, 0x20) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='pimreg1\x00', 0x10) (async) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='pimreg1\x00', 0x10) r5 = fcntl$dupfd(r1, 0x406, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r5, 0x6, 0x16, &(0x7f00000002c0)=[@window={0x3, 0x2, 0x8}, @window={0x3, 0x8, 0x1}, @sack_perm, @sack_perm], 0x4) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000008, 0x110, r0, 0x2d2bf000) syz_ublk_setup_io_uring(0x12e, &(0x7f0000000080)={0x0, 0x591f, 0x400, 0x3, 0x121}, &(0x7f0000000140)=0x0, &(0x7f0000000340), &(0x7f0000000200)) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x341, 0x64) (async) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x341, 0x64) lsetxattr$trusted_overlay_opaque(&(0x7f0000000300)='./file0\x00', &(0x7f00000000c0), 0x0, 0x34, 0x1) (async) lsetxattr$trusted_overlay_opaque(&(0x7f0000000300)='./file0\x00', &(0x7f00000000c0), 0x0, 0x34, 0x1) setxattr$trusted_overlay_opaque(&(0x7f0000000100)='./file0\x00', &(0x7f00000001c0), 0x0, 0x0, 0x2) r7 = syz_io_uring_complete(r6, 0x0) write$P9_RSTATu(r7, 0x0, 0x0) (async) write$P9_RSTATu(r7, 0x0, 0x0) r8 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r8) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002480)="cae8e47f01d78da9ed9e37f2cdbdac67efe580476957b9229578a4998e935a5fc16bd413783d28e5e12a94b69bd79918ed3505c3a4606b9a94e3338c18435fc77e27905aa54f5fbbfbc78d8f2c8eb5d4bb79445d1e0160053c3d9501b784243942154b58df2e92dd55e4e9ae6b02e40a899a272ba26a2f0909ddc88c2ff4970a62f993a7b750c69bf03903d85c3d0681ef1825b173aabf8ce659678a895d912905280935a3b30e49c7b62da25f6a4ecae869ae3180c712aa3fb9537e3b73f6f751bab79b9515b3248144857665043417950bbb25cc935fad38734057acc046ec021b4300b8f4518357802fc63c2ea931251b6a5bc65ed3c04753c96a03e5f717fe2a0773d5f0e56160948a40f0035644e8c35dbb2f4ccdf369401de49f11c4cd1dd17f1bf7efe60ff7bd8491f34ee7aabf6965deabfa26a46e6cf5c3664d66df70733329e1752a577f6fb1fed96ef2c6e176ebf5aec857ef3da83043f5182886478c883bcbcc9a6a93cbe0ced125ea6a9e3b") setns(r8, 0x20000000) program crashed: panic: Incrementing non-positive count ADDR on nsfs.Inode testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open-perf_event_open-socket$unix-openat$binfmt-openat$binfmt-mount$tmpfs-mount$9p_rdma-recvmsg$unix-fchmod-read$FUSE-socket$inet6-write$cgroup_netprio_ifpriomap-write$FUSE_OPEN-write$FUSE_OPEN-setsockopt$SO_BINDTODEVICE-setsockopt$SO_BINDTODEVICE-fcntl$dupfd-setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS-mmap-syz_ublk_setup_io_uring-openat$dir-openat$dir-lsetxattr$trusted_overlay_opaque-lsetxattr$trusted_overlay_opaque-setxattr$trusted_overlay_opaque-syz_io_uring_complete-write$P9_RSTATu-syz_open_procfs$userns-close-syz_clone-setns detailed listing: executing program 0: perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) (async) perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) r0 = socket$unix(0x1, 0x5, 0x0) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) (async) r1 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280), 0x0, 0x0) mount$9p_rdma(&(0x7f00000000c0), &(0x7f0000000180)='./file0\x00', &(0x7f0000000140), 0x8000e0, 0x0) recvmsg$unix(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) fchmod(r2, 0x40) read$FUSE(r2, &(0x7f0000000400)={0x2020, 0x0, 0x0}, 0x2020) r4 = socket$inet6(0x10, 0x3, 0x0) write$cgroup_netprio_ifpriomap(r4, 0x0, 0x0) write$FUSE_OPEN(r2, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r3, {0x0, 0x4}}, 0x20) (async) write$FUSE_OPEN(r2, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r3, {0x0, 0x4}}, 0x20) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='pimreg1\x00', 0x10) (async) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='pimreg1\x00', 0x10) r5 = fcntl$dupfd(r1, 0x406, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r5, 0x6, 0x16, &(0x7f00000002c0)=[@window={0x3, 0x2, 0x8}, @window={0x3, 0x8, 0x1}, @sack_perm, @sack_perm], 0x4) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000008, 0x110, r0, 0x2d2bf000) syz_ublk_setup_io_uring(0x12e, &(0x7f0000000080)={0x0, 0x591f, 0x400, 0x3, 0x121}, &(0x7f0000000140)=0x0, &(0x7f0000000340), &(0x7f0000000200)) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x341, 0x64) (async) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x341, 0x64) lsetxattr$trusted_overlay_opaque(&(0x7f0000000300)='./file0\x00', &(0x7f00000000c0), 0x0, 0x34, 0x1) (async) lsetxattr$trusted_overlay_opaque(&(0x7f0000000300)='./file0\x00', &(0x7f00000000c0), 0x0, 0x34, 0x1) setxattr$trusted_overlay_opaque(&(0x7f0000000100)='./file0\x00', &(0x7f00000001c0), 0x0, 0x0, 0x2) r7 = syz_io_uring_complete(r6, 0x0) write$P9_RSTATu(r7, 0x0, 0x0) (async) r8 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r8) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002480)="cae8e47f01d78da9ed9e37f2cdbdac67efe580476957b9229578a4998e935a5fc16bd413783d28e5e12a94b69bd79918ed3505c3a4606b9a94e3338c18435fc77e27905aa54f5fbbfbc78d8f2c8eb5d4bb79445d1e0160053c3d9501b784243942154b58df2e92dd55e4e9ae6b02e40a899a272ba26a2f0909ddc88c2ff4970a62f993a7b750c69bf03903d85c3d0681ef1825b173aabf8ce659678a895d912905280935a3b30e49c7b62da25f6a4ecae869ae3180c712aa3fb9537e3b73f6f751bab79b9515b3248144857665043417950bbb25cc935fad38734057acc046ec021b4300b8f4518357802fc63c2ea931251b6a5bc65ed3c04753c96a03e5f717fe2a0773d5f0e56160948a40f0035644e8c35dbb2f4ccdf369401de49f11c4cd1dd17f1bf7efe60ff7bd8491f34ee7aabf6965deabfa26a46e6cf5c3664d66df70733329e1752a577f6fb1fed96ef2c6e176ebf5aec857ef3da83043f5182886478c883bcbcc9a6a93cbe0ced125ea6a9e3b") setns(r8, 0x20000000) program crashed: panic: Incrementing non-positive count ADDR on nsfs.Inode testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open-perf_event_open-socket$unix-openat$binfmt-openat$binfmt-mount$tmpfs-mount$9p_rdma-recvmsg$unix-fchmod-read$FUSE-socket$inet6-write$cgroup_netprio_ifpriomap-write$FUSE_OPEN-write$FUSE_OPEN-setsockopt$SO_BINDTODEVICE-setsockopt$SO_BINDTODEVICE-fcntl$dupfd-setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS-mmap-syz_ublk_setup_io_uring-openat$dir-openat$dir-lsetxattr$trusted_overlay_opaque-lsetxattr$trusted_overlay_opaque-setxattr$trusted_overlay_opaque-syz_io_uring_complete-syz_open_procfs$userns-close-syz_clone-setns detailed listing: executing program 0: perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) (async) perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) r0 = socket$unix(0x1, 0x5, 0x0) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) (async) r1 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280), 0x0, 0x0) mount$9p_rdma(&(0x7f00000000c0), &(0x7f0000000180)='./file0\x00', &(0x7f0000000140), 0x8000e0, 0x0) recvmsg$unix(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) fchmod(r2, 0x40) read$FUSE(r2, &(0x7f0000000400)={0x2020, 0x0, 0x0}, 0x2020) r4 = socket$inet6(0x10, 0x3, 0x0) write$cgroup_netprio_ifpriomap(r4, 0x0, 0x0) write$FUSE_OPEN(r2, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r3, {0x0, 0x4}}, 0x20) (async) write$FUSE_OPEN(r2, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r3, {0x0, 0x4}}, 0x20) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='pimreg1\x00', 0x10) (async) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='pimreg1\x00', 0x10) r5 = fcntl$dupfd(r1, 0x406, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r5, 0x6, 0x16, &(0x7f00000002c0)=[@window={0x3, 0x2, 0x8}, @window={0x3, 0x8, 0x1}, @sack_perm, @sack_perm], 0x4) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000008, 0x110, r0, 0x2d2bf000) syz_ublk_setup_io_uring(0x12e, &(0x7f0000000080)={0x0, 0x591f, 0x400, 0x3, 0x121}, &(0x7f0000000140)=0x0, &(0x7f0000000340), &(0x7f0000000200)) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x341, 0x64) (async) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x341, 0x64) lsetxattr$trusted_overlay_opaque(&(0x7f0000000300)='./file0\x00', &(0x7f00000000c0), 0x0, 0x34, 0x1) (async) lsetxattr$trusted_overlay_opaque(&(0x7f0000000300)='./file0\x00', &(0x7f00000000c0), 0x0, 0x34, 0x1) setxattr$trusted_overlay_opaque(&(0x7f0000000100)='./file0\x00', &(0x7f00000001c0), 0x0, 0x0, 0x2) syz_io_uring_complete(r6, 0x0) r7 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r7) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002480)="cae8e47f01d78da9ed9e37f2cdbdac67efe580476957b9229578a4998e935a5fc16bd413783d28e5e12a94b69bd79918ed3505c3a4606b9a94e3338c18435fc77e27905aa54f5fbbfbc78d8f2c8eb5d4bb79445d1e0160053c3d9501b784243942154b58df2e92dd55e4e9ae6b02e40a899a272ba26a2f0909ddc88c2ff4970a62f993a7b750c69bf03903d85c3d0681ef1825b173aabf8ce659678a895d912905280935a3b30e49c7b62da25f6a4ecae869ae3180c712aa3fb9537e3b73f6f751bab79b9515b3248144857665043417950bbb25cc935fad38734057acc046ec021b4300b8f4518357802fc63c2ea931251b6a5bc65ed3c04753c96a03e5f717fe2a0773d5f0e56160948a40f0035644e8c35dbb2f4ccdf369401de49f11c4cd1dd17f1bf7efe60ff7bd8491f34ee7aabf6965deabfa26a46e6cf5c3664d66df70733329e1752a577f6fb1fed96ef2c6e176ebf5aec857ef3da83043f5182886478c883bcbcc9a6a93cbe0ced125ea6a9e3b") setns(r7, 0x20000000) program did not crash testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open-perf_event_open-socket$unix-openat$binfmt-openat$binfmt-mount$tmpfs-mount$9p_rdma-recvmsg$unix-fchmod-read$FUSE-socket$inet6-write$cgroup_netprio_ifpriomap-write$FUSE_OPEN-write$FUSE_OPEN-setsockopt$SO_BINDTODEVICE-setsockopt$SO_BINDTODEVICE-fcntl$dupfd-setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS-mmap-syz_ublk_setup_io_uring-openat$dir-openat$dir-lsetxattr$trusted_overlay_opaque-lsetxattr$trusted_overlay_opaque-setxattr$trusted_overlay_opaque-write$P9_RSTATu-syz_open_procfs$userns-close-syz_clone-setns detailed listing: executing program 0: perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) (async) perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) r0 = socket$unix(0x1, 0x5, 0x0) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) (async) r1 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280), 0x0, 0x0) mount$9p_rdma(&(0x7f00000000c0), &(0x7f0000000180)='./file0\x00', &(0x7f0000000140), 0x8000e0, 0x0) recvmsg$unix(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) fchmod(r2, 0x40) read$FUSE(r2, &(0x7f0000000400)={0x2020, 0x0, 0x0}, 0x2020) r4 = socket$inet6(0x10, 0x3, 0x0) write$cgroup_netprio_ifpriomap(r4, 0x0, 0x0) write$FUSE_OPEN(r2, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r3, {0x0, 0x4}}, 0x20) (async) write$FUSE_OPEN(r2, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r3, {0x0, 0x4}}, 0x20) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='pimreg1\x00', 