Extracting prog: 10m54.10179631s
Minimizing prog: 10m24.193047368s
Simplifying prog options: 0s
Extracting C: 23.000432652s
Simplifying C: 11m34.649933681s


extracting reproducer from 19 programs
testing a last program of every proc
single: executing 5 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-prlimit64-sched_setscheduler-getpid-sched_setaffinity-mprotect-openat$random-ioctl$RNDADDENTROPY-syz_emit_ethernet-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-setsockopt$WPAN_SECURITY_LEVEL-sched_setaffinity-recvmmsg-bpf$PROG_LOAD
detailed listing:
executing program 0:
syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x200008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r0 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x2)
mprotect(&(0x7f0000004000/0x4000)=nil, 0x4000, 0x8)
r1 = openat$random(0xffffffffffffff9c, &(0x7f000000fe80), 0x40800, 0x0)
ioctl$RNDADDENTROPY(r1, 0x40085203, &(0x7f0000000780)=ANY=[@ANYBLOB="04000000000010"])
syz_emit_ethernet(0x86, &(0x7f0000000280)=ANY=[@ANYBLOB], 0x0)
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0)
setsockopt$WPAN_SECURITY_LEVEL(0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x4, 0x16, &(0x7f0000001000)=ANY=[@ANYBLOB="61128c000000000061134c0000000000bf20000000000000070000000f0000003d030100000000009500ffb1000000006926000000301b00bf6700000000000036000b000fff52004507faff15300000d60600000ee60000bf050000000000003d63000000000000650700000200000007070000fbffffff1f75000000000000bf54000000000000070000000410f900bd430100000000009500000000000000050000000000000095000000000000001c15a3ce747c693a74b62fd0758b15f09429c09074bc4b2bd2dc480dd7a064b8673e2060162cc43bcba1060999eef9d60bb39d0af449deaa27ea949e8f9000d885deea2783835e29eba8546fc020c1966f8b5f32b095f566edf66b7751828da9dbd5b996b9e8d897e461c01c697671d100000000400036c17fb01dde179c1f26cac1c7b21bde7d1a55d6ebe700b3be005e47ef55e0dd81244b18590e000000000000356d82e43407a6d7fa94b21002f06cd247b126b6349ab62d7b07ba0a71a72145edade9941f49f300a8c8913e0e4ea9e4c77740ab3312edee62a4dc2fc85755d387d8a1bc8eb71fbe11b2216cc8d1f0160c237d929b49d828724b95555b459f4763c6222175c974be2f76fb5f330b015a68587a75c013000000000000000000000003000000000000d6ddc46e58eff8f4fbadfc6a3af8123b7f4240713a4c0cdc9d7820c4eb67cc0f8b5fe9258eeacb5776aebbab3d5c55020000006082778366dadfc36029633e0514cbcee1f3928970bde148c940434f33acd377cbad17673b2d30b6339255c98eba97efb4e9ac1f11be815dd6045592edcbee7f253ec74c7c1313505bd7ff8fd58b3a6569c91dbdef1df585aeaea7346a2a65caee5c85f9eddeeeee3c8a2e523c864ac430eb47cb4d0c8767b9d4125661b5a1a170c04b64da3a99ddb93bf14fae3ca2d1e882375b8dbac83978e136c34f90b33cc0eeb57debcfe26589efc08125d5d62a7e593c9738a50171adf051ea4f07e7e7e770c2016eeacbe8511afffffbea75759a1ea5404f5453c0b5c46c9700808c096cf8cf5223f341cbea3841b5cd224c1b381d56afebe9f99a00e3cd94dc0bb7af9e8709db487cc4d9b3b96723d69d512ddd57b0dee9b9f6ae80a502cce352098603e77f9ecced07fa25e99e9e415414c91f8bfd1c150570512f26c4ee34a64c131dce3800000000000000006c86287945bd8d258442870e000000000000000000000000f7e6a10de4bf7369b0d5b5373829b09bf5b7b34099b27ac7770fca449d4c4ca15f88b588b2429af2e1d1a4e1fa44cb80fcfae6e50d7e5b4675d7e0be706224f34e6eed553b40e2b897e73752fc7d1e4b0f4c5967eefd7448d5fde5841fa464a67267c631052bd7333769a4b8d19d4794357edce762e8136ab9d7ed34a72baffd849b90579b96b3"], &(0x7f0000000100)='GPL\x00'}, 0x48)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-sendmsg$SMC_PNETID_GET-getsockname$packet-sendmsg$nl_route-userfaultfd-socket$tipc-bind$tipc-socket$tipc-bind$tipc-socket$tipc-setsockopt$TIPC_GROUP_JOIN-sendmsg$tipc-close_range-socket$inet-sendmmsg$inet
detailed listing:
executing program 0:
r0 = socket(0x10, 0x803, 0x0)
sendmsg$SMC_PNETID_GET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}}, 0x0)
getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, <r1=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000580)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB="540000001000370401000000ffdbdf2500000000", @ANYRES32=r1, @ANYBLOB="890c04000000000005001000050000002c0012800b00010067726574617000001c000280050017000000000008000400030000000600"], 0x54}, 0x1, 0x0, 0x0, 0x44801}, 0x0)
r2 = userfaultfd(0x80001)
r3 = socket$tipc(0x1e, 0x5, 0x0)
bind$tipc(r3, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10)
r4 = socket$tipc(0x1e, 0x5, 0x0)
bind$tipc(r4, &(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10)
r5 = socket$tipc(0x1e, 0x2, 0x0)
setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000100)={0x42, 0x2, 0x2}, 0x10)
sendmsg$tipc(r5, &(0x7f0000002340)={&(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x4, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4080000}, 0x0)
close_range(r2, 0xffffffffffffffff, 0x0)
r6 = socket$inet(0x2, 0x2, 0x0)
sendmmsg$inet(r6, &(0x7f0000003380)=[{{&(0x7f0000000000)={0x2, 0x4e21, @local}, 0x10, 0x0, 0x0, &(0x7f0000000340)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r1, @empty, @rand_addr=0x64010102}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x8}}], 0x38}}], 0x1, 0x4040880)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-openat-socket$nl_route-ioctl$ifreq_SIOCGIFINDEX_batadv_hard-sendmsg$nl_route-openat-syz_genetlink_get_family_id$mptcp-sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY-write$binfmt_elf64-prlimit64-sched_setscheduler-getpid-sched_setaffinity-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_BIND_MAP-sched_setscheduler-mmap-setsockopt$inet_tcp_TCP_REPAIR_WINDOW-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-bpf$PROG_LOAD
detailed listing:
executing program 0:
syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000000)='./bus\x00', 0x0, &(0x7f0000000300)={[{@grpquota}, {@quota}, {@quota}, {@stripe={'stripe', 0x3d, 0x3}}, {@jqfmt_vfsold}]}, 0xff, 0x4fa, &(0x7f00000005c0)="$eJzs3c9vG1kdAPCvnThx0uwmu+wBEOyW3YWCqjqJuxut9gDLCSFUCdEjSG1I3CiKHUexU5rQQ3rmikQlTnDkD+DcE3cuCG5cygGJHxGoQeLg1YwnqZvaTdQkdhR/PtJo3ps39fe9pvNe/U3iF8DQuhoRuxExFhF3I2I6u57LjvisfST3Pdt7uLS/93ApF63W7X/l0vbkWnT8mcSV7DWLEfGj70X8NPdy3Mb2ztpitVrZzOqzzdrGbGN758ZqbXGlslJZL5cX5hfmPrn5cfnMxvpebSwrffXpH3e/9fOkW1PZlc5xnKX20AuHcRKjEfGD8wg2ACPZeMYG3RFeSz4i3o6I99PnfzpG0q8mAHCZtVrT0ZrurAMAl10+zYHl8qUsFzAV+Xyp1M7hvROT+Wq90bx+r761vtzOlc1EIX9vtVqZy3KFM1HIJfX5tPy8Xj5SvxkRb0XEL8cn0nppqV5dHuR/fABgiF05sv7/d7y9/gMAl1xx0B0AAPrO+g8Aw8f6DwDDx/oPAMOnvf5PDLobAEAfef8PAMPH+g8AQ+WHt24lR2s/+/zr5fvbW2v1+zeWK421Um1rqbRU39wordTrK+ln9tSOe71qvb4x/1FsPZj59kajOdvY3rlTq2+tN++kn+t9p1JI79rtw8gAgF7eeu/JX3LJivzpRHpEx14OhYH2DDhv+UF3ABiYkUF3ABgYu33B8DrFe3zpAbgkumzR+4Jit18QarVarfPrEnDOrn1J/h+GVUf+308Bw5CR/4fhJf8Pw6vVyp10z/846Y0AwMUmxw/0+P7/29n5d9k3B36yfPSOx+fZKwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALjYDvb/LWV7gU9FPl8qRbwRETNRyN1brVbmIuLNiPjzeGE8qc8PuM8AwGnl/57L9v+6Nv3h1AtN7145LI5FxM9+fftXDxabzc0/RYzl/j1+cL35OLte7n/vAYDjHazT6bnjjfyzvYdLB0c/+/OP70ZEsR1/f28s9g/jj8Zoei5GISIm/5PL6m25jtzFaew+iogvdht/LqbSHEh759Oj8ZPYb/Q1fv6F+Pm0rX1O/i6+cAZ9gWHzJJl/Puv2/OXjanru/vwX0xnq9LL5L3mppf10Dnwe/2D+G+kx/109aYyP/vD9dmni5bZHEV8ejTiIvd8x/xzEz/WI/+EJ4//1K+++36ut9ZuIa9E9fmes2WZtY7axvXNjtba4UlmprJfLC/MLc5/c/Lg8m+aoZ3uvBv/89PqbvdqS8U/2iF88ZvxfP+H4f/v/uz/+2ivif/ODbvHz8c4r4idr4jdOGH9x8vfFXm1J/OUe4z/u63/9hPGf/m3npW3DAYDBaWzvrC1Wq5VNBYWLX0j+yV6AbnQtfKdfscaie9MvPmg/00eaWq3XitVrxjiLrBtwERw+9BHxv0F3BgAAAAAAAAAAAAAA6Kofv7E06DECAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABweX0eAAD//19xzyM=")
openat(0xffffffffffffff9c, &(0x7f0000000180)='./file2\x00', 0xa0c42, 0x100)
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000440)={'batadv_slave_0\x00', <r1=>0x0})
sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000ac0)=ANY=[@ANYBLOB="280000001e00150d2cbd7000fddbdf2507000000", @ANYRES32=r1, @ANYBLOB="020000000000000008000a00", @ANYRES32=r1, @ANYBLOB="128427c5d206a218816c9535b088f1ecc766ba41e7848da577c33047809bed1823b20538e81fa98267aea6d3cc81494d59c32ea3ed8993406b6f00fd29f8511c634fc036a706e5bd24599b31146407da55064d874b952ad844664de34defac1b5155427b1979b9b57107873ebf600121832d4d78d7557e6bd191d30b80c8bece6d93154600491b4ec2074fad5288d008b3ac464f63ceaf6141bc5b1522f7c16a5097882fc6d4bcf537fcc173a7cf82ec030638965c2e3d5705000000a073eed1833cb9a6a38e7af9ad65c8a165eba759af8984eae43494d232"], 0x28}}, 0x48010)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x177)
r3 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r2)
sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(r2, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x2c, r3, 0x21, 0x70bd26, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0xad}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x8}]}, 0x2c}}, 0x24088000)
write$binfmt_elf64(r2, &(0x7f0000000200)=ANY=[@ANYBLOB="7f454c4620040000000000000000000002003e00ebffffff7c000000000000004000000000000000820000000000000000000000090038000100feff020003000300"], 0xed)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
r4 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r5 = bpf$MAP_CREATE(0x0, &(0x7f0000002080)=ANY=[@ANYBLOB="0500000001000000060000000b"], 0x50)
r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000009e00000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r6}, 0xc)
sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x2000)
setsockopt$inet_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000000500)={0xe, 0x10, 0x10, 0xa, 0x200}, 0x14)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r7=>0xffffffffffffffff, <r8=>0xffffffffffffffff})
connect$unix(r7, &(0x7f0000000180)=@abs, 0x6e)
sendmmsg$unix(r8, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xb, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-openat-socket$nl_route-ioctl$ifreq_SIOCGIFINDEX_batadv_hard-sendmsg$nl_route-openat-syz_genetlink_get_family_id$mptcp-sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY-write$binfmt_elf64-prlimit64-sched_setscheduler-getpid-sched_setaffinity-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_BIND_MAP-sched_setscheduler-mmap-setsockopt$inet_tcp_TCP_REPAIR_WINDOW-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-bpf$PROG_LOAD-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$PROG_LOAD
detailed listing:
executing program 0:
syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000000)='./bus\x00', 0x0, &(0x7f0000000300)={[{@grpquota}, {@quota}, {@quota}, {@stripe={'stripe', 0x3d, 0x3}}, {@jqfmt_vfsold}]}, 0xff, 0x4fa, &(0x7f00000005c0)="$eJzs3c9vG1kdAPCvnThx0uwmu+wBEOyW3YWCqjqJuxut9gDLCSFUCdEjSG1I3CiKHUexU5rQQ3rmikQlTnDkD+DcE3cuCG5cygGJHxGoQeLg1YwnqZvaTdQkdhR/PtJo3ps39fe9pvNe/U3iF8DQuhoRuxExFhF3I2I6u57LjvisfST3Pdt7uLS/93ApF63W7X/l0vbkWnT8mcSV7DWLEfGj70X8NPdy3Mb2ztpitVrZzOqzzdrGbGN758ZqbXGlslJZL5cX5hfmPrn5cfnMxvpebSwrffXpH3e/9fOkW1PZlc5xnKX20AuHcRKjEfGD8wg2ACPZeMYG3RFeSz4i3o6I99PnfzpG0q8mAHCZtVrT0ZrurAMAl10+zYHl8qUsFzAV+Xyp1M7hvROT+Wq90bx+r761vtzOlc1EIX9vtVqZy3KFM1HIJfX5tPy8Xj5SvxkRb0XEL8cn0nppqV5dHuR/fABgiF05sv7/d7y9/gMAl1xx0B0AAPrO+g8Aw8f6DwDDx/oPAMOnvf5PDLobAEAfef8PAMPH+g8AQ+WHt24lR2s/+/zr5fvbW2v1+zeWK421Um1rqbRU39wordTrK+ln9tSOe71qvb4x/1FsPZj59kajOdvY3rlTq2+tN++kn+t9p1JI79rtw8gAgF7eeu/JX3LJivzpRHpEx14OhYH2DDhv+UF3ABiYkUF3ABgYu33B8DrFe3zpAbgkumzR+4Jit18QarVarfPrEnDOrn1J/h+GVUf+308Bw5CR/4fhJf8Pw6vVyp10z/846Y0AwMUmxw/0+P7/29n5d9k3B36yfPSOx+fZKwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALjYDvb/LWV7gU9FPl8qRbwRETNRyN1brVbmIuLNiPjzeGE8qc8PuM8AwGnl/57L9v+6Nv3h1AtN7145LI5FxM9+fftXDxabzc0/RYzl/j1+cL35OLte7n/vAYDjHazT6bnjjfyzvYdLB0c/+/OP70ZEsR1/f28s9g/jj8Zoei5GISIm/5PL6m25jtzFaew+iogvdht/LqbSHEh759Oj8ZPYb/Q1fv6F+Pm0rX1O/i6+cAZ9gWHzJJl/Puv2/OXjanru/vwX0xnq9LL5L3mppf10Dnwe/2D+G+kx/109aYyP/vD9dmni5bZHEV8ejTiIvd8x/xzEz/WI/+EJ4//1K+++36ut9ZuIa9E9fmes2WZtY7axvXNjtba4UlmprJfLC/MLc5/c/Lg8m+aoZ3uvBv/89PqbvdqS8U/2iF88ZvxfP+H4f/v/uz/+2ivif/ODbvHz8c4r4idr4jdOGH9x8vfFXm1J/OUe4z/u63/9hPGf/m3npW3DAYDBaWzvrC1Wq5VNBYWLX0j+yV6AbnQtfKdfscaie9MvPmg/00eaWq3XitVrxjiLrBtwERw+9BHxv0F3BgAAAAAAAAAAAAAA6Kofv7E06DECAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABweX0eAAD//19xzyM=")
openat(0xffffffffffffff9c, &(0x7f0000000180)='./file2\x00', 0xa0c42, 0x100)
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000440)={'batadv_slave_0\x00', <r1=>0x0})
sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000ac0)=ANY=[@ANYBLOB="280000001e00150d2cbd7000fddbdf2507000000", @ANYRES32=r1, @ANYBLOB="020000000000000008000a00", @ANYRES32=r1, @ANYBLOB="128427c5d206a218816c9535b088f1ecc766ba41e7848da577c33047809bed1823b20538e81fa98267aea6d3cc81494d59c32ea3ed8993406b6f00fd29f8511c634fc036a706e5bd24599b31146407da55064d874b952ad844664de34defac1b5155427b1979b9b57107873ebf600121832d4d78d7557e6bd191d30b80c8bece6d93154600491b4ec2074fad5288d008b3ac464f63ceaf6141bc5b1522f7c16a5097882fc6d4bcf537fcc173a7cf82ec030638965c2e3d5705000000a073eed1833cb9a6a38e7af9ad65c8a165eba759af8984eae43494d232"], 0x28}}, 0x48010)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x177)
r3 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r2)
sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(r2, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x2c, r3, 0x21, 0x70bd26, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0xad}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x8}]}, 0x2c}}, 0x24088000)
write$binfmt_elf64(r2, &(0x7f0000000200)=ANY=[@ANYBLOB="7f454c4620040000000000000000000002003e00ebffffff7c000000000000004000000000000000820000000000000000000000090038000100feff020003000300"], 0xed)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
r4 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r5 = bpf$MAP_CREATE(0x0, &(0x7f0000002080)=ANY=[@ANYBLOB="0500000001000000060000000b"], 0x50)
r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000009e00000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r6}, 0xc)
sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x2000)
setsockopt$inet_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000000500)={0xe, 0x10, 0x10, 0xa, 0x200}, 0x14)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r7=>0xffffffffffffffff, <r8=>0xffffffffffffffff})
connect$unix(r7, &(0x7f0000000180)=@abs, 0x6e)
sendmmsg$unix(r8, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xb, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000f80)={0x18, 0x13, &(0x7f0000000b40)=ANY=[], &(0x7f0000000e40)='GPL\x00', 0x2, 0xd9, &(0x7f0000000e80)=""/217, 0x0, 0x8}, 0x94)
bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000001080)=ANY=[@ANYBLOB="61154c00000000006113500000000000bfa00000000000001503000008004e002d3501000000000095000000000000006916000000000000bf67000000000000350605000fff07206706000005000000160302000ee60060bf670000000000000f650000000000006507f9ff0100000007070000cddfffff1e75000000000000bf54000000000000070400000400f9ffbd4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd3997f9c9c4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05000000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe01c5473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc2300000008ac86d8a297dff0445a15f21dce4de9f29eff65aadc841848c9b562a31e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932b3a6aa57f1ad2e99e0e67ab93716d20000009fbb0f53acbb40b4f8e2738270b31562ed834f2af97787f696649a462e7ee4bcf8b07a10d6735154beb4000000000000000000000000004000bc00f679629709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253880800000000000000690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43010000207b40407d00000021000000008a523d80bd970d703f37ca364a601ae899a56715a0a62a34c6c94cce6994521629ab028acfc1d926a0f6a5489af8dc2f17923f3c40dfd1970a55c22fe3a5ac000000000000000000000000000000c1eb2d91fb79ea00000000000000bb0d00000000000000000000e4007be511fe320fea2594e190deae46e26c596f84eba9000000000000003cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631d22a11dc3c6939628950000000000000001c7205a6b068fff496d2da7d632bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a0337302f3b41eae59809fd05d12f6186f117b062df67d3a63f3265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089dad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3ff3be4d1458077c2253b0c7c7a0a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631dbaa74f22bad050e9856b48ae3a03a497c37758537650fe6db88aa3c41fdc3d78e046f6160e1741299e8dc29906870e6420ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0afa1e1c758a0079b747067312e9815a21cb3f1f8150d999d788535a4d3114dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fb9fb38f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4ff139604faf0a4da65396174b4563d54b52f06c870edf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202eeb81f428a5b3c299848649e1a6bff52f657a67463d7dbf85ae9321fc2b517dc4a29b9cba8ded5de8206c812439ab129ae818837ee1562078fc524b3baf49a0be9bb7d958d5e87c6ad62934782cc308e936d7637e07c201282bbbed84a2a3bc87b0da23c00d9ef418cf19e7a8c4c328be0ce95798adc2dca871073f6bd61dc18402cde8bf777b2eaa45c940aabc86b94f8cbde4d470667bee722a6a2af483ad0d3415ed0f9db059acaba9eaea93f811d434e00000000000000000000d154ba10a8e51489a614e69722bac30000000000000000000000000000c5dfd188ff555285b9743d3aac000583f42d168613151d681a2f71373f20d92c9048407c91fabecfe8b3f2d5454d127edab14ba61ba1cfc4336324c86f3dcb43e9a58208077e90f6ec1c7ac756f61dcc372cdd30b82507489f0bbfbd3c3f21752e81319c0161e154ceb16e00bc7f5a6962dff317f4d014786e432817064874d69a39cb0da31bcc5f81894d8a80756447322207b4007dff12eb95066cc6bc256f0a12282224d718b06ca80b57aa183dd0c3eee45891441f2b89b4c67aa9882281393954972046974f18df232cd7fca610e33f51c2d062020f403d85ff36c26e2f6bd1d82f4d3ceb3472d9a77e0057a3bfe697d9ab7585f4a1b381343d2cf855689232f4fc5135790662dc1419a374be9d7b3e5be2886d23add90d862f1a682ff11c798e338af3e5bb0f9d3952b15bf3e0c618c89d20ca1e18a031397693bf3cfbd8417e5b55e641c898c280356f2da222d5d68919d98158578dcf18efa404e508bcbbb8cfcf70086821ebdf34c9a1dff45af873df904c2bdbef81f246d26f4b40df949e12bdac18532f4e11c608cc31d60cb591c40a7b386fa1c753336d7220a35118d4919b45eff32aab684e62c6691de14e97aa7e9dc8ecf0cd50540246d2b746e41e5b4e2c095039dfe0f71db6265f7580d098be40ef36faee5d1695830d4242a23e541e6ce9fa1998d8961cf4fe3c8e8fbb566f148c8befc229614a4b7f80d237b8abc6fd0407de31d6e5532f360d379f20f054692b47207922fe6c14eba96c9a7ae906abc1ae1ae8c4fae92883cfa1978a04bbff4bbefc18f77700372471609e2c443e84ee5e9a5178f90512df04f3a0909c96632ae20c68c62b06e9fdc2977dfef1ced97b70263fc81c30f1354b319fe9d59d3101c4ee7375ff8673de5caff9e6ee73ccae77d1bf8f22330e8840af1ded6d5be627f7f87d5b12a2d6317825d77bef85313f541dcc4ff13f413db34d5da05648590a1685031e6955d4352bf0b7efd0b0a1e636b8aa4963d9f67de5ba91d501418bbeaac09bdd1059f3c3159e5900"/2282], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffffd2}, 0x48)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD
detailed listing:
executing program 0:
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0x13, &(0x7f0000000000)=ANY=[@ANYBLOB="18080000000000000000000000400000851000000600000018020000", @ANYRES32=0x0, @ANYBLOB="000000000000000066000000000000ff180000000000000000000000000000009500000000000000870a000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a00000000000085000000060000009500000000000000d302e4a9f4dbf845984588e79fcdafe855956803ef412dc93ef4d49df1092e41d4c77249a57590c651bbbdc9983761e1592d36c6c18d885104229f6c8c1ff04ec06627b725a251c468662ef3210268f8177c2f40466a38c914aa42272f23868e9ec385147f6a27e99c2e575213beff04e63b9b36b803b442644fc722bb3848034cfb64be0eadc432b6207665ad00993bc8fab48bba43302c2286e5315cb079bfcb8be391668da8e8fc03856b1eccc66c08c16c6a8bf40d72d3bc0efcc609fba25810"], &(0x7f0000000740)='GPL\x00', 0x2, 0xde, &(0x7f0000000340)=""/222, 0x41000}, 0x76)

program did not crash
single: failed to extract reproducer
bisect: bisecting 19 programs with base timeout 30s
testing program (duration=34s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 12, 1, 22, 7, 1, 28, 21, 2, 16, 16, 23, 26, 24, 7, 21, 7, 15, 18]
detailed listing:
executing program 2:
syz_emit_ethernet(0x4a, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000000000086dd60a2ed6a00142c00fe8000000000000000000000000000bbfee500000000400000000000000000aa88"], 0x0)
executing program 3:
r0 = open(&(0x7f0000000180)='./bus\x00', 0x14927f, 0x1e9)
close(0x3)
sendmsg$NL80211_CMD_DEL_PMKSA(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[], 0x68}, 0x1, 0x0, 0x0, 0x4004800}, 0x20040001)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000001c0)='./file0\x00', 0x800, &(0x7f0000001640)={[{@init_itable}]}, 0xff, 0x49b, &(0x7f0000001040)="$eJzs3MtvVNUfAPDvnbY8fjzaHyIKglbQSHy0tKCycKFGExeamOgCl7UtiAzU0JoIabQYg0tD4t64NPEvcOfGqAtj4lYTl4aEaGNCcTXmvugwnSltaTvS+XyS6ZxzH3PO9957Zs69p/cG0LH60z9JxPaI+DUievPsrQv0529zs9OjN2anR5Oo1d74M8mWuz47PVouWq63rcgcrkRUPkni+WRhuZMXLp4ZqVbHzxf5wamz7w1OXrj41OmzI6fGT42fGz5+/NjRoWefGX56VeJM47q+78OJ/XtfeevKa6Mnrrz9w9dptfYcyOfXx3FbN5oE1ER/utX+qmUa5z26jLrfDXbUpZPuNlaEZemKiHR39WTtvze6Yn7n9cbLH7dec/P6VBBYM+lv0yIteaYGbGBJtLsGQHuUP/Tp+W/5Wqeux3/CtRciNhXpudnp0bmb8XdHpZjes4bl90fEiZl/vkhfsdzrEAAAK5D1bZ5s1v+rxJ7sPR/r2FmMofRFxP8jYldE3BMRuyPi3ohs2fsi4v585VrvEsvvb8gv7P9Urjat8ypJ+3/P1fX95uriL976uorcjiz+nuTk6er4kWKbHI6ezWl+aJEyvn3pl89azavv/6WvtPyyL1hU4Gp3wwW6sZGpkdXaCNcuRezrbhZ/cnMkID0C9kbEvuV99M4ycfrxr/a3Wuj28S9iFcaZal9GPJbv/5loiL+ULD4+ObglquNHBsujYqEff778eqvy7yj+VXDt4AN5Yn7/NyzR+3eSj9f2RLU6fn5y+WVc/u3Tluc0Kz3+NyVvZmPWP72TT/tgZGrq/FDEpuTVLF+e02XTh+fXLfPl8unxf/hQ8/a/q1gnjT/dSulBfCAiHoyIh4q6PxwRByPi0CLxf//iI+8uEn8SSbRv/1+KGGv6/Xfz+O9L6sfrV5DoOvPdN61GzOv3fy1ptf+PxUz2XZvLvv9uY6kVvMPNBwAAAHeFSkRsj6QykKf7t0elMjCQ/w//7vhfpToxOfXEyYn3z43l9wj0RU+lvNLVW3c9dCiZKT4xzw8X14rL+UeL68afd23N8gOjE9WxNscOnW7bre0/yvaf+qOr3bUD1pz7taBzNbb/SpvqAay/pfz+OxeAjenW9r8l/bO1XXUB1pfzf+hczdr/Rw15/X/YmBY+AOj3Jo+sAzYi/X/oXNo/dC7tHzpSfif8lVjJff0rT5Q3C6z8c7Ys+Q7/TkmUT7xYy7K2xvyUqLQ95A5KpC1mfQudf4YKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADA3ezfAAAA//+5XeWQ")
openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x10)
setxattr$trusted_overlay_upper(&(0x7f0000000000)='./file1\x00', &(0x7f00000001c0), &(0x7f0000000200)=ANY=[], 0x841, 0x0)
lgetxattr(&(0x7f00000005c0)='./file1\x00', &(0x7f0000000840)=@known='trusted.overlay.upper\x00', &(0x7f0000000f40)=""/184, 0x841)
setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000000)={0x3, &(0x7f00000000c0)=[{0x20, 0x5, 0x2, 0xfffff010}, {0x28, 0x7, 0x0, 0xa56e}, {0x6, 0x0, 0x0, 0xa1a}]}, 0x10)
sendmmsg(r1, &(0x7f0000000180), 0x4000190, 0x0)
io_uring_register$IORING_UNREGISTER_RING_FDS(0xffffffffffffffff, 0x15, &(0x7f0000000580)=[{0xa, 0x1, 0x0, &(0x7f0000000a40)=[{&(0x7f0000000200)=""/138, 0x8a}, {&(0x7f00000003c0)=""/182, 0xb6}, {&(0x7f0000000480)=""/248, 0xf8}, {&(0x7f00000002c0)=""/125, 0x7d}, {&(0x7f0000000600)=""/234, 0xea}, {&(0x7f0000000700)=""/105, 0x69}, {&(0x7f0000000780)=""/144, 0x90}, {&(0x7f0000000880)=""/174, 0xae}, {&(0x7f0000000040)}, {&(0x7f0000000940)=""/207, 0xcf}], &(0x7f0000000100)=[0x26a0, 0x1000, 0x8, 0x83, 0x7, 0x5, 0x7]}], 0x1)
syz_clone3(&(0x7f0000000340)={0x200109400, &(0x7f00000000c0), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x1f, {r0}}, 0x58)
executing program 2:
bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x7, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="850000009e000000720a00ff000000007900200000000000950000000000000018100009", @ANYRES32, @ANYBLOB="00000000000000c5cf000000000000009500000800000000"], &(0x7f0000000140)='GPL\x00', 0x2, 0xffa0, &(0x7f0000000180)=""/149, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x1e, 0x10, 0x0, 0x1e}, 0x51)
executing program 3:
r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f0000000100)=ANY=[@ANYBLOB="b4000000000000006114a8000000000026000000f0ffffff95000000000000008d0d9629d18d4f6a1c9a456f6db773899392b2844e943bd3e2029e8c22292ca9cb2201e87c7eb8a71f64357839b9d9d0f268d370876ea9c8ed2f44f1af88953c4be01c7792a333"], &(0x7f0000000000)='syzkaller\x00', 0x5, 0xcab5, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x48)
bpf$ENABLE_STATS(0x20, 0x0, 0x0)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x5, &(0x7f0000000080)=ANY=[@ANYBLOB="180000000000000000000000001000008500000008000000850000002a00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector=0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0x0, 0x8, 0x11, &(0x7f0000000180)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000040)=""/17, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
recvmmsg(r2, &(0x7f0000000080)=[{{0x0, 0x0, 0x0}}], 0x40000000000012d, 0x2, 0x0)
getsockopt$IPT_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000100)={'nat\x00', 0x0, [0x401, 0x6, 0xfffffff9, 0x9, 0x6]}, 0x0)
setsockopt$inet_int(r2, 0x0, 0x12, &(0x7f0000000180)=0x80000001, 0x4)
setsockopt$inet_int(r2, 0x0, 0x7, &(0x7f0000000140)=0x6, 0x4)
bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10)
syz_emit_ethernet(0x32, &(0x7f0000001140)={@broadcast, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @void, {@ipv4={0x800, @udp={{0x6, 0x4, 0x0, 0x0, 0x24, 0x66, 0x0, 0x0, 0x11, 0x0, @empty, @empty, {[@timestamp={0x44, 0x4, 0x8d}]}}, {0x1, 0x4e20, 0xc, 0x0, @gue={{0x1, 0x0, 0x0, 0x0, 0x0, @void}}}}}}}, 0x0)
r3 = socket$unix(0x1, 0x1, 0x0)
bpf$ENABLE_STATS(0x20, 0x0, 0x0)
r4 = bpf$MAP_CREATE(0x0, &(0x7f0000001780)=ANY=[@ANYBLOB="020000000400000006000000050000000010"], 0x48)
r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000260018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@bloom_filter={0x1e, 0xfffffffc, 0xfffffffa, 0x40000000, 0x100, r4, 0x4, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x5, 0x4, 0x6}, 0x50)
r8 = syz_open_dev$vcsn(&(0x7f0000000580), 0x3, 0x70d040)
r9 = dup3(r5, r1, 0x0)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000640)=@bpf_tracing={0x1a, 0x5, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0xe48, 0x0, 0x0, 0x0, 0x6}, [@initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x6}]}, &(0x7f00000002c0)='syzkaller\x00', 0x5, 0xe5, &(0x7f0000000300)=""/229, 0x41000, 0x14, '\x00', 0x0, 0x1a, 0xffffffffffffffff, 0x8, &(0x7f0000000400)={0x5, 0x4}, 0x8, 0x10, &(0x7f00000004c0)={0x3, 0xa, 0x8000, 0x228e}, 0x10, 0x2b4a8, r0, 0x1, &(0x7f00000005c0)=[r4, r4, r4, 0x1, r7, r4, r8, r9, r4], &(0x7f0000000600)=[{0x3ff, 0x5, 0x5, 0x3}]}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r6, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000000c0)={0x3, &(0x7f0000000080)=[{0x559, 0x2, 0x4, 0x8}, {0x1, 0x0, 0xf, 0x4}, {0x7, 0x8, 0xf, 0x10001}]}, 0x10)
executing program 4:
syz_mount_image$fuse(0x0, &(0x7f0000002880)='./file0\x00', 0x20240d5, 0x0, 0x2, 0x0, 0x0)
syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x1, 0x0, 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f00000002c0)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
chdir(0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f00000002c0)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
chdir(&(0x7f00000001c0)='./bus\x00')
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x4008, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]})
executing program 4:
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0x13, &(0x7f0000000000)=ANY=[@ANYBLOB="18080000000000000000000000400000851000000600000018020000", @ANYRES32=0x0, @ANYBLOB="000000000000000066000000000000ff180000000000000000000000000000009500000000000000870a000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a00000000000085000000060000009500000000000000d302e4a9f4dbf845984588e79fcdafe855956803ef412dc93ef4d49df1092e41d4c77249a57590c651bbbdc9983761e1592d36c6c18d885104229f6c8c1ff04ec06627b725a251c468662ef3210268f8177c2f40466a38c914aa42272f23868e9ec385147f6a27e99c2e575213beff04e63b9b36b803b442644fc722bb3848034cfb64be0eadc432b6207665ad00993bc8fab48bba43302c2286e5315cb079bfcb8be391668da8e8fc03856b1eccc66c08c16c6a8bf40d72d3bc0efcc609fba25810"], &(0x7f0000000740)='GPL\x00', 0x2, 0xde, &(0x7f0000000340)=""/222, 0x41000}, 0x76)
executing program 2:
openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) (async)
r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0)
syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1b1c, 0x1b34, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x9, 0x1, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x5, 0x0, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0x0, 0x1}}}}}]}}]}}, 0x0) (async)
r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1b1c, 0x1b34, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x9, 0x1, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x5, 0x0, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0x0, 0x1}}}}}]}}]}}, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io(r1, &(0x7f00000003c0)={0x2c, &(0x7f0000000100)=ANY=[@ANYBLOB="000008000000080482"], 0x0, 0x0, 0x0, 0x0}, 0x0) (async)
syz_usb_control_io(r1, &(0x7f00000003c0)={0x2c, &(0x7f0000000100)=ANY=[@ANYBLOB="000008000000080482"], 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_usb_ep_write(r1, 0x81, 0x0, 0x0)
openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/cpuinfo\x00', 0x0, 0x0) (async)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/cpuinfo\x00', 0x0, 0x0)
bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)=@o_path={0x0}, 0x18)
r3 = socket$packet(0x11, 0x3, 0x300)
socket$nl_route(0x10, 0x3, 0x0)
syz_usb_connect(0x0, 0x4d9, &(0x7f0000000300)={{0x12, 0x1, 0x250, 0x9, 0xbd, 0xc2, 0x8, 0x17dc, 0x202, 0x8add, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x4c7, 0x3, 0x0, 0x0, 0x0, 0xd, [{{0x9, 0x4, 0x7d, 0x2, 0x2, 0xe, 0x1, 0x0, 0x3, [@uac_control={{0xa, 0x24, 0x1, 0xfff, 0xd}}], [{{0x9, 0x5, 0x8, 0x10, 0x8, 0x7, 0x7f, 0xf8, [@uac_iso={0x7, 0x25, 0x1, 0x3, 0x9, 0x6}, @generic={0x12, 0x32, "7fc6d9b85cbf7d143b9290e22dd20d9a"}]}}, {{0x9, 0x5, 0x3, 0x1, 0x10, 0x9, 0xca, 0x66, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x79, 0x6}]}}]}}, {{0x9, 0x4, 0x53, 0x8, 0x10, 0xa5, 0xdd, 0x2a, 0x4, [], [{{0x9, 0x5, 0x0, 0x0, 0x10, 0x4, 0x8, 0x1, [@generic={0x39, 0x3, "25f6834f9374f8846629fccd8c2f12d7e4626e844a1fad1e9980c2c02986dd32e95f760878b307a934dc23dafa5444897d69e05028f4a4"}]}}, {{0x9, 0x5, 0x7, 0x3, 0x400, 0x9, 0x0, 0x8}}, {{0x9, 0x5, 0x4, 0x0, 0x20, 0x4, 0x0, 0x3, [@generic={0x76, 0xd, "d33501c36ca3f5700cdbc3a103864b88f0e2870e85309aed5931b79a3b3d735c8e026762d159da5c00985cd3d40bace232e46cf99334d251386ac139a3af7f155add521867a58070e090520a029afe9a60775edd9934659826585798b924d5aa62ea2d06f15b06c4013d6390dad6c08798c372f1"}, @uac_iso={0x7, 0x25, 0x1, 0x82, 0xf8, 0x9}]}}, {{0x9, 0x5, 0x9, 0x0, 0x40, 0x7, 0xc0, 0x0, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x4, 0xa60}]}}, {{0x9, 0x5, 0xb, 0x2, 0x200, 0x9, 0x8, 0x1, [@generic={0xaf, 0x9, "7c036800cbfba95ed76f9e4a4b0a3de16f63333ee82ccf1270ff13881aa44ac624a14c1c2df84d2636d8a304f01163f1044bf7641b2ea69132c313b4d1bbaa3f26712076d355c839223e6d0d9d47b634fe1c162a2b9ee2f2602499da20f1127a7d114900a4f56430ea6b18632c735dcd495ae54fc44bf3221f2558a9e8e5ca426f86cdfd0339cb9f771b60217df27e22d3f212753984387814a43ca471dcfb6444d315a7503804004a7678ec6e"}]}}, {{0x9, 0x5, 0xb, 0x14, 0x20, 0xe0, 0x80, 0x40}}, {{0x9, 0x5, 0x3, 0x3, 0x1b7, 0x1, 0xff, 0x8}}, {{0x9, 0x5, 0x8, 0x10, 0x10, 0x1, 0x9, 0x81, [@generic={0x42, 0xe, "670ffdca832d53759612929f0a12f1c60c893d5a3fbc9dc62dedac34e2b8829a5a53fb34412cb5d09ae1198b03420a28175f8ad1841ef17a56dfed88e7963abe"}, @uac_iso={0x7, 0x25, 0x1, 0x83, 0x4}]}}, {{0x9, 0x5, 0x4, 0x10, 0x20, 0x5, 0xe1, 0x6, [@generic={0x41, 0x1, "244aec00df9a422efae80ca62d278f47196d219edda84ab2fcf2c59bd17092ffe5aa6dfe0fdd92d26100826d8726bdc7c02b396ea61b6b6c38daf49fd4bfaf"}]}}, {{0x9, 0x5, 0x5, 0x10, 0x10, 0x87, 0x4, 0x8, [@generic={0xb7, 0x22, "6d72c3a27ed9fc7eb92ee469cfd48110c3d55baa7162788c4b42cb56e80d1f3d15d0b0576b31740bab6889035951696f1ecfefc18ace5b5851bbd84dabfcb53156982d18de0ffb459eb64f4d8368d7e681da02bd8e4e362d14832e1cca65169af504d93c9a7eedc3e2c88cc013f20259a43888727714ac7c90678382cdf22d85d26920e8abd23f28855ad4b3d5eb5483f93a257cb7ea103a34ab348e305e5786195d0f4571e8c9827ba0ddbba89dd9306c3837856e"}, @generic={0x34, 0x22, "3b51ebf944821be48a5dc48870fe64bd4890f2557b3baccd4db13d2ee785dbf214b44ef93a6ebf3aab2ea4767aa46fac5859"}]}}, {{0x9, 0x5, 0xf, 0x2, 0x20, 0x5, 0xc1, 0x81}}, {{0x9, 0x5, 0x0, 0x4, 0x40, 0x7, 0x3, 0x5, [@generic={0x2, 0x22}]}}, {{0x9, 0x5, 0x1, 0x3, 0x200, 0x5, 0xa8, 0xd5, [@uac_iso={0x7, 0x25, 0x1, 0x2, 0x0, 0x4}]}}, {{0x9, 0x5, 0x4, 0xc, 0x400, 0x2, 0x9, 0x9c}}, {{0x9, 0x5, 0x7, 0xc, 0x40, 0x14, 0x8, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0xb3, 0x2}, @generic={0x5e, 0x22, "63fbff75eed5cfa208c5d0484766975ba13d529deb19659db0169f59e4b2207f1f8b34afce81e00061c8637fcafce5b85aa46993516a374b54e3434261e1112dfce2ab54aac9b2e72ee8cc6d35309d845a65b1ca33a5a24423a2810f"}]}}, {{0x9, 0x5, 0x5, 0x10, 0x3ff, 0x7, 0x2, 0xe}}]}}, {{0x9, 0x4, 0x25, 0x5, 0x8, 0xe6, 0x15, 0x65, 0x9, [@cdc_ecm={{0x6, 0x24, 0x6, 0x0, 0x0, "ec"}, {0x5, 0x24, 0x0, 0x9}, {0xd, 0x24, 0xf, 0x1, 0x7, 0x0, 0xe, 0x8}, [@ncm={0x6, 0x24, 0x1a, 0xff, 0x30}]}], [{{0x9, 0x5, 0xe, 0x3, 0x3ff, 0x5, 0x1, 0x4}}, {{0x9, 0x5, 0xb, 0x0, 0x40, 0xf1, 0x6, 0xc}}, {{0x9, 0x5, 0xe, 0x10, 0x8, 0xf8, 0x9, 0xb6, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0xb4, 0x1}, @uac_iso={0x7, 0x25, 0x1, 0x80, 0x4, 0x7}]}}, {{0x9, 0x5, 0xb, 0x10, 0x200, 0x15, 0xa7, 0x2, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x0, 0x46c7}, @uac_iso={0x7, 0x25, 0x1, 0x2, 0x9, 0x3}]}}, {{0x9, 0x5, 0x3, 0x2, 0x10, 0x1, 0x2, 0xfa}}, {{0x9, 0x5, 0xa, 0x0, 0x40, 0x7f, 0x6, 0x5}}, {{0x9, 0x5, 0x1, 0x8, 0x200, 0x6, 0x5, 0x6, [@uac_iso={0x7, 0x25, 0x1, 0x81, 0x3, 0x651}]}}, {{0x9, 0x5, 0xc, 0x3, 0x3ff, 0x2, 0x3, 0x3}}]}}]}}]}}, &(0x7f0000001380)={0x0, 0x0, 0x0, 0x0})
r4 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0)
getsockname$packet(r4, &(0x7f0000000140)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=@newlink={0x40, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, r5, 0x69801}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @gre={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x8, 0x7, @dev={0xac, 0x14, 0x14, 0x2}}, @IFLA_GRE_ENCAP_SPORT={0x6, 0x10, 0x4e20}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x40000}, 0x12889c8bf228932c)
sendto$packet(r3, &(0x7f00000001c0)="11eb0300fc0baf745836da8886dd", 0xe, 0x2404c081, &(0x7f0000000200)={0x11, 0x88a8, r5, 0x1, 0x4, 0x6, @multicast}, 0x14) (async)
sendto$packet(r3, &(0x7f00000001c0)="11eb0300fc0baf745836da8886dd", 0xe, 0x2404c081, &(0x7f0000000200)={0x11, 0x88a8, r5, 0x1, 0x4, 0x6, @multicast}, 0x14)
r6 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000003000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x5, 0x97, &(0x7f00000001c0)=""/151}, 0x80)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x0, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000000000000001"], 0x0}, 0x90) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x0, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000000000000001"], 0x0}, 0x90)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x0, &(0x7f00000000c0)='\x00', 0x0, 0x2}, 0x48)
sendfile(r0, r2, 0x0, 0x20000023896)
close(0x3) (async)
close(0x3)
openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x901800, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_mount_image$fuse(&(0x7f0000002040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000280)=ANY=[], 0x0, 0x0, 0x0)
read$FUSE(0xffffffffffffffff, &(0x7f0000004080)={0x2020}, 0x2020)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0)
r3 = socket$netlink(0x10, 0x3, 0x0)
getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r4=>0x0}, &(0x7f00000000c0)=0xc)
syz_mount_image$msdos(&(0x7f0000000040), &(0x7f0000001200)='./file1\x00', 0x1008090, &(0x7f0000000100)=ANY=[@ANYBLOB='nodots,dots,nfs,gid=', @ANYRESHEX=r4, @ANYBLOB=',dovs,dots,audit,\x00'], 0x1, 0x11c3, &(0x7f0000001240)="$eJzs281qa1UUB/Dlvb3mmmvT+m2duNGJTg62A0dOirQgDShtI7SCcEpTDYlJyMkgEQcFZ458DnHoTBBfwCcpguikI4+00X5RRVvaSO/vN8mCfzbsRciBfdjr4J2vP2vvFdlePox7TzyImX5EOkyR4l7cj4n9ePPL1d++2tjaXluu11fWU1pd3lx8O6VUe/WHj7749rUfh48+/K72fSV+mv/44JeloyULB79vftoqUqtI3d4w5Wmn1xvmO51m2m0V7SylDzrNvGimVrdoDs7le51evz9OeXd3ttofNIsi5d1xajfHadhLw8E45Z/krW7KsizNVoPraHxzWJZlRFk+iCejLMvyqajGo3g6ZqMWc1GJiGfjuXg+XogX46Xay7Fw/K1p7xsAAAAAAAAAAAAAAAAAAADuln+e/5+PZ87O/4f5fwAAAAAAAAAAAAAAAAAAALgJ5v8BAAAAAAAAAAAAAAAAAABg+sz/AwAAAAAAAAAAAAAAAAAAwPRtbG2vLdfrK+spPYz4eX/UGDUmn5N89b36ylvp2Pzpql9Ho8b9k3xxkqfzeSWqf+ZLl+YP443XJ/lR9u779Qv5K7F78+0DAADAYyFLJy4932fZ3+WT6sz7gfPn97mImLm1NriiYvx5O+90mgPFLRZ//TH+L/u5TjFzJ7pQXCym/GDiVpz+6NPeCQAAAAAAAAAAAP/Fv7wPWImIK18nnHaPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8Ac7cCwAAAAAIMzfOo2ODQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4KoAAAD//ynKjbc=")
mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='debugfs\x00', 0x0, &(0x7f0000000100))
syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0)
mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', 0x0, 0x404, 0x0)
bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000200)={0x0, <r5=>0x0}, 0x6)
r6 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000040)=r5, 0x4)
bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000000)={r6, 0x20, &(0x7f0000000280)={&(0x7f0000000080)=""/238, 0xffffffffffffff80, 0x0, 0x0}}, 0x1e)
r7 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="7c010000190001000000000000000000fc0200000000000000000000000000007f000001000000000000000000000000fffd0006000000000a00000008000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000010800000000000000000000000000000000000000000000070000000000000000000000000000001d00000000000000040000000000000000000000000000000000000000000000dd02000000000000000000000000000000010002003f0000c4000500ac14143b000000000000000000000000000004d32b00000000000000ac14140c000000000000000000000000000000000000fb000000000000000000ff000000000000000000000000000000f8ffffff0000000033000000020000000a0101010000000000000000000000000000000001"], 0x17c}, 0x1, 0x0, 0x0, 0x40001}, 0x0)
mount$tmpfs(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x3010080, 0x0)
mount$tmpfs(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x84022, &(0x7f0000000240)={[{@nr_inodes={'nr_inodes', 0x3d, [0x65]}}, {@size={'size', 0x3d, [0x6d]}}]})
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x10, 0x0, 0x0)
ioctl$KVM_GET_SREGS2(r2, 0x8140aecc, &(0x7f0000000340))
executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000680)=ANY=[@ANYBLOB="4c00000010004b0422000000000000007a000000", @ANYRES32=0x0, @ANYBLOB="00000000000000002c0012800b00010062726964676500001c0002800800040000000000080015000000"], 0x4c}, 0x1, 0x0, 0x0, 0x200400a0}, 0x0)
executing program 0:
syz_mount_image$fuse(0x0, &(0x7f0000002880)='./file0\x00', 0x20240d5, 0x0, 0x2, 0x0, 0x0)
syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x1, 0x0, 0x0)
syz_mount_image$exfat(0x0, &(0x7f0000000180)='./bus\x00', 0x2801cb0, 0x0, 0x0, 0x0, &(0x7f0000002980))
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f00000002c0)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
chdir(&(0x7f00000001c0)='./bus\x00')
ioctl$int_in(0xffffffffffffffff, 0x5421, &(0x7f0000000200))
mount$incfs(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x302000, 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f00000002c0)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
chdir(&(0x7f00000001c0)='./bus\x00')
syz_mount_image$fuse(0x0, &(0x7f0000000540)='./file0\x00', 0x4400, 0x0, 0x0, 0x0, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, 0x0)
r1 = socket(0x200000000000011, 0x2, 0x1)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge0\x00', <r2=>0x0})
setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="580000001000ffff27bd7000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="150c0000000000001c00128009000100766c616e000000000c000280060001000400000008000500", @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r2], 0x58}, 0x1, 0x0, 0x0, 0x28001}, 0x8000)
executing program 2:
syz_mount_image$fuse(0x0, &(0x7f0000002880)='./file0\x00', 0x20240d5, 0x0, 0x2, 0x0, 0x0)
syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x1, 0x0, 0x0)
syz_mount_image$exfat(0x0, &(0x7f0000000180)='./bus\x00', 0x2801cb0, 0x0, 0x0, 0x0, &(0x7f0000002980))
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f00000002c0)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
chdir(&(0x7f00000001c0)='./bus\x00')
socket$inet6_udp(0xa, 0x2, 0x0)
mount$incfs(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x302000, 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f00000002c0)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
chdir(&(0x7f00000001c0)='./bus\x00')
syz_mount_image$fuse(0x0, &(0x7f0000000540)='./file0\x00', 0x4400, 0x0, 0x0, 0x0, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, 0x0)
r1 = socket(0x200000000000011, 0x2, 0x1)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge0\x00', <r2=>0x0})
setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="580000001000ffff27bd7000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="150c0000000000001c00128009000100766c616e000000000c000280060001000400000008000500", @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r2], 0x58}, 0x1, 0x0, 0x0, 0x28001}, 0x8000)
executing program 3:
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="19000000040000000400000002"], 0x48)
close(0x3)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
syz_read_part_table(0x5f7, &(0x7f0000000ec0)="$eJzs3L9rJGUYB/BnJruzu1EI/gWGs7h4jQfBKtyhhLiKcBFEvOIQK0mzVQptwi54IlfkzuLk4JqzuMYYvMbyLA6OM4mCEBtBsAoiwcJOjJhXZmc2WQmkyVoIn0/xvs/7Y/c7y7xbzgT/a3l8/lFMlVVq/Xslq7rGsE39aNfzdV+UzVsbS6+8NvvGy0e7Iw7+/CQivk5T1TC1qqJTp0WdMv+w0VvfaMWLEfHV7F/f5vWXDkbFzt3GKZf9wcoZfzeTMbd64VE22H2mXR6BTixMv3R1pRnP55vfH5TLh9XtPnErZ+PNyeQ/uPRkZnQyf+yu7XV/bcTv3St3iihuRWT7F/MTH5keHdZsAvm9v98uvrj/ePH6tc781uvLy7e//OnT59aWmvXyjW+qvh1j/66nq64/gXgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACZsbvXCo2ez3cPUic+2L28vTPeurmyeX+xv5uO7Uv+F/yj/waUnMx9eTylmytHaXve3WG50r9y5d7m41Ynz+xfrfe8O2/Xivfcj4txTw1ExgfxeJyLuP17M6vHtZrxa1zspK240RxuzMi4v4oeUUkRrAtEAAAAAAAAAAAAAAAAAAABwZKkVjVF9LSIW7h0t3Syb4YPuRcS5evLnciJFzD9s9NY3uh/fnKsX6ifiB3nEICJ+2bn7zljMVrvqy6zvjsv4I6U0/qaBqeNyNT/lsrMqhbP6JwAA//+xYmft")
sendmsg$NFT_BATCH(r1, &(0x7f0000000cc0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2004c040}, 0xc000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000)
r2 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc)
write$binfmt_script(r2, &(0x7f0000000180)={'#! ', '', [{0x20, '\t\t'}, {0x20, '\t\t'}]}, 0xa)
close(r2)
execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0)
madvise(&(0x7f00008a4000/0x1000)=nil, 0x1000, 0x16)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000080000000b"], 0x50)
r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x8, 0xc, 0x80000000, 0x1}, 0x48)
fstat(r3, &(0x7f0000000180))
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000004000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000008e000085000000030000009500000000000000"], 0x0, 0x0, 0xffffff1b, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r5 = socket$packet(0x11, 0x3, 0x300)
ioctl$BTRFS_IOC_RM_DEV(r5, 0x5000940b, &(0x7f0000000a00)={{r4}, "da70a43f94ad6db2d5637b391b88435a7d022ebc3cf936da9556f7b0aec26a954be46b658e804237380da17088a721a30f2af71c9f621b9079e5371c3c952651cfd67e2527ae4c6ebc938fd567cbb6cf3fb3ee40a634da051faa9b0644abb441974a648fb0debc55dfb8772e1859e5cc6ac9c976cad23af41e93372659c644948aa5ad300b44ac080b2072018b547965b755f24115de8868835d6a58af4266667d44e59eb7fe6bf24f34189d3fd04c1bd6fc52b5c80605e6f5f5b400f02b6231bdc4c24ca886b9738a783cfc9c6b20d59dcc1a2a636271fad820c2cd4c045802191d3705416c1dd07b226a80620e00144baf12673cacae1a2a72b8a76284eb6de982be119f75909f53f62357a1e91f73dadc79c8d4bf971a543626375e3d0d60400af9785953b87d847ac9eb28eeff4f6d8ec4076a3d2b7491d0a637ba9c978c75221bde746cda77a8b32d612497cd8535b2de02f79de981f27a567832676d83b472729bdd46dcb61c4d13ee1c30e4ac243286bb37c4345eb2313b57639eeb0541e899108f232138e356bbae6a7fe9fd78da7fbee284dcee4b1819401197817821d7cd4ff8a16dc0015a249d4677034e4ebf411866dda289dfa2e1cd276f751b6b256cdc6ae16214eaa73e0ecb7d59def2d138218c47419058d353a6dbc88a6a81eeb17003268149bc54154186114d23ea8bda716afa9d5c238a421298ce17f50e109b2354f10e6f073be9ff0ec72627142c844975a9ef781f5e965e984587586605109efbd0d01d7a50d2c7bb4bd17581b3704f7f28caecf86437cac67b41f9b0d67b725008315a7db8f0219eb7344deb2cc3de05516ed93f3311dbbfb150a8f6daf273b06550bee46eb3710075c1eb86e22eaf951420720d13fec2b187c630908f98143b7afc6c6b53a1c3ff8542fa2f39043873abb39a1e1b73f74491d0b9d4f600a76c2ef39981dbee810cc767c02c10187383d3a78d6a9d616948fbb89a98b24ef2f72333814156d1fa260d3bdfe4359c36afa4d580a821ce98d41011e484a0024365394f4cb1cbd5dffa542e42bf7430c64f8c8f05a626acc583ed78ca68cf2a9270d5edec913b2881e3e5e9eef261c6642959d70465bb3bda2a70f9e4ecd7792cd02f1c79f05c5a33cab91a2525802f74016ccba83e3c1d1ecb134eea92b9b8b1bc9cf9460e62e599d9c68f8ca9c23eb81efe235bcc356052a58a241ed0aa3e635396f0c1cf638ab3c4de242a8470a3c632477fa4f50aa611ae0dd501f57f5a87024e92a5ecd6ff26b0b0d633bf5496035267ef8e3c118a5c609612b71d4a1778a44d225c4e4b7c978f1216066bb3f9f74455afe613d85320e8794b1b329facf5ba5f8ac4da7e8b7d9a2da7ddcd1f6e86b62b81e5b27dae359812127dc77e452b59d0ddb9d663d03817bd0e8abf035ee5c742279b65cb0be7767bcd50198cc32968bd4c9060cbc4f33c873cc68aaae8906f125fcc8e730850f0580055135e3e31458b6ec2aba3ca0657844fecb524f9067311c0754d440235fc54239c13d6f1339a82b587fc547ea430183738766c2b22ac5af81cd151747d67f0bc9e9d45e692a92d6e2a96b5356e1acbb1384a54f3b40d430e101f66c223f94c378b2f950e9e960265f9f5c7d2625d808257b565cfdab0cd3a8a0923a0c5a1f1aa87093bc7e70b84c16c462c32281394e4fee4e1291cc91327629060263b49dfba0de15e26a95d95149454c7495396a964d1fe614e420adbd197d8d8403d04605e376c6634aa01b298ec385441adbada0d42b6ccb6b8d60c6bfbd5495b14c9e877e381bfabca14bbdba976534c18aede3cf961310046fd104ab62dc1340ceef522d579d99cdfb4a294a023606d2f5d2c38e58ab095edd61b0b17e3793c9e176969d38cb8685f3fc35e71402323fd8a2a96e210439d40bf29875caea9190291a8e3a008a0ff9bf899468a58fad2586351deafff64a90feb8131d3e6d2905fdf13b09e10c381c3e32abdfe6c7a9a8ddd14715d0c5f090f0b62aba43612e69d76ab6b15116d178b76a91349ecefbd798c317e544a47f3e6e62fdf8da1a67fd8b237b3b4a822457db2bad4f7c61b13eb1a6d0a3f7d842459f1dc3a0a9efbd8f8606cab5a5159e951909c80be6dd8fff1eddb931d8c03698711f040d4fec3b0a144cd922b8dcd445b06f969ba4752e1ea26e0efe3967ab7f020c4a1ef81c9733491faf96f990d27baa587d42535b93fcf3a96d2eff5e75f530b3588471ed295064270aa0064d0dbeebeb4d5e27bb4b2535c25f328d7ea9d2fa1665ec33c4c0a9a79577ab06ed36c05fd0bbae827729d5689ce6e6d4af1316eae5765d5fd604ac3b163a6f20e3d95ee9b5a43dd77b0d9e7e42fff65c209caf5d5a4a00a426fb096e100b08534fd93a492c1e9a8f8b5b616b6ade4e2823c90c3e66fc6e59a616c256a49d01c9930d99d1354597643d71599a36470fe099cd753c0c0cbf35e883f0d3752f93ad48c23bb5c56d62fd1705d3678e3c360c02033991ecb268ae10e9da1e398629d5853ea750cd35c870130ecc43628cb760db6e90e6e2e5cf91a6d8d2ac9e0edd041bd2414853558f5b6ca1d09def6ccf7d0e8503196771eacfe76f6432f98ce3e562a916006a322c09b5f8050e04fb260cc1a89b2fb2ab0aa2cd6c87b3cd30874e882b4b1ea7c0fd4168864b878b551dbe16f19691547c2e8a95c7f8c4caca3e847e7d0e51143f889356a90a8f0e94931a2a32b6c09a7722756b34ef0504d028b1d2a6809b83315e12d666c3bc078e2c0c9d13d53ce1a1d975211b848be9a4ded8381d8895c2df91edf6dbacf7648f9d0804240c51e45284049d336f5ad530280c28b5fbb7d7dbf386ef8151c21a8af059ade9c2e1d07fa0d41b80ed3e2e4f8d5ced7acaa43321413799f872ad362edade44c3ad1a5ec61fe2e80089ffbe9dd739953349bc9422522152e59a898d4206b54651615f1bf3ff7f18ec37d7589511d51b939e0ce16358b85fd67e41fc3b55a42bfb1a351477820844c00c41d737b3f2d117690ac64e4f7fc0dc1ef5c2bb79fefa073d5758c6b919e89bcf6b37125ebe80929bef1ea6cf8a2e82bb9221e9b98cfa63adc1b998a165bcb70d2189aeaad017e92ea20de8aeddb0906aa164476da75ba5a0a6f16f6512d3700e5923a28519336d63b5f8902440aef6842162d0898deb4ef87e1c202f77f29316b331d3b070e1631dc1f62229ff122bb1b24acb9c58a8c80345f1d8802a71f8ff71cd12de3022d832eef07b0f2c3f8cec581c6c67a125f9a92190917af75e6c4f274a37e87ddbee94e26fe62a5d5441aac036ce8e60f71a6f45c943683ab543b90fa910ef4f77821726cc8ef11684ec53b6139ea113e845358acf5a1179a239f4b7d82600eae2d35be76adce7a51701037ece8ea88f61720e4be085efe658a388ad04afcf85c14b5f90bcd81225cbb939bed7f69f5d3393bc0350f976a6e992c5a52f15df1c3610740803d5a2576db1b5122cbfbb6c88a318d14d189b6c4a485437e1fb95f5d2a6b45877feb0cda92f0789be4160ac1ada0ec822171aca1897bb4eeba154f7faf9a01cada4c38620fd122547d4eddab39833a839289795240120c682738d7eff395386774feb668135a4f70ff91f7b4408152490c9f02047b418d60cfb449fbeae9f7bf1327f71c30b63b3a6d73ffc91e8307934e3fab790c39c70006ecaa716f2c23721bcca57cc1705c39a996a8d393a63e7a66d531c97722a71f590eb9e8eb2e968ac1091ab6214d72ad6b2f455ae9fedaaad8abfdfb5a0f0c21ca5c83db2ab3e927e32b732cbe33d05ef0b5515e7329a7b94ac473b01f3808243e9dbaaf0d1909d66b9b1c68d67e4b1e084b9fb175045887f85edf72769f38c59e0b28c83e1addf2f8c885c48594e16f35bea8ffd000e1d1f21189969789a4eac0d0fe13eb6c91d6ef1a1394cc439ed28953e5f6b98bb59b54f0a704d2e2eabd3e2a505b3d24a4190d7f658259eb2950df01ae924afd054f5ec62cee68f9ed8a9951252d8b7be0db4c51a9f16cbd58ba686792fdeb72cab9c20ba7214e9bea5876758115fbfaa369b6ed30ce34275e74b9cb7736f2a48b41fb1e73c40bb98d2d678d99d656c296452a59982a983ca36ee5d42118827e48a0a2707f007b13c1162cf20c03433724d90d7d80411506137809b06cf5811f0f7e5e67d7c7674f2d626de5acc97fe5966fa85c2cc1765b99420f4fdc3f0265c6fe7782353f0722fbce7e16facde7337b055673af4f82ae8c21af260140e823d9e650f72d10fc10642b6b2e1bbcb5c90bae53146d442932772354b6a3384eaba1a16d5a88adc127958f307b1646fefa0cf3f67a66821f2404b5b8f5f3da8ccb3875a2c4440a079c69480a3e5ed9fe8f84853a6aa0bfdfe195d2a0a312d2cd77fe014df8f2336d20ac12d0b8e64198ed3ca405fb6db6f270ef67a75320bb98367d35f32f3f70e0409085ad91bb6acc2b0c003fb186871f5b298dbf5e41d957a90ca3e42d5e146b259c72222ed00b017a3e5cc89a8cafb7b64e2e8a2bbb2b874bca7219b8f68c7bdd071965b322db21a5922b4a03e39838c389d7f916b8406fbe60fd45d926a3e41d7af351c837c76d99f087089238578c7acf66fdc371e3cbc2dd53b1536e095f8ecf567d33022cf3d24abd12c423ec43cd6f55e1bc8c8ee65c825673c6c58c7d3256b5c10f66b15258810d3c89c35f2b0c459ddbd02d8b4b57810551d5ecdd2258e9a3c0e1be31f56abd313d2888ca9ee90b9f07b23e2fd9df617796c301374983cb56a29fb7fd3e5e4eed1c608dbf760bf33666b5aea0cd4e889195adff4098dd2d2e92f7ae5edf3c4f8bb559b2995b0a916f875b230567d17a6ac66ca0ef810ce6c3dfe58bcd55378458f48e1fcad2c3e005dab52cbc7ecc3301676fbbdb4aa10fc4a30c40b7252bb5805f4a862bb3d951c1e5dce9157fade68d49bec8ef52c6f1f06492ed0f0205048b56dd03bfe0888b60c772e1ba45b63993f78793b46b4e91fc580ac7b41aef9bead0319484107207d807e928844c0350a924e98c8b3b7130dc3a8e860c747ccb2ab2a0883be7167466059d4e68171857f98f72c8cb8127dac4b4d59d14bec65dd77801256f8baf7999cac221a654ce500e286b3985da021577cd236ff3f8e58db48c03072a69c0a61f0d46d706a8e0ffbb48a40e4ee60c9a24b17cfcad9ad9427f0bfc301f659d92e52485d13b2918b2f24ffa63ba35c5529baee6352195ec56b5d5672c7fd017de8766f2b758455339d151e7c18deb7ed6b1bdc1f6c5a9ba7139fcd425ad4b3a08b618c4c8d9eda261a9b09fba676c445ffe52a146b5408cad263fd046e84a7b54b14fa66c44b80fa8e9b9b5f26fe47cfaae8f987ee3348412012d84364a6aba7d1b2714354f00e562b4a3c7be0f61178c6c8b2ac5492ade2f9aad0882c44fc54829f2f3cef5cad47a1004d9436c59620ac52e3c64bc02089f5f8cc8ca5545518dd88825b969d69b1a0e2be60b84fe5a05f7ccccef15789f8c62d24b577c534957f6335ab1564f7b3b007a5290845dc075672e73f7295e2aed3c450b04395b2ca975f4df0847041bde9354f8da52774e4053c6e2b6c7a5e649ef1bd8c401a341645a4eec150f01f663ed79d69e75029b6d80271ef0f6b793415632dea73898dfb43d676b61c413324c07e7fc14be8b78699aadc622a7163d2e170262381671fdb3e75a76a6ae87bbf67493e0bfc7f4313f3396db73c17c3d679d77d880c433c581d563bc54fcaf68857970e85f"})
setsockopt$packet_fanout(r5, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x7}, 0x4)
setsockopt$packet_int(r5, 0x107, 0x16, &(0x7f0000000000)=0x4, 0x4)
syz_emit_ethernet(0x22, &(0x7f0000000380)=ANY=[], 0x0)
r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xe, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r6}, 0xc)
executing program 0:
syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000000)='./bus\x00', 0x0, &(0x7f0000000300)={[{@grpquota}, {@quota}, {@quota}, {@stripe={'stripe', 0x3d, 0x3}}, {@jqfmt_vfsold}]}, 0xff, 0x4fa, &(0x7f00000005c0)="$eJzs3c9vG1kdAPCvnThx0uwmu+wBEOyW3YWCqjqJuxut9gDLCSFUCdEjSG1I3CiKHUexU5rQQ3rmikQlTnDkD+DcE3cuCG5cygGJHxGoQeLg1YwnqZvaTdQkdhR/PtJo3ps39fe9pvNe/U3iF8DQuhoRuxExFhF3I2I6u57LjvisfST3Pdt7uLS/93ApF63W7X/l0vbkWnT8mcSV7DWLEfGj70X8NPdy3Mb2ztpitVrZzOqzzdrGbGN758ZqbXGlslJZL5cX5hfmPrn5cfnMxvpebSwrffXpH3e/9fOkW1PZlc5xnKX20AuHcRKjEfGD8wg2ACPZeMYG3RFeSz4i3o6I99PnfzpG0q8mAHCZtVrT0ZrurAMAl10+zYHl8qUsFzAV+Xyp1M7hvROT+Wq90bx+r761vtzOlc1EIX9vtVqZy3KFM1HIJfX5tPy8Xj5SvxkRb0XEL8cn0nppqV5dHuR/fABgiF05sv7/d7y9/gMAl1xx0B0AAPrO+g8Aw8f6DwDDx/oPAMOnvf5PDLobAEAfef8PAMPH+g8AQ+WHt24lR2s/+/zr5fvbW2v1+zeWK421Um1rqbRU39wordTrK+ln9tSOe71qvb4x/1FsPZj59kajOdvY3rlTq2+tN++kn+t9p1JI79rtw8gAgF7eeu/JX3LJivzpRHpEx14OhYH2DDhv+UF3ABiYkUF3ABgYu33B8DrFe3zpAbgkumzR+4Jit18QarVarfPrEnDOrn1J/h+GVUf+308Bw5CR/4fhJf8Pw6vVyp10z/846Y0AwMUmxw/0+P7/29n5d9k3B36yfPSOx+fZKwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALjYDvb/LWV7gU9FPl8qRbwRETNRyN1brVbmIuLNiPjzeGE8qc8PuM8AwGnl/57L9v+6Nv3h1AtN7145LI5FxM9+fftXDxabzc0/RYzl/j1+cL35OLte7n/vAYDjHazT6bnjjfyzvYdLB0c/+/OP70ZEsR1/f28s9g/jj8Zoei5GISIm/5PL6m25jtzFaew+iogvdht/LqbSHEh759Oj8ZPYb/Q1fv6F+Pm0rX1O/i6+cAZ9gWHzJJl/Puv2/OXjanru/vwX0xnq9LL5L3mppf10Dnwe/2D+G+kx/109aYyP/vD9dmni5bZHEV8ejTiIvd8x/xzEz/WI/+EJ4//1K+++36ut9ZuIa9E9fmes2WZtY7axvXNjtba4UlmprJfLC/MLc5/c/Lg8m+aoZ3uvBv/89PqbvdqS8U/2iF88ZvxfP+H4f/v/uz/+2ivif/ODbvHz8c4r4idr4jdOGH9x8vfFXm1J/OUe4z/u63/9hPGf/m3npW3DAYDBaWzvrC1Wq5VNBYWLX0j+yV6AbnQtfKdfscaie9MvPmg/00eaWq3XitVrxjiLrBtwERw+9BHxv0F3BgAAAAAAAAAAAAAA6Kofv7E06DECAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABweX0eAAD//19xzyM=")
openat(0xffffffffffffff9c, &(0x7f0000000180)='./file2\x00', 0xa0c42, 0x100)
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000440)={'batadv_slave_0\x00', <r1=>0x0})
sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000ac0)=ANY=[@ANYBLOB="280000001e00150d2cbd7000fddbdf2507000000", @ANYRES32=r1, @ANYBLOB="020000000000000008000a00", @ANYRES32=r1, @ANYBLOB="128427c5d206a218816c9535b088f1ecc766ba41e7848da577c33047809bed1823b20538e81fa98267aea6d3cc81494d59c32ea3ed8993406b6f00fd29f8511c634fc036a706e5bd24599b31146407da55064d874b952ad844664de34defac1b5155427b1979b9b57107873ebf600121832d4d78d7557e6bd191d30b80c8bece6d93154600491b4ec2074fad5288d008b3ac464f63ceaf6141bc5b1522f7c16a5097882fc6d4bcf537fcc173a7cf82ec030638965c2e3d5705000000a073eed1833cb9a6a38e7af9ad65c8a165eba759af8984eae43494d232"], 0x28}}, 0x48010)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x177)
r3 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r2)
sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(r2, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x2c, r3, 0x21, 0x70bd26, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0xad}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x8}]}, 0x2c}}, 0x24088000)
write$binfmt_elf64(r2, &(0x7f0000000200)=ANY=[@ANYBLOB="7f454c4620040000000000000000000002003e00ebffffff7c000000000000004000000000000000820000000000000000000000090038000100feff020003000300"], 0xed)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
