Warning: Permanently added '[localhost]:41867' (ECDSA) to the list of known hosts. 2022/09/21 14:43:37 fuzzer started 2022/09/21 14:43:37 dialing manager at localhost:40289 syzkaller login: [ 43.990222] cgroup: Unknown subsys name 'net' [ 44.065627] cgroup: Unknown subsys name 'rlimit' 2022/09/21 14:43:51 syscalls: 2215 2022/09/21 14:43:51 code coverage: enabled 2022/09/21 14:43:51 comparison tracing: enabled 2022/09/21 14:43:51 extra coverage: enabled 2022/09/21 14:43:51 setuid sandbox: enabled 2022/09/21 14:43:51 namespace sandbox: enabled 2022/09/21 14:43:51 Android sandbox: enabled 2022/09/21 14:43:51 fault injection: enabled 2022/09/21 14:43:51 leak checking: enabled 2022/09/21 14:43:51 net packet injection: enabled 2022/09/21 14:43:51 net device setup: enabled 2022/09/21 14:43:51 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2022/09/21 14:43:51 devlink PCI setup: PCI device 0000:00:10.0 is not available 2022/09/21 14:43:51 USB emulation: enabled 2022/09/21 14:43:51 hci packet injection: enabled 2022/09/21 14:43:51 wifi device emulation: failed to parse kernel version (6.0.0-rc6-next-20220921) 2022/09/21 14:43:51 802.15.4 emulation: enabled 2022/09/21 14:43:51 fetching corpus: 50, signal 22071/23868 (executing program) 2022/09/21 14:43:51 fetching corpus: 100, signal 38433/41757 (executing program) 2022/09/21 14:43:51 fetching corpus: 150, signal 48048/52723 (executing program) 2022/09/21 14:43:52 fetching corpus: 200, signal 56473/62393 (executing program) 2022/09/21 14:43:52 fetching corpus: 250, signal 63569/70619 (executing program) 2022/09/21 14:43:52 fetching corpus: 300, signal 71358/79372 (executing program) 2022/09/21 14:43:52 fetching corpus: 350, signal 75885/85010 (executing program) 2022/09/21 14:43:52 fetching corpus: 400, signal 78257/88500 (executing program) 2022/09/21 14:43:52 fetching corpus: 450, signal 84010/95117 (executing program) 2022/09/21 14:43:52 fetching corpus: 500, signal 86917/99018 (executing program) 2022/09/21 14:43:52 fetching corpus: 550, signal 91142/104063 (executing program) 2022/09/21 14:43:53 fetching corpus: 600, signal 93658/107533 (executing program) 2022/09/21 14:43:53 fetching corpus: 650, signal 95874/110620 (executing program) 2022/09/21 14:43:53 fetching corpus: 700, signal 99021/114476 (executing program) 2022/09/21 14:43:53 fetching corpus: 750, signal 102014/118189 (executing program) 2022/09/21 14:43:53 fetching corpus: 800, signal 103710/120714 (executing program) 2022/09/21 14:43:53 fetching corpus: 850, signal 106329/123968 (executing program) 2022/09/21 14:43:53 fetching corpus: 900, signal 110340/128372 (executing program) 2022/09/21 14:43:53 fetching corpus: 950, signal 115406/133519 (executing program) 2022/09/21 14:43:54 fetching corpus: 1000, signal 116868/135605 (executing program) 2022/09/21 14:43:54 fetching corpus: 1050, signal 119865/138990 (executing program) 2022/09/21 14:43:54 fetching corpus: 1100, signal 121199/141026 (executing program) 2022/09/21 14:43:54 fetching corpus: 1150, signal 124306/144346 (executing program) 2022/09/21 14:43:54 fetching corpus: 1200, signal 125895/146448 (executing program) 2022/09/21 14:43:54 fetching corpus: 1250, signal 128033/148975 (executing program) 2022/09/21 14:43:54 fetching corpus: 1300, signal 129550/150976 (executing program) 2022/09/21 14:43:54 fetching corpus: 1350, signal 130963/152874 (executing program) 2022/09/21 14:43:55 fetching corpus: 1400, signal 132819/155105 (executing program) 2022/09/21 14:43:55 fetching corpus: 1450, signal 133943/156736 (executing program) 2022/09/21 14:43:55 fetching corpus: 1500, signal 136479/159320 (executing program) 2022/09/21 14:43:55 fetching corpus: 1550, signal 139459/162217 (executing program) 2022/09/21 14:43:55 fetching corpus: 1600, signal 140982/164071 (executing program) 2022/09/21 14:43:55 fetching corpus: 1650, signal 142398/165766 (executing program) 2022/09/21 14:43:55 fetching corpus: 1700, signal 143598/167363 (executing program) 2022/09/21 14:43:55 fetching corpus: 1750, signal 144725/168827 (executing program) 2022/09/21 14:43:56 fetching corpus: 1800, signal 145837/170224 (executing program) 2022/09/21 14:43:56 fetching corpus: 1850, signal 147582/172147 (executing program) 2022/09/21 14:43:56 fetching corpus: 1900, signal 149440/174164 (executing program) 2022/09/21 14:43:56 fetching corpus: 1950, signal 150675/175596 (executing program) 2022/09/21 14:43:56 fetching corpus: 2000, signal 151864/176940 (executing program) 2022/09/21 14:43:56 fetching corpus: 2050, signal 153763/178749 (executing program) 2022/09/21 14:43:56 fetching corpus: 2100, signal 154954/180118 (executing program) 2022/09/21 14:43:56 fetching corpus: 2150, signal 155918/181344 (executing program) 2022/09/21 14:43:56 fetching corpus: 2200, signal 156856/182456 (executing program) 2022/09/21 14:43:57 fetching corpus: 2250, signal 158400/183905 (executing program) 2022/09/21 14:43:57 fetching corpus: 2300, signal 159960/185464 (executing program) 2022/09/21 14:43:57 fetching corpus: 2350, signal 161648/187074 (executing program) 2022/09/21 14:43:57 fetching corpus: 2400, signal 163129/188430 (executing program) 2022/09/21 14:43:57 fetching corpus: 2450, signal 163989/189401 (executing program) 2022/09/21 14:43:57 fetching corpus: 2500, signal 165073/190521 (executing program) 2022/09/21 14:43:57 fetching corpus: 2550, signal 165793/191421 (executing program) 2022/09/21 14:43:58 fetching corpus: 2600, signal 166851/192440 (executing program) 2022/09/21 14:43:58 fetching corpus: 2650, signal 168214/193613 (executing program) 2022/09/21 14:43:58 fetching corpus: 2700, signal 169353/194663 (executing program) 2022/09/21 14:43:58 fetching corpus: 2750, signal 170144/195572 (executing program) 2022/09/21 14:43:58 fetching corpus: 2800, signal 171853/196892 (executing program) 2022/09/21 14:43:58 fetching corpus: 2850, signal 173053/197929 (executing program) 2022/09/21 14:43:58 fetching corpus: 2900, signal 174614/199095 (executing program) 2022/09/21 14:43:58 fetching corpus: 2950, signal 175487/199877 (executing program) 2022/09/21 14:43:58 fetching corpus: 3000, signal 176534/200800 (executing program) 2022/09/21 14:43:59 fetching corpus: 3050, signal 177717/201735 (executing program) 2022/09/21 14:43:59 fetching corpus: 3100, signal 178340/202451 (executing program) 2022/09/21 14:43:59 fetching corpus: 3150, signal 179464/203253 (executing program) 2022/09/21 14:43:59 fetching corpus: 3200, signal 180504/204040 (executing program) 2022/09/21 14:43:59 fetching corpus: 3250, signal 181731/204887 (executing program) 2022/09/21 14:43:59 fetching corpus: 3300, signal 182163/205438 (executing program) 2022/09/21 14:43:59 fetching corpus: 3350, signal 183183/206232 (executing program) 2022/09/21 14:44:00 fetching corpus: 3400, signal 183985/206861 (executing program) 2022/09/21 14:44:00 fetching corpus: 3450, signal 185276/207605 (executing program) 2022/09/21 14:44:00 fetching corpus: 3500, signal 186126/208262 (executing program) 2022/09/21 14:44:00 fetching corpus: 3550, signal 187032/208866 (executing program) 2022/09/21 14:44:00 fetching corpus: 3600, signal 188362/209646 (executing program) 2022/09/21 14:44:00 fetching corpus: 3650, signal 189107/210160 (executing program) 2022/09/21 14:44:00 fetching corpus: 3700, signal 189920/210725 (executing program) 2022/09/21 14:44:00 fetching corpus: 3750, signal 190380/211130 (executing program) 2022/09/21 14:44:01 fetching corpus: 3800, signal 190934/211572 (executing program) 2022/09/21 14:44:01 fetching corpus: 3850, signal 191961/212218 (executing program) 2022/09/21 14:44:01 fetching corpus: 3900, signal 193340/212932 (executing program) 2022/09/21 14:44:01 fetching corpus: 3950, signal 194002/213411 (executing program) 2022/09/21 14:44:01 fetching corpus: 4000, signal 194572/213768 (executing program) 2022/09/21 14:44:01 fetching corpus: 4050, signal 195240/214160 (executing program) 2022/09/21 14:44:01 fetching corpus: 4100, signal 195881/214533 (executing program) 2022/09/21 14:44:02 fetching corpus: 4150, signal 196848/214995 (executing program) 2022/09/21 14:44:02 fetching corpus: 4200, signal 197675/215412 (executing program) 2022/09/21 14:44:02 fetching corpus: 4250, signal 198355/215778 (executing program) 2022/09/21 14:44:02 fetching corpus: 4300, signal 198775/216107 (executing program) 2022/09/21 14:44:02 fetching corpus: 4350, signal 199521/216492 (executing program) 2022/09/21 14:44:02 fetching corpus: 4400, signal 200316/216817 (executing program) 2022/09/21 14:44:02 fetching corpus: 4450, signal 201120/217113 (executing program) 2022/09/21 14:44:02 fetching corpus: 4500, signal 201612/217363 (executing program) 2022/09/21 14:44:03 fetching corpus: 4550, signal 202443/217679 (executing program) 2022/09/21 14:44:03 fetching corpus: 4600, signal 203478/218154 (executing program) 2022/09/21 14:44:03 fetching corpus: 4650, signal 203966/218361 (executing program) 2022/09/21 14:44:03 fetching corpus: 4700, signal 204371/218613 (executing program) 2022/09/21 14:44:03 fetching corpus: 4750, signal 204954/218809 (executing program) 2022/09/21 14:44:03 fetching corpus: 4800, signal 205401/218992 (executing program) 2022/09/21 14:44:03 fetching corpus: 4850, signal 206630/219617 (executing program) 2022/09/21 14:44:03 fetching corpus: 4900, signal 207394/219829 (executing program) 2022/09/21 14:44:04 fetching corpus: 4950, signal 208527/220021 (executing program) 2022/09/21 14:44:04 fetching corpus: 5000, signal 209064/220180 (executing program) 2022/09/21 14:44:04 fetching corpus: 5050, signal 209719/220412 (executing program) 2022/09/21 14:44:04 fetching corpus: 5100, signal 211106/220564 (executing program) 2022/09/21 14:44:04 fetching corpus: 5150, signal 211670/220693 (executing program) 2022/09/21 14:44:04 fetching corpus: 5200, signal 212093/220782 (executing program) 2022/09/21 