0x10) (async) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='pimreg1\x00', 0x10) r5 = fcntl$dupfd(r1, 0x406, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r5, 0x6, 0x16, &(0x7f00000002c0)=[@window={0x3, 0x2, 0x8}, @window={0x3, 0x8, 0x1}, @sack_perm, @sack_perm], 0x4) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000008, 0x110, r0, 0x2d2bf000) syz_ublk_setup_io_uring(0x12e, &(0x7f0000000080)={0x0, 0x591f, 0x400, 0x3, 0x121}, &(0x7f0000000140), &(0x7f0000000340), &(0x7f0000000200)) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x341, 0x64) (async) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x341, 0x64) lsetxattr$trusted_overlay_opaque(&(0x7f0000000300)='./file0\x00', &(0x7f00000000c0), 0x0, 0x34, 0x1) (async) lsetxattr$trusted_overlay_opaque(&(0x7f0000000300)='./file0\x00', &(0x7f00000000c0), 0x0, 0x34, 0x1) setxattr$trusted_overlay_opaque(&(0x7f0000000100)='./file0\x00', &(0x7f00000001c0), 0x0, 0x0, 0x2) write$P9_RSTATu(0xffffffffffffffff, 0x0, 0x0) (async) r6 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r6) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002480)="cae8e47f01d78da9ed9e37f2cdbdac67efe580476957b9229578a4998e935a5fc16bd413783d28e5e12a94b69bd79918ed3505c3a4606b9a94e3338c18435fc77e27905aa54f5fbbfbc78d8f2c8eb5d4bb79445d1e0160053c3d9501b784243942154b58df2e92dd55e4e9ae6b02e40a899a272ba26a2f0909ddc88c2ff4970a62f993a7b750c69bf03903d85c3d0681ef1825b173aabf8ce659678a895d912905280935a3b30e49c7b62da25f6a4ecae869ae3180c712aa3fb9537e3b73f6f751bab79b9515b3248144857665043417950bbb25cc935fad38734057acc046ec021b4300b8f4518357802fc63c2ea931251b6a5bc65ed3c04753c96a03e5f717fe2a0773d5f0e56160948a40f0035644e8c35dbb2f4ccdf369401de49f11c4cd1dd17f1bf7efe60ff7bd8491f34ee7aabf6965deabfa26a46e6cf5c3664d66df70733329e1752a577f6fb1fed96ef2c6e176ebf5aec857ef3da83043f5182886478c883bcbcc9a6a93cbe0ced125ea6a9e3b") setns(r6, 0x20000000) program crashed: panic: Incrementing non-positive count ADDR on nsfs.Inode testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open-perf_event_open-socket$unix-openat$binfmt-openat$binfmt-mount$tmpfs-mount$9p_rdma-recvmsg$unix-fchmod-read$FUSE-socket$inet6-write$cgroup_netprio_ifpriomap-write$FUSE_OPEN-write$FUSE_OPEN-setsockopt$SO_BINDTODEVICE-setsockopt$SO_BINDTODEVICE-fcntl$dupfd-setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS-mmap-syz_ublk_setup_io_uring-openat$dir-openat$dir-lsetxattr$trusted_overlay_opaque-lsetxattr$trusted_overlay_opaque-write$P9_RSTATu-syz_open_procfs$userns-close-syz_clone-setns detailed listing: executing program 0: perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) (async) perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) r0 = socket$unix(0x1, 0x5, 0x0) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) (async) r1 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280), 0x0, 0x0) mount$9p_rdma(&(0x7f00000000c0), &(0x7f0000000180)='./file0\x00', &(0x7f0000000140), 0x8000e0, 0x0) recvmsg$unix(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) fchmod(r2, 0x40) read$FUSE(r2, &(0x7f0000000400)={0x2020, 0x0, 0x0}, 0x2020) r4 = socket$inet6(0x10, 0x3, 0x0) write$cgroup_netprio_ifpriomap(r4, 0x0, 0x0) write$FUSE_OPEN(r2, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r3, {0x0, 0x4}}, 0x20) (async) write$FUSE_OPEN(r2, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r3, {0x0, 0x4}}, 0x20) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='pimreg1\x00', 0x10) (async) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='pimreg1\x00', 0x10) r5 = fcntl$dupfd(r1, 0x406, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r5, 0x6, 0x16, &(0x7f00000002c0)=[@window={0x3, 0x2, 0x8}, @window={0x3, 0x8, 0x1}, @sack_perm, @sack_perm], 0x4) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000008, 0x110, r0, 0x2d2bf000) syz_ublk_setup_io_uring(0x12e, &(0x7f0000000080)={0x0, 0x591f, 0x400, 0x3, 0x121}, &(0x7f0000000140), &(0x7f0000000340), &(0x7f0000000200)) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x341, 0x64) (async) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x341, 0x64) lsetxattr$trusted_overlay_opaque(&(0x7f0000000300)='./file0\x00', &(0x7f00000000c0), 0x0, 0x34, 0x1) (async) lsetxattr$trusted_overlay_opaque(&(0x7f0000000300)='./file0\x00', &(0x7f00000000c0), 0x0, 0x34, 0x1) write$P9_RSTATu(0xffffffffffffffff, 0x0, 0x0) (async) r6 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r6) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002480)="cae8e47f01d78da9ed9e37f2cdbdac67efe580476957b9229578a4998e935a5fc16bd413783d28e5e12a94b69bd79918ed3505c3a4606b9a94e3338c18435fc77e27905aa54f5fbbfbc78d8f2c8eb5d4bb79445d1e0160053c3d9501b784243942154b58df2e92dd55e4e9ae6b02e40a899a272ba26a2f0909ddc88c2ff4970a62f993a7b750c69bf03903d85c3d0681ef1825b173aabf8ce659678a895d912905280935a3b30e49c7b62da25f6a4ecae869ae3180c712aa3fb9537e3b73f6f751bab79b9515b3248144857665043417950bbb25cc935fad38734057acc046ec021b4300b8f4518357802fc63c2ea931251b6a5bc65ed3c04753c96a03e5f717fe2a0773d5f0e56160948a40f0035644e8c35dbb2f4ccdf369401de49f11c4cd1dd17f1bf7efe60ff7bd8491f34ee7aabf6965deabfa26a46e6cf5c3664d66df70733329e1752a577f6fb1fed96ef2c6e176ebf5aec857ef3da83043f5182886478c883bcbcc9a6a93cbe0ced125ea6a9e3b") setns(r6, 0x20000000) program crashed: panic: Incrementing non-positive count ADDR on nsfs.Inode testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open-perf_event_open-socket$unix-openat$binfmt-openat$binfmt-mount$tmpfs-mount$9p_rdma-recvmsg$unix-fchmod-read$FUSE-socket$inet6-write$cgroup_netprio_ifpriomap-write$FUSE_OPEN-write$FUSE_OPEN-setsockopt$SO_BINDTODEVICE-setsockopt$SO_BINDTODEVICE-fcntl$dupfd-setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS-mmap-syz_ublk_setup_io_uring-openat$dir-openat$dir-lsetxattr$trusted_overlay_opaque-write$P9_RSTATu-syz_open_procfs$userns-close-syz_clone-setns detailed listing: executing program 0: perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) (async) perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) r0 = socket$unix(0x1, 0x5, 0x0) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) (async) r1 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280), 0x0, 0x0) mount$9p_rdma(&(0x7f00000000c0), &(0x7f0000000180)='./file0\x00', &(0x7f0000000140), 0x8000e0, 0x0) recvmsg$unix(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) fchmod(r2, 0x40) read$FUSE(r2, &(0x7f0000000400)={0x2020, 0x0, 0x0}, 0x2020) r4 = socket$inet6(0x10, 0x3, 0x0) write$cgroup_netprio_ifpriomap(r4, 0x0, 0x0) write$FUSE_OPEN(r2, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r3, {0x0, 0x4}}, 0x20) (async) write$FUSE_OPEN(r2, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r3, {0x0, 0x4}}, 0x20) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='pimreg1\x00', 0x10) (async) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='pimreg1\x00', 0x10) r5 = fcntl$dupfd(r1, 0x406, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r5, 0x6, 0x16, &(0x7f00000002c0)=[@window={0x3, 0x2, 0x8}, @window={0x3, 0x8, 0x1}, @sack_perm, @sack_perm], 0x4) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000008, 0x110, r0, 0x2d2bf000) syz_ublk_setup_io_uring(0x12e, &(0x7f0000000080)={0x0, 0x591f, 0x400, 0x3, 0x121}, &(0x7f0000000140), &(0x7f0000000340), &(0x7f0000000200)) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x341, 0x64) (async) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x341, 0x64) lsetxattr$trusted_overlay_opaque(&(0x7f0000000300)='./file0\x00', &(0x7f00000000c0), 0x0, 0x34, 0x1) (async) write$P9_RSTATu(0xffffffffffffffff, 0x0, 0x0) (async) r6 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r6) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002480)="cae8e47f01d78da9ed9e37f2cdbdac67efe580476957b9229578a4998e935a5fc16bd413783d28e5e12a94b69bd79918ed3505c3a4606b9a94e3338c18435fc77e27905aa54f5fbbfbc78d8f2c8eb5d4bb79445d1e0160053c3d9501b784243942154b58df2e92dd55e4e9ae6b02e40a899a272ba26a2f0909ddc88c2ff4970a62f993a7b750c69bf03903d85c3d0681ef1825b173aabf8ce659678a895d912905280935a3b30e49c7b62da25f6a4ecae869ae3180c712aa3fb9537e3b73f6f751bab79b9515b3248144857665043417950bbb25cc935fad38734057acc046ec021b4300b8f4518357802fc63c2ea931251b6a5bc65ed3c04753c96a03e5f717fe2a0773d5f0e56160948a40f0035644e8c35dbb2f4ccdf369401de49f11c4cd1dd17f1bf7efe60ff7bd8491f34ee7aabf6965deabfa26a46e6cf5c3664d66df70733329e1752a577f6fb1fed96ef2c6e176ebf5aec857ef3da83043f5182886478c883bcbcc9a6a93cbe0ced125ea6a9e3b") setns(r6, 0x20000000) program crashed: panic: Incrementing non-positive count ADDR on nsfs.Inode testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open-perf_event_open-socket$unix-openat$binfmt-openat$binfmt-mount$tmpfs-mount$9p_rdma-recvmsg$unix-fchmod-read$FUSE-socket$inet6-write$cgroup_netprio_ifpriomap-write$FUSE_OPEN-write$FUSE_OPEN-setsockopt$SO_BINDTODEVICE-setsockopt$SO_BINDTODEVICE-fcntl$dupfd-setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS-mmap-syz_ublk_setup_io_uring-openat$dir-openat$dir-write$P9_RSTATu-syz_open_procfs$userns-close-syz_clone-setns detailed listing: executing program 0: perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) (async) perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) r0 = socket$unix(0x1, 0x5, 0x0) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) (async) r1 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280), 0x0, 0x0) mount$9p_rdma(&(0x7f00000000c0), &(0x7f0000000180)='./file0\x00', &(0x7f0000000140), 0x8000e0, 0x0) recvmsg$unix(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) fchmod(r2, 0x40) read$FUSE(r2, &(0x7f0000000400)={0x2020, 0x0, 0x0}, 0x2020) r4 = socket$inet6(0x10, 0x3, 0x0) write$cgroup_netprio_ifpriomap(r4, 0x0, 0x0) write$FUSE_OPEN(r2, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r3, {0x0, 0x4}}, 0x20) (async) write$FUSE_OPEN(r2, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r3, {0x0, 0x4}}, 0x20) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='pimreg1\x00', 0x10) (async) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='pimreg1\x00', 0x10) r5 = fcntl$dupfd(r1, 0x406, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r5, 0x6, 0x16, &(0x7f00000002c0)=[@window={0x3, 0x2, 0x8}, @window={0x3, 0x8, 0x1}, @sack_perm, @sack_perm], 0x4) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000008, 0x110, r0, 0x2d2bf000) syz_ublk_setup_io_uring(0x12e, &(0x7f0000000080)={0x0, 0x591f, 0x400, 0x3, 0x121}, &(0x7f0000000140), &(0x7f0000000340), &(0x7f0000000200)) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x341, 