r4 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r5 = bpf$MAP_CREATE(0x0, &(0x7f0000002080)=ANY=[@ANYBLOB="0500000001000000060000000b"], 0x50)
r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000009e00000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r6}, 0xc)
sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x2000)
setsockopt$inet_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000000500)={0xe, 0x10, 0x10, 0xa, 0x200}, 0x14)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r7=>0xffffffffffffffff, <r8=>0xffffffffffffffff})
connect$unix(r7, &(0x7f0000000180)=@abs, 0x6e)
sendmmsg$unix(r8, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xb, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000f80)={0x18, 0x13, &(0x7f0000000b40)=ANY=[], &(0x7f0000000e40)='GPL\x00', 0x2, 0xd9, &(0x7f0000000e80)=""/217, 0x0, 0x8}, 0x94)
bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000001080)=ANY=[@ANYBLOB="61154c00000000006113500000000000bfa00000000000001503000008004e002d3501000000000095000000000000006916000000000000bf67000000000000350605000fff07206706000005000000160302000ee60060bf670000000000000f650000000000006507f9ff0100000007070000cddfffff1e75000000000000bf54000000000000070400000400f9ffbd4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd3997f9c9c4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05000000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe01c5473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc2300000008ac86d8a297dff0445a15f21dce4de9f29eff65aadc841848c9b562a31e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932b3a6aa57f1ad2e99e0e67ab93716d20000009fbb0f53acbb40b4f8e2738270b31562ed834f2af97787f696649a462e7ee4bcf8b07a10d6735154beb4000000000000000000000000004000bc00f679629709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253880800000000000000690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43010000207b40407d00000021000000008a523d80bd970d703f37ca364a601ae899a56715a0a62a34c6c94cce6994521629ab028acfc1d926a0f6a5489af8dc2f17923f3c40dfd1970a55c22fe3a5ac000000000000000000000000000000c1eb2d91fb79ea00000000000000bb0d00000000000000000000e4007be511fe320fea2594e190deae46e26c596f84eba9000000000000003cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631d22a11dc3c6939628950000000000000001c7205a6b068fff496d2da7d632bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a0337302f3b41eae59809fd05d12f6186f117b062df67d3a63f3265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089dad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3ff3be4d1458077c2253b0c7c7a0a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631dbaa74f22bad050e9856b48ae3a03a497c37758537650fe6db88aa3c41fdc3d78e046f6160e1741299e8dc29906870e6420ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0afa1e1c758a0079b747067312e9815a21cb3f1f8150d999d788535a4d3114dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fb9fb38f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4ff139604faf0a4da65396174b4563d54b52f06c870edf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202eeb81f428a5b3c299848649e1a6bff52f657a67463d7dbf85ae9321fc2b517dc4a29b9cba8ded5de8206c812439ab129ae818837ee1562078fc524b3baf49a0be9bb7d958d5e87c6ad62934782cc308e936d7637e07c201282bbbed84a2a3bc87b0da23c00d9ef418cf19e7a8c4c328be0ce95798adc2dca871073f6bd61dc18402cde8bf777b2eaa45c940aabc86b94f8cbde4d470667bee722a6a2af483ad0d3415ed0f9db059acaba9eaea93f811d434e00000000000000000000d154ba10a8e51489a614e69722bac30000000000000000000000000000c5dfd188ff555285b9743d3aac000583f42d168613151d681a2f71373f20d92c9048407c91fabecfe8b3f2d5454d127edab14ba61ba1cfc4336324c86f3dcb43e9a58208077e90f6ec1c7ac756f61dcc372cdd30b82507489f0bbfbd3c3f21752e81319c0161e154ceb16e00bc7f5a6962dff317f4d014786e432817064874d69a39cb0da31bcc5f81894d8a80756447322207b4007dff12eb95066cc6bc256f0a12282224d718b06ca80b57aa183dd0c3eee45891441f2b89b4c67aa9882281393954972046974f18df232cd7fca610e33f51c2d062020f403d85ff36c26e2f6bd1d82f4d3ceb3472d9a77e0057a3bfe697d9ab7585f4a1b381343d2cf855689232f4fc5135790662dc1419a374be9d7b3e5be2886d23add90d862f1a682ff11c798e338af3e5bb0f9d3952b15bf3e0c618c89d20ca1e18a031397693bf3cfbd8417e5b55e641c898c280356f2da222d5d68919d98158578dcf18efa404e508bcbbb8cfcf70086821ebdf34c9a1dff45af873df904c2bdbef81f246d26f4b40df949e12bdac18532f4e11c608cc31d60cb591c40a7b386fa1c753336d7220a35118d4919b45eff32aab684e62c6691de14e97aa7e9dc8ecf0cd50540246d2b746e41e5b4e2c095039dfe0f71db6265f7580d098be40ef36faee5d1695830d4242a23e541e6ce9fa1998d8961cf4fe3c8e8fbb566f148c8befc229614a4b7f80d237b8abc6fd0407de31d6e5532f360d379f20f054692b47207922fe6c14eba96c9a7ae906abc1ae1ae8c4fae92883cfa1978a04bbff4bbefc18f77700372471609e2c443e84ee5e9a5178f90512df04f3a0909c96632ae20c68c62b06e9fdc2977dfef1ced97b70263fc81c30f1354b319fe9d59d3101c4ee7375ff8673de5caff9e6ee73ccae77d1bf8f22330e8840af1ded6d5be627f7f87d5b12a2d6317825d77bef85313f541dcc4ff13f413db34d5da05648590a1685031e6955d4352bf0b7efd0b0a1e636b8aa4963d9f67de5ba91d501418bbeaac09bdd1059f3c3159e5900"/2282], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffffd2}, 0x48)
executing program 2:
syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000000)='./bus\x00', 0x0, &(0x7f0000000300)={[{@grpquota}, {@quota}, {@quota}, {@stripe={'stripe', 0x3d, 0x3}}, {@jqfmt_vfsold}]}, 0xff, 0x4fa, &(0x7f00000005c0)="$eJzs3c9vG1kdAPCvnThx0uwmu+wBEOyW3YWCqjqJuxut9gDLCSFUCdEjSG1I3CiKHUexU5rQQ3rmikQlTnDkD+DcE3cuCG5cygGJHxGoQeLg1YwnqZvaTdQkdhR/PtJo3ps39fe9pvNe/U3iF8DQuhoRuxExFhF3I2I6u57LjvisfST3Pdt7uLS/93ApF63W7X/l0vbkWnT8mcSV7DWLEfGj70X8NPdy3Mb2ztpitVrZzOqzzdrGbGN758ZqbXGlslJZL5cX5hfmPrn5cfnMxvpebSwrffXpH3e/9fOkW1PZlc5xnKX20AuHcRKjEfGD8wg2ACPZeMYG3RFeSz4i3o6I99PnfzpG0q8mAHCZtVrT0ZrurAMAl10+zYHl8qUsFzAV+Xyp1M7hvROT+Wq90bx+r761vtzOlc1EIX9vtVqZy3KFM1HIJfX5tPy8Xj5SvxkRb0XEL8cn0nppqV5dHuR/fABgiF05sv7/d7y9/gMAl1xx0B0AAPrO+g8Aw8f6DwDDx/oPAMOnvf5PDLobAEAfef8PAMPH+g8AQ+WHt24lR2s/+/zr5fvbW2v1+zeWK421Um1rqbRU39wordTrK+ln9tSOe71qvb4x/1FsPZj59kajOdvY3rlTq2+tN++kn+t9p1JI79rtw8gAgF7eeu/JX3LJivzpRHpEx14OhYH2DDhv+UF3ABiYkUF3ABgYu33B8DrFe3zpAbgkumzR+4Jit18QarVarfPrEnDOrn1J/h+GVUf+308Bw5CR/4fhJf8Pw6vVyp10z/846Y0AwMUmxw/0+P7/29n5d9k3B36yfPSOx+fZKwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALjYDvb/LWV7gU9FPl8qRbwRETNRyN1brVbmIuLNiPjzeGE8qc8PuM8AwGnl/57L9v+6Nv3h1AtN7145LI5FxM9+fftXDxabzc0/RYzl/j1+cL35OLte7n/vAYDjHazT6bnjjfyzvYdLB0c/+/OP70ZEsR1/f28s9g/jj8Zoei5GISIm/5PL6m25jtzFaew+iogvdht/LqbSHEh759Oj8ZPYb/Q1fv6F+Pm0rX1O/i6+cAZ9gWHzJJl/Puv2/OXjanru/vwX0xnq9LL5L3mppf10Dnwe/2D+G+kx/109aYyP/vD9dmni5bZHEV8ejTiIvd8x/xzEz/WI/+EJ4//1K+++36ut9ZuIa9E9fmes2WZtY7axvXNjtba4UlmprJfLC/MLc5/c/Lg8m+aoZ3uvBv/89PqbvdqS8U/2iF88ZvxfP+H4f/v/uz/+2ivif/ODbvHz8c4r4idr4jdOGH9x8vfFXm1J/OUe4z/u63/9hPGf/m3npW3DAYDBaWzvrC1Wq5VNBYWLX0j+yV6AbnQtfKdfscaie9MvPmg/00eaWq3XitVrxjiLrBtwERw+9BHxv0F3BgAAAAAAAAAAAAAA6Kofv7E06DECAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABweX0eAAD//19xzyM=")
openat(0xffffffffffffff9c, &(0x7f0000000180)='./file2\x00', 0xa0c42, 0x100)
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000440)={'batadv_slave_0\x00', <r1=>0x0})
sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000ac0)=ANY=[@ANYBLOB="280000001e00150d2cbd7000fddbdf2507000000", @ANYRES32=r1, @ANYBLOB="020000000000000008000a00", @ANYRES32=r1, @ANYBLOB="128427c5d206a218816c9535b088f1ecc766ba41e7848da577c33047809bed1823b20538e81fa98267aea6d3cc81494d59c32ea3ed8993406b6f00fd29f8511c634fc036a706e5bd24599b31146407da55064d874b952ad844664de34defac1b5155427b1979b9b57107873ebf600121832d4d78d7557e6bd191d30b80c8bece6d93154600491b4ec2074fad5288d008b3ac464f63ceaf6141bc5b1522f7c16a5097882fc6d4bcf537fcc173a7cf82ec030638965c2e3d5705000000a073eed1833cb9a6a38e7af9ad65c8a165eba759af8984eae43494d232"], 0x28}}, 0x48010)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x177)
r3 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r2)
sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(r2, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x2c, r3, 0x21, 0x70bd26, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0xad}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x8}]}, 0x2c}}, 0x24088000)
write$binfmt_elf64(r2, &(0x7f0000000200)=ANY=[@ANYBLOB="7f454c4620040000000000000000000002003e00ebffffff7c000000000000004000000000000000820000000000000000000000090038000100feff020003000300"], 0xed)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
r4 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r5 = bpf$MAP_CREATE(0x0, &(0x7f0000002080)=ANY=[@ANYBLOB="0500000001000000060000000b"], 0x50)
r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000009e00000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r6}, 0xc)
sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x2000)
setsockopt$inet_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000000500)={0xe, 0x10, 0x10, 0xa, 0x200}, 0x14)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r7=>0xffffffffffffffff, <r8=>0xffffffffffffffff})
connect$unix(r7, &(0x7f0000000180)=@abs, 0x6e)
sendmmsg$unix(r8, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xb, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
executing program 1:
r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x16b042, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0b000000080000000c000000ffbfffff01"], 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000810018110000", @ANYRES32=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xfffffff3)
mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1000001, 0x13, r0, 0x0)
executing program 1:
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000280)=0x4, 0x4)
sendto$inet(r0, &(0x7f0000000040)="0400", 0xffec, 0x0, &(0x7f0000000340)={0x2, 0x0, @loopback}, 0x10)
syz_mount_image$fuse(&(0x7f0000000240), &(0x7f0000000380)='./file0\x00', 0x100000, &(0x7f00000003c0)=ANY=[@ANYBLOB="aadaca5cb30193904b2b36ea0d765e3fae82e6a1e8dc16c6deb2bc86e1e02b3f574ddeeb598ec450a2a649e7105bfe4e8e594118fe3b0c47fa4b59547f8359539f41ce267375a013a2f5bf38718f70bd011cf68b9441dfd4bc702556421f46dbc80c969069ccfe8948f01a3a743b425bb085bb95d6c99e0c09648ddaef895d8ea4e3f8c2e1d6ed2cf231fe66bb4d3777985188fade946da67980895190c377819b09f70cde2f054329220a662863a8cf", @ANYRES32=r0], 0x1, 0x0, 0x0)
r1 = open(&(0x7f0000000000)='./file0\x00', 0x315542, 0x3b4)
r2 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
sendfile(r1, r2, 0x0, 0x10002)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
openat$ptmx(0xffffffffffffff9c, 0x0, 0x2000, 0x0)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000001a40)=[{{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000040)}], 0x1}}], 0x1, 0x488c0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000f000/0x18000)=nil, &(0x7f0000000380)=[@text32={0x20, &(0x7f0000000300)="b8050000000f01c10f46a78900000066ba2100b067ee66ba2000b8000000000f23c00f21f835010003000f23f8ee6d6c2f800000c00f3266bac0000f3066b808008ed0660f38806f008ee0", 0x4b}], 0x1, 0x3b, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60)
r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0xe, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="850000002e0000006c0a00000000000045000000000000009500000000000000"], &(0x7f0000000140)='GPL\x00', 0x5, 0x99, &(0x7f0000000180)=""/153, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x13}, 0x23)
ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000000)={[0x36, 0x40000000788, 0x80000000002, 0x183, 0x400000004, 0x0, 0xee, 0x0, 0x100000000, 0x1000045, 0x10000, 0x6, 0xf, 0xfffffffffffffffd, 0x0, 0xab], 0x8000000, 0x3c4210})
ioctl$KVM_RUN(r5, 0xae80, 0x0)
r6 = syz_btf_id_by_name$bpf_lsm(&(0x7f0000000140)='bpf_lsm_task_setnice\x00')
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x15, 0xc, &(0x7f0000000180)=ANY=[@ANYRESDEC=r2, @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000003800000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x46, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r6, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
executing program 1:
syz_mount_image$fuse(0x0, &(0x7f0000002880)='./file0\x00', 0x20240d5, 0x0, 0x2, 0x0, 0x0)
syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x1, 0x0, 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f00000002c0)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
chdir(0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f00000002c0)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
chdir(&(0x7f00000001c0)='./bus\x00')
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x4008, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]})
executing program 1:
r0 = socket(0x10, 0x803, 0x0)
sendmsg$SMC_PNETID_GET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}}, 0x0)
getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, <r1=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000580)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB="540000001000370401000000ffdbdf2500000000", @ANYRES32=r1, @ANYBLOB="890c04000000000005001000050000002c0012800b00010067726574617000001c000280050017000000000008000400030000000600"], 0x54}, 0x1, 0x0, 0x0, 0x44801}, 0x0)
r2 = userfaultfd(0x80001)
r3 = socket$tipc(0x1e, 0x5, 0x0)
bind$tipc(r3, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10)
r4 = socket$tipc(0x1e, 0x5, 0x0)
bind$tipc(r4, &(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10)
r5 = socket$tipc(0x1e, 0x2, 0x0)
setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000100)={0x42, 0x2, 0x2}, 0x10)
sendmsg$tipc(r5, &(0x7f0000002340)={&(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x4, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4080000}, 0x0)
close_range(r2, 0xffffffffffffffff, 0x0)
r6 = socket$inet(0x2, 0x2, 0x0)
sendmmsg$inet(r6, &(0x7f0000003380)=[{{&(0x7f0000000000)={0x2, 0x4e21, @local}, 0x10, 0x0, 0x0, &(0x7f0000000340)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r1, @empty, @rand_addr=0x64010102}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x8}}], 0x38}}], 0x1, 0x4040880)
executing program 3:
syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x200008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r0 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x2)
mprotect(&(0x7f0000004000/0x4000)=nil, 0x4000, 0x8)
r1 = openat$random(0xffffffffffffff9c, &(0x7f000000fe80), 0x40800, 0x0)
ioctl$RNDADDENTROPY(r1, 0x40085203, &(0x7f0000000780)=ANY=[@ANYBLOB="04000000000010"])
syz_emit_ethernet(0x86, &(0x7f0000000280)=ANY=[@ANYBLOB], 0x0)
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0)
setsockopt$WPAN_SECURITY_LEVEL(0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x4, 0x16, &(0x7f0000001000)=ANY=[@ANYBLOB="61128c000000000061134c0000000000bf20000000000000070000000f0000003d030100000000009500ffb1000000006926000000301b00bf6700000000000036000b000fff52004507faff15300000d60600000ee60000bf050000000000003d63000000000000650700000200000007070000fbffffff1f75000000000000bf54000000000000070000000410f900bd430100000000009500000000000000050000000000000095000000000000001c15a3ce747c693a74b62fd0758b15f09429c09074bc4b2bd2dc480dd7a064b8673e2060162cc43bcba1060999eef9d60bb39d0af449deaa27ea949e8f9000d885deea2783835e29eba8546fc020c1966f8b5f32b095f566edf66b7751828da9dbd5b996b9e8d897e461c01c697671d100000000400036c17fb01dde179c1f26cac1c7b21bde7d1a55d6ebe700b3be005e47ef55e0dd81244b18590e000000000000356d82e43407a6d7fa94b21002f06cd247b126b6349ab62d7b07ba0a71a72145edade9941f49f300a8c8913e0e4ea9e4c77740ab3312edee62a4dc2fc85755d387d8a1bc8eb71fbe11b2216cc8d1f0160c237d929b49d828724b95555b459f4763c6222175c974be2f76fb5f330b015a68587a75c013000000000000000000000003000000000000d6ddc46e58eff8f4fbadfc6a3af8123b7f4240713a4c0cdc9d7820c4eb67cc0f8b5fe9258eeacb5776aebbab3d5c55020000006082778366dadfc36029633e0514cbcee1f3928970bde148c940434f33acd377cbad17673b2d30b6339255c98eba97efb4e9ac1f11be815dd6045592edcbee7f253ec74c7c1313505bd7ff8fd58b3a6569c91dbdef1df585aeaea7346a2a65caee5c85f9eddeeeee3c8a2e523c864ac430eb47cb4d0c8767b9d4125661b5a1a170c04b64da3a99ddb93bf14fae3ca2d1e882375b8dbac83978e136c34f90b33cc0eeb57debcfe26589efc08125d5d62a7e593c9738a50171adf051ea4f07e7e7e770c2016eeacbe8511afffffbea75759a1ea5404f5453c0b5c46c9700808c096cf8cf5223f341cbea3841b5cd224c1b381d56afebe9f99a00e3cd94dc0bb7af9e8709db487cc4d9b3b96723d69d512ddd57b0dee9b9f6ae80a502cce352098603e77f9ecced07fa25e99e9e415414c91f8bfd1c150570512f26c4ee34a64c131dce3800000000000000006c86287945bd8d258442870e000000000000000000000000f7e6a10de4bf7369b0d5b5373829b09bf5b7b34099b27ac7770fca449d4c4ca15f88b588b2429af2e1d1a4e1fa44cb80fcfae6e50d7e5b4675d7e0be706224f34e6eed553b40e2b897e73752fc7d1e4b0f4c5967eefd7448d5fde5841fa464a67267c631052bd7333769a4b8d19d4794357edce762e8136ab9d7ed34a72baffd849b90579b96b3"], &(0x7f0000000100)='GPL\x00'}, 0x48)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
bisect: bisecting 19 programs
bisect: split chunks (needed=false): <19>
bisect: split chunk #0 of len 19 into 3 parts
bisect: testing without sub-chunk 1/3
testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [21, 2, 16, 16, 23, 26, 24, 7, 21, 7, 15, 18]
detailed listing:
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x901800, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_mount_image$fuse(&(0x7f0000002040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000280)=ANY=[], 0x0, 0x0, 0x0)
read$FUSE(0xffffffffffffffff, &(0x7f0000004080)={0x2020}, 0x2020)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0)
r3 = socket$netlink(0x10, 0x3, 0x0)
getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r4=>0x0}, &(0x7f00000000c0)=0xc)
syz_mount_image$msdos(&(0x7f0000000040), &(0x7f0000001200)='./file1\x00', 0x1008090, &(0x7f0000000100)=ANY=[@ANYBLOB='nodots,dots,nfs,gid=', @ANYRESHEX=r4, @ANYBLOB=',dovs,dots,audit,\x00'], 0x1, 0x11c3, &(0x7f0000001240)="$eJzs281qa1UUB/Dlvb3mmmvT+m2duNGJTg62A0dOirQgDShtI7SCcEpTDYlJyMkgEQcFZ458DnHoTBBfwCcpguikI4+00X5RRVvaSO/vN8mCfzbsRciBfdjr4J2vP2vvFdlePox7TzyImX5EOkyR4l7cj4n9ePPL1d++2tjaXluu11fWU1pd3lx8O6VUe/WHj7749rUfh48+/K72fSV+mv/44JeloyULB79vftoqUqtI3d4w5Wmn1xvmO51m2m0V7SylDzrNvGimVrdoDs7le51evz9OeXd3ttofNIsi5d1xajfHadhLw8E45Z/krW7KsizNVoPraHxzWJZlRFk+iCejLMvyqajGo3g6ZqMWc1GJiGfjuXg+XogX46Xay7Fw/K1p7xsAAAAAAAAAAAAAAAAAAADuln+e/5+PZ87O/4f5fwAAAAAAAAAAAAAAAAAAALgJ5v8BAAAAAAAAAAAAAAAAAABg+sz/AwAAAAAAAAAAAAAAAAAAwPRtbG2vLdfrK+spPYz4eX/UGDUmn5N89b36ylvp2Pzpql9Ho8b9k3xxkqfzeSWqf+ZLl+YP443XJ/lR9u779Qv5K7F78+0DAADAYyFLJy4932fZ3+WT6sz7gfPn97mImLm1NriiYvx5O+90mgPFLRZ//TH+L/u5TjFzJ7pQXCym/GDiVpz+6NPeCQAAAAAAAAAAAP/Fv7wPWImIK18nnHaPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8Ac7cCwAAAAAIMzfOo2ODQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4KoAAAD//ynKjbc=")
mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='debugfs\x00', 0x0, &(0x7f0000000100))
syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0)
mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', 0x0, 0x404, 0x0)
bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000200)={0x0, <r5=>0x0}, 0x6)
r6 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000040)=r5, 0x4)
bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000000)={r6, 0x20, &(0x7f0000000280)={&(0x7f0000000080)=""/238, 0xffffffffffffff80, 0x0, 0x0}}, 0x1e)
r7 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="7c010000190001000000000000000000fc0200000000000000000000000000007f000001000000000000000000000000fffd0006000000000a00000008000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000010800000000000000000000000000000000000000000000070000000000000000000000000000001d00000000000000040000000000000000000000000000000000000000000000dd02000000000000000000000000000000010002003f0000c4000500ac14143b000000000000000000000000000004d32b00000000000000ac14140c000000000000000000000000000000000000fb000000000000000000ff000000000000000000000000000000f8ffffff0000000033000000020000000a0101010000000000000000000000000000000001"], 0x17c}, 0x1, 0x0, 0x0, 0x40001}, 0x0)
mount$tmpfs(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x3010080, 0x0)
mount$tmpfs(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x84022, &(0x7f0000000240)={[{@nr_inodes={'nr_inodes', 0x3d, [0x65]}}, {@size={'size', 0x3d, [0x6d]}}]})
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x10, 0x0, 0x0)
ioctl$KVM_GET_SREGS2(r2, 0x8140aecc, &(0x7f0000000340))
executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000680)=ANY=[@ANYBLOB="4c00000010004b0422000000000000007a000000", @ANYRES32=0x0, @ANYBLOB="00000000000000002c0012800b00010062726964676500001c0002800800040000000000080015000000"], 0x4c}, 0x1, 0x0, 0x0, 0x200400a0}, 0x0)
executing program 0:
syz_mount_image$fuse(0x0, &(0x7f0000002880)='./file0\x00', 0x20240d5, 0x0, 0x2, 0x0, 0x0)
syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x1, 0x0, 0x0)
syz_mount_image$exfat(0x0, &(0x7f0000000180)='./bus\x00', 0x2801cb0, 0x0, 0x0, 0x0, &(0x7f0000002980))
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f00000002c0)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
chdir(&(0x7f00000001c0)='./bus\x00')
ioctl$int_in(0xffffffffffffffff, 0x5421, &(0x7f0000000200))
mount$incfs(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x302000, 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f00000002c0)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
chdir(&(0x7f00000001c0)='./bus\x00')
syz_mount_image$fuse(0x0, &(0x7f0000000540)='./file0\x00', 0x4400, 0x0, 0x0, 0x0, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, 0x0)
r1 = socket(0x200000000000011, 0x2, 0x1)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge0\x00', <r2=>0x0})
setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="580000001000ffff27bd7000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="150c0000000000001c00128009000100766c616e000000000c000280060001000400000008000500", @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r2], 0x58}, 0x1, 0x0, 0x0, 0x28001}, 0x8000)
executing program 2:
syz_mount_image$fuse(0x0, &(0x7f0000002880)='./file0\x00', 0x20240d5, 0x0, 0x2, 0x0, 0x0)
syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x1, 0x0, 0x0)
syz_mount_image$exfat(0x0, &(0x7f0000000180)='./bus\x00', 0x2801cb0, 0x0, 0x0, 0x0, &(0x7f0000002980))
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f00000002c0)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
chdir(&(0x7f00000001c0)='./bus\x00')
socket$inet6_udp(0xa, 0x2, 0x0)
mount$incfs(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x302000, 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f00000002c0)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
chdir(&(0x7f00000001c0)='./bus\x00')
syz_mount_image$fuse(0x0, &(0x7f0000000540)='./file0\x00', 0x4400, 0x0, 0x0, 0x0, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, 0x0)
r1 = socket(0x200000000000011, 0x2, 0x1)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge0\x00', <r2=>0x0})
setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="580000001000ffff27bd7000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="150c0000000000001c00128009000100766c616e000000000c000280060001000400000008000500", @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r2], 0x58}, 0x1, 0x0, 0x0, 0x28001}, 0x8000)
executing program 3:
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="19000000040000000400000002"], 0x48)
close(0x3)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
syz_read_part_table(0x5f7, &(0x7f0000000ec0)="$eJzs3L9rJGUYB/BnJruzu1EI/gWGs7h4jQfBKtyhhLiKcBFEvOIQK0mzVQptwi54IlfkzuLk4JqzuMYYvMbyLA6OM4mCEBtBsAoiwcJOjJhXZmc2WQmkyVoIn0/xvs/7Y/c7y7xbzgT/a3l8/lFMlVVq/Xslq7rGsE39aNfzdV+UzVsbS6+8NvvGy0e7Iw7+/CQivk5T1TC1qqJTp0WdMv+w0VvfaMWLEfHV7F/f5vWXDkbFzt3GKZf9wcoZfzeTMbd64VE22H2mXR6BTixMv3R1pRnP55vfH5TLh9XtPnErZ+PNyeQ/uPRkZnQyf+yu7XV/bcTv3St3iihuRWT7F/MTH5keHdZsAvm9v98uvrj/ePH6tc781uvLy7e//OnT59aWmvXyjW+qvh1j/66nq64/gXgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACZsbvXCo2ez3cPUic+2L28vTPeurmyeX+xv5uO7Uv+F/yj/waUnMx9eTylmytHaXve3WG50r9y5d7m41Ynz+xfrfe8O2/Xivfcj4txTw1ExgfxeJyLuP17M6vHtZrxa1zspK240RxuzMi4v4oeUUkRrAtEAAAAAAAAAAAAAAAAAAABwZKkVjVF9LSIW7h0t3Syb4YPuRcS5evLnciJFzD9s9NY3uh/fnKsX6ifiB3nEICJ+2bn7zljMVrvqy6zvjsv4I6U0/qaBqeNyNT/lsrMqhbP6JwAA//+xYmft")
sendmsg$NFT_BATCH(r1, &(0x7f0000000cc0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2004c040}, 0xc000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000)
r2 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc)
write$binfmt_script(r2, &(0x7f0000000180)={'#! ', '', [{0x20, '\t\t'}, {0x20, '\t\t'}]}, 0xa)
close(r2)
execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0)
madvise(&(0x7f00008a4000/0x1000)=nil, 0x1000, 0x16)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000080000000b"], 0x50)
r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x8, 0xc, 0x80000000, 0x1}, 0x48)
fstat(r3, &(0x7f0000000180))
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000004000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000008e000085000000030000009500000000000000"], 0x0, 0x0, 0xffffff1b, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r5 = socket$packet(0x11, 0x3, 0x300)
ioctl$BTRFS_IOC_RM_DEV(r5, 0x5000940b, &(0x7f0000000a00)={{r4}, "da70a43f94ad6db2d5637b391b88435a7d022ebc3cf936da9556f7b0aec26a954be46b658e804237380da17088a721a30f2af71c9f621b9079e5371c3c952651cfd67e2527ae4c6ebc938fd567cbb6cf3fb3ee40a634da051faa9b0644abb441974a648fb0debc55dfb8772e1859e5cc6ac9c976cad23af41e93372659c644948aa5ad300b44ac080b2072018b547965b755f24115de8868835d6a58af4266667d44e59eb7fe6bf24f34189d3fd04c1bd6fc52b5c80605e6f5f5b400f02b6231bdc4c24ca886b9738a783cfc9c6b20d59dcc1a2a636271fad820c2cd4c045802191d3705416c1dd07b226a80620e00144baf12673cacae1a2a72b8a76284eb6de982be119f75909f53f62357a1e91f73dadc79c8d4bf971a543626375e3d0d60400af9785953b87d847ac9eb28eeff4f6d8ec4076a3d2b7491d0a637ba9c978c75221bde746cda77a8b32d612497cd8535b2de02f79de981f27a567832676d83b472729bdd46dcb61c4d13ee1c30e4ac243286bb37c4345eb2313b57639eeb0541e899108f232138e356bbae6a7fe9fd78da7fbee284dcee4b1819401197817821d7cd4ff8a16dc0015a249d4677034e4ebf411866dda289dfa2e1cd276f751b6b256cdc6ae16214eaa73e0ecb7d59def2d138218c47419058d353a6dbc88a6a81eeb17003268149bc54154186114d23ea8bda716afa9d5c238a421298ce17f50e109b2354f10e6f073be9ff0ec72627142c844975a9ef781f5e965e984587586605109efbd0d01d7a50d2c7bb4bd17581b3704f7f28caecf86437cac67b41f9b0d67b725008315a7db8f0219eb7344deb2cc3de05516ed93f3311dbbfb150a8f6daf273b06550bee46eb3710075c1eb86e22eaf951420720d13fec2b187c630908f98143b7afc6c6b53a1c3ff8542fa2f39043873abb39a1e1b73f74491d0b9d4f600a76c2ef39981dbee810cc767c02c10187383d3a78d6a9d616948fbb89a98b24ef2f72333814156d1fa260d3bdfe4359c36afa4d580a821ce98d41011e484a0024365394f4cb1cbd5dffa542e42bf7430c64f8c8f05a626acc583ed78ca68cf2a9270d5edec913b2881e3e5e9eef261c6642959d70465bb3bda2a70f9e4ecd7792cd02f1c79f05c5a33cab91a2525802f74016ccba83e3c1d1ecb134eea92b9b8b1bc9cf9460e62e599d9c68f8ca9c23eb81efe235bcc356052a58a241ed0aa3e635396f0c1cf638ab3c4de242a8470a3c632477fa4f50aa611ae0dd501f57f5a87024e92a5ecd6ff26b0b0d633bf5496035267ef8e3c118a5c609612b71d4a1778a44d225c4e4b7c978f1216066bb3f9f74455afe613d85320e8794b1b329facf5ba5f8ac4da7e8b7d9a2da7ddcd1f6e86b62b81e5b27dae359812127dc77e452b59d0ddb9d663d03817bd0e8abf035ee5c742279b65cb0be7767bcd50198cc32968bd4c9060cbc4f33c873cc68aaae8906f125fcc8e730850f0580055135e3e31458b6ec2aba3ca0657844fecb524f9067311c0754d440235fc54239c13d6f1339a82b587fc547ea430183738766c2b22ac5af81cd151747d67f0bc9e9d45e692a92d6e2a96b5356e1acbb1384a54f3b40d430e101f66c223f94c378b2f950e9e960265f9f5c7d2625d808257b565cfdab0cd3a8a0923a0c5a1f1aa87093bc7e70b84c16c462c32281394e4fee4e1291cc91327629060263b49dfba0de15e26a95d95149454c7495396a964d1fe614e420adbd197d8d8403d04605e376c6634aa01b298ec385441adbada0d42b6ccb6b8d60c6bfbd5495b14c9e877e381bfabca14bbdba976534c18aede3cf961310046fd104ab62dc1340ceef522d579d99cdfb4a294a023606d2f5d2c38e58ab095edd61b0b17e3793c9e176969d38cb8685f3fc35e71402323fd8a2a96e210439d40bf29875caea9190291a8e3a008a0ff9bf899468a58fad2586351deafff64a90feb8131d3e6d2905fdf13b09e10c381c3e32abdfe6c7a9a8ddd14715d0c5f090f0b62aba43612e69d76ab6b15116d178b76a91349ecefbd798c317e544a47f3e6e62fdf8da1a67fd8b237b3b4a822457db2bad4f7c61b13eb1a6d0a3f7d842459f1dc3a0a9efbd8f8606cab5a5159e951909c80be6dd8fff1eddb931d8c03698711f040d4fec3b0a144cd922b8dcd445b06f969ba4752e1ea26e0efe3967ab7f020c4a1ef81c9733491faf96f990d27baa587d42535b93fcf3a96d2eff5e75f530b3588471ed295064270aa0064d0dbeebeb4d5e27bb4b2535c25f328d7ea9d2fa1665ec33c4c0a9a79577ab06ed36c05fd0bbae827729d5689ce6e6d4af1316eae5765d5fd604ac3b163a6f20e3d95ee9b5a43dd77b0d9e7e42fff65c209caf5d5a4a00a426fb096e100b08534fd93a492c1e9a8f8b5b616b6ade4e2823c90c3e66fc6e59a616c256a49d01c9930d99d1354597643d71599a36470fe099cd753c0c0cbf35e883f0d3752f93ad48c23bb5c56d62fd1705d3678e3c360c02033991ecb268ae10e9da1e398629d5853ea750cd35c870130ecc43628cb760db6e90e6e2e5cf91a6d8d2ac9e0edd041bd2414853558f5b6ca1d09def6ccf7d0e8503196771eacfe76f6432f98ce3e562a916006a322c09b5f8050e04fb260cc1a89b2fb2ab0aa2cd6c87b3cd30874e882b4b1ea7c0fd4168864b878b551dbe16f19691547c2e8a95c7f8c4caca3e847e7d0e51143f889356a90a8f0e94931a2a32b6c09a7722756b34ef0504d028b1d2a6809b83315e12d666c3bc078e2c0c9d13d53ce1a1d975211b848be9a4ded8381d8895c2df91edf6dbacf7648f9d0804240c51e45284049d336f5ad530280c28b5fbb7d7dbf386ef8151c21a8af059ade9c2e1d07fa0d41b80ed3e2e4f8d5ced7acaa43321413799f872ad362edade44c3ad1a5ec61fe2e80089ffbe9dd739953349bc9422522152e59a898d4206b54651615f1bf3ff7f18ec37d7589511d51b939e0ce16358b85fd67e41fc3b55a42bfb1a351477820844c00c41d737b3f2d117690ac64e4f7fc0dc1ef5c2bb79fefa073d5758c6b919e89bcf6b37125ebe80929bef1ea6cf8a2e82bb9221e9b98cfa63adc1b998a165bcb70d2189aeaad017e92ea20de8aeddb0906aa164476da75ba5a0a6f16f6512d3700e5923a28519336d63b5f8902440aef6842162d0898deb4ef87e1c202f77f29316b331d3b070e1631dc1f62229ff122bb1b24acb9c58a8c80345f1d8802a71f8ff71cd12de3022d832eef07b0f2c3f8cec581c6c67a125f9a92190917af75e6c4f274a37e87ddbee94e26fe62a5d5441aac036ce8e60f71a6f45c943683ab543b90fa910ef4f77821726cc8ef11684ec53b6139ea113e845358acf5a1179a239f4b7d82600eae2d35be76adce7a51701037ece8ea88f61720e4be085efe658a388ad04afcf85c14b5f90bcd81225cbb939bed7f69f5d3393bc0350f976a6e992c5a52f15df1c3610740803d5a2576db1b5122cbfbb6c88a318d14d189b6c4a485437e1fb95f5d2a6b45877feb0cda92f0789be4160ac1ada0ec822171aca1897bb4eeba154f7faf9a01cada4c38620fd122547d4eddab39833a839289795240120c682738d7eff395386774feb668135a4f70ff91f7b4408152490c9f02047b418d60cfb449fbeae9f7bf1327f71c30b63b3a6d73ffc91e8307934e3fab790c39c70006ecaa716f2c23721bcca57cc1705c39a996a8d393a63e7a66d531c97722a71f590eb9e8eb2e968ac1091ab6214d72ad6b2f455ae9fedaaad8abfdfb5a0f0c21ca5c83db2ab3e927e32b732cbe33d05ef0b5515e7329a7b94ac473b01f3808243e9dbaaf0d1909d66b9b1c68d67e4b1e084b9fb175045887f85edf72769f38c59e0b28c83e1addf2f8c885c48594e16f35bea8ffd000e1d1f21189969789a4eac0d0fe13eb6c91d6ef1a1394cc439ed28953e5f6b98bb59b54f0a704d2e2eabd3e2a505b3d24a4190d7f658259eb2950df01ae924afd054f5ec62cee68f9ed8a9951252d8b7be0db4c51a9f16cbd58ba686792fdeb72cab9c20ba7214e9bea5876758115fbfaa369b6ed30ce34275e74b9cb7736f2a48b41fb1e73c40bb98d2d678d99d656c296452a59982a983ca36ee5d42118827e48a0a2707f007b13c1162cf20c03433724d90d7d80411506137809b06cf5811f0f7e5e67d7c7674f2d626de5acc97fe5966fa85c2cc1765b99420f4fdc3f0265c6fe7782353f0722fbce7e16facde7337b055673af4f82ae8c21af260140e823d9e650f72d10fc10642b6b2e1bbcb5c90bae53146d442932772354b6a3384eaba1a16d5a88adc127958f307b1646fefa0cf3f67a66821f2404b5b8f5f3da8ccb3875a2c4440a079c69480a3e5ed9fe8f84853a6aa0bfdfe195d2a0a312d2cd77fe014df8f2336d20ac12d0b8e64198ed3ca405fb6db6f270ef67a75320bb98367d35f32f3f70e0409085ad91bb6acc2b0c003fb186871f5b298dbf5e41d957a90ca3e42d5e146b259c72222ed00b017a3e5cc89a8cafb7b64e2e8a2bbb2b874bca7219b8f68c7bdd071965b322db21a5922b4a03e39838c389d7f916b8406fbe60fd45d926a3e41d7af351c837c76d99f087089238578c7acf66fdc371e3cbc2dd53b1536e095f8ecf567d33022cf3d24abd12c423ec43cd6f55e1bc8c8ee65c825673c6c58c7d3256b5c10f66b15258810d3c89c35f2b0c459ddbd02d8b4b57810551d5ecdd2258e9a3c0e1be31f56abd313d2888ca9ee90b9f07b23e2fd9df617796c301374983cb56a29fb7fd3e5e4eed1c608dbf760bf33666b5aea0cd4e889195adff4098dd2d2e92f7ae5edf3c4f8bb559b2995b0a916f875b230567d17a6ac66ca0ef810ce6c3dfe58bcd55378458f48e1fcad2c3e005dab52cbc7ecc3301676fbbdb4aa10fc4a30c40b7252bb5805f4a862bb3d951c1e5dce9157fade68d49bec8ef52c6f1f06492ed0f0205048b56dd03bfe0888b60c772e1ba45b63993f78793b46b4e91fc580ac7b41aef9bead0319484107207d807e928844c0350a924e98c8b3b7130dc3a8e860c747ccb2ab2a0883be7167466059d4e68171857f98f72c8cb8127dac4b4d59d14bec65dd77801256f8baf7999cac221a654ce500e286b3985da021577cd236ff3f8e58db48c03072a69c0a61f0d46d706a8e0ffbb48a40e4ee60c9a24b17cfcad9ad9427f0bfc301f659d92e52485d13b2918b2f24ffa63ba35c5529baee6352195ec56b5d5672c7fd017de8766f2b758455339d151e7c18deb7ed6b1bdc1f6c5a9ba7139fcd425ad4b3a08b618c4c8d9eda261a9b09fba676c445ffe52a146b5408cad263fd046e84a7b54b14fa66c44b80fa8e9b9b5f26fe47cfaae8f987ee3348412012d84364a6aba7d1b2714354f00e562b4a3c7be0f61178c6c8b2ac5492ade2f9aad0882c44fc54829f2f3cef5cad47a1004d9436c59620ac52e3c64bc02089f5f8cc8ca5545518dd88825b969d69b1a0e2be60b84fe5a05f7ccccef15789f8c62d24b577c534957f6335ab1564f7b3b007a5290845dc075672e73f7295e2aed3c450b04395b2ca975f4df0847041bde9354f8da52774e4053c6e2b6c7a5e649ef1bd8c401a341645a4eec150f01f663ed79d69e75029b6d80271ef0f6b793415632dea73898dfb43d676b61c413324c07e7fc14be8b78699aadc622a7163d2e170262381671fdb3e75a76a6ae87bbf67493e0bfc7f4313f3396db73c17c3d679d77d880c433c581d563bc54fcaf68857970e85f"})
setsockopt$packet_fanout(r5, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x7}, 0x4)
setsockopt$packet_int(r5, 0x107, 0x16, &(0x7f0000000000)=0x4, 0x4)
syz_emit_ethernet(0x22, &(0x7f0000000380)=ANY=[], 0x0)
r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xe, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r6}, 0xc)
executing program 0:
syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000000)='./bus\x00', 0x0, &(0x7f0000000300)={[{@grpquota}, {@quota}, {@quota}, {@stripe={'stripe', 0x3d, 0x3}}, {@jqfmt_vfsold}]}, 0xff, 0x4fa, &(0x7f00000005c0)="$eJzs3c9vG1kdAPCvnThx0uwmu+wBEOyW3YWCqjqJuxut9gDLCSFUCdEjSG1I3CiKHUexU5rQQ3rmikQlTnDkD+DcE3cuCG5cygGJHxGoQeLg1YwnqZvaTdQkdhR/PtJo3ps39fe9pvNe/U3iF8DQuhoRuxExFhF3I2I6u57LjvisfST3Pdt7uLS/93ApF63W7X/l0vbkWnT8mcSV7DWLEfGj70X8NPdy3Mb2ztpitVrZzOqzzdrGbGN758ZqbXGlslJZL5cX5hfmPrn5cfnMxvpebSwrffXpH3e/9fOkW1PZlc5xnKX20AuHcRKjEfGD8wg2ACPZeMYG3RFeSz4i3o6I99PnfzpG0q8mAHCZtVrT0ZrurAMAl10+zYHl8qUsFzAV+Xyp1M7hvROT+Wq90bx+r761vtzOlc1EIX9vtVqZy3KFM1HIJfX5tPy8Xj5SvxkRb0XEL8cn0nppqV5dHuR/fABgiF05sv7/d7y9/gMAl1xx0B0AAPrO+g8Aw8f6DwDDx/oPAMOnvf5PDLobAEAfef8PAMPH+g8AQ+WHt24lR2s/+/zr5fvbW2v1+zeWK421Um1rqbRU39wordTrK+ln9tSOe71qvb4x/1FsPZj59kajOdvY3rlTq2+tN++kn+t9p1JI79rtw8gAgF7eeu/JX3LJivzpRHpEx14OhYH2DDhv+UF3ABiYkUF3ABgYu33B8DrFe3zpAbgkumzR+4Jit18QarVarfPrEnDOrn1J/h+GVUf+308Bw5CR/4fhJf8Pw6vVyp10z/846Y0AwMUmxw/0+P7/29n5d9k3B36yfPSOx+fZKwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALjYDvb/LWV7gU9FPl8qRbwRETNRyN1brVbmIuLNiPjzeGE8qc8PuM8AwGnl/57L9v+6Nv3h1AtN7145LI5FxM9+fftXDxabzc0/RYzl/j1+cL35OLte7n/vAYDjHazT6bnjjfyzvYdLB0c/+/OP70ZEsR1/f28s9g/jj8Zoei5GISIm/5PL6m25jtzFaew+iogvdht/LqbSHEh759Oj8ZPYb/Q1fv6F+Pm0rX1O/i6+cAZ9gWHzJJl/Puv2/OXjanru/vwX0xnq9LL5L3mppf10Dnwe/2D+G+kx/109aYyP/vD9dmni5bZHEV8ejTiIvd8x/xzEz/WI/+EJ4//1K+++36ut9ZuIa9E9fmes2WZtY7axvXNjtba4UlmprJfLC/MLc5/c/Lg8m+aoZ3uvBv/89PqbvdqS8U/2iF88ZvxfP+H4f/v/uz/+2ivif/ODbvHz8c4r4idr4jdOGH9x8vfFXm1J/OUe4z/u63/9hPGf/m3npW3DAYDBaWzvrC1Wq5VNBYWLX0j+yV6AbnQtfKdfscaie9MvPmg/00eaWq3XitVrxjiLrBtwERw+9BHxv0F3BgAAAAAAAAAAAAAA6Kofv7E06DECAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABweX0eAAD//19xzyM=")
openat(0xffffffffffffff9c, &(0x7f0000000180)='./file2\x00', 0xa0c42, 0x100)
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000440)={'batadv_slave_0\x00', <r1=>0x0})
sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000ac0)=ANY=[@ANYBLOB="280000001e00150d2cbd7000fddbdf2507000000", @ANYRES32=r1, @ANYBLOB="020000000000000008000a00", @ANYRES32=r1, @ANYBLOB="128427c5d206a218816c9535b088f1ecc766ba41e7848da577c33047809bed1823b20538e81fa98267aea6d3cc81494d59c32ea3ed8993406b6f00fd29f8511c634fc036a706e5bd24599b31146407da55064d874b952ad844664de34defac1b5155427b1979b9b57107873ebf600121832d4d78d7557e6bd191d30b80c8bece6d93154600491b4ec2074fad5288d008b3ac464f63ceaf6141bc5b1522f7c16a5097882fc6d4bcf537fcc173a7cf82ec030638965c2e3d5705000000a073eed1833cb9a6a38e7af9ad65c8a165eba759af8984eae43494d232"], 0x28}}, 0x48010)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x177)
r3 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r2)
sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(r2, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x2c, r3, 0x21, 0x70bd26, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0xad}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x8}]}, 0x2c}}, 0x24088000)
write$binfmt_elf64(r2, &(0x7f0000000200)=ANY=[@ANYBLOB="7f454c4620040000000000000000000002003e00ebffffff7c000000000000004000000000000000820000000000000000000000090038000100feff020003000300"], 0xed)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
r4 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r5 = bpf$MAP_CREATE(0x0, &(0x7f0000002080)=ANY=[@ANYBLOB="0500000001000000060000000b"], 0x50)
r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000009e00000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r6}, 0xc)
sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x2000)
setsockopt$inet_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000000500)={0xe, 0x10, 0x10, 0xa, 0x200}, 0x14)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r7=>0xffffffffffffffff, <r8=>0xffffffffffffffff})
connect$unix(r7, &(0x7f0000000180)=@abs, 0x6e)
sendmmsg$unix(r8, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xb, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000f80)={0x18, 0x13, &(0x7f0000000b40)=ANY=[], &(0x7f0000000e40)='GPL\x00', 0x2, 0xd9, &(0x7f0000000e80)=""/217, 0x0, 0x8}, 0x94)
bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000001080)=ANY=[@ANYBLOB="61154c00000000006113500000000000bfa00000000000001503000008004e002d3501000000000095000000000000006916000000000000bf67000000000000350605000fff07206706000005000000160302000ee60060bf670000000000000f650000000000006507f9ff0100000007070000cddfffff1e75000000000000bf54000000000000070400000400f9ffbd4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd3997f9c9c4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05000000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe01c5473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc2300000008ac86d8a297dff0445a15f21dce4de9f29eff65aadc841848c9b562a31e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932b3a6aa57f1ad2e99e0e67ab93716d20000009fbb0f53acbb40b4f8e2738270b31562ed834f2af97787f696649a462e7ee4bcf8b07a10d6735154beb4000000000000000000000000004000bc00f679629709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253880800000000000000690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43010000207b40407d00000021000000008a523d80bd970d703f37ca364a601ae899a56715a0a62a34c6c94cce6994521629ab028acfc1d926a0f6a5489af8dc2f17923f3c40dfd1970a55c22fe3a5ac000000000000000000000000000000c1eb2d91fb79ea00000000000000bb0d00000000000000000000e4007be511fe320fea2594e190deae46e26c596f84eba9000000000000003cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631d22a11dc3c6939628950000000000000001c7205a6b068fff496d2da7d632bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a0337302f3b41eae59809fd05d12f6186f117b062df67d3a63f3265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089dad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3ff3be4d1458077c2253b0c7c7a0a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631dbaa74f22bad050e9856b48ae3a03a497c37758537650fe6db88aa3c41fdc3d78e046f6160e1741299e8dc29906870e6420ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0afa1e1c758a0079b747067312e9815a21cb3f1f8150d999d788535a4d3114dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fb9fb38f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4ff139604faf0a4da65396174b4563d54b52f06c870edf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202eeb81f428a5b3c299848649e1a6bff52f657a67463d7dbf85ae9321fc2b517dc4a29b9cba8ded5de8206c812439ab129ae818837ee1562078fc524b3baf49a0be9bb7d958d5e87c6ad62934782cc308e936d7637e07c201282bbbed84a2a3bc87b0da23c00d9ef418cf19e7a8c4c328be0ce95798adc2dca871073f6bd61dc18402cde8bf777b2eaa45c940aabc86b94f8cbde4d470667bee722a6a2af483ad0d3415ed0f9db059acaba9eaea93f811d434e00000000000000000000d154ba10a8e51489a614e69722bac30000000000000000000000000000c5dfd188ff555285b9743d3aac000583f42d168613151d681a2f71373f20d92c9048407c91fabecfe8b3f2d5454d127edab14ba61ba1cfc4336324c86f3dcb43e9a58208077e90f6ec1c7ac756f61dcc372cdd30b82507489f0bbfbd3c3f21752e81319c0161e154ceb16e00bc7f5a6962dff317f4d014786e432817064874d69a39cb0da31bcc5f81894d8a80756447322207b4007dff12eb95066cc6bc256f0a12282224d718b06ca80b57aa183dd0c3eee45891441f2b89b4c67aa9882281393954972046974f18df232cd7fca610e33f51c2d062020f403d85ff36c26e2f6bd1d82f4d3ceb3472d9a77e0057a3bfe697d9ab7585f4a1b381343d2cf855689232f4fc5135790662dc1419a374be9d7b3e5be2886d23add90d862f1a682ff11c798e338af3e5bb0f9d3952b15bf3e0c618c89d20ca1e18a031397693bf3cfbd8417e5b55e641c898c280356f2da222d5d68919d98158578dcf18efa404e508bcbbb8cfcf70086821ebdf34c9a1dff45af873df904c2bdbef81f246d26f4b40df949e12bdac18532f4e11c608cc31d60cb591c40a7b386fa1c753336d7220a35118d4919b45eff32aab684e62c6691de14e97aa7e9dc8ecf0cd50540246d2b746e41e5b4e2c095039dfe0f71db6265f7580d098be40ef36faee5d1695830d4242a23e541e6ce9fa1998d8961cf4fe3c8e8fbb566f148c8befc229614a4b7f80d237b8abc6fd0407de31d6e5532f360d379f20f054692b47207922fe6c14eba96c9a7ae906abc1ae1ae8c4fae92883cfa1978a04bbff4bbefc18f77700372471609e2c443e84ee5e9a5178f90512df04f3a0909c96632ae20c68c62b06e9fdc2977dfef1ced97b70263fc81c30f1354b319fe9d59d3101c4ee7375ff8673de5caff9e6ee73ccae77d1bf8f22330e8840af1ded6d5be627f7f87d5b12a2d6317825d77bef85313f541dcc4ff13f413db34d5da05648590a1685031e6955d4352bf0b7efd0b0a1e636b8aa4963d9f67de5ba91d501418bbeaac09bdd1059f3c3159e5900"/2282], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffffd2}, 0x48)
executing program 2:
syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000000)='./bus\x00', 0x0, &(0x7f0000000300)={[{@grpquota}, {@quota}, {@quota}, {@stripe={'stripe', 0x3d, 0x3}}, {@jqfmt_vfsold}]}, 0xff, 0x4fa, &(0x7f00000005c0)="$eJzs3c9vG1kdAPCvnThx0uwmu+wBEOyW3YWCqjqJuxut9gDLCSFUCdEjSG1I3CiKHUexU5rQQ3rmikQlTnDkD+DcE3cuCG5cygGJHxGoQeLg1YwnqZvaTdQkdhR/PtJo3ps39fe9pvNe/U3iF8DQuhoRuxExFhF3I2I6u57LjvisfST3Pdt7uLS/93ApF63W7X/l0vbkWnT8mcSV7DWLEfGj70X8NPdy3Mb2ztpitVrZzOqzzdrGbGN758ZqbXGlslJZL5cX5hfmPrn5cfnMxvpebSwrffXpH3e/9fOkW1PZlc5xnKX20AuHcRKjEfGD8wg2ACPZeMYG3RFeSz4i3o6I99PnfzpG0q8mAHCZtVrT0ZrurAMAl10+zYHl8qUsFzAV+Xyp1M7hvROT+Wq90bx+r761vtzOlc1EIX9vtVqZy3KFM1HIJfX5tPy8Xj5SvxkRb0XEL8cn0nppqV5dHuR/fABgiF05sv7/d7y9/gMAl1xx0B0AAPrO+g8Aw8f6DwDDx/oPAMOnvf5PDLobAEAfef8PAMPH+g8AQ+WHt24lR2s/+/zr5fvbW2v1+zeWK421Um1rqbRU39wordTrK+ln9tSOe71qvb4x/1FsPZj59kajOdvY3rlTq2+tN++kn+t9p1JI79rtw8gAgF7eeu/JX3LJivzpRHpEx14OhYH2DDhv+UF3ABiYkUF3ABgYu33B8DrFe3zpAbgkumzR+4Jit18QarVarfPrEnDOrn1J/h+GVUf+308Bw5CR/4fhJf8Pw6vVyp10z/846Y0AwMUmxw/0+P7/29n5d9k3B36yfPSOx+fZKwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALjYDvb/LWV7gU9FPl8qRbwRETNRyN1brVbmIuLNiPjzeGE8qc8PuM8AwGnl/57L9v+6Nv3h1AtN7145LI5FxM9+fftXDxabzc0/RYzl/j1+cL35OLte7n/vAYDjHazT6bnjjfyzvYdLB0c/+/OP70ZEsR1/f28s9g/jj8Zoei5GISIm/5PL6m25jtzFaew+iogvdht/LqbSHEh759Oj8ZPYb/Q1fv6F+Pm0rX1O/i6+cAZ9gWHzJJl/Puv2/OXjanru/vwX0xnq9LL5L3mppf10Dnwe/2D+G+kx/109aYyP/vD9dmni5bZHEV8ejTiIvd8x/xzEz/WI/+EJ4//1K+++36ut9ZuIa9E9fmes2WZtY7axvXNjtba4UlmprJfLC/MLc5/c/Lg8m+aoZ3uvBv/89PqbvdqS8U/2iF88ZvxfP+H4f/v/uz/+2ivif/ODbvHz8c4r4idr4jdOGH9x8vfFXm1J/OUe4z/u63/9hPGf/m3npW3DAYDBaWzvrC1Wq5VNBYWLX0j+yV6AbnQtfKdfscaie9MvPmg/00eaWq3XitVrxjiLrBtwERw+9BHxv0F3BgAAAAAAAAAAAAAA6Kofv7E06DECAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABweX0eAAD//19xzyM=")
openat(0xffffffffffffff9c, &(0x7f0000000180)='./file2\x00', 0xa0c42, 0x100)
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000440)={'batadv_slave_0\x00', <r1=>0x0})
sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000ac0)=ANY=[@ANYBLOB="280000001e00150d2cbd7000fddbdf2507000000", @ANYRES32=r1, @ANYBLOB="020000000000000008000a00", @ANYRES32=r1, @ANYBLOB="128427c5d206a218816c9535b088f1ecc766ba41e7848da577c33047809bed1823b20538e81fa98267aea6d3cc81494d59c32ea3ed8993406b6f00fd29f8511c634fc036a706e5bd24599b31146407da55064d874b952ad844664de34defac1b5155427b1979b9b57107873ebf600121832d4d78d7557e6bd191d30b80c8bece6d93154600491b4ec2074fad5288d008b3ac464f63ceaf6141bc5b1522f7c16a5097882fc6d4bcf537fcc173a7cf82ec030638965c2e3d5705000000a073eed1833cb9a6a38e7af9ad65c8a165eba759af8984eae43494d232"], 0x28}}, 0x48010)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x177)
r3 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r2)
sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(r2, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x2c, r3, 0x21, 0x70bd26, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0xad}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x8}]}, 0x2c}}, 0x24088000)
write$binfmt_elf64(r2, &(0x7f0000000200)=ANY=[@ANYBLOB="7f454c4620040000000000000000000002003e00ebffffff7c000000000000004000000000000000820000000000000000000000090038000100feff020003000300"], 0xed)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
r4 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r5 = bpf$MAP_CREATE(0x0, &(0x7f0000002080)=ANY=[@ANYBLOB="0500000001000000060000000b"], 0x50)
r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000009e00000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r6}, 0xc)
sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x2000)
setsockopt$inet_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000000500)={0xe, 0x10, 0x10, 0xa, 0x200}, 0x14)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r7=>0xffffffffffffffff, <r8=>0xffffffffffffffff})
connect$unix(r7, &(0x7f0000000180)=@abs, 0x6e)
sendmmsg$unix(r8, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xb, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
executing program 1:
r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x16b042, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0b000000080000000c000000ffbfffff01"], 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000810018110000", @ANYRES32=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xfffffff3)
mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1000001, 0x13, r0, 0x0)
executing program 1:
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000280)=0x4, 0x4)
sendto$inet(r0, &(0x7f0000000040)="0400", 0xffec, 0x0, &(0x7f0000000340)={0x2, 0x0, @loopback}, 0x10)
syz_mount_image$fuse(&(0x7f0000000240), &(0x7f0000000380)='./file0\x00', 0x100000, &(0x7f00000003c0)=ANY=[@ANYBLOB="aadaca5cb30193904b2b36ea0d765e3fae82e6a1e8dc16c6deb2bc86e1e02b3f574ddeeb598ec450a2a649e7105bfe4e8e594118fe3b0c47fa4b59547f8359539f41ce267375a013a2f5bf38718f70bd011cf68b9441dfd4bc702556421f46dbc80c969069ccfe8948f01a3a743b425bb085bb95d6c99e0c09648ddaef895d8ea4e3f8c2e1d6ed2cf231fe66bb4d3777985188fade946da67980895190c377819b09f70cde2f054329220a662863a8cf", @ANYRES32=r0], 0x1, 0x0, 0x0)
r1 = open(&(0x7f0000000000)='./file0\x00', 0x315542, 0x3b4)
r2 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
sendfile(r1, r2, 0x0, 0x10002)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
openat$ptmx(0xffffffffffffff9c, 0x0, 0x2000, 0x0)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000001a40)=[{{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000040)}], 0x1}}], 0x1, 0x488c0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000f000/0x18000)=nil, &(0x7f0000000380)=[@text32={0x20, &(0x7f0000000300)="b8050000000f01c10f46a78900000066ba2100b067ee66ba2000b8000000000f23c00f21f835010003000f23f8ee6d6c2f800000c00f3266bac0000f3066b808008ed0660f38806f008ee0", 0x4b}], 0x1, 0x3b, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60)
r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0xe, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="850000002e0000006c0a00000000000045000000000000009500000000000000"], &(0x7f0000000140)='GPL\x00', 0x5, 0x99, &(0x7f0000000180)=""/153, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x13}, 0x23)
ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000000)={[0x36, 0x40000000788, 0x80000000002, 0x183, 0x400000004, 0x0, 0xee, 0x0, 0x100000000, 0x1000045, 0x10000, 0x6, 0xf, 0xfffffffffffffffd, 0x0, 0xab], 0x8000000, 0x3c4210})
ioctl$KVM_RUN(r5, 0xae80, 0x0)
r6 = syz_btf_id_by_name$bpf_lsm(&(0x7f0000000140)='bpf_lsm_task_setnice\x00')
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x15, 0xc, &(0x7f0000000180)=ANY=[@ANYRESDEC=r2, @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000003800000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x46, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r6, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
executing program 1:
syz_mount_image$fuse(0x0, &(0x7f0000002880)='./file0\x00', 0x20240d5, 0x0, 0x2, 0x0, 0x0)
syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x1, 0x0, 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f00000002c0)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
chdir(0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f00000002c0)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
chdir(&(0x7f00000001c0)='./bus\x00')
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x4008, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]})
executing program 1:
r0 = socket(0x10, 0x803, 0x0)
sendmsg$SMC_PNETID_GET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}}, 0x0)
getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, <r1=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000580)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB="540000001000370401000000ffdbdf2500000000", @ANYRES32=r1, @ANYBLOB="890c04000000000005001000050000002c0012800b00010067726574617000001c000280050017000000000008000400030000000600"], 0x54}, 0x1, 0x0, 0x0, 0x44801}, 0x0)
r2 = userfaultfd(0x80001)
r3 = socket$tipc(0x1e, 0x5, 0x0)
bind$tipc(r3, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10)
r4 = socket$tipc(0x1e, 0x5, 0x0)
bind$tipc(r4, &(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10)
r5 = socket$tipc(0x1e, 0x2, 0x0)
setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000100)={0x42, 0x2, 0x2}, 0x10)
sendmsg$tipc(r5, &(0x7f0000002340)={&(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x4, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4080000}, 0x0)
close_range(r2, 0xffffffffffffffff, 0x0)
r6 = socket$inet(0x2, 0x2, 0x0)
sendmmsg$inet(r6, &(0x7f0000003380)=[{{&(0x7f0000000000)={0x2, 0x4e21, @local}, 0x10, 0x0, 0x0, &(0x7f0000000340)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r1, @empty, @rand_addr=0x64010102}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x8}}], 0x38}}], 0x1, 0x4040880)
executing program 3:
syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x200008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r0 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x2)
mprotect(&(0x7f0000004000/0x4000)=nil, 0x4000, 0x8)
r1 = openat$random(0xffffffffffffff9c, &(0x7f000000fe80), 0x40800, 0x0)
ioctl$RNDADDENTROPY(r1, 0x40085203, &(0x7f0000000780)=ANY=[@ANYBLOB="04000000000010"])
syz_emit_ethernet(0x86, &(0x7f0000000280)=ANY=[@ANYBLOB], 0x0)
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0)
setsockopt$WPAN_SECURITY_LEVEL(0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x4, 0x16, &(0x7f0000001000)=ANY=[@ANYBLOB="61128c000000000061134c0000000000bf20000000000000070000000f0000003d030100000000009500ffb1000000006926000000301b00bf6700000000000036000b000fff52004507faff15300000d60600000ee60000bf050000000000003d63000000000000650700000200000007070000fbffffff1f75000000000000bf54000000000000070000000410f900bd430100000000009500000000000000050000000000000095000000000000001c15a3ce747c693a74b62fd0758b15f09429c09074bc4b2bd2dc480dd7a064b8673e2060162cc43bcba1060999eef9d60bb39d0af449deaa27ea949e8f9000d885deea2783835e29eba8546fc020c1966f8b5f32b095f566edf66b7751828da9dbd5b996b9e8d897e461c01c697671d100000000400036c17fb01dde179c1f26cac1c7b21bde7d1a55d6ebe700b3be005e47ef55e0dd81244b18590e000000000000356d82e43407a6d7fa94b21002f06cd247b126b6349ab62d7b07ba0a71a72145edade9941f49f300a8c8913e0e4ea9e4c77740ab3312edee62a4dc2fc85755d387d8a1bc8eb71fbe11b2216cc8d1f0160c237d929b49d828724b95555b459f4763c6222175c974be2f76fb5f330b015a68587a75c013000000000000000000000003000000000000d6ddc46e58eff8f4fbadfc6a3af8123b7f4240713a4c0cdc9d7820c4eb67cc0f8b5fe9258eeacb5776aebbab3d5c55020000006082778366dadfc36029633e0514cbcee1f3928970bde148c940434f33acd377cbad17673b2d30b6339255c98eba97efb4e9ac1f11be815dd6045592edcbee7f253ec74c7c1313505bd7ff8fd58b3a6569c91dbdef1df585aeaea7346a2a65caee5c85f9eddeeeee3c8a2e523c864ac430eb47cb4d0c8767b9d4125661b5a1a170c04b64da3a99ddb93bf14fae3ca2d1e882375b8dbac83978e136c34f90b33cc0eeb57debcfe26589efc08125d5d62a7e593c9738a50171adf051ea4f07e7e7e770c2016eeacbe8511afffffbea75759a1ea5404f5453c0b5c46c9700808c096cf8cf5223f341cbea3841b5cd224c1b381d56afebe9f99a00e3cd94dc0bb7af9e8709db487cc4d9b3b96723d69d512ddd57b0dee9b9f6ae80a502cce352098603e77f9ecced07fa25e99e9e415414c91f8bfd1c150570512f26c4ee34a64c131dce3800000000000000006c86287945bd8d258442870e000000000000000000000000f7e6a10de4bf7369b0d5b5373829b09bf5b7b34099b27ac7770fca449d4c4ca15f88b588b2429af2e1d1a4e1fa44cb80fcfae6e50d7e5b4675d7e0be706224f34e6eed553b40e2b897e73752fc7d1e4b0f4c5967eefd7448d5fde5841fa464a67267c631052bd7333769a4b8d19d4794357edce762e8136ab9d7ed34a72baffd849b90579b96b3"], &(0x7f0000000100)='GPL\x00'}, 0x48)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/3
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 21, 7, 15, 18]
detailed listing:
executing program 1:
r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x16b042, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0b000000080000000c000000ffbfffff01"], 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000810018110000", @ANYRES32=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xfffffff3)
mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1000001, 0x13, r0, 0x0)
executing program 1:
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000280)=0x4, 0x4)
sendto$inet(r0, &(0x7f0000000040)="0400", 0xffec, 0x0, &(0x7f0000000340)={0x2, 0x0, @loopback}, 0x10)