14:44:04 fetching corpus: 5250, signal 212914/220889 (executing program) 2022/09/21 14:44:05 fetching corpus: 5300, signal 213248/220905 (executing program) 2022/09/21 14:44:05 fetching corpus: 5350, signal 213892/220905 (executing program) 2022/09/21 14:44:05 fetching corpus: 5386, signal 214565/221152 (executing program) 2022/09/21 14:44:05 fetching corpus: 5386, signal 214565/221152 (executing program) 2022/09/21 14:44:07 starting 8 fuzzer processes 14:44:07 executing program 0: r0 = socket$inet(0x2, 0x6767ceaeaf1c63ee, 0x8) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000400), 0x40, 0x0) io_submit(0x0, 0x4, &(0x7f0000000480)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x3, 0x80, 0xffffffffffffffff, &(0x7f0000000000)="f2265d8e3d69dd1b09cc014e32a782bf866c931ac85276c1c1f9e159e75985fdb5fe3586b3944443dd593881a59d5dac25ff36bbccda7e7be490167e598ce0e9d22d05d85b4d67eb92770376ec77382f07e5513c583ca625d20a76cc1bc1eec4777e0c17b77ed726d25a67c0264ddbe329d0b230", 0x74, 0x100000001}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0xbc, 0xffffffffffffffff, &(0x7f00000000c0)="400e53bc6bd3df186b018c5eb60e1ab600008e580cedfbd7cd35f6c72d5c0b962b0e2cd1ceb1eff32a8ebadabf3a29985d89f16400820fe9aea109284e8d1d876146f6e79525a55f260873f2ca56bb860d747962dc765a20fb304f167c00d8df7654fd282885604fdfe7b6b7d4f43ec30857e976d41ec4754006849c83fff2dcfab09acb26087bef93ffbfeb528c7b869e1564141bd7d3bde662bde725244e156d5af1228448d3a1ab765688a9a93a25aa82ad6b04d00368cbef02e0c81698661f9d09d57c4e7e80510d9de7f39a5eff583ae9000ac20cf370a351825b1b2898074b8f56de37f436ba4d312b0ecac46137f3fb", 0xf3, 0x80000000, 0x0, 0x3}, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x8, 0x1000, r0, &(0x7f0000000200)="2a32c07291651cbbe7406f1bc56e62dff1b97e339edd7d14ae839c207d110338015ce60b960759c361e835f9fb502415424fb3f5ff8c4f77cbd4421a87eb9e6c04ba231f9ea9b3d155974138da98c1abf9af3769da9f2ffa0a667675648d04c370c58ddf5739631de3a36f7781d0a3e966883358f8092f80d288c7c30f6bbe72136cc3e171f29ff52501da", 0x8b, 0x2, 0x0, 0x3}, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x6, 0xd10d, 0xffffffffffffffff, &(0x7f0000000300)="b812a27e9cb027d4cd235487b42651cefbabfaec1cf44cf5a0078191a1dc2c4b8f6daf17b899d418f9572a4486913bb56fdf59e588c04bc7040816ffec4630f4d66979ab64a3b4d11bec0c9b9f27a77db40a9ffaac2c6f725c709937f9fde96350041bd9528b6997cb6a40cef6a115a1ef75872558ca0c33ad35da67a7e9a6884a6242931b1e29a0bee86072ee903369feba87d418f85003298b51353eeb9efb5dc6111a7676e9c71dc49e4470c4d0d8ca7de959cecabeb5e525b19ffdeb8eb4d4c510ef40e704260bf1fd940831eadf4d1d58fd572f37f4c4531e7e957933ec76483a3c92eecf453b7edaf05ddd03a4e62316b9296fa4721d83091967", 0xfd, 0x5, 0x0, 0x3, r1}]) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f00000004c0)={r1, 0x6, 0x9, 0xfffffffffffffffe}) pwritev2(r2, &(0x7f0000000580)=[{&(0x7f0000000500)="102aa1a20065693113e82174b05d4d53b04da8cd1faf660be33ac953b7f82bb6b052b80e866b9af861907ebfcdacee1ccfc1f4b88bc2d0004978b92f3c0f100dd89bc2d935042f2d95116abe7fede43fe5421ca749c54a33d47c8bf151f8d0b40a0ec808", 0x64}], 0x1, 0x6, 0x1, 0x15) r3 = accept(r2, 0x0, &(0x7f00000005c0)) getsockname$inet(r3, &(0x7f0000000600)={0x2, 0x0, @broadcast}, &(0x7f0000000640)=0x10) r4 = memfd_secret(0x80000) r5 = syz_open_dev$hidraw(&(0x7f0000000680), 0x100000001, 0xc0000) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r4, 0xc0189374, &(0x7f00000006c0)={{0x1, 0x1, 0x18, r5, {0x7f}}, './file0\x00'}) ioctl$TIOCSPTLCK(0xffffffffffffffff, 0x40045431, &(0x7f0000000700)) getsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x9, &(0x7f0000000740)=""/49, &(0x7f0000000780)=0x31) socket$inet(0x2, 0x80000, 0x8000) r6 = syz_open_dev$tty20(0xc, 0x4, 0x1) r7 = openat$incfs(r4, &(0x7f0000000800)='.pending_reads\x00', 0xa000, 0x50) copy_file_range(r6, &(0x7f00000007c0)=0xffffffffffffffff, r7, &(0x7f0000000840)=0xad, 0x2, 0x0) r8 = socket$inet(0x2, 0x1, 0x438) dup2(r8, r1) r9 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_GETKMSGREDIRECT(r9, 0x541c, &(0x7f0000000880)) 14:44:07 executing program 3: r0 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) keyctl$invalidate(0x15, r0) r1 = add_key$fscrypt_provisioning(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)={0x0, 0x0, @auto=[0x17]}, 0x9, r0) r2 = request_key(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)='-)\\${\\\\\x17\'%&][@\x7f#[,\x00', 0xfffffffffffffff9) r3 = add_key(&(0x7f0000000240)='id_legacy\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="47b91d59f63be3ffd728f1da32a417d6229b5f5355f72eacd94dde9dc2d83701375ffebf14ac11d548e515", 0x2b, 0xfffffffffffffffc) keyctl$KEYCTL_MOVE(0x1e, r1, r2, r3, 0x0) request_key(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={'syz', 0x1}, &(0x7f0000000380)='id_legacy\x00', r3) r4 = request_key(&(0x7f00000003c0)='cifs.idmap\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000440)='/\x8fy){/(@\x00', r2) r5 = request_key(&(0x7f0000000480)='syzkaller\x00', &(0x7f00000004c0)={'syz', 0x0}, &(0x7f0000000500)='\x00', 0xfffffffffffffffb) keyctl$describe(0x6, r5, &(0x7f0000000540), 0x0) r6 = add_key$keyring(&(0x7f0000000640), &(0x7f0000000680)={'syz', 0x3}, 0x0, 0x0, r3) r7 = request_key(&(0x7f0000000580)='keyring\x00', &(0x7f00000005c0)={'syz', 0x3}, &(0x7f0000000600)='{%^#]*\x00', r6) add_key$keyring(&(0x7f00000006c0), &(0x7f0000000700)={'syz', 0x3}, 0x0, 0x0, r2) r8 = add_key$fscrypt_v1(&(0x7f0000000740), &(0x7f0000000780)={'fscrypt:', @desc1}, &(0x7f00000007c0)={0x0, "1a61b170aa2e74fa2e2a58b75a62ed60ed4c0d5f2da48478b7926a7387aff5957112b698943a3a974513d87e02845c385f49f39c58dd3836a95d1b9608ab57c6", 0x15}, 0x48, r0) r9 = add_key(&(0x7f0000000840)='dns_resolver\x00', &(0x7f0000000880)={'syz', 0x0}, &(0x7f00000008c0)="b7e87711369e4d18ad73a277c2aefd84d885ee8eb2cc7c6a1d6e5a230ee77d9fe4c35454ae3ca9dd55f8e002c51506a84304535f", 0x34, 0xfffffffffffffff8) keyctl$KEYCTL_MOVE(0x1e, r8, r7, r9, 0x1) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', r4) r10 = add_key(&(0x7f00000009c0)='cifs.idmap\x00', &(0x7f0000000a00)={'syz', 0x1}, 0x0, 0x0, r7) keyctl$KEYCTL_MOVE(0x1e, r9, r3, r10, 0x1) add_key$fscrypt_v1(&(0x7f0000000a40), &(0x7f0000000a80)={'fscrypt:', @auto=[0x36, 0x35, 0x61, 0x37, 0x31, 0x37, 0x62, 0x30, 0x34, 0x61, 0x67, 0x31, 0x34, 0x34, 0x30, 0x32]}, &(0x7f0000000ac0)={0x0, "2bd2380a9e1e411b4f9228d449ab1fcf377960907d2b1e0789b9b1439d1fa0b501897c192c163643c7c4151603f56505edce47b844b8a76f7a63f55ef17ed2d4", 0x31}, 0x48, r10) 14:44:07 executing program 1: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) r4 = dup(r0) r5 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r4, 0xc0189371, &(0x7f0000000700)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) r7 = dup2(r2, r5) r8 = fspick(r6, &(0x7f0000000740)='./file0\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r7, 0xc0189371, &(0x7f0000000780)={{0x1, 0x1, 0x18, r8}, './file0\x00'}) sendmsg$NL80211_CMD_DISASSOCIATE(r2, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x30, 0x0, 0x400, 0x70bd25, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_LOCAL_STATE_CHANGE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@broadcast}]}, 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0xc000) sendmsg$NL80211_CMD_SET_MAC_ACL(r4, &(0x7f0000000a00)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000900)={0x94, 0x0, 0x100, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @val={0xc, 0x99, {0x7fffffff, 0x2f}}}}, [@NL80211_ATTR_ACL_POLICY={0x8}, @NL80211_ATTR_MAC_ADDRS={0x4c, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}, {0xa}, {0xa, 0x6, @broadcast}, {0xa, 0x6, @device_b}, {0xa, 0x6, @device_b}, {0xa}]}, @NL80211_ATTR_ACL_POLICY={0x8}, @NL80211_ATTR_MAC_ADDRS={0x10, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x4}, 0x800) ioctl$CDROMEJECT(r9, 0x5309) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0x0) 14:44:07 executing program 2: splice(0xffffffffffffffff, &(0x7f0000000000)=0x7, 0xffffffffffffffff, &(0x7f0000000040)=0x1, 0x7fffffff, 0x12) write(0xffffffffffffffff, &(0x7f0000000080)="83acfa400e440ba5fb8037e5e9b62e01f6c1849a6d7c", 0x16) ioctl$BTRFS_IOC_BALANCE(0xffffffffffffffff, 0x5000940c, 0x0) r0 = syz_io_uring_complete(0x0) getsockopt$WPAN_WANTLQI(r0, 0x0, 0x3, &(0x7f00000000c0), &(0x7f0000000100)=0x4) ioctl$FIBMAP(r0, 0x1, &(0x7f0000000140)) r1 = syz_open_dev$vcsu(&(0x7f0000000180), 0x2, 0xc00) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(r1, 0xc018937d, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r0, {0xc0}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r2, 0xc0189375, &(0x7f0000000200)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r3, 0x402c5342, &(0x7f0000000240)={0x5, 0x7, 0x9, {0x6, 0x7fff}, 0x3f, 0xfffffffd}) ioctl$HIDIOCAPPLICATION(r3, 0x4802, 0x2) r4 = syz_open_dev$vcsa(&(0x7f00000002c0), 0x7, 0x50042) pwritev(r4, &(0x7f00000005c0)=[{&(0x7f0000000300)="c222327fbf5b", 0x6}, {&(0x7f0000000340)="a1ddecd095fdece294201cf64afc166c54e46b9eb9c42fa37f23946c4c660c0a4d69168147967dcbcbcd9d36ba94aa3ad91e33a49ae8b13bff17113ffc16a8163ed7880efe72a5396fa38d2ffbf08cfeb6216d3561dbef5e5844f897859a2f739ff225489fe8eef9047c556c2ab70097319e9209c155b1c41eddbd54d1cc51eeaadbf45b877257170fa152a29c8c309c694472066f3bfa88eff8ddc4489e034ec45297b8ed1f623dfe03d55c3b6b7ed5c4c3714234cdec2ca15c509d3197d7efc4bddc8959", 0xc5}, {&(0x7f0000000440)="4097e1365393d5050efe7c8407cb2313b01fb7609e03225d", 0x18}, {&(0x7f0000000480)="fbd6788d34455e72abdef5f9b0ecf33836adeba6461a7004bcf202f9aef8da", 0x1f}, {&(0x7f00000004c0)="6c8877b95fa810cf662e657963df0e81ef7d4c879677332df5f80f60aa1eb38b11d10005ad725213d186943c4e065f1dce9c3c93166e3b9d1b269f5102d4ba90ff0d100b549eb22e773f0dd4b667de9fca0bdf61bdc37b2fa7f60d90fd9ea3656fa96251763ebd71e6d0f83848793be4a70c2f5331354191523c3a377692341cf815f2bdb482b7f0f9702390ff806d90d1e02e1ecee2203da393", 0x9a}, {&(0x7f0000000580)="3eb315b4479f846f2fc3aeffcc054586d73225696e60", 0x16}], 0x6, 0x3, 0x8) r5 = socket$nl_generic(0x10, 0x3, 