0x64) (async) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x341, 0x64) write$P9_RSTATu(0xffffffffffffffff, 0x0, 0x0) (async) r6 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r6) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002480)="cae8e47f01d78da9ed9e37f2cdbdac67efe580476957b9229578a4998e935a5fc16bd413783d28e5e12a94b69bd79918ed3505c3a4606b9a94e3338c18435fc77e27905aa54f5fbbfbc78d8f2c8eb5d4bb79445d1e0160053c3d9501b784243942154b58df2e92dd55e4e9ae6b02e40a899a272ba26a2f0909ddc88c2ff4970a62f993a7b750c69bf03903d85c3d0681ef1825b173aabf8ce659678a895d912905280935a3b30e49c7b62da25f6a4ecae869ae3180c712aa3fb9537e3b73f6f751bab79b9515b3248144857665043417950bbb25cc935fad38734057acc046ec021b4300b8f4518357802fc63c2ea931251b6a5bc65ed3c04753c96a03e5f717fe2a0773d5f0e56160948a40f0035644e8c35dbb2f4ccdf369401de49f11c4cd1dd17f1bf7efe60ff7bd8491f34ee7aabf6965deabfa26a46e6cf5c3664d66df70733329e1752a577f6fb1fed96ef2c6e176ebf5aec857ef3da83043f5182886478c883bcbcc9a6a93cbe0ced125ea6a9e3b") setns(r6, 0x20000000) program crashed: panic: Incrementing non-positive count ADDR on nsfs.Inode testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open-perf_event_open-socket$unix-openat$binfmt-openat$binfmt-mount$tmpfs-mount$9p_rdma-recvmsg$unix-fchmod-read$FUSE-socket$inet6-write$cgroup_netprio_ifpriomap-write$FUSE_OPEN-write$FUSE_OPEN-setsockopt$SO_BINDTODEVICE-setsockopt$SO_BINDTODEVICE-fcntl$dupfd-setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS-mmap-syz_ublk_setup_io_uring-openat$dir-write$P9_RSTATu-syz_open_procfs$userns-close-syz_clone-setns detailed listing: executing program 0: perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) (async) perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) r0 = socket$unix(0x1, 0x5, 0x0) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) (async) r1 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280), 0x0, 0x0) mount$9p_rdma(&(0x7f00000000c0), &(0x7f0000000180)='./file0\x00', &(0x7f0000000140), 0x8000e0, 0x0) recvmsg$unix(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) fchmod(r2, 0x40) read$FUSE(r2, &(0x7f0000000400)={0x2020, 0x0, 0x0}, 0x2020) r4 = socket$inet6(0x10, 0x3, 0x0) write$cgroup_netprio_ifpriomap(r4, 0x0, 0x0) write$FUSE_OPEN(r2, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r3, {0x0, 0x4}}, 0x20) (async) write$FUSE_OPEN(r2, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r3, {0x0, 0x4}}, 0x20) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='pimreg1\x00', 0x10) (async) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='pimreg1\x00', 0x10) r5 = fcntl$dupfd(r1, 0x406, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r5, 0x6, 0x16, &(0x7f00000002c0)=[@window={0x3, 0x2, 0x8}, @window={0x3, 0x8, 0x1}, @sack_perm, @sack_perm], 0x4) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000008, 0x110, r0, 0x2d2bf000) syz_ublk_setup_io_uring(0x12e, &(0x7f0000000080)={0x0, 0x591f, 0x400, 0x3, 0x121}, &(0x7f0000000140), &(0x7f0000000340), &(0x7f0000000200)) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x341, 0x64) (async) write$P9_RSTATu(0xffffffffffffffff, 0x0, 0x0) (async) r6 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r6) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002480)="cae8e47f01d78da9ed9e37f2cdbdac67efe580476957b9229578a4998e935a5fc16bd413783d28e5e12a94b69bd79918ed3505c3a4606b9a94e3338c18435fc77e27905aa54f5fbbfbc78d8f2c8eb5d4bb79445d1e0160053c3d9501b784243942154b58df2e92dd55e4e9ae6b02e40a899a272ba26a2f0909ddc88c2ff4970a62f993a7b750c69bf03903d85c3d0681ef1825b173aabf8ce659678a895d912905280935a3b30e49c7b62da25f6a4ecae869ae3180c712aa3fb9537e3b73f6f751bab79b9515b3248144857665043417950bbb25cc935fad38734057acc046ec021b4300b8f4518357802fc63c2ea931251b6a5bc65ed3c04753c96a03e5f717fe2a0773d5f0e56160948a40f0035644e8c35dbb2f4ccdf369401de49f11c4cd1dd17f1bf7efe60ff7bd8491f34ee7aabf6965deabfa26a46e6cf5c3664d66df70733329e1752a577f6fb1fed96ef2c6e176ebf5aec857ef3da83043f5182886478c883bcbcc9a6a93cbe0ced125ea6a9e3b") setns(r6, 0x20000000) program crashed: panic: Incrementing non-positive count ADDR on nsfs.Inode testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open-perf_event_open-socket$unix-openat$binfmt-openat$binfmt-mount$tmpfs-mount$9p_rdma-recvmsg$unix-fchmod-read$FUSE-socket$inet6-write$cgroup_netprio_ifpriomap-write$FUSE_OPEN-write$FUSE_OPEN-setsockopt$SO_BINDTODEVICE-setsockopt$SO_BINDTODEVICE-fcntl$dupfd-setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS-mmap-syz_ublk_setup_io_uring-write$P9_RSTATu-syz_open_procfs$userns-close-syz_clone-setns detailed listing: executing program 0: perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) (async) perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) r0 = socket$unix(0x1, 0x5, 0x0) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) (async) r1 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280), 0x0, 0x0) mount$9p_rdma(&(0x7f00000000c0), &(0x7f0000000180)='./file0\x00', &(0x7f0000000140), 0x8000e0, 0x0) recvmsg$unix(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) fchmod(r2, 0x40) read$FUSE(r2, &(0x7f0000000400)={0x2020, 0x0, 0x0}, 0x2020) r4 = socket$inet6(0x10, 0x3, 0x0) write$cgroup_netprio_ifpriomap(r4, 0x0, 0x0) write$FUSE_OPEN(r2, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r3, {0x0, 0x4}}, 0x20) (async) write$FUSE_OPEN(r2, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r3, {0x0, 0x4}}, 0x20) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='pimreg1\x00', 0x10) (async) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='pimreg1\x00', 0x10) r5 = fcntl$dupfd(r1, 0x406, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r5, 0x6, 0x16, &(0x7f00000002c0)=[@window={0x3, 0x2, 0x8}, @window={0x3, 0x8, 0x1}, @sack_perm, @sack_perm], 0x4) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000008, 0x110, r0, 0x2d2bf000) syz_ublk_setup_io_uring(0x12e, &(0x7f0000000080)={0x0, 0x591f, 0x400, 0x3, 0x121}, &(0x7f0000000140), &(0x7f0000000340), &(0x7f0000000200)) write$P9_RSTATu(0xffffffffffffffff, 0x0, 0x0) (async) r6 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r6) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002480)="cae8e47f01d78da9ed9e37f2cdbdac67efe580476957b9229578a4998e935a5fc16bd413783d28e5e12a94b69bd79918ed3505c3a4606b9a94e3338c18435fc77e27905aa54f5fbbfbc78d8f2c8eb5d4bb79445d1e0160053c3d9501b784243942154b58df2e92dd55e4e9ae6b02e40a899a272ba26a2f0909ddc88c2ff4970a62f993a7b750c69bf03903d85c3d0681ef1825b173aabf8ce659678a895d912905280935a3b30e49c7b62da25f6a4ecae869ae3180c712aa3fb9537e3b73f6f751bab79b9515b3248144857665043417950bbb25cc935fad38734057acc046ec021b4300b8f4518357802fc63c2ea931251b6a5bc65ed3c04753c96a03e5f717fe2a0773d5f0e56160948a40f0035644e8c35dbb2f4ccdf369401de49f11c4cd1dd17f1bf7efe60ff7bd8491f34ee7aabf6965deabfa26a46e6cf5c3664d66df70733329e1752a577f6fb1fed96ef2c6e176ebf5aec857ef3da83043f5182886478c883bcbcc9a6a93cbe0ced125ea6a9e3b") setns(r6, 0x20000000) program crashed: panic: Incrementing non-positive count ADDR on nsfs.Inode testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open-perf_event_open-socket$unix-openat$binfmt-openat$binfmt-mount$tmpfs-mount$9p_rdma-recvmsg$unix-fchmod-read$FUSE-socket$inet6-write$cgroup_netprio_ifpriomap-write$FUSE_OPEN-write$FUSE_OPEN-setsockopt$SO_BINDTODEVICE-setsockopt$SO_BINDTODEVICE-fcntl$dupfd-setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS-mmap-write$P9_RSTATu-syz_open_procfs$userns-close-syz_clone-setns detailed listing: executing program 0: perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) (async) perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) r0 = socket$unix(0x1, 0x5, 0x0) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) (async) r1 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280), 0x0, 0x0) mount$9p_rdma(&(0x7f00000000c0), &(0x7f0000000180)='./file0\x00', &(0x7f0000000140), 0x8000e0, 0x0) recvmsg$unix(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) fchmod(r2, 0x40) read$FUSE(r2, &(0x7f0000000400)={0x2020, 0x0, 0x0}, 0x2020) r4 = socket$inet6(0x10, 0x3, 0x0) write$cgroup_netprio_ifpriomap(r4, 0x0, 0x0) write$FUSE_OPEN(r2, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r3, {0x0, 0x4}}, 0x20) (async) write$FUSE_OPEN(r2, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r3, {0x0, 0x4}}, 0x20) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='pimreg1\x00', 0x10) (async) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='pimreg1\x00', 0x10) r5 = fcntl$dupfd(r1, 0x406, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r5, 0x6, 0x16, &(0x7f00000002c0)=[@window={0x3, 0x2, 0x8}, @window={0x3, 0x8, 0x1}, @sack_perm, @sack_perm], 0x4) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000008, 0x110, r0, 0x2d2bf000) write$P9_RSTATu(0xffffffffffffffff, 0x0, 0x0) (async) r6 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r6) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002480)="cae8e47f01d78da9ed9e37f2cdbdac67efe580476957b9229578a4998e935a5fc16bd413783d28e5e12a94b69bd79918ed3505c3a4606b9a94e3338c18435fc77e27905aa54f5fbbfbc78d8f2c8eb5d4bb79445d1e0160053c3d9501b784243942154b58df2e92dd55e4e9ae6b02e40a899a272ba26a2f0909ddc88c2ff4970a62f993a7b750c69bf03903d85c3d0681ef1825b173aabf8ce659678a895d912905280935a3b30e49c7b62da25f6a4ecae869ae3180c712aa3fb9537e3b73f6f751bab79b9515b3248144857665043417950bbb25cc935fad38734057acc046ec021b4300b8f4518357802fc63c2ea931251b6a5bc65ed3c04753c96a03e5f717fe2a0773d5f0e56160948a40f0035644e8c35dbb2f4ccdf369401de49f11c4cd1dd17f1bf7efe60ff7bd8491f34ee7aabf6965deabfa26a46e6cf5c3664d66df70733329e1752a577f6fb1fed96ef2c6e176ebf5aec857ef3da83043f5182886478c883bcbcc9a6a93cbe0ced125ea6a9e3b") setns(r6, 0x20000000) program crashed: panic: Incrementing non-positive count ADDR on nsfs.Inode testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open-perf_event_open-socket$unix-openat$binfmt-openat$binfmt-mount$tmpfs-mount$9p_rdma-recvmsg$unix-fchmod-read$FUSE-socket$inet6-write$cgroup_netprio_ifpriomap-write$FUSE_OPEN-write$FUSE_OPEN-setsockopt$SO_BINDTODEVICE-setsockopt$SO_BINDTODEVICE-fcntl$dupfd-setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS-write$P9_RSTATu-syz_open_procfs$userns-close-syz_clone-setns detailed listing: executing program 0: perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) (async) perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) r0 = socket$unix(0x1, 0x5, 0x0) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) (async) r1 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280), 0x0, 