syz_mount_image$fuse(&(0x7f0000000240), &(0x7f0000000380)='./file0\x00', 0x100000, &(0x7f00000003c0)=ANY=[@ANYBLOB="aadaca5cb30193904b2b36ea0d765e3fae82e6a1e8dc16c6deb2bc86e1e02b3f574ddeeb598ec450a2a649e7105bfe4e8e594118fe3b0c47fa4b59547f8359539f41ce267375a013a2f5bf38718f70bd011cf68b9441dfd4bc702556421f46dbc80c969069ccfe8948f01a3a743b425bb085bb95d6c99e0c09648ddaef895d8ea4e3f8c2e1d6ed2cf231fe66bb4d3777985188fade946da67980895190c377819b09f70cde2f054329220a662863a8cf", @ANYRES32=r0], 0x1, 0x0, 0x0)
r1 = open(&(0x7f0000000000)='./file0\x00', 0x315542, 0x3b4)
r2 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
sendfile(r1, r2, 0x0, 0x10002)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
openat$ptmx(0xffffffffffffff9c, 0x0, 0x2000, 0x0)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000001a40)=[{{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000040)}], 0x1}}], 0x1, 0x488c0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000f000/0x18000)=nil, &(0x7f0000000380)=[@text32={0x20, &(0x7f0000000300)="b8050000000f01c10f46a78900000066ba2100b067ee66ba2000b8000000000f23c00f21f835010003000f23f8ee6d6c2f800000c00f3266bac0000f3066b808008ed0660f38806f008ee0", 0x4b}], 0x1, 0x3b, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60)
r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0xe, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="850000002e0000006c0a00000000000045000000000000009500000000000000"], &(0x7f0000000140)='GPL\x00', 0x5, 0x99, &(0x7f0000000180)=""/153, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x13}, 0x23)
ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000000)={[0x36, 0x40000000788, 0x80000000002, 0x183, 0x400000004, 0x0, 0xee, 0x0, 0x100000000, 0x1000045, 0x10000, 0x6, 0xf, 0xfffffffffffffffd, 0x0, 0xab], 0x8000000, 0x3c4210})
ioctl$KVM_RUN(r5, 0xae80, 0x0)
r6 = syz_btf_id_by_name$bpf_lsm(&(0x7f0000000140)='bpf_lsm_task_setnice\x00')
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x15, 0xc, &(0x7f0000000180)=ANY=[@ANYRESDEC=r2, @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000003800000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x46, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r6, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
executing program 1:
syz_mount_image$fuse(0x0, &(0x7f0000002880)='./file0\x00', 0x20240d5, 0x0, 0x2, 0x0, 0x0)
syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x1, 0x0, 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f00000002c0)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
chdir(0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f00000002c0)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
chdir(&(0x7f00000001c0)='./bus\x00')
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x4008, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]})
executing program 1:
r0 = socket(0x10, 0x803, 0x0)
sendmsg$SMC_PNETID_GET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}}, 0x0)
getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, <r1=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000580)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB="540000001000370401000000ffdbdf2500000000", @ANYRES32=r1, @ANYBLOB="890c04000000000005001000050000002c0012800b00010067726574617000001c000280050017000000000008000400030000000600"], 0x54}, 0x1, 0x0, 0x0, 0x44801}, 0x0)
r2 = userfaultfd(0x80001)
r3 = socket$tipc(0x1e, 0x5, 0x0)
bind$tipc(r3, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10)
r4 = socket$tipc(0x1e, 0x5, 0x0)
bind$tipc(r4, &(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10)
r5 = socket$tipc(0x1e, 0x2, 0x0)
setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000100)={0x42, 0x2, 0x2}, 0x10)
sendmsg$tipc(r5, &(0x7f0000002340)={&(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x4, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4080000}, 0x0)
close_range(r2, 0xffffffffffffffff, 0x0)
r6 = socket$inet(0x2, 0x2, 0x0)
sendmmsg$inet(r6, &(0x7f0000003380)=[{{&(0x7f0000000000)={0x2, 0x4e21, @local}, 0x10, 0x0, 0x0, &(0x7f0000000340)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r1, @empty, @rand_addr=0x64010102}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x8}}], 0x38}}], 0x1, 0x4040880)
executing program 3:
syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x200008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r0 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x2)
mprotect(&(0x7f0000004000/0x4000)=nil, 0x4000, 0x8)
r1 = openat$random(0xffffffffffffff9c, &(0x7f000000fe80), 0x40800, 0x0)
ioctl$RNDADDENTROPY(r1, 0x40085203, &(0x7f0000000780)=ANY=[@ANYBLOB="04000000000010"])
syz_emit_ethernet(0x86, &(0x7f0000000280)=ANY=[@ANYBLOB], 0x0)
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0)
setsockopt$WPAN_SECURITY_LEVEL(0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x4, 0x16, &(0x7f0000001000)=ANY=[@ANYBLOB="61128c000000000061134c0000000000bf20000000000000070000000f0000003d030100000000009500ffb1000000006926000000301b00bf6700000000000036000b000fff52004507faff15300000d60600000ee60000bf050000000000003d63000000000000650700000200000007070000fbffffff1f75000000000000bf54000000000000070000000410f900bd430100000000009500000000000000050000000000000095000000000000001c15a3ce747c693a74b62fd0758b15f09429c09074bc4b2bd2dc480dd7a064b8673e2060162cc43bcba1060999eef9d60bb39d0af449deaa27ea949e8f9000d885deea2783835e29eba8546fc020c1966f8b5f32b095f566edf66b7751828da9dbd5b996b9e8d897e461c01c697671d100000000400036c17fb01dde179c1f26cac1c7b21bde7d1a55d6ebe700b3be005e47ef55e0dd81244b18590e000000000000356d82e43407a6d7fa94b21002f06cd247b126b6349ab62d7b07ba0a71a72145edade9941f49f300a8c8913e0e4ea9e4c77740ab3312edee62a4dc2fc85755d387d8a1bc8eb71fbe11b2216cc8d1f0160c237d929b49d828724b95555b459f4763c6222175c974be2f76fb5f330b015a68587a75c013000000000000000000000003000000000000d6ddc46e58eff8f4fbadfc6a3af8123b7f4240713a4c0cdc9d7820c4eb67cc0f8b5fe9258eeacb5776aebbab3d5c55020000006082778366dadfc36029633e0514cbcee1f3928970bde148c940434f33acd377cbad17673b2d30b6339255c98eba97efb4e9ac1f11be815dd6045592edcbee7f253ec74c7c1313505bd7ff8fd58b3a6569c91dbdef1df585aeaea7346a2a65caee5c85f9eddeeeee3c8a2e523c864ac430eb47cb4d0c8767b9d4125661b5a1a170c04b64da3a99ddb93bf14fae3ca2d1e882375b8dbac83978e136c34f90b33cc0eeb57debcfe26589efc08125d5d62a7e593c9738a50171adf051ea4f07e7e7e770c2016eeacbe8511afffffbea75759a1ea5404f5453c0b5c46c9700808c096cf8cf5223f341cbea3841b5cd224c1b381d56afebe9f99a00e3cd94dc0bb7af9e8709db487cc4d9b3b96723d69d512ddd57b0dee9b9f6ae80a502cce352098603e77f9ecced07fa25e99e9e415414c91f8bfd1c150570512f26c4ee34a64c131dce3800000000000000006c86287945bd8d258442870e000000000000000000000000f7e6a10de4bf7369b0d5b5373829b09bf5b7b34099b27ac7770fca449d4c4ca15f88b588b2429af2e1d1a4e1fa44cb80fcfae6e50d7e5b4675d7e0be706224f34e6eed553b40e2b897e73752fc7d1e4b0f4c5967eefd7448d5fde5841fa464a67267c631052bd7333769a4b8d19d4794357edce762e8136ab9d7ed34a72baffd849b90579b96b3"], &(0x7f0000000100)='GPL\x00'}, 0x48)

program crashed: KASAN: use-after-free Read in incfs_free_mount_info
bisect: the chunk can be dropped
bisect: testing without sub-chunk 3/3
bisect: split chunks (needed=true): <5>
bisect: split chunk #0 of len 5 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [15, 18]
detailed listing:
executing program 1:
r0 = socket(0x10, 0x803, 0x0)
sendmsg$SMC_PNETID_GET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}}, 0x0)
getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, <r1=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000580)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB="540000001000370401000000ffdbdf2500000000", @ANYRES32=r1, @ANYBLOB="890c04000000000005001000050000002c0012800b00010067726574617000001c000280050017000000000008000400030000000600"], 0x54}, 0x1, 0x0, 0x0, 0x44801}, 0x0)
r2 = userfaultfd(0x80001)
r3 = socket$tipc(0x1e, 0x5, 0x0)
bind$tipc(r3, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10)
r4 = socket$tipc(0x1e, 0x5, 0x0)
bind$tipc(r4, &(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10)
r5 = socket$tipc(0x1e, 0x2, 0x0)
setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000100)={0x42, 0x2, 0x2}, 0x10)
sendmsg$tipc(r5, &(0x7f0000002340)={&(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x4, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4080000}, 0x0)
close_range(r2, 0xffffffffffffffff, 0x0)
r6 = socket$inet(0x2, 0x2, 0x0)
sendmmsg$inet(r6, &(0x7f0000003380)=[{{&(0x7f0000000000)={0x2, 0x4e21, @local}, 0x10, 0x0, 0x0, &(0x7f0000000340)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r1, @empty, @rand_addr=0x64010102}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x8}}], 0x38}}], 0x1, 0x4040880)
executing program 3:
syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x200008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r0 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x2)
mprotect(&(0x7f0000004000/0x4000)=nil, 0x4000, 0x8)
r1 = openat$random(0xffffffffffffff9c, &(0x7f000000fe80), 0x40800, 0x0)
ioctl$RNDADDENTROPY(r1, 0x40085203, &(0x7f0000000780)=ANY=[@ANYBLOB="04000000000010"])
syz_emit_ethernet(0x86, &(0x7f0000000280)=ANY=[@ANYBLOB], 0x0)
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0)
setsockopt$WPAN_SECURITY_LEVEL(0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x4, 0x16, &(0x7f0000001000)=ANY=[@ANYBLOB="61128c000000000061134c0000000000bf20000000000000070000000f0000003d030100000000009500ffb1000000006926000000301b00bf6700000000000036000b000fff52004507faff15300000d60600000ee60000bf050000000000003d63000000000000650700000200000007070000fbffffff1f75000000000000bf54000000000000070000000410f900bd430100000000009500000000000000050000000000000095000000000000001c15a3ce747c693a74b62fd0758b15f09429c09074bc4b2bd2dc480dd7a064b8673e2060162cc43bcba1060999eef9d60bb39d0af449deaa27ea949e8f9000d885deea2783835e29eba8546fc020c1966f8b5f32b095f566edf66b7751828da9dbd5b996b9e8d897e461c01c697671d100000000400036c17fb01dde179c1f26cac1c7b21bde7d1a55d6ebe700b3be005e47ef55e0dd81244b18590e000000000000356d82e43407a6d7fa94b21002f06cd247b126b6349ab62d7b07ba0a71a72145edade9941f49f300a8c8913e0e4ea9e4c77740ab3312edee62a4dc2fc85755d387d8a1bc8eb71fbe11b2216cc8d1f0160c237d929b49d828724b95555b459f4763c6222175c974be2f76fb5f330b015a68587a75c013000000000000000000000003000000000000d6ddc46e58eff8f4fbadfc6a3af8123b7f4240713a4c0cdc9d7820c4eb67cc0f8b5fe9258eeacb5776aebbab3d5c55020000006082778366dadfc36029633e0514cbcee1f3928970bde148c940434f33acd377cbad17673b2d30b6339255c98eba97efb4e9ac1f11be815dd6045592edcbee7f253ec74c7c1313505bd7ff8fd58b3a6569c91dbdef1df585aeaea7346a2a65caee5c85f9eddeeeee3c8a2e523c864ac430eb47cb4d0c8767b9d4125661b5a1a170c04b64da3a99ddb93bf14fae3ca2d1e882375b8dbac83978e136c34f90b33cc0eeb57debcfe26589efc08125d5d62a7e593c9738a50171adf051ea4f07e7e7e770c2016eeacbe8511afffffbea75759a1ea5404f5453c0b5c46c9700808c096cf8cf5223f341cbea3841b5cd224c1b381d56afebe9f99a00e3cd94dc0bb7af9e8709db487cc4d9b3b96723d69d512ddd57b0dee9b9f6ae80a502cce352098603e77f9ecced07fa25e99e9e415414c91f8bfd1c150570512f26c4ee34a64c131dce3800000000000000006c86287945bd8d258442870e000000000000000000000000f7e6a10de4bf7369b0d5b5373829b09bf5b7b34099b27ac7770fca449d4c4ca15f88b588b2429af2e1d1a4e1fa44cb80fcfae6e50d7e5b4675d7e0be706224f34e6eed553b40e2b897e73752fc7d1e4b0f4c5967eefd7448d5fde5841fa464a67267c631052bd7333769a4b8d19d4794357edce762e8136ab9d7ed34a72baffd849b90579b96b3"], &(0x7f0000000100)='GPL\x00'}, 0x48)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 21, 7]
detailed listing:
executing program 1:
r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x16b042, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0b000000080000000c000000ffbfffff01"], 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000810018110000", @ANYRES32=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xfffffff3)
mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1000001, 0x13, r0, 0x0)
executing program 1:
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000280)=0x4, 0x4)
sendto$inet(r0, &(0x7f0000000040)="0400", 0xffec, 0x0, &(0x7f0000000340)={0x2, 0x0, @loopback}, 0x10)
syz_mount_image$fuse(&(0x7f0000000240), &(0x7f0000000380)='./file0\x00', 0x100000, &(0x7f00000003c0)=ANY=[@ANYBLOB="aadaca5cb30193904b2b36ea0d765e3fae82e6a1e8dc16c6deb2bc86e1e02b3f574ddeeb598ec450a2a649e7105bfe4e8e594118fe3b0c47fa4b59547f8359539f41ce267375a013a2f5bf38718f70bd011cf68b9441dfd4bc702556421f46dbc80c969069ccfe8948f01a3a743b425bb085bb95d6c99e0c09648ddaef895d8ea4e3f8c2e1d6ed2cf231fe66bb4d3777985188fade946da67980895190c377819b09f70cde2f054329220a662863a8cf", @ANYRES32=r0], 0x1, 0x0, 0x0)
r1 = open(&(0x7f0000000000)='./file0\x00', 0x315542, 0x3b4)
r2 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
sendfile(r1, r2, 0x0, 0x10002)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
openat$ptmx(0xffffffffffffff9c, 0x0, 0x2000, 0x0)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000001a40)=[{{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000040)}], 0x1}}], 0x1, 0x488c0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000f000/0x18000)=nil, &(0x7f0000000380)=[@text32={0x20, &(0x7f0000000300)="b8050000000f01c10f46a78900000066ba2100b067ee66ba2000b8000000000f23c00f21f835010003000f23f8ee6d6c2f800000c00f3266bac0000f3066b808008ed0660f38806f008ee0", 0x4b}], 0x1, 0x3b, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60)
r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0xe, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="850000002e0000006c0a00000000000045000000000000009500000000000000"], &(0x7f0000000140)='GPL\x00', 0x5, 0x99, &(0x7f0000000180)=""/153, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x13}, 0x23)
ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000000)={[0x36, 0x40000000788, 0x80000000002, 0x183, 0x400000004, 0x0, 0xee, 0x0, 0x100000000, 0x1000045, 0x10000, 0x6, 0xf, 0xfffffffffffffffd, 0x0, 0xab], 0x8000000, 0x3c4210})
ioctl$KVM_RUN(r5, 0xae80, 0x0)
r6 = syz_btf_id_by_name$bpf_lsm(&(0x7f0000000140)='bpf_lsm_task_setnice\x00')
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x15, 0xc, &(0x7f0000000180)=ANY=[@ANYRESDEC=r2, @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000003800000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x46, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r6, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
executing program 1:
syz_mount_image$fuse(0x0, &(0x7f0000002880)='./file0\x00', 0x20240d5, 0x0, 0x2, 0x0, 0x0)
syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x1, 0x0, 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f00000002c0)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
chdir(0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f00000002c0)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
chdir(&(0x7f00000001c0)='./bus\x00')
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x4008, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]})

program crashed: KASAN: use-after-free Read in incfs_free_mount_info
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <3>
bisect: split chunk #0 of len 3 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-syz_mount_image$fuse-mount$incfs-chdir-mount$incfs-chdir-mount$overlay
detailed listing:
executing program 1:
syz_mount_image$fuse(0x0, &(0x7f0000002880)='./file0\x00', 0x20240d5, 0x0, 0x2, 0x0, 0x0)
syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x1, 0x0, 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f00000002c0)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
chdir(0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f00000002c0)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
chdir(&(0x7f00000001c0)='./bus\x00')
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x4008, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]})

program crashed: KASAN: use-after-free Read in incfs_free_mount_info
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <1>
bisect: split chunk #0 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: 1 programs left: 

executing program 1:
syz_mount_image$fuse(0x0, &(0x7f0000002880)='./file0\x00', 0x20240d5, 0x0, 0x2, 0x0, 0x0)
syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x1, 0x0, 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f00000002c0)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
chdir(0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f00000002c0)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
chdir(&(0x7f00000001c0)='./bus\x00')
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x4008, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]})


bisect: trying to concatenate
bisect: concatenate 1 entries
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-syz_mount_image$fuse-mount$incfs-chdir-mount$incfs-chdir-mount$overlay
detailed listing:
executing program 0:
syz_mount_image$fuse(0x0, &(0x7f0000002880)='./file0\x00', 0x20240d5, 0x0, 0x2, 0x0, 0x0)
syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x1, 0x0, 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f00000002c0)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
chdir(0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f00000002c0)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
chdir(&(0x7f00000001c0)='./bus\x00')
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x4008, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]})

program crashed: KASAN: use-after-free Read in incfs_free_mount_info
bisect: concatenation succeeded
found reproducer with 7 syscalls
minimizing guilty program
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-syz_mount_image$fuse-mount$incfs-chdir-mount$incfs-chdir
detailed listing:
executing program 0:
syz_mount_image$fuse(0x0, &(0x7f0000002880)='./file0\x00', 0x20240d5, 0x0, 0x2, 0x0, 0x0)
syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x1, 0x0, 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f00000002c0)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
chdir(0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f00000002c0)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
chdir(&(0x7f00000001c0)='./bus\x00')

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-syz_mount_image$fuse-mount$incfs-chdir-mount$incfs
detailed listing:
executing program 0:
syz_mount_image$fuse(0x0, &(0x7f0000002880)='./file0\x00', 0x20240d5, 0x0, 0x2, 0x0, 0x0)
syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x1, 0x0, 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f00000002c0)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
chdir(0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f00000002c0)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-syz_mount_image$fuse-mount$incfs-chdir
detailed listing:
executing program 0:
syz_mount_image$fuse(0x0, &(0x7f0000002880)='./file0\x00', 0x20240d5, 0x0, 0x2, 0x0, 0x0)
syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x1, 0x0, 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f00000002c0)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
chdir(0x0)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-syz_mount_image$fuse-mount$incfs
detailed listing:
executing program 0:
syz_mount_image$fuse(0x0, &(0x7f0000002880)='./file0\x00', 0x20240d5, 0x0, 0x2, 0x0, 0x0)
syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x1, 0x0, 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f00000002c0)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-syz_mount_image$fuse
detailed listing:
executing program 0:
syz_mount_image$fuse(0x0, &(0x7f0000002880)='./file0\x00', 0x20240d5, 0x0, 0x2, 0x0, 0x0)
syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x1, 0x0, 0x0)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-mount$incfs
detailed listing:
executing program 0:
syz_mount_image$fuse(0x0, &(0x7f0000002880)='./file0\x00', 0x20240d5, 0x0, 0x2, 0x0, 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f00000002c0)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-mount$incfs
detailed listing:
executing program 0:
syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x1, 0x0, 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f00000002c0)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-mount$incfs
detailed listing:
executing program 0:
syz_mount_image$fuse(0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f00000002c0)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-mount$incfs
detailed listing:
executing program 0:
syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x1, 0x0, 0x0)
mount$incfs(0x0, &(0x7f00000002c0)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-mount$incfs
detailed listing:
executing program 0:
syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x1, 0x0, 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', 0x0, &(0x7f0000000840), 0x1004002, 0x0)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-mount$incfs
detailed listing:
executing program 0:
syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x1, 0x0, 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f00000002c0)='./bus\x00', 0x0, 0x1004002, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-mount$incfs
program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
simplifying C reproducer
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-mount$incfs
program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-mount$incfs
program did not crash
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-mount$incfs
program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-mount$incfs
program did not crash
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-mount$incfs
program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-mount$incfs
program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-mount$incfs
program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-mount$incfs
program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-mount$incfs
program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-mount$incfs
program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-mount$incfs
program did not crash
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-mount$incfs
program did not crash
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-mount$incfs
program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-mount$incfs
program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-mount$incfs
detailed listing:
executing program 0:
syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x1, 0x0, 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f00000002c0)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
validation run: crashed=true
testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-mount$incfs
detailed listing:
executing program 0:
syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x1, 0x0, 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f00000002c0)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
validation run: crashed=true
testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-mount$incfs
detailed listing:
executing program 0:
syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x1, 0x0, 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f00000002c0)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
validation run: crashed=true
reproducing took 36m45.055084543s
repro crashed as (corrupted=false):
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe45ed5890
R13: 00007f5d69446b3b R14: 00000000000069ab R15: 00007ffe45ed58d0
 </TASK>
---[ end trace c5d39b93eea67021 ]---
==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
BUG: KASAN: null-ptr-deref in atomic_inc_return include/linux/atomic/atomic-instrumented.h:188 [inline]
BUG: KASAN: null-ptr-deref in ihold+0x20/0x60 fs/inode.c:454
Write of size 4 at addr 0000000000000170 by task syz-executor/361

CPU: 0 PID: 361 Comm: syz-executor Tainted: G        W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Call Trace:
 <TASK>
 __dump_stack+0x21/0x30 lib/dump_stack.c:88
 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
 __kasan_report mm/kasan/report.c:431 [inline]
 kasan_report+0xe7/0x140 mm/kasan/report.c:444
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189
 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37
 instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
 atomic_inc_return include/linux/atomic/atomic-instrumented.h:188 [inline]
 ihold+0x20/0x60 fs/inode.c:454
 d_delete_notify include/linux/fsnotify.h:275 [inline]
 vfs_rmdir+0x1f0/0x460 fs/namei.c:4170
 incfs_kill_sb+0x105/0x220 fs/incfs/vfs.c:1989
 deactivate_locked_super+0xa0/0x100 fs/super.c:335
 deactivate_super+0xaf/0xe0 fs/super.c:366
 cleanup_mnt+0x45b/0x510 fs/namespace.c:1148
 __cleanup_mnt+0x19/0x20 fs/namespace.c:1155
 task_work_run+0x127/0x190 kernel/task_work.c:188
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 exit_to_user_mode_loop+0xd0/0xe0 kernel/entry/common.c:181
 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:214
 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
 syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:307
 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f5d693b21d7
Code: a2 c7 05 bc c3 24 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007ffe45ed4748 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f5d693b21d7
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe45ed4800
RBP: 00007ffe45ed4800 R08: 00007ffe45ed5800 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe45ed5890
R13: 00007f5d69446b3b R14: 00000000000069ab R15: 00007ffe45ed58d0
 </TASK>
==================================================================
BUG: kernel NULL pointer dereference, address: 0000000000000170
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD 12f844067 P4D 12f844067 PUD 0 
Oops: 0002 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 361 Comm: syz-executor Tainted: G    B   W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:165 [inline]
RIP: 0010:arch_atomic_inc_return include/linux/atomic/atomic-arch-fallback.h:370 [inline]
RIP: 0010:atomic_inc_return include/linux/atomic/atomic-instrumented.h:189 [inline]
RIP: 0010:ihold+0x26/0x60 fs/inode.c:454
Code: 00 00 00 00 55 48 89 e5 41 56 53 48 89 fb e8 e1 cb b2 ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 40 fc f1 ff 41 be 01 00 00 00 <f0> 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 61
RSP: 0018:ffffc90000a37ce8 EFLAGS: 00010246
RAX: ffff8881233abb00 RBX: 0000000000000000 RCX: ffff8881233abb40
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00000000ffffffff
RBP: ffffc90000a37cf8 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff0e18a4c R12: 1ffff1102125c3e2
R13: dffffc0000000000 R14: 0000000000000001 R15: 0000000000000000
FS:  0000555590fc8500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000170 CR3: 000000011dfc7000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 d_delete_notify include/linux/fsnotify.h:275 [inline]
 vfs_rmdir+0x1f0/0x460 fs/namei.c:4170
 incfs_kill_sb+0x105/0x220 fs/incfs/vfs.c:1989
 deactivate_locked_super+0xa0/0x100 fs/super.c:335
 deactivate_super+0xaf/0xe0 fs/super.c:366
 cleanup_mnt+0x45b/0x510 fs/namespace.c:1148
 __cleanup_mnt+0x19/0x20 fs/namespace.c:1155
 task_work_run+0x127/0x190 kernel/task_work.c:188
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 exit_to_user_mode_loop+0xd0/0xe0 kernel/entry/common.c:181
 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:214
 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
 syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:307
 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f5d693b21d7
Code: a2 c7 05 bc c3 24 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007ffe45ed4748 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f5d693b21d7
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe45ed4800
RBP: 00007ffe45ed4800 R08: 00007ffe45ed5800 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe45ed5890
R13: 00007f5d69446b3b R14: 00000000000069ab R15: 00007ffe45ed58d0
 </TASK>
Modules linked in:
CR2: 0000000000000170
---[ end trace c5d39b93eea67022 ]---
RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:165 [inline]
RIP: 0010:arch_atomic_inc_return include/linux/atomic/atomic-arch-fallback.h:370 [inline]
RIP: 0010:atomic_inc_return include/linux/atomic/atomic-instrumented.h:189 [inline]
RIP: 0010:ihold+0x26/0x60 fs/inode.c:454
Code: 00 00 00 00 55 48 89 e5 41 56 53 48 89 fb e8 e1 cb b2 ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 40 fc f1 ff 41 be 01 00 00 00 <f0> 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 61
RSP: 0018:ffffc90000a37ce8 EFLAGS: 00010246
RAX: ffff8881233abb00 RBX: 0000000000000000 RCX: ffff8881233abb40
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00000000ffffffff
RBP: ffffc90000a37cf8 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff0e18a4c R12: 1ffff1102125c3e2
R13: dffffc0000000000 R14: 0000000000000001 R15: 0000000000000000
FS:  0000555590fc8500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000170 CR3: 000000011dfc7000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	00 00                	add    %al,(%rax)
   2:	00 00                	add    %al,(%rax)
   4:	55                   	push   %rbp
   5:	48 89 e5             	mov    %rsp,%rbp
   8:	41 56                	push   %r14
   a:	53                   	push   %rbx
   b:	48 89 fb             	mov    %rdi,%rbx
   e:	e8 e1 cb b2 ff       	call   0xffb2cbf4
  13:	48 8d bb 70 01 00 00 	lea    0x170(%rbx),%rdi
  1a:	be 04 00 00 00       	mov    $0x4,%esi
  1f:	e8 40 fc f1 ff       	call   0xfff1fc64
  24:	41 be 01 00 00 00    	mov    $0x1,%r14d
* 2a:	f0 44 0f c1 b3 70 01 	lock xadd %r14d,0x170(%rbx) <-- trapping instruction
  31:	00 00
  33:	41 ff c6             	inc    %r14d
  36:	bf 02 00 00 00       	mov    $0x2,%edi
  3b:	44 89 f6             	mov    %r14d,%esi
  3e:	e8                   	.byte 0xe8
  3f:	61                   	(bad)

final repro crashed as (corrupted=false):
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe45ed5890
R13: 00007f5d69446b3b R14: 00000000000069ab R15: 00007ffe45ed58d0
 </TASK>
---[ end trace c5d39b93eea67021 ]---
==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
BUG: KASAN: null-ptr-deref in atomic_inc_return include/linux/atomic/atomic-instrumented.h:188 [inline]
BUG: KASAN: null-ptr-deref in ihold+0x20/0x60 fs/inode.c:454
Write of size 4 at addr 0000000000000170 by task syz-executor/361

CPU: 0 PID: 361 Comm: syz-executor Tainted: G        W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Call Trace:
 <TASK>
 __dump_stack+0x21/0x30 lib/dump_stack.c:88
 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
 __kasan_report mm/kasan/report.c:431 [inline]
 kasan_report+0xe7/0x140 mm/kasan/report.c:444
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189
 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37
 instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
 atomic_inc_return include/linux/atomic/atomic-instrumented.h:188 [inline]
 ihold+0x20/0x60 fs/inode.c:454
 d_delete_notify include/linux/fsnotify.h:275 [inline]
 vfs_rmdir+0x1f0/0x460 fs/namei.c:4170
 incfs_kill_sb+0x105/0x220 fs/incfs/vfs.c:1989
 deactivate_locked_super+0xa0/0x100 fs/super.c:335
 deactivate_super+0xaf/0xe0 fs/super.c:366
 cleanup_mnt+0x45b/0x510 fs/namespace.c:1148
 __cleanup_mnt+0x19/0x20 fs/namespace.c:1155
 task_work_run+0x127/0x190 kernel/task_work.c:188
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 exit_to_user_mode_loop+0xd0/0xe0 kernel/entry/common.c:181
 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:214
 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
 syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:307
 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f5d693b21d7
Code: a2 c7 05 bc c3 24 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007ffe45ed4748 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f5d693b21d7
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe45ed4800
RBP: 00007ffe45ed4800 R08: 00007ffe45ed5800 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe45ed5890
R13: 00007f5d69446b3b R14: 00000000000069ab R15: 00007ffe45ed58d0
 </TASK>
==================================================================
BUG: kernel NULL pointer dereference, address: 0000000000000170
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD 12f844067 P4D 12f844067 PUD 0 
Oops: 0002 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 361 Comm: syz-executor Tainted: G    B   W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:165 [inline]
RIP: 0010:arch_atomic_inc_return include/linux/atomic/atomic-arch-fallback.h:370 [inline]
RIP: 0010:atomic_inc_return include/linux/atomic/atomic-instrumented.h:189 [inline]
RIP: 0010:ihold+0x26/0x60 fs/inode.c:454
Code: 00 00 00 00 55 48 89 e5 41 56 53 48 89 fb e8 e1 cb b2 ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 40 fc f1 ff 41 be 01 00 00 00 <f0> 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 61
RSP: 0018:ffffc90000a37ce8 EFLAGS: 00010246
RAX: ffff8881233abb00 RBX: 0000000000000000 RCX: ffff8881233abb40
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00000000ffffffff
RBP: ffffc90000a37cf8 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff0e18a4c R12: 1ffff1102125c3e2
R13: dffffc0000000000 R14: 0000000000000001 R15: 0000000000000000
FS:  0000555590fc8500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000170 CR3: 000000011dfc7000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 d_delete_notify include/linux/fsnotify.h:275 [inline]
 vfs_rmdir+0x1f0/0x460 fs/namei.c:4170
 incfs_kill_sb+0x105/0x220 fs/incfs/vfs.c:1989
 deactivate_locked_super+0xa0/0x100 fs/super.c:335
 deactivate_super+0xaf/0xe0 fs/super.c:366
 cleanup_mnt+0x45b/0x510 fs/namespace.c:1148
 __cleanup_mnt+0x19/0x20 fs/namespace.c:1155
 task_work_run+0x127/0x190 kernel/task_work.c:188
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 exit_to_user_mode_loop+0xd0/0xe0 kernel/entry/common.c:181
 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:214
 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
 syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:307
 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f5d693b21d7
Code: a2 c7 05 bc c3 24 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007ffe45ed4748 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f5d693b21d7
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe45ed4800
RBP: 00007ffe45ed4800 R08: 00007ffe45ed5800 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe45ed5890
R13: 00007f5d69446b3b R14: 00000000000069ab R15: 00007ffe45ed58d0
 </TASK>
Modules linked in:
CR2: 0000000000000170
---[ end trace c5d39b93eea67022 ]---
RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:165 [inline]
RIP: 0010:arch_atomic_inc_return include/linux/atomic/atomic-arch-fallback.h:370 [inline]
RIP: 0010:atomic_inc_return include/linux/atomic/atomic-instrumented.h:189 [inline]
RIP: 0010:ihold+0x26/0x60 fs/inode.c:454
Code: 00 00 00 00 55 48 89 e5 41 56 53 48 89 fb e8 e1 cb b2 ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 40 fc f1 ff 41 be 01 00 00 00 <f0> 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 61
RSP: 0018:ffffc90000a37ce8 EFLAGS: 00010246
RAX: ffff8881233abb00 RBX: 0000000000000000 RCX: ffff8881233abb40
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00000000ffffffff
RBP: ffffc90000a37cf8 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff0e18a4c R12: 1ffff1102125c3e2
R13: dffffc0000000000 R14: 0000000000000001 R15: 0000000000000000
FS:  0000555590fc8500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000170 CR3: 000000011dfc7000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	00 00                	add    %al,(%rax)
   2:	00 00                	add    %al,(%rax)
   4:	55                   	push   %rbp
   5:	48 89 e5             	mov    %rsp,%rbp
   8:	41 56                	push   %r14
   a:	53                   	push   %rbx
   b:	48 89 fb             	mov    %rdi,%rbx
   e:	e8 e1 cb b2 ff       	call   0xffb2cbf4
  13:	48 8d bb 70 01 00 00 	lea    0x170(%rbx),%rdi
  1a:	be 04 00 00 00       	mov    $0x4,%esi
  1f:	e8 40 fc f1 ff       	call   0xfff1fc64
  24:	41 be 01 00 00 00    	mov    $0x1,%r14d
* 2a:	f0 44 0f c1 b3 70 01 	lock xadd %r14d,0x170(%rbx) <-- trapping instruction
  31:	00 00
  33:	41 ff c6             	inc    %r14d
  36:	bf 02 00 00 00       	mov    $0x2,%edi
  3b:	44 89 f6             	mov    %r14d,%esi
  3e:	e8                   	.byte 0xe8
  3f:	61                   	(bad)