0x10) write$binfmt_aout(r4, &(0x7f0000000640)={{0x108, 0x1, 0x0, 0xc5, 0x61, 0x1, 0x187, 0x5}, "dcda0772c825963b42fc2d09c03daeb76a4c90341d02c38a325d8e144f2532ee2e34a147e8601372eccbe263e46be00de9c81201699c9d5f", ['\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00']}, 0x758) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r2, 0xc0189374, &(0x7f0000000e00)={{0x1, 0x1, 0x18, r1, {0x5}}, './file0\x00'}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000dc0), r6) fsetxattr$security_evm(r6, &(0x7f0000000e40), &(0x7f0000000e80), 0x1, 0x2) fsetxattr$security_evm(r2, &(0x7f0000000ec0), &(0x7f0000000f00)=@v2={0x0, 0x0, 0x8, 0x1ff, 0xd1, "6172d7fcf168efd53c8c16586b1a2d1cce341509cef47ecd9910aefb190e7fe0350b4fd1abfede10caa14a688c4b9f8e05129fe47c07b45ddd736cf76ace761a146373dd09cd09fc7a32f4d02108ac912fbeedad4e274de28b4c0845fb2860714571a858991206b302ff0b4589ba1cce2808f19069c7efac40e5f680bfd8dcdca1121b3cb13742dd47fb5affb43e62d6ac695014bae9c1cbf5f188470ee7e86a873e7285106bf4dabe662270684fe92f087f902da029b1048bf97c23da086fbbb2b33d8958f5d22707e5dc2dbe71d76f9d"}, 0xda, 0x3) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc0189379, &(0x7f0000001040)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) 14:44:07 executing program 4: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) setxattr$security_selinux(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0), &(0x7f0000000800)='system_u:object_r:shell_exec_t:s0\x00', 0x22, 0x2) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0xf0f1e000) setxattr$security_capability(&(0x7f0000000840)='./file0\x00', &(0x7f0000000880), &(0x7f00000008c0)=@v3={0x3000000, [{0x421e, 0x8001}, {0x6, 0x7}], 0xee01}, 0x18, 0x3) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000900)={"7f6d1f508aa7a78b4903735cf6ee0d94", 0x0, 0x0, {0x6, 0x8}, {0x9f4, 0x9}, 0x1f, [0xfcd, 0x8, 0x5, 0x3, 0x6, 0x5, 0x40, 0xffff, 0x2, 0x1, 0x6, 0x7fff, 0xc0, 0x3, 0x3]}) r2 = socket$netlink(0x10, 0x3, 0xa) ioctl$BTRFS_IOC_SCRUB(r2, 0xc400941b, &(0x7f0000000a00)={0x0, 0x689, 0x4, 0x1}) r3 = openat$incfs(r1, &(0x7f0000000e00)='.pending_reads\x00', 0x22000, 0x1c8) renameat(r3, &(0x7f0000000e40)='./file0\x00', r1, &(0x7f0000000e80)='./file0\x00') ioctl$AUTOFS_DEV_IOCTL_READY(r3, 0xc0189376, 0xfffffffffffffffe) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f00), r1) sendmsg$NL80211_CMD_SET_MAC_ACL(r3, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0x10, 0x0, 0x0, 0x1100000}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f40)={0x1c, r4, 0x200, 0x70bd2c, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_ACL_POLICY={0x8, 0xa5, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x880) syz_open_dev$mouse(&(0x7f0000001000), 0x1, 0x4181) mount$9p_xen(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x1804003, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}, {@cache_loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) [ 73.607676] audit: type=1400 audit(1663771447.496:6): avc: denied { execmem } for pid=289 comm="syz-executor.2" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 14:44:07 executing program 7: ioctl$PTP_PIN_GETFUNC2(0xffffffffffffffff, 0xc0603d0f, &(0x7f0000000000)={'\x00', 0x73}) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x4}) ioctl$PTP_PIN_GETFUNC2(r0, 0xc0603d0f, &(0x7f00000000c0)={'\x00', 0x8, 0x0, 0x4}) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000140), 0x8000, 0x0) r2 = getpgid(0xffffffffffffffff) setsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000180)={r2, 0xee00}, 0xc) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) ioctl$PTP_PIN_GETFUNC2(r0, 0xc0603d0f, &(0x7f00000001c0)={'\x00', 0x81, 0x1, 0xfff}) ioctl$PTP_PIN_SETFUNC2(r1, 0x40603d10, &(0x7f0000000240)={'\x00', 0x9, 0x3}) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f00000002c0)) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) r4 = accept4$inet6(0xffffffffffffffff, 0x0, &(0x7f0000002c80), 0x80000) sendmmsg(r3, &(0x7f0000003080)=[{{&(0x7f0000000300)=@l2={0x1f, 0xa31b, @none, 0x78, 0x1}, 0x80, &(0x7f0000002440)=[{&(0x7f0000000380)="1742e8ada78d28e6435bcc86d8b7e8891a0b52575c0306a2d1bac9c06e8e26ddb7ca7f5d16abcb0859c45b596b523b6933222be8dca3e5d9f90a714d14098cc7c4b775afaaa441692b399b4ac12c1daeefaf4ad70c4d8bf34bc71e4975374560cff022a57fe978a1b45f505f86403c948221133c8ede51a150fa3f6781a203f019f8d65f499b6678d7d58f94", 0x8c}, {&(0x7f0000000440)="d721ee279734ae54e206da8058ea09604a52e4832ad1e82766449305007f3caeb895e0a77ebb11adb14a7445f720d985c984d350cb058aa95cf0bc49f41b54ce547635f5d9266b07c2f30c385241b53c6d0c25665279e34c04dd322f86be901d6986e3fdb90d8cdc7f0a0f3409bc37185498d1161fb7a0228076be70dc63fe93552807943996e2f7e7fba6ab021b41d6359c113ebc73fce57961fd2ffd2e575a93453be70f63ae7a6239baeadb6945e81a45fcf5ff858f52e702c0fa9e44e9d913f0405c05c6cfbd88ca5114828897a3b574d3f287f04ef01c01ecac8cedb08aa295bf955fa05522a4a4c3177e725f1f3dda8732a71beeec06b624be3dad7359c4609004f6bd6b606abccfa74a9858745c9e9dc75e67fab08903afcf14f3bc42b568b08813ce8b40f17c91fb2d20248cabb2a59a4fa5cf06e815b97d06c7b2dc726007a8a9b49ab24307ab8a5a275b6843f489a4471200f49821df97b778064b3eed130734128060da50b8a7cf274ad0f10cdf8b6f328bdcd78e89300dae83f4ffcf1ed23f630cb7736864b6ffb394fcfdbcc8563b4a606673e956c2ee3ba8899a7734928f50c97cd84ff27d3336d3f4684d7b9162f3d50180f57e04d7e63223a445f64ea9252132cf6a452b7dfc9b75f156d9ed0393efb500e397d8ed3a7020bdc0c62a4f8bf7f0c1d7cbac1b1b138d426d151dac0b6c5e7c68ff1c83d0aec9535f06700e4a00c8e6112772d3473a3b1d7cd540af9bffd48ca3581a6977b506640ce974d4abf3edfb5121f8444c391c12a68a5608fc462df450cdf1816d5db80fcdc5e1282ef67156e25421fea8cba3f56b3667f2441b138918973f5187213389321c21d9f666e3fa73a13782c1d8509d23713ed81d3ae6a56e55b8270cd50365d2b45e4781df3c264bd38050e7334d79d220e9d7ca0d69a830b159d15481e97333b2a27ca65123597f21a804a3771595c0de860b739dcd590b7f793bc4543d7b4b4a349eeed0540c8f2a87c10ffe87bb765b15054948a2a88ddb228e7b90f09ef9ea1383e68ad6b1a78f99f32e10a6bdcfff839e4b717052bf07c8db7376a7d27e5424815a86ce983652db86c9b9c80e505506f69e9de8caa70cc6b7bc214d2c5dd9db067e58879fddb8daa3001a6b7b38fe7065229b10eee8feaee6f5d6dcb2d13beaf75e1fead1b8684b63e18c9a9396ff6dfd171bfc287ba092cf72019003866f2d255da585cf59c0e1d7aafc7dd226f97a89d3a6f0e6a942b62b3e038eb94dac840c645d2b63366a82d94b9881b50b6c03031787c751e0c9d94803c4a5ad807bc99e727c507153ba0b802dbcc5ddfdd7fab47d9aea443817d9210aeeb603a9c712988cd4781e12b24ea08594454a5ad7ba6629caa8e395c038364404fe56d9489b791201bb0a0d44dbd523788ead6650265de44cfec0076a7dd49cb8ab1ef1618fd467c849c0443c3afeaf67def44e0fb718565c06c4163b2ac2b9ec5e0d059ffe2b17d06c5310d289c3523113a4064bdd6ef633586a36b5a6151421d82c42634efb5c135de7ba941acaf9821949c7efe7f663bd9b53d1d5ec1c11abe0f99a070db7fedf010e50ed73da09ad1f0cd8c61fc824313129287329598db1608abb9bcd257dc1a24208a28702645b153444a4b4815391527c3027ecef3604a74e7bed9532f988dea9a601c78214a7b911e4e86d0db985056908930c93a16046f7f91eb1f01b60955de670999afa5b8bd974e8a030d37279e673cad95a7688fa17feb81e3b4665f1f3b716112069917dd076c31f65867caaebbc66162f570cebc15f09cdccaf07a67de1b06e204bb24e6bfc786d02713521543fbd78fe53ede22a3f82ada5e8ab6896ee9efc39c140a8d4691aa54873ba79fa2e3261055343cf0c8e19cfc4f9cde500facfa9d425badfa72bc601996dcd651dee82708d40a155979deb70427c3155d2a6ad5bb5d6dab9314fa0fdab54e6aaa91a16a52ffb56d97de5b4cd9d20abd00ee203162a73f82c98892c00f0c18db08a41b6887cd9400de7702e9b13a13e630ae47b8bcd7cd0983e4de8eaad4df6b05a4939d03a84a4aa4080110dcab23f555f29ea6bb68f1f326df173a784960c463ea09d9cd79e8814d985f9f5048efed5b050f6a425f3f73e058401bc35c30db7d1bd915e15e40f3ffe4c3f6292e1d7eefea5c8e743ec1deae99959be4a679a4cdf94bad1780f01b5f8330f11f9d7e95333068e5efd9398373d01fae9d770908efd5726d4413dbf96821c0493b8492ec5863f0908857ee2f0365cb576b410f78dec6a77a4458dd1d9d109ba9a6961b68eaa5a29801ff51e96a3a65503c69e82f56c0dd06f14a234e7bed04dcb157cc13abb7ca4daf7610efbdfc8c223c3d1791607c488182a4b4c256ffbd7275d031f756a1f5b8082fff289d4d75724ffd03d9134dfd0989d785dca32465ba0e98c4f050148bd13d9e7a3b083069fda31fce4697dd25243f967f0a9ee08be992445384f4fe1289f0032b4bc587d3a7b4895e07a06d83de6da299a45baf31934b6bea2b75ed2851472bc9e2023e6ba4d1c17e741f792b15b88a33315e3074a4adaabfcf833502e55cbd39adb29e0d340e46c51d0c7fee0e9d4868db035f61f362f3d6284461368473dd3bb900d463c691a34f31a81ed553960926aa45040298126bbb7746f9cd898f0f7db3cd54977bd0c9f830bce68d227d40cd749d52654faec710619e40a0a0a31544a0851d975953fd0f5bc68eddeaa2e3b301b8af997861c91b67a10d66d5d3ee52bf35035fd71952b693c64ec8fe9c123548927c0479aa130250f38e13b866e77328e19d24307f5d037f81f17eded0e30c1219537d43dfaddcdf24b80e97cb7f29388331a09ae5bb2f5c3900569a479413f9c2d87194d1c87f8eb5f81640a62abc2d993a3ddc681ad6ffc0197a3bf981666dea135f485005c6c466ae1fd67eba8d6a10657afcfe1e6f13b98d0ec05f453e8736123d5d7cee3420121bda205ddcbc5933537b254fa3df43441d7727e2b4d12b9dd4da8ce4bf223f1bf4ad498267e7c533daafe74e9c0089709296e51a7f2acd46fe55b7194f5f3b7125dc6d0ba6c44154ad0102b6b7c0004700bde4b47f0ebcc25556d2ddf6e957cfb72f66328102b67783f6f4b97131fa2e4877bb2ea0fbefcfd0bcf67d34bb913968d6dafdee0b9f8307cc30e382326911d08515028a25ff15e679e5983b70af275c4f2e44e1d2ba1e9575a980e74f3d4b7d49914c8041702840a4267b27a275fe2eb86eba46bcb147384ac181d59192dcb301a0183c076f41fee44c753d0b27044beaa7ca73cc6eae5410f2581e4c5ea19bd25f7cfdb51c4a9c5f1d4151a35411cc06fed38a81040f19b9e1e6daf5e48da5ea37d2f781180864e6b68139cf45207c6ebe53ac96d36a0979bc5e533331a8371a65d3c5993605b88f4d81fe6b83be7377f392441cdd6b443253fdde6c6bab6f2469a56481d790b69064068cd014718d9521c1e0281f91361bf8762d288166a50ab56f692b47ba7a2c196074e888e3fbd206baac64c944674c9dc065656887c69b541bbb6298f1e8577af7f3e3d0a9c271282a473abb0cbd4fcde2a797373e0536e20207e39b59a81dd7629c4ee03ab2431d8faf3f76838827cd7921cb78b4c71d4470ff8f5f3d4ba1f4d494268510f06b78978b64e8fc763f639978bc9d28831abb9ac685d5c21b97e0a034fd7116b033adde9626485dfb3744c860addc6468665e92f77443dc80ae8baa6669abdca3e690628f151a4236415ed158299f5eaaa8584fba1a70f6b951c9b21527a9efc81d9910512fa9ab80a58d5bf1121510bd43d738d0db52ef98a1bf42220e7e77858f823661cdb52b1bdbe017d5d01421e8a577d6931bc5e46bb2f0b7a85c448613fe8d2d