0x0) mount$9p_rdma(&(0x7f00000000c0), &(0x7f0000000180)='./file0\x00', &(0x7f0000000140), 0x8000e0, 0x0) recvmsg$unix(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) fchmod(r2, 0x40) read$FUSE(r2, &(0x7f0000000400)={0x2020, 0x0, 0x0}, 0x2020) r4 = socket$inet6(0x10, 0x3, 0x0) write$cgroup_netprio_ifpriomap(r4, 0x0, 0x0) write$FUSE_OPEN(r2, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r3, {0x0, 0x4}}, 0x20) (async) write$FUSE_OPEN(r2, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r3, {0x0, 0x4}}, 0x20) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='pimreg1\x00', 0x10) (async) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='pimreg1\x00', 0x10) r5 = fcntl$dupfd(r1, 0x406, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r5, 0x6, 0x16, &(0x7f00000002c0)=[@window={0x3, 0x2, 0x8}, @window={0x3, 0x8, 0x1}, @sack_perm, @sack_perm], 0x4) write$P9_RSTATu(0xffffffffffffffff, 0x0, 0x0) (async) r6 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r6) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002480)="cae8e47f01d78da9ed9e37f2cdbdac67efe580476957b9229578a4998e935a5fc16bd413783d28e5e12a94b69bd79918ed3505c3a4606b9a94e3338c18435fc77e27905aa54f5fbbfbc78d8f2c8eb5d4bb79445d1e0160053c3d9501b784243942154b58df2e92dd55e4e9ae6b02e40a899a272ba26a2f0909ddc88c2ff4970a62f993a7b750c69bf03903d85c3d0681ef1825b173aabf8ce659678a895d912905280935a3b30e49c7b62da25f6a4ecae869ae3180c712aa3fb9537e3b73f6f751bab79b9515b3248144857665043417950bbb25cc935fad38734057acc046ec021b4300b8f4518357802fc63c2ea931251b6a5bc65ed3c04753c96a03e5f717fe2a0773d5f0e56160948a40f0035644e8c35dbb2f4ccdf369401de49f11c4cd1dd17f1bf7efe60ff7bd8491f34ee7aabf6965deabfa26a46e6cf5c3664d66df70733329e1752a577f6fb1fed96ef2c6e176ebf5aec857ef3da83043f5182886478c883bcbcc9a6a93cbe0ced125ea6a9e3b") setns(r6, 0x20000000) program crashed: panic: Incrementing non-positive count ADDR on nsfs.Inode testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open-perf_event_open-socket$unix-openat$binfmt-openat$binfmt-mount$tmpfs-mount$9p_rdma-recvmsg$unix-fchmod-read$FUSE-socket$inet6-write$cgroup_netprio_ifpriomap-write$FUSE_OPEN-write$FUSE_OPEN-setsockopt$SO_BINDTODEVICE-setsockopt$SO_BINDTODEVICE-fcntl$dupfd-write$P9_RSTATu-syz_open_procfs$userns-close-syz_clone-setns detailed listing: executing program 0: perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) (async) perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) r0 = socket$unix(0x1, 0x5, 0x0) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) (async) r1 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280), 0x0, 0x0) mount$9p_rdma(&(0x7f00000000c0), &(0x7f0000000180)='./file0\x00', &(0x7f0000000140), 0x8000e0, 0x0) recvmsg$unix(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) fchmod(r2, 0x40) read$FUSE(r2, &(0x7f0000000400)={0x2020, 0x0, 0x0}, 0x2020) r4 = socket$inet6(0x10, 0x3, 0x0) write$cgroup_netprio_ifpriomap(r4, 0x0, 0x0) write$FUSE_OPEN(r2, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r3, {0x0, 0x4}}, 0x20) (async) write$FUSE_OPEN(r2, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r3, {0x0, 0x4}}, 0x20) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='pimreg1\x00', 0x10) (async) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='pimreg1\x00', 0x10) fcntl$dupfd(r1, 0x406, r1) write$P9_RSTATu(0xffffffffffffffff, 0x0, 0x0) (async) r5 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r5) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002480)="cae8e47f01d78da9ed9e37f2cdbdac67efe580476957b9229578a4998e935a5fc16bd413783d28e5e12a94b69bd79918ed3505c3a4606b9a94e3338c18435fc77e27905aa54f5fbbfbc78d8f2c8eb5d4bb79445d1e0160053c3d9501b784243942154b58df2e92dd55e4e9ae6b02e40a899a272ba26a2f0909ddc88c2ff4970a62f993a7b750c69bf03903d85c3d0681ef1825b173aabf8ce659678a895d912905280935a3b30e49c7b62da25f6a4ecae869ae3180c712aa3fb9537e3b73f6f751bab79b9515b3248144857665043417950bbb25cc935fad38734057acc046ec021b4300b8f4518357802fc63c2ea931251b6a5bc65ed3c04753c96a03e5f717fe2a0773d5f0e56160948a40f0035644e8c35dbb2f4ccdf369401de49f11c4cd1dd17f1bf7efe60ff7bd8491f34ee7aabf6965deabfa26a46e6cf5c3664d66df70733329e1752a577f6fb1fed96ef2c6e176ebf5aec857ef3da83043f5182886478c883bcbcc9a6a93cbe0ced125ea6a9e3b") setns(r5, 0x20000000) program crashed: panic: Incrementing non-positive count ADDR on nsfs.Inode testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open-perf_event_open-socket$unix-openat$binfmt-openat$binfmt-mount$tmpfs-mount$9p_rdma-recvmsg$unix-fchmod-read$FUSE-socket$inet6-write$cgroup_netprio_ifpriomap-write$FUSE_OPEN-write$FUSE_OPEN-setsockopt$SO_BINDTODEVICE-setsockopt$SO_BINDTODEVICE-write$P9_RSTATu-syz_open_procfs$userns-close-syz_clone-setns detailed listing: executing program 0: perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) (async) perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) r0 = socket$unix(0x1, 0x5, 0x0) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) (async) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280), 0x0, 0x0) mount$9p_rdma(&(0x7f00000000c0), &(0x7f0000000180)='./file0\x00', &(0x7f0000000140), 0x8000e0, 0x0) recvmsg$unix(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) fchmod(r1, 0x40) read$FUSE(r1, &(0x7f0000000400)={0x2020, 0x0, 0x0}, 0x2020) r3 = socket$inet6(0x10, 0x3, 0x0) write$cgroup_netprio_ifpriomap(r3, 0x0, 0x0) write$FUSE_OPEN(r1, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r2, {0x0, 0x4}}, 0x20) (async) write$FUSE_OPEN(r1, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r2, {0x0, 0x4}}, 0x20) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='pimreg1\x00', 0x10) (async) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='pimreg1\x00', 0x10) write$P9_RSTATu(0xffffffffffffffff, 0x0, 0x0) (async) r4 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r4) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002480)="cae8e47f01d78da9ed9e37f2cdbdac67efe580476957b9229578a4998e935a5fc16bd413783d28e5e12a94b69bd79918ed3505c3a4606b9a94e3338c18435fc77e27905aa54f5fbbfbc78d8f2c8eb5d4bb79445d1e0160053c3d9501b784243942154b58df2e92dd55e4e9ae6b02e40a899a272ba26a2f0909ddc88c2ff4970a62f993a7b750c69bf03903d85c3d0681ef1825b173aabf8ce659678a895d912905280935a3b30e49c7b62da25f6a4ecae869ae3180c712aa3fb9537e3b73f6f751bab79b9515b3248144857665043417950bbb25cc935fad38734057acc046ec021b4300b8f4518357802fc63c2ea931251b6a5bc65ed3c04753c96a03e5f717fe2a0773d5f0e56160948a40f0035644e8c35dbb2f4ccdf369401de49f11c4cd1dd17f1bf7efe60ff7bd8491f34ee7aabf6965deabfa26a46e6cf5c3664d66df70733329e1752a577f6fb1fed96ef2c6e176ebf5aec857ef3da83043f5182886478c883bcbcc9a6a93cbe0ced125ea6a9e3b") setns(r4, 0x20000000) program crashed: panic: Incrementing non-positive count ADDR on nsfs.Inode testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open-perf_event_open-socket$unix-openat$binfmt-openat$binfmt-mount$tmpfs-mount$9p_rdma-recvmsg$unix-fchmod-read$FUSE-socket$inet6-write$cgroup_netprio_ifpriomap-write$FUSE_OPEN-write$FUSE_OPEN-setsockopt$SO_BINDTODEVICE-write$P9_RSTATu-syz_open_procfs$userns-close-syz_clone-setns detailed listing: executing program 0: perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) (async) perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) r0 = socket$unix(0x1, 0x5, 0x0) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) (async) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280), 0x0, 0x0) mount$9p_rdma(&(0x7f00000000c0), &(0x7f0000000180)='./file0\x00', &(0x7f0000000140), 0x8000e0, 0x0) recvmsg$unix(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) fchmod(r1, 0x40) read$FUSE(r1, &(0x7f0000000400)={0x2020, 0x0, 0x0}, 0x2020) r3 = socket$inet6(0x10, 0x3, 0x0) write$cgroup_netprio_ifpriomap(r3, 0x0, 0x0) write$FUSE_OPEN(r1, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r2, {0x0, 0x4}}, 0x20) (async) write$FUSE_OPEN(r1, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r2, {0x0, 0x4}}, 0x20) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='pimreg1\x00', 0x10) (async) write$P9_RSTATu(0xffffffffffffffff, 0x0, 0x0) (async) r4 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r4) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002480)="cae8e47f01d78da9ed9e37f2cdbdac67efe580476957b9229578a4998e935a5fc16bd413783d28e5e12a94b69bd79918ed3505c3a4606b9a94e3338c18435fc77e27905aa54f5fbbfbc78d8f2c8eb5d4bb79445d1e0160053c3d9501b784243942154b58df2e92dd55e4e9ae6b02e40a899a272ba26a2f0909ddc88c2ff4970a62f993a7b750c69bf03903d85c3d0681ef1825b173aabf8ce659678a895d912905280935a3b30e49c7b62da25f6a4ecae869ae3180c712aa3fb9537e3b73f6f751bab79b9515b3248144857665043417950bbb25cc935fad38734057acc046ec021b4300b8f4518357802fc63c2ea931251b6a5bc65ed3c04753c96a03e5f717fe2a0773d5f0e56160948a40f0035644e8c35dbb2f4ccdf369401de49f11c4cd1dd17f1bf7efe60ff7bd8491f34ee7aabf6965deabfa26a46e6cf5c3664d66df70733329e1752a577f6fb1fed96ef2c6e176ebf5aec857ef3da83043f5182886478c883bcbcc9a6a93cbe0ced125ea6a9e3b") setns(r4, 0x20000000) program crashed: panic: Incrementing non-positive count ADDR on nsfs.Inode testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open-perf_event_open-socket$unix-openat$binfmt-openat$binfmt-mount$tmpfs-mount$9p_rdma-recvmsg$unix-fchmod-read$FUSE-socket$inet6-write$cgroup_netprio_ifpriomap-write$FUSE_OPEN-write$FUSE_OPEN-write$P9_RSTATu-syz_open_procfs$userns-close-syz_clone-setns detailed listing: executing program 0: perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) (async) perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) r0 = socket$unix(0x1, 0x5, 0x0) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) (async) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280), 0x0, 0x0) mount$9p_rdma(&(0x7f00000000c0), &(0x7f0000000180)='./file0\x00', &(0x7f0000000140), 0x8000e0, 0x0) recvmsg$unix(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) fchmod(r1, 0x40) read$FUSE(r1, &(0x7f0000000400)={0x2020, 0x0, 0x0}, 0x2020) r3 = socket$inet6(0x10, 0x3, 0x0) write$cgroup_netprio_ifpriomap(r3, 0x0, 0x0) write$FUSE_OPEN(r1, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r2, {0x0, 0x4}}, 0x20) (async) write$FUSE_OPEN(r1, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r2, {0x0, 0x4}}, 0x20) write$P9_RSTATu(0xffffffffffffffff, 0x0, 0x0) (async) r4 