573e6f226a516aa570fe692b8ad0ec75e579abc7aa1e55ed1f90e69e5423970aeffcb735f2fb1e22c8043ad167a735a729040d0063802dc4dbff56fe5d7b796304be6b1f40acd758a4867d28b26d71ce8b8f0f47407e94f224c304e19b920b228c8f1266f98c857716fd4855a6056df2cd7a7adf666bd79f1a17d3e967a16f9d6d70a47b37c528c7ef6238ee5041802e10165e990211a27c7ae6abfb1cd720955fb8cb8c274220513bf9366eee53fecc79ee67093672b69bdc8f2deb494262cc1c28b8d507abb9e80e73c945b2278a86d57d7a460a9df6deff5523e127bc2751c9e4ea7ca97a988a38069c2461cd6279b789c61a11c26d19d72b008090a6f9246d7675df6e181153eada048ba079c252b69d3417b1a7e3690104bcdca37e733092b2d4f00a0e0c34498b4c45b2bdd90b8cb79d6dd666f19b02dc75b866897925df4895331c5c065aed5d65fbf912ead29e5c78d53b5a1d4c312d7a790ab9281e3344d36693de3efa679d4acb7cefadc69515810abe7484896ae7a70ad6de2fb52d7887282f345e7f265145e91059a36780f8da5c891f37b516dfacfb317dd12f6d9699d6b0cf8ad437e3ab631861581024aee6172e1c26c487c10a26ca56eb8a2162eadd489a1c2f4879a7a0f604dd3951f1ead46ce85beed58f8a7979500620bd1ddb658d5f66678ccbb99c47764f1ed61dc16b1b2524fef3e3e3400af23ff19ed1dc0c5b70a3c5437679ab28f8f6b34eee6d2f3127da267b84b9cc99398a23826038c4cd3f03d47b26156a207ab7440bf5a27d91b9403e32c802c1d534f43ad931e2a949c67ec77b270e6e5dee601c31a52d00f61d03aeb731e379fa86303200fd7ed336a5ff8e4a9a48f559e73f0d87df1c7d74e9cb5e8b4e2b9eff13ea8dc34c4b83f5cca74c9d95b90eb20c7558b93a88eaa85cf92a6e8d4f935489bcb825ec181af95067dc4b94086f68a33c5cbe7cedda5545c1bf974cc537052393d4af3715ef93b3933db1d026b03c3859a904ac325149103926371c531f5265924ab9f66d22a985b04b411e7deacb098e26371ba6dd873fcbd14e28c6d663780b9ec79199f8bd4b8650e83a42c19409cea9eff5eb027f020c80446151c2ed9bb502dc07b364daeb1fe89a34da7be423c06fa10cb64362b40e0339af173d1647cc7138e6624be82a437844deec648f37bebbb49f5c047bb6e055e27bb79f155712cd82a7848b290760fe88bbbd83e3cce8f6cf4505208b1a0f0082f776ec73dd27c1c06cdf167b811e04e9c783ee4cc81f674560ba21eae767ba29134e2f983b2254915e6da536bea7e687c48948a63f6c5b04aec1437506aca8f9b61d032880c16fa191d371b89440295cd2084216b2ea28ea2031c454284d0e1568eafd8e5bfd77118bd46195978f6f778d057368f5dd23338442f631d14ad71afe09af589c28fbbcd0e267ad020403b4e99bdf37cb88204dbdb8c814d4001e11f2511d288f83f00ccad323ac9b2144f9fc1257c7cac516f4c6ec205d26c9f56814ae43cbfa547d7d7c623392c91b8acee33b6eb36566a28efa517d711d19375c282ef766cf295d8d809ba7751f7c23dc6c26e0880c0a61bbffc6b5b2f32ddc83328856cd7de06b570809d26f8efe8a36a86197672b2123b772da70cfbbbf50dcec9959234102e8a9380a03e869bee2d12771ac1df84763f9ce5f53b24a5d6f186b4e73ded6716d487371f7f97494f74342bb76fa579e494ebe0f585b73f2cb678860f755f130bd7535a437910b74da93de77ad0a03b4b6a1aa668cbe9eb1fdecc7105a0d25adf31f4baf4c46a9bd966b235d724294e8e768aaab47ad6ec19b408a10a0f2dba02767539d5c8ba811c1ee48a29d457228989c4f2c2", 0x1000}, {&(0x7f0000001440)="168615d1b64bd6a058f1d61e985b60d721b03d60f794d5a108b892449f9736e9a69b395b9aed6bf043e4428e30ec8f76e0161aef9b3012569095368931ab9719fc0852e3f147c4d0ee6696f64a1a0d2ebb8115dae7c7a9ddd81681d4b7c867d8228294de587ef33ac5a1a19cec2ab1334043fb9412890e1fcc787f53c85bac8cfa16e88c686f320c5ca0b8e59785b1338d61ad5ff2230b7cd30b25da40d12087527eeca3f2f4412196eb62dd48ad97988dc92fb66bdbf7568861e3f679f1f08b59dfde20e1fd83c5856051f4fad3b567549c2660fc6997970a291d09f1452f352b75c8826760304048a794c1c63ebed881e6d58dc3753ed049a47a927f174c8a6273ad94630e932f94a1460a0b1b3c34538e566d0746a8a8d490360582b66f0d49d091d8558057655cd5c7b9be6fb77625f435f64f17a5eef41ebfce0f7e2d9058ff3c2bc2232951575d4269c4fa5eac689bca775f6df4163f3bd559fb1d87ac843dcbf917a66df0b5b0dda50ee35a1f8511b64ac98ed55d63b446b974fdfb44a902c5eb0a7e7ba3f8a4813acb19526ec9c1d85795e830d9271b9d2341c7b78ffbc18a32ccca021132438cc20139c0092abc04061965a6545d0e1809e944698ca55b93c5499fec25e01ce28334008ddeb86c56f9e1c081f9052146462f1f788b59db500e9dead0ae6b92613d89888e7ea95fa07ff20cd915d5348789477d7deb8ff96de40222894aa79cffbd0c8fcf9a34a05a2764034adf9aae48aed5f4075b131f005c0ddaa188dac94b2bcaed514874fb0568fc7fcee6dce6807c34945cd12b2e963f067dd1a8646a589597caff49af3c8a65ff1946b2da1b4f042d025674327e6d80c3350e4d0715596db45cf4a85cc29ec28eed4775a948f57c3c44cc00bbbe6d5037347e1841a54377a60374dc5bc3f2611b1cd50c382f2eb3e663334e771ca4ca9f59b91e3fbe12e73d4ef57310109c71fa75a7db28b318438a6811e38bbf9a5c840c9f6cf6ffaa04339a77a9cfa0efa54f57bfb89d606faadee18c87f4a1f8bf6914ccde9abd07decce15306ed063b4331a867a4b9916da20fa910e1fd95029273332e70003711d036df150ab5bfb0d8c0fa7911ab8a9378affc1a287913c03b24e8c9cf3feba243818b5c5bf83a80fcc6a571acb2f8d33c70f9227cbd3d7e6cc82dbf178d70a846baf36dddb700bb5ab4444d1a4ddefdd7ace35562bc5cd0ed749348da5321255b206937aa0389eb74c76cdee3de3e1bdc23236a3e79ed9af443e653a44b7101b3ecf4bbf2f5f0b5bd67dd237337017452f5d394ccdc98efb485446e2c697b98f3ae440f9bea419404379370f95a15170d05c5fa7ab1dc0ab41867665d8b05592626e58797f4420964eb596902203db81e022fdf21ac958cfa24cafab85d1f9a3bc430505649cdf88da899edf4f937e148a584704ec77839070d33ba9ae746536edbd0b33b9d019b1cf71a888c7e1940fb149f6bba664984f977ac1f592d8e0dc7783cdbd395d00ca2fca6e2cef18632d262fa16b63648481de79653dd3e14355cc5ff78cbdc5ebc7079a243954b15f9f0c437defcd725e5be7d3d8ff5b74c9b0a667b7e8902178435f1bf72e3889cd0fb4f27c54aca03e6f94f68f4b8ac2969e5c9756cde397e56977311cc2f8bcced354848c5e7208c30bc3a398588de8f960b1df41c440966feeececbf64948b980c5f504b9421a57c2573a46e1770fb382cb69f96d573d509f99a160dd10a68082956bf3e54356619241996a72aba864b45f22760b3be59ef6a717fad733e78bd3809ef77fc873ee9797e761b82db30c1f1e979bf8815f64ea337db50fe24e0089ded6ecb33efa385e202897867e8b291d74968c493b5b56efd3503765bdb99d39eca905c4cf758e9075b6c9847d8bf964feb3b50104bc718b7ac64e3a0c6eacb64506d5e07561def130a4a71244cd5ce530cfda4294bb87fda5b8f64f3a804ac44b0681a4f89dc352a91eba8eb2ce2bdf5286ab83bd844affac9ec114a7b07f66d9dfebf12a1cb8eb1ec533295a9f3413a828b5267de7dce6e5018853d266dc6743ef7257d9a1da54738217a54a6a6d14a02f2cafbccc05cc8ac31829bfb62a90a6efd337e645d744e27ff4042881a7346e8927e5da340c1efa1ebcdeaaac1cb7aa32b742e7d3d4537beb852640af807e81c5ae936a0907f2cf2b575b1242ca1924e39215a95d6a18029be3129ae8a727b0c35e84a881049c4a7a9299a7bc44481fa375adf5d1e750149e4befc2dd54d8fd1cf95c0d9c6d1b380fa4bd7eb56c420a822404c97cf67998ae80e82252c21a9115b9107e77fdfae94b2d33915d0d57fad03b95a8de40817552d84f7dc98e123d87e25439c8aa654f4f0088803901fe414d9d62ba05cd67e743f19f53bce6dc2bd957b7cd88d82965c008c8746f9924d7df07b2fea2cd9a6323907e0a1e02e6cebf6efc59f026104532f5fa2ee63b6963c8f57679bfb2ff1cf2b8d1d5e81f0f5a1b5cb271659b6fb7f44c2490f56fdd7cb74e0e066764c85934a444bd3a4328d49e4ffb4c4ed1c32246e1cf6ff92f4574867ef1adc2cc5f2c150dcf6ac6c596831e51e952fafc03b96278f4b81b6a3d92a3a9a1da0a144635b4ed3d420b70a36a95afb09393c78e680e757fd74db0d477f59cc2cffc3405039ac7d2708ad48bd9a67aa5642d662af64dbd633722dca0f17ec9f80bb7d51d2380d1acbfba7a82ed861977f0fecd14d2acb795091a027abb424cb1c9c758201b18d47d14799effb2f74ea11f2c91472e357efe0eff722ce301bacc19ac7909ce0dd34c95d155caf4b1219c6e869f72535972cbfe55e34ded4f6366991c43cf2effc1a8c95ac58def0f4bb2fbc3bf5f9edd076082554ef9ee450d86ce2951b935eb1da7c4c408170632ddccf6e24d49c9e18777ab99a1861846f6299d26a2444639ec2b3adc0ecf75a1353abdb38f5622453fcc8594566c855656382e2a3ede83ae67a176604fd8c6ba8984d5e6280e64f29397ea5fc31ad622d8978467e7437aed35b62e57cc3199258806ccd7ee03315bf5da143ba3f96f6bbb2403ce4569c5da60584cde498c634f03727910532098b51a796803039a2563340e48d84fe1b31d9c79725df30097b59f5a4e37e3912fc0d6523280bca881d6fb171e15a529f5af1ea051d01a04429d11384316a76254fb4064a9a3294f9a3046ca7aaf0714c52ba9f0948d6720d5cfa49d2e4381921f2f8841e1ca5807da8c7105b8c82ba6a28f7c5b1c693279d246fdda0fa753b67a3eb491165de9e0f70ee5db6ec37db16d595f9296ad806f4586424f19c336e8773b341b12754672976a18aefa70b3ab49db1615b4a4a4b087e209c89ec99af6d2d0d2f796e53ecb8f15c98feb3aaf8242093650d12d8797b9251d24e5562b0a8a5cbda4b05d9d41b7181736c998361b183e2a5fa0dad22618c1550e1effd2ffcc3dcf1973b61bdc300cf1de7c8d5689d485f25c84d8a76d30d514c7a21067b7ef289d73c723326af533776e56823de72cf79247dc070c954efc7c5f45843f9c77b31355c32d700b830b951def1934cae326a7001f242616d5b3a737c948c3d9c17dc1b30a9707226321816e6587639dabf3ad9cbb7fca0bfe292e9032490f5adc208e8a5b8f95157a8c12168789b121c34d8b4a636c27dd9119ab53610d36d00adf245ee779fb6dbfa9ecdc6c5d9265e838e4fe76d8023582e31d1372b9cf5188513b996b039e93f69568d8f2ef83d0e1ef7796bb9ffd45fe6de1c07138847863ca80e1e973b49fdeaf4ebb4b889b71437788f781be2c12e2ed53d4e958ef5960580bb0f4f746577d6ef983395cdd56ad33de457ac28fe297b990c7c4a59cbb7c681dddbb48f37d90096c992f8a53e2a524dfcbca9454cc907d3a434644856f4222d1a78280017b010a207f2e8aed0477d80b5f340dbad45b877d0f2d433acc80fd9f100322bf4c7a0ac2f010182a77f75df63410fe979fd8027bd0a64919935e8146e01d77284be2f9414ca6d7730509fac1df5b7594d7b28cc5562c2eeb061c04b235ee8cbcc20dd8e326036922fcfcb4cfb8eb4e9ad03d64461b1feef0b294707ac5c8cfdfddc1f3e8d5dc9e6072e105ac58029d7d70d9f46f787f45a6fd0e95818ef4a57ff554e3495084efe9f1d1c35c168f69e2fa2621ff687e827012ad78929a6cc730c47cfa9c4d459d033835776dbf5598a8ce3a8736974dd452b026802b752bb88e1ff760487b017327dfc4b2b8ee0b43dfaca2ad2d51ef5a94dd3e62c98f2867d50ce4a7b403dc7d609eae6d82728254a7193c56193f7f008ab94246f17e154fe9eae14c65fa9d83cd0f52725a24e9aa90f0218fd1640078cf19a094d0be5742698dd24f71d252e330458af1c823e7290d77485e5986d1e574ebb91c50840dcc8118e348aab47061f9cf2cc405d25a14a39275b510ac6ec742e479be67da50f371fdf2bed2aca3838b9ba6410d354592dadd06f0841a1febf83c936f9007e898b2f7fdec0af70131666a4b99dfe5fb1c82110eff37aa5ebac0f4d1f62143908ad7a2a312fd6bc611e7594b917609726ffcb2a7990d0e0715ee8c897111d8c2f32b9e63a25f2887d0a434a09e17e61428fe8c8cd920bab486ec8aaa4594a161c0e2be5cf16979da8bccd854c6594a4e5579b7f9377c9e5bcbd6c1f7b91e7669c8ac258736da529b5c5638ed208b6b40a43181a37113299f393f49776f50156cdc2820f98d2800ee545a753e7f5f9a53ac0efa0a0d93b817d85373685b984ba3e8a40f8168de8711bfeaecc4c47b8491c7a0dc9f6157d8f8ab2d79cccbd408f419601d9c37a520c5983e394170f378d9e79249006e8f78f5bc16ea1dec212aad6ddebcd7473c2bf293f10137544fec7d7c6f6584c2433726ed37826ffdcecd71b7de90eaf2253a1380b7bda9a1af0d922a5b1407ea2e1c59b6c37bcac5573fd8524dbea6906fe9ac6787cf9236c913753f630593d31ade6d2eceb2c9212c0c8c941d5270d529a4a99e77bd4e065c230b44ba09df5b5ae7fb4b9d7950e760c6117f1af6b29584c13b5f040b386478730f1196e6acbece2727ee0d7db81896b624cfc429e1eced159dc61903fc2f5e5b584c89cbce27df175b823198d7070f880128b8f3a2bf106f35777701e1eacd1aa04b02e1669aa75d889b792c32b54391d47bb28129045bf45bc5ba80ec26f0beb3850982ad6d9ca69895b2dece112f4aba427465997140e15c2602a0dbe5100953bbe4261b30ce0d11677faa1e87d95db8ff9552ad2f77b49820bc634774cf28e215495445fa9e94025664307b117cff0003284ed3d996d1a0e5526abdd7fb9cd2b32f54ae2bab8fd5a5a31b3f233db1ab283761f19dca1b0fd499194ca90628280ea52c52a880875f6a9249b36f4aecaee2e75e1cdcc721f8e2a4e90ac7f1d3360d32c18fc0a48bd729ec8d7c4a3d3b663bb0fa890be755f8cb23ad1bd0ffaadf235c510302a7a29c8951c34990d1c01b3b0ae6bc37a0baa3275a865e31515dde7be0b12a1e5d6c3a0b386ebaff6037e34d70891740ed43baded3664dbe21843505fc55f33d2efa2e9a0f31ef3d3c5c9adca5020fd56e8afaf20af15e2eac82f6c93c7f732c2957baaf996afc7431b3f2f8ca668ffab8dfccfb53436f990c6b2558dc34b405076f5fc699882f1c7dc4424232e68beb1b642c4090a6a16e8955e7934d28bc62528c8eb6cf6f56de01a90ab170079ceb579e22c7a6db708e0fbb2e1b8dbc2334d5f108475708171a7778df079f901e77e39408", 0x1000}], 0x3, &(0x7f0000002480)=[{0x60, 0x0, 0x800, "f920d7bc5e6eae6106ca2584ccd951ffaa51f35ef97ec3465db37bca4043cda4ea5584c67eeccf48dc8b3efd75cd272da6514013479fcaa5b3dc05d644e941171f9b0541a1ab6ebff863"}, {0x48, 0x119, 0x355ddae9, "7270487a341d48e5681532c85c8c7fe3754653fa2fde42e152ccc0489e0b604e9894a824a77429efedc90d2b8be1f86db6adab"}], 0xa8}}, {{&(0x7f0000002540)=@nfc_llcp={0x27, 0x1, 0x1, 0x4, 0x7f, 0x15, "0ff96335194686af1fda31494bc4df542791b4f9de1f5eb7d0b944975bf9e69afd44afb29057ab5567e75564efd78b386af86805a272c56349ecc7bac36e3b", 0x16}, 0x80, &(0x7f0000002b40)=[{&(0x7f00000025c0)="295be48abd0be5eb6d48a24d66627de13f58cac8df1b99062a261b45aafed97d55d87b05fc8e80f6977938a101f809dbb32b31e198c0fa291de0ca96d670059ae429c775a7b506bbd35dfb0f159162bfec3460c50938187ea92aac7260922f700fba0053ec3bb7c1b7cc94bb106fd9abf874be282f3b60e05575775c7e8e5569af4b32e0e983ee56120be79b31", 0x8d}, {&(0x7f0000002680)="b20a64abcaa990f168b2e9134acb95298c60e7fd9cf0d56a07a06b79b501721f707ef271ef7b131f4eac76451a3660e6e42dcd42670928fe444a36c3ec7c750def4ed4b5c2b28ba603d07d8c6353af0dd4db6c12c454ff5e4bfb541f861bd94e2f556786f04ac56459e5e15e6fb5111f96f82240f2094835ab4edabafaac859cc010e7d0a62138267b13e911d6bb49102e68152d1b6caa50d6997df94753088aee5c75665c9ab0479d72e9c7b0bd2624696f4f66b689c9418025f7e50e4e500c3974473f593cbd1de20f475e8cf2a96d", 0xd0}, {&(0x7f0000002780)="abbe2910d4dc17d80e792ab8b33de80b00fd3d2e16ba3690da19c3eba3eb3b42621284bf275f4244c0390acd52df7c725f873ac4029db1d68d4f0e138a159b4c7bcb65afd1921421a80cada98e9a1fa896de34bb148279749feb264aed548dc6d7d904aedb7bda2b5abb618a5a15c26fae9534ca719c4fab855c80259a", 0x7d}, {&(0x7f0000002800)="c4a28cc0b731e5c9eb4311fe5ecab31aefad2323310fc6501faf581ace2860579fde31c50b8ce0de94894f9ce8f99c31313a563f617c31fdfa952bf6d161a0640f615a1a1745dacbbacb1a53a50914031371ca1e3ba881eee4e19db8f8627a94df5fc4a052ba62d533b37778ea93a55be94f259a8eeb1ea2", 0x78}, {&(0x7f0000002880)="dc7a681eff044b3f272b66855daec009d3e9c681a45dc7582f3afbf85d830c53a80d8cb8ee088e7e34c590f3d792d3229f9ecf1c1cdb220daddd072ad91b313fa4b27ca7f21a148ef5976099c0eb1fb2ce00be766155b4e3e458fb3e86813b3b1eb8489b7294d2", 0x67}, {&(0x7f0000002900)}, {&(0x7f0000002940)="840ec5d1426212b5f6133ae50451f336aae810ca39a648a35932848adc7c84ebdd931051d7a4180f426e327d286a1bf913b7d83a", 0x34}, {&(0x7f0000002980)="b1b6df838e2bd27b3f062022788a4c1ad1461af15013b70325f9cbea368115c7de993b635483acb3f5e9760a38e520355526c1ec011ee7c2672f0d7b2828807627c86770296936fca175ffbbece74dc900852a2428fa389bc144e8c4970fe2b5e64ef3975b45dcc6d99d8baf049c8a4feea6258365a33f4f96346a091a0151dbafbfc971a806d379f1a5d615dd9669011e4aa33fc5d2387aba874ffa47090e1e83d365ec4e2e02ff10e76a824cdd27c4e6", 0xb1}, {&(0x7f0000002a40)="acd8a7a7f74dddc81f85dc3c211f7fc4b8c170d44c00abf3ef5ca1539b70d201acb1a971f14e48f968bc7ea575c87ad361444695b470b4b563aab618a82a93f686288e53123aeba79a6773f194daa81d03103c8bc405c16066d5a968488feb9b9811a4461a2b2c6a0fcc1812f2aa4ac8cdccede35de15a55454b43857673cd05d4f1d35838516a9ca4ed4998faf8b381a43303b0aeaa410bdaf2db9b65d5ec8ba23930871b50ce1a891447a468deb7ef30b5da16304b9485ad91ab14e720a432f9d777dac06ec88181653def5e4f00409aaa", 0xd2}], 0x9, &(0x7f0000002c00)=[{0x70, 0x14, 0x1, "d3428e0d4010fee17d0f439280340dad6effc8e4daae6a08d2f9007a3a4ca5de394f46fdb4fc26c8328b7efe125d0556b856b1b1e5078099e877affeb3b9ce57595354017b148f5c29ef06c73ca48104c571e89838d99a8098d628b0686e"}], 0x70}}, {{&(0x7f0000002cc0)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x1, 0x1, 0x0, 0x2, {0xa, 0x4e23, 0x0, @loopback, 0x8001}}}, 0x80, &(0x7f0000002ec0)=[{&(0x7f0000002d40)="bc74490659db682a30aa0e4efcc465837c9699a48c5245597bb774b46f8e3c7346a5d52f19ea83d00702e7b80010fb35ca06c35889ad2283f9b5a58b6cc437790166a19b9316203c015e826de53a17dd77e62f9a3d1d5692b451e24d29375e8e2e", 0x61}, {&(0x7f0000002dc0)="11840ba2383dca1cf652", 0xa}, {&(0x7f0000002e00)="d7c79094b8fb6954455700264269e953e38803eacceeb5f1223d61f439c0c271b203c1b640635920b5d22dab732e6e31ea6b7c32daff68b5d8ffb75f0953bfb8f1a6575c6ee5842457b2677f071b68fb378ea438f589906561368eb89c1cf90c3f8495fff4c70d764ee6d49cc4b8f32f3cba020b8dcf1cd193b8eb1a27132359bb2b17549683d8467313b4739442fb55cf45043c1272", 0x96}], 0x3}}, {{0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000002f00)=[{0x98, 0x102, 0x3, "2e41e799130286c5ea514002ed1b3ee1f18c5bbacf9bbba78213bde822c4354c9dd4efcb15e16a507a164a48cffd7b2858ea89fec3be2fd31defb03a958bc9a2e03462321b8f7c23b76ac1cb00120ae234ee816a697a06781843bd0073ef3bfad2ed18e14c41e61ce02782db77b55d2e622cbd32c1950bea6ab920776239cd2f509ba0486b"}, {0xe0, 0x104, 0x2, "4a06713d958b7eb6bc7c71fb695eb0e943fa350d0c65cd081ca393a0115f2f67e5ff5fa45846b8576165af33b56c6a81088e77bf3be571f3cdabf146042ee76c760c2a07b42bf5170cf5aa514a5f357cd6e30e3839efdf98fbbb9294c698ec6dac89afe2346559439b633521ef37facbfc2e6541c0e3b9e5db1c5501bc82e4f210fc2e90aaa6134266de99c15dff084120f06bb53585f88cb955f5f28bf028a96419bb9313595bd390df65ab312678f5d30ba96047339020ec4767f50915fdb5fa4cee835ff78013f8b951"}], 0x178}}], 0x4, 0x40000) r5 = open(&(0x7f0000003180)='./file0\x00', 0x400400, 0x108) sendmsg$IPSET_CMD_HEADER(r5, &(0x7f00000032c0)={&(0x7f00000031c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000003280)={&(0x7f0000003200)={0x7c, 0xc, 0x6, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x7c}, 0x1, 0x0, 0x0, 0x45}, 0x4000) sendmmsg(r1, &(0x7f0000003a40)=[{{&(0x7f0000003300)=@isdn={0x22, 0xda, 0x0, 0x4, 0x7f}, 0x80, &(0x7f0000003480)=[{&(0x7f0000003380)="685ee2022c6f5f0672a3989ccdeacf2412b3a957cf5c991ce574810c47227401efd72d7007a79c56295f256ae844981874537c4ee84055041c0f2fa2913d9983e43b348896617d45fd4afa53fb6a5c285d12f562728db34e7060dad6969b20425e17ec85bcfa5c98f1c86dec500a04c291416d067be826cc2bfb0246e93e56245603f0052414ffa6eb69266c311981e99d6e1e5328e1d3622628f0d8eefc2964240f99a69d464618e1c776469ceb2789fbe9e988215fa69a0c6465641557508b700ecb15450afd24a4fa490762d410dd47fe6a74e332de16e0baf3c986330ea19867bdef2a654b5f42e58e7348209c636f", 0xf1}], 0x1}}, {{&(0x7f00000034c0)=@vsock={0x28, 0x0, 0x2711, @hyper}, 0x80, &(0x7f0000003540), 0x0, &(0x7f0000003580)=[{0x70, 0x6, 0x7, "e361a519e81ec0fd9266972d22866cfc1df4e3fb0267a60821ebe347aef594d7780947a5338f208a9fba61d560eb38b95e8114a1e20f9446d9953d31a22631217211ec25752fa97f12ccdf2fa9a4e424960b575303ab7c18c8c82ae86b19"}, {0xc0, 0x11, 0x3ff, "00de17cdec7857739f12c8ffd8cd3ba2b43a0c09131393f10b5ce7f45071458750fca427f8603c78758a778407834611104ccfcf2080149cc8c3e4bc6c62deb5b198e5bdf73b854882d036247e6d04a1137f1a6db2ec18b819f298cd1f1943175098c93dfd8a452a507e6a3e907930bdd142cd3fc349b83500b7f08530225db8c14f2666ea53ad09c33da3b9598fc651712f0cbb3e2714a2242aa2e4d9f3e583d0157f9eb54e0d965eeb"}, {0x78, 0xff, 0x400, "5c4578085aa09955ebe682268b4d47823a61fa7c23a42123c6b61c9d56222a0bab38daf9626d41f2abce8f9a3255184cc25c119d6f6698086214f94e8eb01788bd33d9422328be2fc22097878187ffe1247299883abf345c898ab2a87a6df74c9dc15be3"}], 0x1a8}}, {{&(0x7f0000003740)=@pppoe={0x18, 0x0, {0x3, @empty, 'ip6tnl0\x00'}}, 0x80, &(0x7f0000003a00)=[{&(0x7f00000037c0)="6ad88ca5cd1eb27aea25425b9073dfe79fe11979a8839dff1d3f805bea3263e3271a834e6371acf47eaec0a871988dd4f8b6c0da0b1dfca6e699aeee5ea15849bc23220a493c6598702867b0b25b690054dcfe9884e6b3153066ec3a9023fce055aa3fbb035607953e48b2c9f3a5ae652db542784f73d1d5a7c8a28d79b77b7a2d55e8bffbc8da13a443af9815f933fb8871a95751cd4b9e9d678a5725cbac17fb390012da11e872eb8f2c10adaa1b19861412ca5a13363038481911537e9e602b86ea0f4ca8fbeb00b3fcad6876f9bc2f642a6ffa421bd5faac347ca02edcaac930df1ba667467d165f77eb6c17cd175b4ad316ea", 0xf5}, {&(0x7f00000038c0)="b32755cdb1623ef33f274dc087bb2c1cc13297342f5af7799feaeb5884fcc8575e0ebc4eb2e4778a63b8aae1a491efb66dc0a4d3c1b1f1a76883342d4f42897ae1f606334884608dadc6f1628f462905b9fa2ca0fabb894c9a2e69aa5b46e18d90d165df263cd3ee07d8220fa8d0b58235b17a88025308b94cb788f56d9b3cc48d79cdfa4cc3dcd3e49ab9e38ccf8d3e8893e0", 0x93}, {&(0x7f0000003980)="4f49994799000f939218102e88dae99363718b02a26728939a8b62e61fbf58ddbb32471e96b8d42a374e5d3e3c36d4eb4ed57316db643c8a20f26e5f5dbb367e21833a1f6c6de062289aa04fc0920c532223671d401488bacaa2a45e0879f5a9897d431f1bc59dccf393c4", 0x6b}], 0x3}}], 0x3, 0x4000) ioctl$EXT4_IOC_CHECKPOINT(r1, 0x4004662b, &(0x7f0000003b00)=0x1) syz_io_uring_submit(0x0, 0x0, &(0x7f0000004f40)=@IORING_OP_SENDMSG={0x9, 0x4, 0x0, r1, 0x0, &(0x7f0000004f00)={&(0x7f0000003b40)=@nfc={0x27, 0x1, 0x2, 0x4}, 0x80, &(0x7f0000004c80)=[{&(0x7f0000003bc0)="dcc40cbfe0f7bdf7712d93c78f2c2f4101d8117bed84d63a2adc3d622243b0f42526d336c80dc0ccb2d22cf553052473d02051cb9345d0d3c1b60c64bb653730d4cf06eb661990ba734d223f92d998d589a474c400887674d836823ffcfeb40c6dbc51e23d742c024177df3a365294b74e899a274ddca8cbf14e20b0e354be11dc86da9a0fdcbf75960f0830dc83507b8ab58e2ad70d5fc8ba11ecd672b2f94ed822de6736bb75ccdd4fe7d58b3f4eab95", 