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r4) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002480)="cae8e47f01d78da9ed9e37f2cdbdac67efe580476957b9229578a4998e935a5fc16bd413783d28e5e12a94b69bd79918ed3505c3a4606b9a94e3338c18435fc77e27905aa54f5fbbfbc78d8f2c8eb5d4bb79445d1e0160053c3d9501b784243942154b58df2e92dd55e4e9ae6b02e40a899a272ba26a2f0909ddc88c2ff4970a62f993a7b750c69bf03903d85c3d0681ef1825b173aabf8ce659678a895d912905280935a3b30e49c7b62da25f6a4ecae869ae3180c712aa3fb9537e3b73f6f751bab79b9515b3248144857665043417950bbb25cc935fad38734057acc046ec021b4300b8f4518357802fc63c2ea931251b6a5bc65ed3c04753c96a03e5f717fe2a0773d5f0e56160948a40f0035644e8c35dbb2f4ccdf369401de49f11c4cd1dd17f1bf7efe60ff7bd8491f34ee7aabf6965deabfa26a46e6cf5c3664d66df70733329e1752a577f6fb1fed96ef2c6e176ebf5aec857ef3da83043f5182886478c883bcbcc9a6a93cbe0ced125ea6a9e3b") setns(r4, 0x20000000) program crashed: panic: Incrementing non-positive count ADDR on nsfs.Inode testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open-perf_event_open-socket$unix-openat$binfmt-openat$binfmt-mount$tmpfs-mount$9p_rdma-recvmsg$unix-fchmod-read$FUSE-socket$inet6-write$cgroup_netprio_ifpriomap-write$FUSE_OPEN-write$P9_RSTATu-syz_open_procfs$userns-close-syz_clone-setns detailed listing: executing program 0: perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) (async) perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) r0 = socket$unix(0x1, 0x5, 0x0) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) (async) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280), 0x0, 0x0) mount$9p_rdma(&(0x7f00000000c0), &(0x7f0000000180)='./file0\x00', &(0x7f0000000140), 0x8000e0, 0x0) recvmsg$unix(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) fchmod(r1, 0x40) read$FUSE(r1, &(0x7f0000000400)={0x2020, 0x0, 0x0}, 0x2020) r3 = socket$inet6(0x10, 0x3, 0x0) write$cgroup_netprio_ifpriomap(r3, 0x0, 0x0) write$FUSE_OPEN(r1, &(0x7f0000002440)={0x20, 0xfffffffffffffff5, r2, {0x0, 0x4}}, 0x20) (async) write$P9_RSTATu(0xffffffffffffffff, 0x0, 0x0) (async) r4 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r4) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002480)="cae8e47f01d78da9ed9e37f2cdbdac67efe580476957b9229578a4998e935a5fc16bd413783d28e5e12a94b69bd79918ed3505c3a4606b9a94e3338c18435fc77e27905aa54f5fbbfbc78d8f2c8eb5d4bb79445d1e0160053c3d9501b784243942154b58df2e92dd55e4e9ae6b02e40a899a272ba26a2f0909ddc88c2ff4970a62f993a7b750c69bf03903d85c3d0681ef1825b173aabf8ce659678a895d912905280935a3b30e49c7b62da25f6a4ecae869ae3180c712aa3fb9537e3b73f6f751bab79b9515b3248144857665043417950bbb25cc935fad38734057acc046ec021b4300b8f4518357802fc63c2ea931251b6a5bc65ed3c04753c96a03e5f717fe2a0773d5f0e56160948a40f0035644e8c35dbb2f4ccdf369401de49f11c4cd1dd17f1bf7efe60ff7bd8491f34ee7aabf6965deabfa26a46e6cf5c3664d66df70733329e1752a577f6fb1fed96ef2c6e176ebf5aec857ef3da83043f5182886478c883bcbcc9a6a93cbe0ced125ea6a9e3b") setns(r4, 0x20000000) program crashed: panic: Incrementing non-positive count ADDR on nsfs.Inode testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open-perf_event_open-socket$unix-openat$binfmt-openat$binfmt-mount$tmpfs-mount$9p_rdma-recvmsg$unix-fchmod-read$FUSE-socket$inet6-write$cgroup_netprio_ifpriomap-write$P9_RSTATu-syz_open_procfs$userns-close-syz_clone-setns detailed listing: executing program 0: perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) (async) perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) r0 = socket$unix(0x1, 0x5, 0x0) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) (async) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280), 0x0, 0x0) mount$9p_rdma(&(0x7f00000000c0), &(0x7f0000000180)='./file0\x00', &(0x7f0000000140), 0x8000e0, 0x0) recvmsg$unix(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) fchmod(r1, 0x40) read$FUSE(r1, &(0x7f0000000400)={0x2020}, 0x2020) r2 = socket$inet6(0x10, 0x3, 0x0) write$cgroup_netprio_ifpriomap(r2, 0x0, 0x0) write$P9_RSTATu(0xffffffffffffffff, 0x0, 0x0) (async) r3 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r3) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002480)="cae8e47f01d78da9ed9e37f2cdbdac67efe580476957b9229578a4998e935a5fc16bd413783d28e5e12a94b69bd79918ed3505c3a4606b9a94e3338c18435fc77e27905aa54f5fbbfbc78d8f2c8eb5d4bb79445d1e0160053c3d9501b784243942154b58df2e92dd55e4e9ae6b02e40a899a272ba26a2f0909ddc88c2ff4970a62f993a7b750c69bf03903d85c3d0681ef1825b173aabf8ce659678a895d912905280935a3b30e49c7b62da25f6a4ecae869ae3180c712aa3fb9537e3b73f6f751bab79b9515b3248144857665043417950bbb25cc935fad38734057acc046ec021b4300b8f4518357802fc63c2ea931251b6a5bc65ed3c04753c96a03e5f717fe2a0773d5f0e56160948a40f0035644e8c35dbb2f4ccdf369401de49f11c4cd1dd17f1bf7efe60ff7bd8491f34ee7aabf6965deabfa26a46e6cf5c3664d66df70733329e1752a577f6fb1fed96ef2c6e176ebf5aec857ef3da83043f5182886478c883bcbcc9a6a93cbe0ced125ea6a9e3b") setns(r3, 0x20000000) program crashed: panic: Incrementing non-positive count ADDR on nsfs.Inode testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open-perf_event_open-socket$unix-openat$binfmt-openat$binfmt-mount$tmpfs-mount$9p_rdma-recvmsg$unix-fchmod-read$FUSE-socket$inet6-write$P9_RSTATu-syz_open_procfs$userns-close-syz_clone-setns detailed listing: executing program 0: perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) (async) perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) r0 = socket$unix(0x1, 0x5, 0x0) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) (async) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280), 0x0, 0x0) mount$9p_rdma(&(0x7f00000000c0), &(0x7f0000000180)='./file0\x00', &(0x7f0000000140), 0x8000e0, 0x0) recvmsg$unix(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) fchmod(r1, 0x40) read$FUSE(r1, &(0x7f0000000400)={0x2020}, 0x2020) socket$inet6(0x10, 0x3, 0x0) write$P9_RSTATu(0xffffffffffffffff, 0x0, 0x0) (async) r2 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r2) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002480)="cae8e47f01d78da9ed9e37f2cdbdac67efe580476957b9229578a4998e935a5fc16bd413783d28e5e12a94b69bd79918ed3505c3a4606b9a94e3338c18435fc77e27905aa54f5fbbfbc78d8f2c8eb5d4bb79445d1e0160053c3d9501b784243942154b58df2e92dd55e4e9ae6b02e40a899a272ba26a2f0909ddc88c2ff4970a62f993a7b750c69bf03903d85c3d0681ef1825b173aabf8ce659678a895d912905280935a3b30e49c7b62da25f6a4ecae869ae3180c712aa3fb9537e3b73f6f751bab79b9515b3248144857665043417950bbb25cc935fad38734057acc046ec021b4300b8f4518357802fc63c2ea931251b6a5bc65ed3c04753c96a03e5f717fe2a0773d5f0e56160948a40f0035644e8c35dbb2f4ccdf369401de49f11c4cd1dd17f1bf7efe60ff7bd8491f34ee7aabf6965deabfa26a46e6cf5c3664d66df70733329e1752a577f6fb1fed96ef2c6e176ebf5aec857ef3da83043f5182886478c883bcbcc9a6a93cbe0ced125ea6a9e3b") setns(r2, 0x20000000) program crashed: panic: Incrementing non-positive count ADDR on nsfs.Inode testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open-perf_event_open-socket$unix-openat$binfmt-openat$binfmt-mount$tmpfs-mount$9p_rdma-recvmsg$unix-fchmod-read$FUSE-write$P9_RSTATu-syz_open_procfs$userns-close-syz_clone-setns detailed listing: executing program 0: perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) (async) perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) r0 = socket$unix(0x1, 0x5, 0x0) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) (async) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280), 0x0, 0x0) mount$9p_rdma(&(0x7f00000000c0), &(0x7f0000000180)='./file0\x00', &(0x7f0000000140), 0x8000e0, 0x0) recvmsg$unix(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) fchmod(r1, 0x40) read$FUSE(r1, &(0x7f0000000400)={0x2020}, 0x2020) write$P9_RSTATu(0xffffffffffffffff, 0x0, 0x0) (async) r2 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r2) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002480)="cae8e47f01d78da9ed9e37f2cdbdac67efe580476957b9229578a4998e935a5fc16bd413783d28e5e12a94b69bd79918ed3505c3a4606b9a94e3338c18435fc77e27905aa54f5fbbfbc78d8f2c8eb5d4bb79445d1e0160053c3d9501b784243942154b58df2e92dd55e4e9ae6b02e40a899a272ba26a2f0909ddc88c2ff4970a62f993a7b750c69bf03903d85c3d0681ef1825b173aabf8ce659678a895d912905280935a3b30e49c7b62da25f6a4ecae869ae3180c712aa3fb9537e3b73f6f751bab79b9515b3248144857665043417950bbb25cc935fad38734057acc046ec021b4300b8f4518357802fc63c2ea931251b6a5bc65ed3c04753c96a03e5f717fe2a0773d5f0e56160948a40f0035644e8c35dbb2f4ccdf369401de49f11c4cd1dd17f1bf7efe60ff7bd8491f34ee7aabf6965deabfa26a46e6cf5c3664d66df70733329e1752a577f6fb1fed96ef2c6e176ebf5aec857ef3da83043f5182886478c883bcbcc9a6a93cbe0ced125ea6a9e3b") setns(r2, 0x20000000) program did not crash testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open-perf_event_open-socket$unix-openat$binfmt-openat$binfmt-mount$tmpfs-mount$9p_rdma-recvmsg$unix-fchmod-socket$inet6-write$P9_RSTATu-syz_open_procfs$userns-close-syz_clone-setns detailed listing: executing program 0: perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) (async) perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) r0 = socket$unix(0x1, 0x5, 0x0) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) (async) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280), 0x0, 0x0) mount$9p_rdma(&(0x7f00000000c0), &(0x7f0000000180)='./file0\x00', &(0x7f0000000140), 0x8000e0, 0x0) recvmsg$unix(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) fchmod(r1, 0x40) socket$inet6(0x10, 0x3, 0x0) write$P9_RSTATu(0xffffffffffffffff, 0x0, 0x0) (async) r2 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r2) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002480)="cae8e47f01d78da9ed9e37f2cdbdac67efe580476957b9229578a4998e935a5fc16bd413783d28e5e12a94b69bd79918ed3505c3a4606b9a94e3338c18435fc77e27905aa54f5fbbfbc78d8f2c8eb5d4bb79445d1e0160053c3d9501b784243942154b58df2e92dd55e4e9ae6b02e40a899a272ba26a2f0909ddc88c2ff4970a62f993a7b750c69bf03903d85c3d0681ef1825b173aabf8ce659678a895d912905280935a3b30e49c7b62da25f6a4ecae869ae3180c712aa3fb9537e3b73f6f751bab79b9515b3248144857665043417950bbb25cc935fad38734057acc046ec021b4300b8f4518357802fc63c2ea931251b6a5bc65ed3c04753c96a03e5f717fe2a0773d5f0e56160948a40f0035644e8c35dbb2f4ccdf369401de49f11c4cd1dd17f1bf7efe60ff7bd8491f34ee7aabf6965deabfa26a46e6cf5c3664d66df70733329e1752a577f6fb1fed96ef2c6e176ebf5aec857ef3da83043f5182886478c883bcbcc9a6a93cbe0ced125ea6a9e3b") setns(r2, 0x20000000) program crashed: panic: Incrementing non-positive count ADDR on nsfs.Inode testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open-perf_event_open-socket$unix-openat$binfmt-openat$binfmt-mount$tmpfs-mount$9p_rdma-recvmsg$unix-socket$inet6-write$P9_RSTATu-syz_open_procfs$userns-close-syz_clone-setns detailed listing: executing program 0: perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) (async) perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) r0 = socket$unix(0x1, 0x5, 