0xb1}, {&(0x7f0000003c80)="e1d45967092fb62e45a1c084b64332f6d6863fde23f0a947830102c1864b486b9e69b7ee7dd7d0270c470bf0321e4220c44b0ded3531ba5c6b3f89fac23c1747436da88525a2636c1e049fd1d028ae2133c0a828d72e3a512e3a6147fbb0dbf71ef28a701ec6fb452acd1f6f694f9999371aa1976cc2106cbd1abd50de107f583390641edb6e20dfd9ca90872b7b02f55c83fc3d936689ce16ac0d9fb409fd552ef09371b079816ac3f367469c7b07030a2a8d2f6e05d67dfa864b4e3ad667ac281e01bcd3a657067709409b8f709943f7035ede7c6bd72304ec0e0ac8647c47364ba14cef640a54f4b856351543991afa654be75c9a6c9341c2fb93957123edfbc8d386fb652ad169eeb1daad38789d257c5fbb4e29ee0e0c01d307a34dfc06200ed49c1d5f277d33d2d676d761b084f5be5b264edb9206a62dca450f9e8b2282ece5ad3cf5c3c7b08d62f01702519f020d0f4de42e1c5815a781e2f0ebed4cee26546cc17107203a68ac9ac50c3a0e7ed428482ef254a3f0ef7954a13c6beabb249cd6a461b756398778cff82c11d12bbe09d205a75e48d4e16ad91aa7467c216ffab38c797ef618025de963c1c8dd4cebe7049f44411096f234681eadf7f588e164b80cab67f9c0aa7a70750e0d2fbae9eab38f009caa0b9b7d11bce13c2c89c8d6209489d092883b1ce3dace50e261c605149911a39c2e8d8de0da8a089aa370d9241eded96991f6cf684fe754606227ca15fedba06023fda6ff64485fc679ce4751096fdad263ca12b08e7de70be3df846aab258f0300834d612b668c8792558715373bb105b89f7ca268ed06c1ddf8b9c3fd24cb4f06ff38f7028b9433735b74197c9a5d61fad52c382622e2c4d22d05775d6ab88b213c2933e50e78d87736c3a520ff1a61eafcdfab73e35c3035c812d2075fbe2295c2813a0b0f74543ed4442f7568137c4c73b23a01c8c8793cca97d2e1c6caac307a49589a3fb8e7d0d75c06cb9a8a6bdeb6619db7b8462e102978d17a1d1724147efb5981f56740c01f08c522b0df75759c22a88cbfd699af86056a871d58e63e96dad0edd8237ed2f538b68d1b7c678f95d32a5be18e13c430a04829f45bd3efdd440a3fb7947d7e63e49ebb55e1176a64983670fd8b56cad7acc4bde192debe72d5da150ac51e57842c73cfb57a84bc57b963a4c58186edde3ce3b0a4cef2c8b43212148bdb018ab17eb52827f5353eb7d9e62f7b28bab0d316c3436ba96a62cedccf85232902d3a6c923d785e8eb5df8b2019495936d97d35d1181b205c08eb541ee4afe06df1c1b764fc7cb266eaff7b3983d5daf76614e21295d91c12924ce56a326ef14b6a090365943e8e70415dd140f65d54d37bcf8208bf8203d7b5b580a03da22a20253acff1d32317351ab8c4df38592c693ffcaf10d6c80f9b356df763d50d23bf808aa3992e3051470e99c7f3e92b5b5706abaf9d7fbce2c135ac4fef2d753d716f429e8acf390ee1c7e6a4dba194ce64e666917749f57ffedb2e7755517ac2a151ea1f8414d8d731b19db55b0a965ed26e55c98c6857252a9114a3793eead6024f6c6025ac2890d60e8971d82f968eb3d2955c67c91c8871932e4b73e2f8f42a188f72420331d3d0c34757e6b4d6d2e0ce2571175496789e96fab59de67201d25c31fe8944c32b7be600b58a9dc51c0e3d7d6de7374931a2d6de8efb624d29123d1d6689dc3bbf3bbfe50067cc608b4e6e3a60794c4fc7409413f10fa1eddadc56d7f9e408a138128773a047ee63752d8ca667e077df05308132dc75902f9e7056744f9677680fd452709197805184c77c2a07c1a59aeb245ea32f51a7d4a9d8647c7c0c571853a0ac9bc62b5aa1e81e7406dfa63ca0bb4029a79c3cfaf808da76d6f2f39257ecd758ad5900114ee45da9b240b7f5fa574b2b1f3ac4288cce4c01c1d1326e102dae23fe47493757cc02555960f2b4f1e5dfc3d2da15c398ee669a00ef482d272e0f27ecb1b273cbae50c7935bbe102c5fbfc7e0a4f9375138b85910fcbe02bc3eb4540290ffea4e9a70a03ff0299381b258073931d6c35b7534b95568c079a69c859e547ce1f314d8c41f6e899ab086d255689db208b9fef0b878dadc9df19ace7d102f440a590b24b4598ca901ff390d30fddb9294e7dec166ff441b546d2a45e0300c7c604b6b2704854886d57f937a921147dac40681acfec07f9f9bf0340b2c722ff425aefcb81597f6852b8e5af009563d4bf3dd84d20d5943f8b2d953d5c608fe86c496275148d715f7c9cba1e3224540012e0d44fe64e84d5b7ef8473165d4f31323ef83e3d4f7a15f40ef50d1534a73dd64ce64c93b54e3e4302bc3d3bdc668be8baa820dc4cd3b88293dad16093daf42132d467d004ad7177096f75e015d7d4baf8f9623a70e229d550537d6dfc9078bcfdab040d9dd1065ac523467b0e17901517d520f47ca05cd21dd02283fb3e9c86fdae73ef15381b09ccc9457a5acb08466ef8cefceedf9e221246a296577d5bd3a8c6add80e64815fdd52ab4f341b356306a03dd0ee46d2b429daedd1ccebef7dead747d5411ebc263113ecf2a8711af972481c01b3930f8ebdbb774af40733f961389d90efd81ea9dccc66d878d06752a6742b25eb3b1346081de946708d56416f43497b7cd16bc7f31cb764592d6e7918f920c7a9ee01ef109e37b80190444baf8895c484163adb66932f18dff009f2806a6734d32249a10e0e7140d6552a5a973b36c84abc02f1a712a746ea686af535201a416b29b9f0d6aee4289208841642c5de22568ef54fb6522d5face1040b327a6c2a6234e031a9e48043b93bb9ec4fa5bb8a958b94dea48fb01501c759c4c2b89480684bf4fc0b92c442f9641b9cbb8184548dfdaa7f4dd631e8d7818c5a77916db8dc0e671a98f8772bc2c739a298bdf3896644d2da4f93a346b714ba0faf376488cc2ab8682e9e38437c8392a5996253a48e605ceea86aa3494ce848d9891384e229b9683d9c6c9f76b531fab6cf938a9b192cf05919ac7cec4638545bf722b391cf043ec2c02ac5d878d7daaee133c80dcfa2e7c1f35150fedb00d39f3a7a0aee44ed68f3c01594c57bb3b046cbce8b3cc813ae76374b6bd1cfbec273bc0d50c339a9399eabc644cc9beb7b4bca850768c640e1a9754ac44178c33bc20f80022e9c6c820345c4686207e9b751f17f0d2278a078e3eee71f5ca9452474957082085d4d0e28b876f043eff5e88b992988992edac2fd6c8173da19cd1e14951ebcf536b7d2fbd2cb432e784f3d8a067c9f0b8ae2682d3ede74854352dd5077b9b27029c217efaa72179e84539ab7bd222679c1e73385317418930e84ca009e675f42832d836f354a00fbc6a8bbf0a037eb9247aa19458f47bcd491eb9500560d6479e1ece11a34067e49d836b53e323ff7f5b08b2b6fd5ad1d6e4a92d14cf6fe347ba0de30a57d6b9b45050ef934d7d70bf9c7629645bf27ee0c96e30656bbf7f47678db5ab6942092dc5f25ff32b60588cc94a4702cba632a9efa09649444ea4cb057c830f147ac03c5d2bc0eea4ba4458745d747e99774dd475210dc38bc58b3e045c24286f25f28f5b2d49fbbb0cb38ccc4603fb63a60bddaac59eb1eacb36bf4c2e8ca99ac50aa05e29de461d9744012832c07894eff2bf00f7d5a6f0473a602406b141211be212ec1fc3e2df6334348fbbea1bc7f5a871866dd185c7051a38fc5b6e33f17f6b611f72920868222bced3f2eacd0456633d77c530233820ef0c7a1afc5b13e06737e9cca8d2dbe4996cabdb3c730aed74c355d9245647696c8c31f68f3590e0ef09af1dc386aaf4aa2c3dbfccdd80f20b4e82d4ee883475bba34b3309f33b25f9ea33e909ad6ea46920ea369357363110dd914b480f7546a9757d1d3673157803ba275d4b746c70cf71b523e89244398abdec6a55b496555938975adca08ff2b3a59fa0357a70647957cf4f33979d25e31f7b474475cc8008f7276fdfeeb7c7e2c58c628a5b5a3b31c3235a39240e3719122c91d60f3e1dca2dd7f06304c4eb66132d9c6cf4bef11951fa3b84f02fa301bcb73e570d49d783ca19609e65a326f9e760e4e69b186f9ead26987b450c08ad0d0df163db6a43e18f3a412297f9b8995ac27badd08af22197baa0adc0390b28cb6d0791b05e670b9c08dd4a371a2c576d189f74a03879d1089aa53ed25ce27a1fe1ebcddd6d20e8d26f15e6b0223101c7b90e93e88bb33ee02decc762f7b6e33308fd390f0e34ebf73fa84836a7ae25ae510caf2b3364b5f47e3fc433dde75ee85344721ae44fc8898fa83e3068fdfdeb1edbfd93321704f5bec0bf3892fed37d03c0159129efabe0e584ea9cd9a643a911db3a7fe6251cd2417e72ab94ea61d27622bbce9a0ef6373fa6695daede73764ded808ab982763e8b4c6efc7c12bfdb442b6ff8ba4a2f2dae2e63e42622226ce9f13a0219fd5450001d5c020baf04a4bd0fa6c1565f2eeadba342060a06a90b36ec377172be5519b1fac9c787fc679a429812ae17b562459e6be1dedc2b1e04db20fa712392ab9b57e2f9022cc29dedcafa154bb552b2cd5408e93051b853999283f4260f98efbcc549e2fb16956e899ce921cc196abfb8fb1a37eb436eeeccffa1d004e3a7a197c27c1b53141c717b878562e694afe0f7fafd756524bce0fe0626cb1d0f9e6c06495c75cf32744c70bffd543218fdca4028b8c3ea6e9ce917661d6d74458310861778ec20ddea83d4f459eaafb69f9a99ef77e18813a894993fb1a7184f6980ab6b2838bd97398c5fd093a216d012cb1d8957fcfeef3fb84f8b79a5e05d23a1fe6cd1b6010a0931ada43e76f69212e48bbfeffc03c9fe749117375b010c9822423514c7404d2328d59d1cfb659f3cec3d0a14ff8eb2fe1f8536bf8cd19f21176c81136c1171dde7d543223e3448a75cb4fbe6589c3926ba0ec2b1853dbb43ffd965df4de5390eb5518af66f6e79f1181a0df7e1dcb3bfe030f53ab9bcce4b027a59a8da70e67c2a4bd491623e7bff33ba751ca3357f6b798a1afc359b6065b88b9d39dfc2479edcd2e9c3f4383df860cb2c301ca7f0344bf57f53e5efe547ede83cf01bbb9141cfe2049f1c7bb9217a503e5faf83cef398d4e193851e146c8418c9b3bbcf6f6280f7dda1dc9b5807f30043a968a1ab8514ab2bde36e43de50879de48909ffdc2bccc1fa11adfd009048773577e8fa74db25378eeae6d2baee525fa228b80fe3bc0eab3c2f5f51ff2df61e8ae62762eb09966c31d97a4e8057b677979117b9162d963b096a8471bce4eb58ae5078233a44ac1d67d244831acf76cc247f8543b3ddb670e7982eb8cda2edb7ca7e557fbe209fc4db267d21ccf0ada04c7cf69d91b4a32c907e8c1723080a0e64b77b69c0480f57ccf0285c1178a9bad6e2edff81d4944843047eaee13331c84866a218a9b386f56edfa03d11da536150f2b234d6ebdd8eea11fff4aa4f0e90274eb5f2a801ecf93d49400136ac94ccc59a2c3a0407f106a448a19ce05648f064f18d08c5060971ea8cedc29b41e3c6cc9689b25f805d49880104fe1f82531229232ff2cd6da12d98d156052e08f1bf06f784c7a2b22a6ad539e54fcb638d4adebaaaf3982c5009c6adb356e90ae3a8a115c09afbb1079fa653477c7b32304cf7667f0ab59b264ed6686f56acdbcbb9740e6019b7541eef05d63c66b1628b75cce5bb242afdee29e598a8f73bf1c63e043f8328b14b7a7093927f71ef8fc14ef04467257e8a080e255d977f289ad11c44", 0x1000}], 0x2, &(0x7f0000004cc0)=[{0x78, 0x0, 0x69aa0f53, "1f5fa6806a21c1bf6096e033eedec98ebd27ba3204ffcb355c64c63f4e937b32df6ebded32d9fa313985dee3a5d1f5a81ece5d1db54cbe360f613100f57153e697f8f222f19da8a1cafdfea7f7680f1b8e601507f59235a6b12e0fcc49a8f3a6c797158cf61fd852"}, {0xf8, 0x84, 0x2, "dd440fcb8dea1f5f8de91dd30cd7bafe347300300043a3261a2c180cf028859ab1a11ba8aa2a278f6334d51a0f1d3e2c3079eb4564c483159625cc02cf15d500665c35815d205f83656fe7f45300305d09d5f4dd8bacdaeba9f65504c22d9e85f49ee139a92a5845e9a724311050252ba16f3147b7ac4a0ee100c9a50759df07fe7e5214c61278aacf546413f27f6cbd4909ddf45b0314c0334f8349a9ece7a4a3595d2092a9588f4fadd6db96940c12a67953a3c4a75cd9869230fc34c7aed60b4fa2d5068bafc69c01ecafdf595f99381e65c5a48b2638bd42789e2b2ac885f874f786e5"}, {0x98, 0x105, 0x4, "3178bfba7b88a385516b21a79c0944997acbec78d4adc26487dbaaa88a8e2c72cad78545fcc4cb336061c395b2a0d171e638387af137a48b44c2fa8260fd541913a277a8251994b61451fe76b8e1dcb3c8de8ff9488fedc58713b6a72015f83805f233c9d6aff5f2b6899378d9b459f8b524ac871e4860e5bf3b745ae24fa0e84978"}], 0x208}, 0x0, 0x44000, 0x1}, 0xda82) getsockopt$inet6_mtu(r0, 0x29, 0x17, &(0x7f0000004f80), &(0x7f0000004fc0)=0x4) ioctl$PTP_PIN_GETFUNC2(0xffffffffffffffff, 0xc0603d0f, &(0x7f0000005040)={'\x00', 0x80000000, 0x1, 0x7fffffff}) 14:44:07 executing program 5: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r2, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', &(0x7f0000001d80)={{}, {0x1, 0x2}, [{0x2, 0x2, 0xffffffffffffffff}, {0x2, 0x1, r3}, {0x2, 0x3, 0xee01}, {0x2, 0x6}, {0x2, 0x1, r4}, {}, {0x2, 0x0, r6}], {}, [{0x8, 0x1, 0xee00}, {0x8, 0x4, 0xffffffffffffffff}, {0x8, 0x2, 0xffffffffffffffff}], {}, {0x20, 0x2}}, 0x74, 0x1) mkdir(&(0x7f0000001e00)='./file1\x00', 0x1a) fsetxattr$trusted_overlay_redirect(r2, &(0x7f0000001e40), &(0x7f0000001e80)='./file1/file0\x00', 0xe, 0x3) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001f00), r0) sendmsg$NL80211_CMD_TDLS_MGMT(r0, &(0x7f0000001fc0)={&(0x7f0000001ec0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001f80)={&(0x7f0000001f40)={0x2c, r7, 0x100, 0x70bd25, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000090}, 0x4001800) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) fstat(r1, &(0x7f0000002100)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {'rfdno', 0x3d, r8}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid={'access', 0x3d, r6}}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid={'dfltuid', 0x3d, r9}}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid={'dfltgid', 0x3d, r5}}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt={'euid>', r3}}, {@fowner_eq={'fowner', 0x3d, r3}}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) ioctl$BTRFS_IOC_DEFRAG_RANGE(r1, 0x40309410, &(0x7f0000002300)={0x3, 0x3, 0x0, 0x4, 0x1, [0x9, 0x2, 0x3b55, 0x9]}) ioctl$EXT4_IOC_GETSTATE(r0, 0x40046629, &(0x7f0000002340)) mkdir(&(0x7f0000002380)='./file0\x00', 0x0) 14:44:07 executing program 6: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_PAUSE_SET(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r0, 0x10, 0x70bd29, 0x25dfdbfb, {}, [@ETHTOOL_A_PAUSE_RX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000140)='blkio.bfq.sectors\x00', 0x0, 0x0) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f00000001c0), 0xffffffffffffffff) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000002c0)={'erspan0\x00', &(0x7f0000000200)={'ip_vti0\x00', 0x0, 0x20, 0x8, 0x1, 0x9, {{0x20, 0x4, 0x1, 0x4, 0x80, 0x66, 0x0, 0x4, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, {[@cipso={0x86, 0x5d, 0x2, [{0x0, 0x10, "4e769b613f09c802d73b441515e6"}, {0x0, 0x8, "af02d9c58434"}, {0x0, 0xe, "298fa1248c0dd9ad63246221"}, {0x1, 0x7, "aac3db73ba"}, {0x7, 0xd, "afc00dc87dbcaf37b16ed8"}, {0x6, 0x7, "25cd014963"}, {0x2, 0x6, "ed121c3b"}, {0x2, 0x10, "990ed47ab657ff841558d1f4abf5"}]}, @noop, @end, @timestamp_addr={0x44, 0xc, 0x58, 0x1, 0x2, [{@initdev={0xac, 0x1e, 0x1, 0x0}, 0x6}]}]}}}}}) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'vxcan1\x00', 0x0}) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r1, &(0x7f0000000400)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x78, r2, 0x300, 0x70bd28, 0x25dfdbfd, {}, [@ETHTOOL_A_CHANNELS_COMBINED_COUNT={0x8, 0x9, 0x9}, @ETHTOOL_A_CHANNELS_COMBINED_COUNT={0x8, 0x9, 0x7}, @ETHTOOL_A_CHANNELS_RX_COUNT={0x8, 0x6, 0x2}, @ETHTOOL_A_CHANNELS_TX_COUNT={0x8, 0x7, 0x8c59ee0}, @ETHTOOL_A_CHANNELS_OTHER_COUNT={0x8, 0x8, 0x2}, @ETHTOOL_A_CHANNELS_OTHER_COUNT={0x8, 0x8, 0x5}, @ETHTOOL_A_CHANNELS_RX_COUNT={0x8, 0x6, 0x3}, @ETHTOOL_A_CHANNELS_RX_COUNT={0x8, 0x6, 0x3}, @ETHTOOL_A_CHANNELS_HEADER={0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}]}]}, 0x78}, 0x1, 0x0, 0x0, 0x44011}, 0xaaaa4553b78f670d) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000480), r1) sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000540)={&(0x7f00000004c0)={0x48, r5, 0x4, 0x70bd2a, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x20, 0x3}}}}, [@NL80211_ATTR_CONTROL_PORT_ETHERTYPE={0x6, 0x66, 0x8884}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_CONTROL_PORT_ETHERTYPE={0x6, 0x66, 0x6000}]}, 0x48}, 0x1, 0x0, 0x0, 0x4004001}, 0x20000000) sendmsg$TIPC_NL_BEARER_SET(r1, &(0x7f0000000740)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000700)={&(0x7f0000000600)={0xf8, 0x0, 0x8, 0x70bd28, 0x25dfdbfb, {}, [@TIPC_NLA_SOCK={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x10000}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x2}]}, @TIPC_NLA_SOCK={0x70, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_SOCK_CON={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x401}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_SOCK_CON={0x34, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x9}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x7}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xffffffff}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x6}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x1}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x7}]}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x7}, @TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x7}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x8}]}]}, @TIPC_NLA_LINK={0x4}, @TIPC_NLA_BEARER={0x1c, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x5}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}]}, @TIPC_NLA_PUBL={0x34, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x800}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x1}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x5}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x7}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x1}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x1f}]}, @TIPC_NLA_MEDIA={0xc, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}]}, 0xf8}, 0x1, 0x0, 0x0, 0x4000010}, 0x4000000) ioctl$AUTOFS_DEV_IOCTL_READY(r1, 0xc0189376, &(0x7f0000000780)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) sendmsg$TIPC_NL_MEDIA_SET(r6, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x20, 0x0, 0x100, 0x70bd25, 0x25dfdbff, {}, [@TIPC_NLA_BEARER={0xc, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x5}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x1040}, 0x6000044) syz_io_uring_submit(0x0, 0x0, &(0x7f00000008c0)=@IORING_OP_CLOSE={0x13, 0x1, 0x0, r1, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x5) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r6, 0x81f8943c, &(0x7f0000000900)={0x0, ""/256, 0x0}) ioctl$BTRFS_IOC_INO_LOOKUP(r1, 0xd0009412, &(0x7f0000000b00)={r7, 0x6}) pipe(&(0x7f0000001b00)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001b80), r6) sendmsg$NL80211_CMD_VENDOR(r8, &(0x7f0000001c40)={&(0x7f0000001b40)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001c00)={&(0x7f0000001bc0)={0x38, r9, 0x200, 0x70bd2d, 0x25dfdbfc, {{}, {@val={0x8, 0x1, 0x29}, @void, @val={0xc, 0x99, {0x9, 0x20}}}}, [@NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x7}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x8000}, 0x80) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000001c80)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_POWER_SAVE(0xffffffffffffffff, &(0x7f0000001d80)={&(0x7f0000001cc0), 0xc, &(0x7f0000001d40)={&(0x7f0000001d00)={0x2c, r5, 0x400, 0x70bd27, 0x25dfdbff, {{}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_PS_STATE={0x8}, @NL80211_ATTR_PS_STATE={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40041}, 0x0) [ 74.854871] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 74.856667] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 74.859702] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 74.860983] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 74.863765] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 74.865394] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 74.870158] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 74.871436] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 74.874686] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 74.875622] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 74.877763] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 74.880335] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 74.891961] Bluetooth: hci1: HCI_REQ-0x0c1a [ 74.906688] Bluetooth: hci0: HCI_REQ-0x0c1a [ 74.929218] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 74.931770] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 74.933780] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 74.944713] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 74.947221] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 74.968966] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 74.971822] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 74.976029] Bluetooth: hci3: HCI_REQ-0x0c1a [ 74.977026] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 74.978896] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 74.982948] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 74.984969] Bluetooth: hci7: unexpected cc 0x0c25 length: 249 > 3 [ 74.986629] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 74.992039] Bluetooth: hci7: HCI_REQ-0x0c1a [ 75.001342] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 75.004135] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 75.007790] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 75.008484] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 75.017544] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 75.022487] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 75.023878] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 75.027149] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 75.029781] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 75.031093] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 75.034858] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 75.039385] Bluetooth: hci4: HCI_REQ-0x0c1a [ 75.040942] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3 [ 75.052497] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 75.053885] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 75.056151] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 75.064051] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 75.071520] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 75.073382] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 75.076529] Bluetooth: hci6: HCI_REQ-0x0c1a [ 75.095511] Bluetooth: hci5: HCI_REQ-0x0c1a [ 76.932362] Bluetooth: hci2: Opcode 0x c03 failed: -110 [ 76.934531] Bluetooth: hci0: command 0x0409 tx timeout [ 76.934551] Bluetooth: hci1: command 0x0409 tx timeout [ 76.996414] Bluetooth: hci3: command 0x0409 tx timeout [ 76.998159] Bluetooth: hci7: command 0x0409 tx timeout [ 