0x0) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) (async) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280), 0x0, 0x0) mount$9p_rdma(&(0x7f00000000c0), &(0x7f0000000180)='./file0\x00', &(0x7f0000000140), 0x8000e0, 0x0) recvmsg$unix(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) socket$inet6(0x10, 0x3, 0x0) write$P9_RSTATu(0xffffffffffffffff, 0x0, 0x0) (async) r1 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r1) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002480)="cae8e47f01d78da9ed9e37f2cdbdac67efe580476957b9229578a4998e935a5fc16bd413783d28e5e12a94b69bd79918ed3505c3a4606b9a94e3338c18435fc77e27905aa54f5fbbfbc78d8f2c8eb5d4bb79445d1e0160053c3d9501b784243942154b58df2e92dd55e4e9ae6b02e40a899a272ba26a2f0909ddc88c2ff4970a62f993a7b750c69bf03903d85c3d0681ef1825b173aabf8ce659678a895d912905280935a3b30e49c7b62da25f6a4ecae869ae3180c712aa3fb9537e3b73f6f751bab79b9515b3248144857665043417950bbb25cc935fad38734057acc046ec021b4300b8f4518357802fc63c2ea931251b6a5bc65ed3c04753c96a03e5f717fe2a0773d5f0e56160948a40f0035644e8c35dbb2f4ccdf369401de49f11c4cd1dd17f1bf7efe60ff7bd8491f34ee7aabf6965deabfa26a46e6cf5c3664d66df70733329e1752a577f6fb1fed96ef2c6e176ebf5aec857ef3da83043f5182886478c883bcbcc9a6a93cbe0ced125ea6a9e3b") setns(r1, 0x20000000) program crashed: panic: Incrementing non-positive count ADDR on nsfs.Inode testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open-perf_event_open-socket$unix-openat$binfmt-openat$binfmt-mount$tmpfs-mount$9p_rdma-socket$inet6-write$P9_RSTATu-syz_open_procfs$userns-close-syz_clone-setns detailed listing: executing program 0: perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) (async) perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) socket$unix(0x1, 0x5, 0x0) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) (async) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280), 0x0, 0x0) mount$9p_rdma(&(0x7f00000000c0), &(0x7f0000000180)='./file0\x00', &(0x7f0000000140), 0x8000e0, 0x0) socket$inet6(0x10, 0x3, 0x0) write$P9_RSTATu(0xffffffffffffffff, 0x0, 0x0) (async) r0 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r0) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002480)="cae8e47f01d78da9ed9e37f2cdbdac67efe580476957b9229578a4998e935a5fc16bd413783d28e5e12a94b69bd79918ed3505c3a4606b9a94e3338c18435fc77e27905aa54f5fbbfbc78d8f2c8eb5d4bb79445d1e0160053c3d9501b784243942154b58df2e92dd55e4e9ae6b02e40a899a272ba26a2f0909ddc88c2ff4970a62f993a7b750c69bf03903d85c3d0681ef1825b173aabf8ce659678a895d912905280935a3b30e49c7b62da25f6a4ecae869ae3180c712aa3fb9537e3b73f6f751bab79b9515b3248144857665043417950bbb25cc935fad38734057acc046ec021b4300b8f4518357802fc63c2ea931251b6a5bc65ed3c04753c96a03e5f717fe2a0773d5f0e56160948a40f0035644e8c35dbb2f4ccdf369401de49f11c4cd1dd17f1bf7efe60ff7bd8491f34ee7aabf6965deabfa26a46e6cf5c3664d66df70733329e1752a577f6fb1fed96ef2c6e176ebf5aec857ef3da83043f5182886478c883bcbcc9a6a93cbe0ced125ea6a9e3b") setns(r0, 0x20000000) program crashed: panic: Incrementing non-positive count ADDR on nsfs.Inode testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open-perf_event_open-socket$unix-openat$binfmt-openat$binfmt-mount$tmpfs-socket$inet6-write$P9_RSTATu-syz_open_procfs$userns-close-syz_clone-setns detailed listing: executing program 0: perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) (async) perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) socket$unix(0x1, 0x5, 0x0) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) (async) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280), 0x0, 0x0) socket$inet6(0x10, 0x3, 0x0) write$P9_RSTATu(0xffffffffffffffff, 0x0, 0x0) (async) r0 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r0) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002480)="cae8e47f01d78da9ed9e37f2cdbdac67efe580476957b9229578a4998e935a5fc16bd413783d28e5e12a94b69bd79918ed3505c3a4606b9a94e3338c18435fc77e27905aa54f5fbbfbc78d8f2c8eb5d4bb79445d1e0160053c3d9501b784243942154b58df2e92dd55e4e9ae6b02e40a899a272ba26a2f0909ddc88c2ff4970a62f993a7b750c69bf03903d85c3d0681ef1825b173aabf8ce659678a895d912905280935a3b30e49c7b62da25f6a4ecae869ae3180c712aa3fb9537e3b73f6f751bab79b9515b3248144857665043417950bbb25cc935fad38734057acc046ec021b4300b8f4518357802fc63c2ea931251b6a5bc65ed3c04753c96a03e5f717fe2a0773d5f0e56160948a40f0035644e8c35dbb2f4ccdf369401de49f11c4cd1dd17f1bf7efe60ff7bd8491f34ee7aabf6965deabfa26a46e6cf5c3664d66df70733329e1752a577f6fb1fed96ef2c6e176ebf5aec857ef3da83043f5182886478c883bcbcc9a6a93cbe0ced125ea6a9e3b") setns(r0, 0x20000000) program did not crash testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open-perf_event_open-socket$unix-openat$binfmt-openat$binfmt-mount$9p_rdma-socket$inet6-write$P9_RSTATu-syz_open_procfs$userns-close-syz_clone-setns detailed listing: executing program 0: perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) (async) perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) socket$unix(0x1, 0x5, 0x0) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) (async) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) mount$9p_rdma(&(0x7f00000000c0), &(0x7f0000000180)='./file0\x00', &(0x7f0000000140), 0x8000e0, 0x0) socket$inet6(0x10, 0x3, 0x0) write$P9_RSTATu(0xffffffffffffffff, 0x0, 0x0) (async) r0 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r0) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002480)="cae8e47f01d78da9ed9e37f2cdbdac67efe580476957b9229578a4998e935a5fc16bd413783d28e5e12a94b69bd79918ed3505c3a4606b9a94e3338c18435fc77e27905aa54f5fbbfbc78d8f2c8eb5d4bb79445d1e0160053c3d9501b784243942154b58df2e92dd55e4e9ae6b02e40a899a272ba26a2f0909ddc88c2ff4970a62f993a7b750c69bf03903d85c3d0681ef1825b173aabf8ce659678a895d912905280935a3b30e49c7b62da25f6a4ecae869ae3180c712aa3fb9537e3b73f6f751bab79b9515b3248144857665043417950bbb25cc935fad38734057acc046ec021b4300b8f4518357802fc63c2ea931251b6a5bc65ed3c04753c96a03e5f717fe2a0773d5f0e56160948a40f0035644e8c35dbb2f4ccdf369401de49f11c4cd1dd17f1bf7efe60ff7bd8491f34ee7aabf6965deabfa26a46e6cf5c3664d66df70733329e1752a577f6fb1fed96ef2c6e176ebf5aec857ef3da83043f5182886478c883bcbcc9a6a93cbe0ced125ea6a9e3b") setns(r0, 0x20000000) program crashed: panic: Incrementing non-positive count ADDR on nsfs.Inode testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open-perf_event_open-socket$unix-openat$binfmt-mount$9p_rdma-socket$inet6-write$P9_RSTATu-syz_open_procfs$userns-close-syz_clone-setns detailed listing: executing program 0: perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) (async) perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) socket$unix(0x1, 0x5, 0x0) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) (async) mount$9p_rdma(&(0x7f00000000c0), &(0x7f0000000180)='./file0\x00', &(0x7f0000000140), 0x8000e0, 0x0) socket$inet6(0x10, 0x3, 0x0) write$P9_RSTATu(0xffffffffffffffff, 0x0, 0x0) (async) r0 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r0) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002480)="cae8e47f01d78da9ed9e37f2cdbdac67efe580476957b9229578a4998e935a5fc16bd413783d28e5e12a94b69bd79918ed3505c3a4606b9a94e3338c18435fc77e27905aa54f5fbbfbc78d8f2c8eb5d4bb79445d1e0160053c3d9501b784243942154b58df2e92dd55e4e9ae6b02e40a899a272ba26a2f0909ddc88c2ff4970a62f993a7b750c69bf03903d85c3d0681ef1825b173aabf8ce659678a895d912905280935a3b30e49c7b62da25f6a4ecae869ae3180c712aa3fb9537e3b73f6f751bab79b9515b3248144857665043417950bbb25cc935fad38734057acc046ec021b4300b8f4518357802fc63c2ea931251b6a5bc65ed3c04753c96a03e5f717fe2a0773d5f0e56160948a40f0035644e8c35dbb2f4ccdf369401de49f11c4cd1dd17f1bf7efe60ff7bd8491f34ee7aabf6965deabfa26a46e6cf5c3664d66df70733329e1752a577f6fb1fed96ef2c6e176ebf5aec857ef3da83043f5182886478c883bcbcc9a6a93cbe0ced125ea6a9e3b") setns(r0, 0x20000000) program crashed: panic: Incrementing non-positive count ADDR on nsfs.Inode testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open-perf_event_open-socket$unix-mount$9p_rdma-socket$inet6-write$P9_RSTATu-syz_open_procfs$userns-close-syz_clone-setns detailed listing: executing program 0: perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) (async) perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) socket$unix(0x1, 0x5, 0x0) mount$9p_rdma(&(0x7f00000000c0), &(0x7f0000000180)='./file0\x00', &(0x7f0000000140), 0x8000e0, 0x0) socket$inet6(0x10, 0x3, 0x0) write$P9_RSTATu(0xffffffffffffffff, 0x0, 0x0) (async) r0 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r0) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002480)="cae8e47f01d78da9ed9e37f2cdbdac67efe580476957b9229578a4998e935a5fc16bd413783d28e5e12a94b69bd79918ed3505c3a4606b9a94e3338c18435fc77e27905aa54f5fbbfbc78d8f2c8eb5d4bb79445d1e0160053c3d9501b784243942154b58df2e92dd55e4e9ae6b02e40a899a272ba26a2f0909ddc88c2ff4970a62f993a7b750c69bf03903d85c3d0681ef1825b173aabf8ce659678a895d912905280935a3b30e49c7b62da25f6a4ecae869ae3180c712aa3fb9537e3b73f6f751bab79b9515b3248144857665043417950bbb25cc935fad38734057acc046ec021b4300b8f4518357802fc63c2ea931251b6a5bc65ed3c04753c96a03e5f717fe2a0773d5f0e56160948a40f0035644e8c35dbb2f4ccdf369401de49f11c4cd1dd17f1bf7efe60ff7bd8491f34ee7aabf6965deabfa26a46e6cf5c3664d66df70733329e1752a577f6fb1fed96ef2c6e176ebf5aec857ef3da83043f5182886478c883bcbcc9a6a93cbe0ced125ea6a9e3b") setns(r0, 0x20000000) program crashed: panic: Incrementing non-positive count ADDR on nsfs.Inode testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open-perf_event_open-mount$9p_rdma-socket$inet6-write$P9_RSTATu-syz_open_procfs$userns-close-syz_clone-setns detailed listing: executing program 0: perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) (async) perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) mount$9p_rdma(&(0x7f00000000c0), &(0x7f0000000180)='./file0\x00', &(0x7f0000000140), 0x8000e0, 0x0) socket$inet6(0x10, 0x3, 0x0) write$P9_RSTATu(0xffffffffffffffff, 0x0, 0x0) (async) r0 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r0) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002480)="cae8e47f01d78da9ed9e37f2cdbdac67efe580476957b9229578a4998e935a5fc16bd413783d28e5e12a94b69bd79918ed3505c3a4606b9a94e3338c18435fc77e27905aa54f5fbbfbc78d8f2c8eb5d4bb79445d1e0160053c3d9501b784243942154b58df2e92dd55e4e9ae6b02e40a899a272ba26a2f0909ddc88c2ff4970a62f993a7b750c69bf03903d85c3d0681ef1825b173aabf8ce659678a895d912905280935a3b30e49c7b62da25f6a4ecae869ae3180c712aa3fb9537e3b73f6f751bab79b9515b3248144857665043417950bbb25cc935fad38734057acc046ec021b4300b8f4518357802fc63c2ea931251b6a5bc65ed3c04753c96a03e5f717fe2a0773d5f0e56160948a40f0035644e8c35dbb2f4ccdf369401de49f11c4cd1dd17f1bf7efe60ff7bd8491f34ee7aabf6965deabfa26a46e6cf5c3664d66df70733329e1752a577f6fb1fed96ef2c6e176ebf5aec857ef3da83043f5182886478c883bcbcc9a6a93cbe0ced125ea6a9e3b") setns(r0, 0x20000000) program did not crash testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): perf_event_open-socket$unix-mount$9p_rdma-socket$inet6-write$P9_RSTATu-syz_open_procfs$userns-close-syz_clone-setns detailed listing: executing program 0: perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0xa2, 0x2, 0x10, 0x5, 0x0, 0x948, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x8000000000000000, 0x83f}, 0x101561, 0xfffffffffffffdfc, 0x7, 0x5, 0xfffffffffbffffff, 0x24, 0x108, 0x0, 0x400005}, 0x0, 0x2, 0xffffffffffffffff, 0x19) (async) socket$unix(0x1, 0x5, 0x0) mount$9p_rdma(&(0x7f00000000c0), &(0x7f0000000180)='./file0\x00', &(0x7f0000000140), 0x8000e0, 0x0) socket$inet6(0x10, 0x3, 0x0) write$P9_RSTATu(0xffffffffffffffff, 0x0, 0x0) (async) r0 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r0) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002480)="cae8e47f01d78da9ed9e37f2cdbdac67efe580476957b9229578a4998e935a5fc16bd413783d28e5e12a94b69bd79918ed3505c3a4606b9a94e3338c18435fc77e27905aa54f5fbbfbc78d8f2c8eb5d4bb79445d1e0160053c3d9501b784243942154b58df2e92dd55e4e9ae6b02e40a899a272ba26a2f0909ddc88c2ff4970a62f993a7b750c69bf03903d85c3d0681ef1825b173aabf8ce659678a895d912905280935a3b30e49c7b62da25f6a4ecae869ae3180c712aa3fb9537e3b73f6f751bab79b9515b3248144857665043417950bbb25cc935fad38734057acc046ec021b4300b8f4518357802fc63c2ea931251b6a5bc65ed3c04753c96a03e5f717fe2a0773d5f0e56160948a40f0035644e8c35dbb2f4ccdf369401de49f11c4cd1dd17f1bf7efe60ff7bd8491f34ee7aabf6965deabfa26a46e6cf5c3664d66df70733329e1752a577f6fb1fed96ef2c6e176ebf5aec857ef3da83043f5182886478c883bcbcc9a6a93cbe0ced125ea6a9e3b") setns(r0, 0x20000000) program crashed: panic: Incrementing non-positive count ADDR on nsfs.Inode testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-mount$9p_rdma-socket$inet6-write$P9_RSTATu-syz_open_procfs$userns-close-syz_clone-setns detailed listing: executing program 0: socket$unix(0x1, 0x5, 0x0) mount$9p_rdma(&(0x7f00000000c0), &(0x7f0000000180)='./file0\x00', &(0x7f0000000140), 0x8000e0, 0x0) socket$inet6(0x10, 0x3, 0x0) write$P9_RSTATu(0xffffffffffffffff, 0x0, 0x0) (async) r0 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r0) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002480)="cae8e47f01d78da9ed9e37f2cdbdac67efe580476957b9229578a4998e935a5fc16bd413783d28e5e12a94b69bd79918ed3505c3a4606b9a94e3338c18435fc77e27905aa54f5fbbfbc78d8f2c8eb5d4bb79445d1e0160053c3d9501b784243942154b58df2e92dd55e4e9ae6b02e40a899a272ba26a2f0909ddc88c2ff4970a62f993a7b750c69bf03903d85c3d0681ef1825b173aabf8ce659678a895d912905280935a3b30e49c7b62da25f6a4ecae869ae3180c712aa3fb9537e3b73f6f751bab79b9515b3248144857665043417950bbb25cc935fad38734057acc046ec021b4300b8f4518357802fc63c2ea931251b6a5bc65ed3c04753c96a03e5f717fe2a0773d5f0e56160948a40f0035644e8c35dbb2f4ccdf369401de49f11c4cd1dd17f1bf7efe60ff7bd8491f34ee7aabf6965deabfa26a46e6cf5c3664d66df70733329e1752a577f6fb1fed96ef2c6e176ebf5aec857ef3da83043f5182886478c883bcbcc9a6a93cbe0ced125ea6a9e3b") setns(r0, 0x20000000) program crashed: panic: Incrementing non-positive count ADDR on nsfs.Inode testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-mount$9p_rdma-socket$inet6-write$P9_RSTATu-syz_open_procfs$userns-close-syz_clone-setns detailed listing: executing program 0: socket$unix(0x1, 0x5, 0x0) mount$9p_rdma(&(0x7f00000000c0), &(0x7f0000000180)='./file0\x00', &(0x7f0000000140), 0x8000e0, 0x0) socket$inet6(0x10, 0x3, 0x0) write$P9_RSTATu(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r0) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002480)="cae8e47f01d78da9ed9e37f2cdbdac67efe580476957b9229578a4998e935a5fc16bd413783d28e5e12a94b69bd79918ed3505c3a4606b9a94e3338c18435fc77e27905aa54f5fbbfbc78d8f2c8eb5d4bb79445d1e0160053c3d9501b784243942154b58df2e92dd55e4e9ae6b02e40a899a272ba26a2f0909ddc88c2ff4970a62f993a7b750c69bf03903d85c3d0681ef1825b173aabf8ce659678a895d912905280935a3b30e49c7b62da25f6a4ecae869ae3180c712aa3fb9537e3b73f6f751bab79b9515b3248144857665043417950bbb25cc935fad38734057acc046ec021b4300b8f4518357802fc63c2ea931251b6a5bc65ed3c04753c96a03e5f717fe2a0773d5f0e56160948a40f0035644e8c35dbb2f4ccdf369401de49f11c4cd1dd17f1bf7efe60ff7bd8491f34ee7aabf6965deabfa26a46e6cf5c3664d66df70733329e1752a577f6fb1fed96ef2c6e176ebf5aec857ef3da83043f5182886478c883bcbcc9a6a93cbe0ced125ea6a9e3b") setns(r0, 0x20000000) program crashed: panic: Incrementing non-positive count ADDR on nsfs.Inode testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-mount$9p_rdma-socket$inet6-write$P9_RSTATu-syz_open_procfs$userns-close-syz_clone-setns detailed listing: executing program 0: socket$unix(0x1, 0x5, 0x0) mount$9p_rdma(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000140), 0x8000e0, 0x0) socket$inet6(0x10, 0x3, 0x0) write$P9_RSTATu(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r0) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002480)="cae8e47f01d78da9ed9e37f2cdbdac67efe580476957b9229578a4998e935a5fc16bd413783d28e5e12a94b69bd79918ed3505c3a4606b9a94e3338c18435fc77e27905aa54f5fbbfbc78d8f2c8eb5d4bb79445d1e0160053c3d9501b784243942154b58df2e92dd55e4e9ae6b02e40a899a272ba26a2f0909ddc88c2ff4970a62f993a7b750c69bf03903d85c3d0681ef1825b173aabf8ce659678a895d912905280935a3b30e49c7b62da25f6a4ecae869ae3180c712aa3fb9537e3b73f6f751bab79b9515b3248144857665043417950bbb25cc935fad38734057acc046ec021b4300b8f4518357802fc63c2ea931251b6a5bc65ed3c04753c96a03e5f717fe2a0773d5f0e56160948a40f0035644e8c35dbb2f4ccdf369401de49f11c4cd1dd17f1bf7efe60ff7bd8491f34ee7aabf6965deabfa26a46e6cf5c3664d66df70733329e1752a577f6fb1fed96ef2c6e176ebf5aec857ef3da83043f5182886478c883bcbcc9a6a93cbe0ced125ea6a9e3b") setns(r0, 0x20000000) program crashed: panic: Incrementing non-positive count ADDR on nsfs.Inode testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-mount$9p_rdma-socket$inet6-write$P9_RSTATu-syz_open_procfs$userns-close-syz_clone-setns detailed listing: executing program 0: socket$unix(0x1, 0x5, 0x0) mount$9p_rdma(0x0, 0x0, &(0x7f0000000140), 0x8000e0, 0x0) socket$inet6(0x10, 0x3, 0x0) write$P9_RSTATu(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r0) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002480)="cae8e47f01d78da9ed9e37f2cdbdac67efe580476957b9229578a4998e935a5fc16bd413783d28e5e12a94b69bd79918ed3505c3a4606b9a94e3338c18435fc77e27905aa54f5fbbfbc78d8f2c8eb5d4bb79445d1e0160053c3d9501b784243942154b58df2e92dd55e4e9ae6b02e40a899a272ba26a2f0909ddc88c2ff4970a62f993a7b750c69bf03903d85c3d0681ef1825b173aabf8ce659678a895d912905280935a3b30e49c7b62da25f6a4ecae869ae3180c712aa3fb9537e3b73f6f751bab79b9515b3248144857665043417950bbb25cc935fad38734057acc046ec021b4300b8f4518357802fc63c2ea931251b6a5bc65ed3c04753c96a03e5f717fe2a0773d5f0e56160948a40f0035644e8c35dbb2f4ccdf369401de49f11c4cd1dd17f1bf7efe60ff7bd8491f34ee7aabf6965deabfa26a46e6cf5c3664d66df70733329e1752a577f6fb1fed96ef2c6e176ebf5aec857ef3da83043f5182886478c883bcbcc9a6a93cbe0ced125ea6a9e3b") setns(r0, 0x20000000) program crashed: panic: Incrementing non-positive count ADDR on nsfs.Inode testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-mount$9p_rdma-socket$inet6-write$P9_RSTATu-syz_open_procfs$userns-close-syz_clone-setns detailed listing: executing program 0: socket$unix(0x1, 0x5, 0x0) mount$9p_rdma(0x0, 0x0, 0x0, 0x8000e0, 0x0) socket$inet6(0x10, 0x3, 0x0) write$P9_RSTATu(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r0) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002480)="cae8e47f01d78da9ed9e37f2cdbdac67efe580476957b9229578a4998e935a5fc16bd413783d28e5e12a94b69bd79918ed3505c3a4606b9a94e3338c18435fc77e27905aa54f5fbbfbc78d8f2c8eb5d4bb79445d1e0160053c3d9501b784243942154b58df2e92dd55e4e9ae6b02e40a899a272ba26a2f0909ddc88c2ff4970a62f993a7b750c69bf03903d85c3d0681ef1825b173aabf8ce659678a895d912905280935a3b30e49c7b62da25f6a4ecae869ae3180c712aa3fb9537e3b73f6f751bab79b9515b3248144857665043417950bbb25cc935fad38734057acc046ec021b4300b8f4518357802fc63c2ea931251b6a5bc65ed3c04753c96a03e5f717fe2a0773d5f0e56160948a40f0035644e8c35dbb2f4ccdf369401de49f11c4cd1dd17f1bf7efe60ff7bd8491f34ee7aabf6965deabfa26a46e6cf5c3664d66df70733329e1752a577f6fb1fed96ef2c6e176ebf5aec857ef3da83043f5182886478c883bcbcc9a6a93cbe0ced125ea6a9e3b") setns(r0, 0x20000000) program crashed: panic: Incrementing non-positive count ADDR on nsfs.Inode testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-mount$9p_rdma-socket$inet6-write$P9_RSTATu-syz_open_procfs$userns-close-syz_clone-setns detailed listing: executing program 0: socket$unix(0x1, 0x5, 0x0) mount$9p_rdma(0x0, 0x0, 0x0, 0x8000e0, 0x0) socket$inet6(0x10, 0x3, 0x0) write$P9_RSTATu(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_procfs$userns(0x0, 0x0) close(r0) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002480)="cae8e47f01d78da9ed9e37f2cdbdac67efe580476957b9229578a4998e935a5fc16bd413783d28e5e12a94b69bd79918ed3505c3a4606b9a94e3338c18435fc77e27905aa54f5fbbfbc78d8f2c8eb5d4bb79445d1e0160053c3d9501b784243942154b58df2e92dd55e4e9ae6b02e40a899a272ba26a2f0909ddc88c2ff4970a62f993a7b750c69bf03903d85c3d0681ef1825b173aabf8ce659678a895d912905280935a3b30e49c7b62da25f6a4ecae869ae3180c712aa3fb9537e3b73f6f751bab79b9515b3248144857665043417950bbb25cc935fad38734057acc046ec021b4300b8f4518357802fc63c2ea931251b6a5bc65ed3c04753c96a03e5f717fe2a0773d5f0e56160948a40f0035644e8c35dbb2f4ccdf369401de49f11c4cd1dd17f1bf7efe60ff7bd8491f34ee7aabf6965deabfa26a46e6cf5c3664d66df70733329e1752a577f6fb1fed96ef2c6e176ebf5aec857ef3da83043f5182886478c883bcbcc9a6a93cbe0ced125ea6a9e3b") setns(r0, 0x20000000) program did not crash testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-mount$9p_rdma-socket$inet6-write$P9_RSTATu-syz_open_procfs$userns-close-syz_clone-setns detailed listing: executing program 0: socket$unix(0x1, 0x5, 0x0) mount$9p_rdma(0x0, 0x0, 0x0, 0x8000e0, 0x0) socket$inet6(0x10, 0x3, 0x0) write$P9_RSTATu(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r0) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, 0x0) setns(r0, 0x20000000) program crashed: panic: Incrementing non-positive count ADDR on nsfs.Inode extracting C reproducer testing compiled C program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-mount$9p_rdma-socket$inet6-write$P9_RSTATu-syz_open_procfs$userns-close-syz_clone-setns program crashed: panic: Incrementing non-positive count ADDR on nsfs.Inode simplifying C reproducer testing compiled C program (duration=33.793488286s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-mount$9p_rdma-socket$inet6-write$P9_RSTATu-syz_open_procfs$userns-close-syz_clone-setns program did not crash testing compiled C program (duration=33.793488286s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-mount$9p_rdma-socket$inet6-write$P9_RSTATu-syz_open_procfs$userns-close-syz_clone-setns program did not crash testing compiled C program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-mount$9p_rdma-socket$inet6-write$P9_RSTATu-syz_open_procfs$userns-close-syz_clone-setns program crashed: panic: Incrementing non-positive count ADDR on nsfs.Inode testing compiled C program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-mount$9p_rdma-socket$inet6-write$P9_RSTATu-syz_open_procfs$userns-close-syz_clone-setns program crashed: panic: Incrementing non-positive count ADDR on nsfs.Inode testing compiled C program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-mount$9p_rdma-socket$inet6-write$P9_RSTATu-syz_open_procfs$userns-close-syz_clone-setns program crashed: panic: Incrementing non-positive count ADDR on nsfs.Inode testing compiled C program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-mount$9p_rdma-socket$inet6-write$P9_RSTATu-syz_open_procfs$userns-close-syz_clone-setns program crashed: panic: Incrementing non-positive count ADDR on nsfs.Inode testing compiled C program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-mount$9p_rdma-socket$inet6-write$P9_RSTATu-syz_open_procfs$userns-close-syz_clone-setns program crashed: panic: Incrementing non-positive count ADDR on nsfs.Inode testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-mount$9p_rdma-socket$inet6-write$P9_RSTATu-syz_open_procfs$userns-close-syz_clone-setns detailed listing: executing program 0: socket$unix(0x1, 0x5, 0x0) mount$9p_rdma(0x0, 0x0, 0x0, 0x8000e0, 0x0) socket$inet6(0x10, 0x3, 0x0) write$P9_RSTATu(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r0) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, 0x0) setns(r0, 0x20000000) program crashed: panic: Incrementing non-positive count ADDR on nsfs.Inode validation run: crashed=true testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-mount$9p_rdma-socket$inet6-write$P9_RSTATu-syz_open_procfs$userns-close-syz_clone-setns detailed listing: executing program 0: socket$unix(0x1, 0x5, 0x0) mount$9p_rdma(0x0, 0x0, 0x0, 0x8000e0, 0x0) socket$inet6(0x10, 0x3, 0x0) write$P9_RSTATu(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r0) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, 0x0) setns(r0, 0x20000000) program did not crash validation run: crashed=false testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-mount$9p_rdma-socket$inet6-write$P9_RSTATu-syz_open_procfs$userns-close-syz_clone-setns detailed listing: executing program 0: socket$unix(0x1, 0x5, 0x0) mount$9p_rdma(0x0, 0x0, 0x0, 0x8000e0, 0x0) socket$inet6(0x10, 0x3, 0x0) write$P9_RSTATu(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r0) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, 0x0) setns(r0, 0x20000000) program crashed: panic: Incrementing non-positive count ADDR on nsfs.Inode validation run: crashed=true testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-mount$9p_rdma-socket$inet6-write$P9_RSTATu-syz_open_procfs$userns-close-syz_clone-setns detailed listing: executing program 0: socket$unix(0x1, 0x5, 0x0) mount$9p_rdma(0x0, 0x0, 0x0, 0x8000e0, 0x0) socket$inet6(0x10, 0x3, 0x0) write$P9_RSTATu(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r0) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, 0x0) setns(r0, 0x20000000) program did not crash validation run: crashed=false testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-mount$9p_rdma-socket$inet6-write$P9_RSTATu-syz_open_procfs$userns-close-syz_clone-setns detailed listing: executing program 0: socket$unix(0x1, 0x5, 0x0) mount$9p_rdma(0x0, 0x0, 0x0, 0x8000e0, 0x0) socket$inet6(0x10, 0x3, 0x0) write$P9_RSTATu(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r0) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, 0x0) setns(r0, 0x20000000) program did not crash validation run: crashed=false testing program (duration=33.793488286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-mount$9p_rdma-socket$inet6-write$P9_RSTATu-syz_open_procfs$userns-close-syz_clone-setns detailed listing: executing program 0: socket$unix(0x1, 0x5, 0x0) mount$9p_rdma(0x0, 0x0, 0x0, 0x8000e0, 0x0) socket$inet6(0x10, 0x3, 0x0) write$P9_RSTATu(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_procfs$userns(0x0, &(0x7f0000000200)) close(r0) syz_clone(0xa4a01040, 0x0, 0x0, 0x0, 0x0, 0x0) setns(r0, 0x20000000) program crashed: panic: Incrementing non-positive count ADDR on nsfs.Inode validation run: crashed=true reproducing took 31m47.003875502s repro crashed as (corrupted=false): panic: Incrementing non-positive count 0xc000b52068 on nsfs.Inode goroutine 910 gp=0xc000bcee00 m=4 mp=0xc000065808 [running]: panic({0x17fe020?, 0xc000207730?}) GOROOT/src/runtime/panic.go:802 +0x150 fp=0xc0007d5310 sp=0xc0007d5260 pc=0x480c60 gvisor.dev/gvisor/pkg/sentry/fsimpl/nsfs.(*inodeRefs).IncRef(0xc000b52068) bazel-out/aarch64-fastbuild/bin/pkg/sentry/fsimpl/nsfs/inode_refs.go:82 +0x12c fp=0xc0007d53a0 sp=0xc0007d5310 pc=0xbb098c gvisor.dev/gvisor/pkg/sentry/kernel.(*PIDNamespace).IncRef(...) pkg/sentry/kernel/threads.go:258 gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).GetPIDNamespace(...) pkg/sentry/kernel/threads.go:577 gvisor.dev/gvisor/pkg/sentry/kernel.(*namespaceSet).initFromTask(0xc0007d54c8, 0xc00082c008, 0xc00082cc88, 0x20000000) pkg/sentry/kernel/task_clone.go:532 +0xe4 fp=0xc0007d5430 sp=0xc0007d53a0 pc=0xd992d4 gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Setns(0xc00082c008, 0xc0009a2600, 0x20000000) pkg/sentry/kernel/task_clone.go:612 +0x26c fp=0xc0007d55e0 sp=0xc0007d5430 pc=0xd99d2c gvisor.dev/gvisor/pkg/sentry/syscalls/linux.Setns(0xc00082c008, 0x49808c?, {{0x5}, {0x20000000}, {0x0}, {0x0}, {0x0}, {0x0}}) pkg/sentry/syscalls/linux/sys_thread.go:479 +0xcc fp=0xc0007d56a0 sp=0xc0007d55e0 pc=0x100fccc gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).executeSyscall(0xc00082c008, 0x10c, {{0x5}, {0x20000000}, {0x0}, {0x0}, {0x0}, {0x0}}) pkg/sentry/kernel/task_syscall.go:143 +0x680 fp=0xc0007d5950 sp=0xc0007d56a0 pc=0xdc1ba0 gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallInvoke(0xc00082c008, 0x10c, {{0x5}, {0x20000000}, {0x0}, {0x0}, {0x0}, {0x0}}) pkg/sentry/kernel/task_syscall.go:323 +0x50 fp=0xc0007d5a00 sp=0xc0007d5950 pc=0xdc3220 gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallEnter(0xc00082c008, 0x10c, {{0x5}, {0x20000000}, {0x0}, {0x0}, {0x0}, {0x0}}) pkg/sentry/kernel/task_syscall.go:283 +0x78 fp=0xc0007d5a70 sp=0xc0007d5a00 pc=0xdc2d68 gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscall(0xc00082c008) pkg/sentry/kernel/task_syscall.go:258 +0x3b8 fp=0xc0007d5ba0 sp=0xc0007d5a70 pc=0xdc2a08 gvisor.dev/gvisor/pkg/sentry/kernel.(*runApp).execute(0xc00082c008?, 0xc00082c008) pkg/sentry/kernel/task_run.go:258 +0x154c fp=0xc0007d5e50 sp=0xc0007d5ba0 pc=0xdb375c gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).run(0xc00082c008, 0xde) pkg/sentry/kernel/task_run.go:89 +0x350 fp=0xc0007d5fa0 sp=0xc0007d5e50 pc=0xdb1af0 gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start.gowrap1() pkg/sentry/kernel/task_start.go:416 +0x40 fp=0xc0007d5fd0 sp=0xc0007d5fa0 pc=0xdc00a0 runtime.goexit({}) src/runtime/asm_arm64.s:1268 +0x4 fp=0xc0007d5fd0 sp=0xc0007d5fd0 pc=0x48a144 created by gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start in goroutine 1028 pkg/sentry/kernel/task_start.go:416 +0x138 final repro crashed as (corrupted=false): panic: Incrementing non-positive count 0xc000b52068 on nsfs.Inode goroutine 910 gp=0xc000bcee00 m=4 mp=0xc000065808 [running]: panic({0x17fe020?, 0xc000207730?}) GOROOT/src/runtime/panic.go:802 +0x150 fp=0xc0007d5310 sp=0xc0007d5260 pc=0x480c60 gvisor.dev/gvisor/pkg/sentry/fsimpl/nsfs.(*inodeRefs).IncRef(0xc000b52068) bazel-out/aarch64-fastbuild/bin/pkg/sentry/fsimpl/nsfs/inode_refs.go:82 +0x12c fp=0xc0007d53a0 sp=0xc0007d5310 pc=0xbb098c gvisor.dev/gvisor/pkg/sentry/kernel.(*PIDNamespace).IncRef(...) pkg/sentry/kernel/threads.go:258 gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).GetPIDNamespace(...) pkg/sentry/kernel/threads.go:577 gvisor.dev/gvisor/pkg/sentry/kernel.(*namespaceSet).initFromTask(0xc0007d54c8, 0xc00082c008, 0xc00082cc88, 0x20000000) pkg/sentry/kernel/task_clone.go:532 +0xe4 fp=0xc0007d5430 sp=0xc0007d53a0 pc=0xd992d4 gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Setns(0xc00082c008, 0xc0009a2600, 0x20000000) pkg/sentry/kernel/task_clone.go:612 +0x26c fp=0xc0007d55e0 sp=0xc0007d5430 pc=0xd99d2c gvisor.dev/gvisor/pkg/sentry/syscalls/linux.Setns(0xc00082c008, 0x49808c?, {{0x5}, {0x20000000}, {0x0}, {0x0}, {0x0}, {0x0}}) pkg/sentry/syscalls/linux/sys_thread.go:479 +0xcc fp=0xc0007d56a0 sp=0xc0007d55e0 pc=0x100fccc gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).executeSyscall(0xc00082c008, 0x10c, {{0x5}, {0x20000000}, {0x0}, {0x0}, {0x0}, {0x0}}) pkg/sentry/kernel/task_syscall.go:143 +0x680 fp=0xc0007d5950 sp=0xc0007d56a0 pc=0xdc1ba0 gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallInvoke(0xc00082c008, 0x10c, {{0x5}, {0x20000000}, {0x0}, {0x0}, {0x0}, {0x0}}) pkg/sentry/kernel/task_syscall.go:323 +0x50 fp=0xc0007d5a00 sp=0xc0007d5950 pc=0xdc3220 gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallEnter(0xc00082c008, 0x10c, {{0x5}, {0x20000000}, {0x0}, {0x0}, {0x0}, {0x0}}) pkg/sentry/kernel/task_syscall.go:283 +0x78 fp=0xc0007d5a70 sp=0xc0007d5a00 pc=0xdc2d68 gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscall(0xc00082c008) pkg/sentry/kernel/task_syscall.go:258 +0x3b8 fp=0xc0007d5ba0 sp=0xc0007d5a70 pc=0xdc2a08 gvisor.dev/gvisor/pkg/sentry/kernel.(*runApp).execute(0xc00082c008?, 0xc00082c008) pkg/sentry/kernel/task_run.go:258 +0x154c fp=0xc0007d5e50 sp=0xc0007d5ba0 pc=0xdb375c gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).run(0xc00082c008, 0xde) pkg/sentry/kernel/task_run.go:89 +0x350 fp=0xc0007d5fa0 sp=0xc0007d5e50 pc=0xdb1af0 gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start.gowrap1() pkg/sentry/kernel/task_start.go:416 +0x40 fp=0xc0007d5fd0 sp=0xc0007d5fa0 pc=0xdc00a0 runtime.goexit({}) src/runtime/asm_arm64.s:1268 +0x4 fp=0xc0007d5fd0 sp=0xc0007d5fd0 pc=0x48a144 created by gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start in goroutine 1028 pkg/sentry/kernel/task_start.go:416 +0x138