77.060417] Bluetooth: hci4: command 0x0409 tx timeout [ 77.125547] Bluetooth: hci5: command 0x0409 tx timeout [ 77.126547] Bluetooth: hci6: command 0x0409 tx timeout [ 78.980354] Bluetooth: hci1: command 0x041b tx timeout [ 78.981307] Bluetooth: hci0: command 0x041b tx timeout [ 79.045336] Bluetooth: hci7: command 0x041b tx timeout [ 79.045740] Bluetooth: hci3: command 0x041b tx timeout [ 79.109327] Bluetooth: hci4: command 0x041b tx timeout [ 79.172357] Bluetooth: hci6: command 0x041b tx timeout [ 79.172775] Bluetooth: hci5: command 0x041b tx timeout [ 81.028329] Bluetooth: hci0: command 0x040f tx timeout [ 81.028360] Bluetooth: hci1: command 0x040f tx timeout [ 81.093324] Bluetooth: hci3: command 0x040f tx timeout [ 81.093761] Bluetooth: hci7: command 0x040f tx timeout [ 81.156308] Bluetooth: hci4: command 0x040f tx timeout [ 81.221355] Bluetooth: hci5: command 0x040f tx timeout [ 81.221782] Bluetooth: hci6: command 0x040f tx timeout [ 82.628427] Bluetooth: hci2: Opcode 0x c03 failed: -110 [ 83.076427] Bluetooth: hci1: command 0x0419 tx timeout [ 83.076440] Bluetooth: hci0: command 0x0419 tx timeout [ 83.140328] Bluetooth: hci7: command 0x0419 tx timeout [ 83.140341] Bluetooth: hci3: command 0x0419 tx timeout [ 83.204440] Bluetooth: hci4: command 0x0419 tx timeout [ 83.268310] Bluetooth: hci6: command 0x0419 tx timeout [ 83.268363] Bluetooth: hci5: command 0x0419 tx timeout [ 87.300305] Bluetooth: hci2: Opcode 0x c03 failed: -110 [ 89.939535] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 89.948901] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 89.950019] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 89.952601] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 89.953710] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 89.954410] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 89.958478] Bluetooth: hci2: HCI_REQ-0x0c1a [ 91.972343] Bluetooth: hci2: command 0x0409 tx timeout [ 94.020341] Bluetooth: hci2: command 0x041b tx timeout [ 96.068329] Bluetooth: hci2: command 0x040f tx timeout [ 98.117466] Bluetooth: hci2: command 0x0419 tx timeout 14:45:06 executing program 6: syz_mount_image$ext4(&(0x7f0000000140)='ext2\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x1, &(0x7f0000001480)=[{&(0x7f00000001c0)="12b46d6821e2b9780a4eef2b83e62fd8903b5db787ada822637a7a58c9", 0x1d, 0xffffffffffff7fff}], 0x2008002, &(0x7f0000001500)={[{@minixdf}, {@quota}, {@resuid={'resuid', 0x3d, 0xee01}}, {@noacl}, {@prjquota}, {@nodelalloc}, {@nobarrier}, {@orlov}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0xffffffffffffff81}}], [{@permit_directio}, {@uid_eq}, {@smackfshat={'smackfshat', 0x3d, 'ns/ipc\x00'}}, {@subj_role={'subj_role', 0x3d, 'ns/ipc\x00'}}, {@pcr={'pcr', 0x3d, 0x9}}, {@defcontext={'defcontext', 0x3d, 'sysadm_u'}}]}) stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) setresuid(0x0, r0, 0x0) stat(&(0x7f0000000180)='./file0\x00', &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000000140)='./file0\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_unix(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000100), 0xa8420, &(0x7f0000000300)={'trans=unix,', {[{@cache_fscache}, {@access_client}, {@access_any}, {@access_uid={'access', 0x3d, 0xee01}}, {@privport}, {@dfltgid={'dfltgid', 0x3d, r1}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}, {@obj_user={'obj_user', 0x3d, 'environ\x00'}}, {@subj_role={'subj_role', 0x3d, 'environ\x00'}}, {@euid_eq={'euid', 0x3d, r2}}, {@measure}]}}) lchown(&(0x7f0000000000)='./file0\x00', r0, r1) [ 132.868925] loop6: detected capacity change from 0 to 16255 [ 132.870701] EXT4-fs: Mount option "noacl" will be removed by 3.5 [ 132.870701] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 132.870701] [ 132.871803] EXT4-fs: Ignoring removed orlov option [ 132.882625] ext2: Bad value for 'debug_want_extra_isize' 14:45:06 executing program 6: syz_mount_image$ext4(&(0x7f0000000140)='ext2\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x1, &(0x7f0000001480)=[{&(0x7f00000001c0)="12b46d6821e2b9780a4eef2b83e62fd8903b5db787ada822637a7a58c9", 0x1d, 0xffffffffffff7fff}], 0x2008002, &(0x7f0000001500)={[{@minixdf}, {@quota}, {@resuid={'resuid', 0x3d, 0xee01}}, {@noacl}, {@prjquota}, {@nodelalloc}, {@nobarrier}, {@orlov}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0xffffffffffffff81}}], [{@permit_directio}, {@uid_eq}, {@smackfshat={'smackfshat', 0x3d, 'ns/ipc\x00'}}, {@subj_role={'subj_role', 0x3d, 'ns/ipc\x00'}}, {@pcr={'pcr', 0x3d, 0x9}}, {@defcontext={'defcontext', 0x3d, 'sysadm_u'}}]}) stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) setresuid(0x0, r0, 0x0) stat(&(0x7f0000000180)='./file0\x00', &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000000140)='./file0\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_unix(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000100), 0xa8420, &(0x7f0000000300)={'trans=unix,', {[{@cache_fscache}, {@access_client}, {@access_any}, {@access_uid={'access', 0x3d, 0xee01}}, {@privport}, {@dfltgid={'dfltgid', 0x3d, r1}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}, {@obj_user={'obj_user', 0x3d, 'environ\x00'}}, {@subj_role={'subj_role', 0x3d, 'environ\x00'}}, {@euid_eq={'euid', 0x3d, r2}}, {@measure}]}}) lchown(&(0x7f0000000000)='./file0\x00', r0, r1) [ 133.012077] loop6: detected capacity change from 0 to 16255 [ 133.025663] EXT4-fs: Mount option "noacl" will be removed by 3.5 [ 133.025663] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 133.025663] [ 133.026848] EXT4-fs: Ignoring removed orlov option [ 133.027641] ext2: Bad value for 'debug_want_extra_isize' 14:45:06 executing program 1: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) r4 = dup(r0) r5 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r4, 0xc0189371, &(0x7f0000000700)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) r7 = dup2(r2, r5) r8 = fspick(r6, &(0x7f0000000740)='./file0\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r7, 0xc0189371, &(0x7f0000000780)={{0x1, 0x1, 0x18, r8}, './file0\x00'}) sendmsg$NL80211_CMD_DISASSOCIATE(r2, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x30, 0x0, 0x400, 0x70bd25, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_LOCAL_STATE_CHANGE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@broadcast}]}, 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0xc000) sendmsg$NL80211_CMD_SET_MAC_ACL(r4, &(0x7f0000000a00)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000900)={0x94, 0x0, 0x100, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @val={0xc, 0x99, {0x7fffffff, 0x2f}}}}, [@NL80211_ATTR_ACL_POLICY={0x8}, @NL80211_ATTR_MAC_ADDRS={0x4c, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}, {0xa}, {0xa, 0x6, @broadcast}, {0xa, 0x6, @device_b}, {0xa, 0x6, @device_b}, {0xa}]}, @NL80211_ATTR_ACL_POLICY={0x8}, @NL80211_ATTR_MAC_ADDRS={0x10, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x4}, 0x800) ioctl$CDROMEJECT(r9, 0x5309) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0x0) 14:45:06 executing program 6: syz_mount_image$ext4(&(0x7f0000000140)='ext2\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x1, &(0x7f0000001480)=[{&(0x7f00000001c0)="12b46d6821e2b9780a4eef2b83e62fd8903b5db787ada822637a7a58c9", 0x1d, 0xffffffffffff7fff}], 0x2008002, &(0x7f0000001500)={[{@minixdf}, {@quota}, {@resuid={'resuid', 0x3d, 0xee01}}, {@noacl}, {@prjquota}, {@nodelalloc}, {@nobarrier}, {@orlov}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0xffffffffffffff81}}], [{@permit_directio}, {@uid_eq}, {@smackfshat={'smackfshat', 0x3d, 'ns/ipc\x00'}}, {@subj_role={'subj_role', 0x3d, 'ns/ipc\x00'}}, {@pcr={'pcr', 0x3d, 0x9}}, {@defcontext={'defcontext', 0x3d, 'sysadm_u'}}]}) stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) setresuid(0x0, r0, 0x0) stat(&(0x7f0000000180)='./file0\x00', &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000000140)='./file0\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_unix(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000100), 0xa8420, &(0x7f0000000300)={'trans=unix,', {[{@cache_fscache}, {@access_client}, {@access_any}, {@access_uid={'access', 0x3d, 0xee01}}, {@privport}, {@dfltgid={'dfltgid', 0x3d, r1}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}, {@obj_user={'obj_user', 0x3d, 'environ\x00'}}, {@subj_role={'subj_role', 0x3d, 'environ\x00'}}, {@euid_eq={'euid', 0x3d, r2}}, {@measure}]}}) lchown(&(0x7f0000000000)='./file0\x00', r0, r1) [ 133.155917] loop6: detected capacity change from 0 to 16255 [ 133.172052] EXT4-fs: Mount option "noacl" will be removed by 3.5 [ 133.172052] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 133.172052] [ 133.173206] EXT4-fs: Ignoring removed orlov option [ 133.183980] ext2: Bad value for 'debug_want_extra_isize' 14:45:07 executing program 1: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) r4 = dup(r0) r5 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r4, 0xc0189371, &(0x7f0000000700)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) r7 = dup2(r2, r5) r8 = fspick(r6, &(0x7f0000000740)='./file0\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r7, 0xc0189371, &(0x7f0000000780)={{0x1, 0x1, 0x18, r8}, './file0\x00'}) sendmsg$NL80211_CMD_DISASSOCIATE(r2, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x30, 0x0, 0x400, 0x70bd25, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_LOCAL_STATE_CHANGE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@broadcast}]}, 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0xc000) sendmsg$NL80211_CMD_SET_MAC_ACL(r4, &(0x7f0000000a00)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000900)={0x94, 0x0, 0x100, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @val={0xc, 0x99, {0x7fffffff, 0x2f}}}}, [@NL80211_ATTR_ACL_POLICY={0x8}, @NL80211_ATTR_MAC_ADDRS={0x4c, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}, {0xa}, {0xa, 0x6, @broadcast}, {0xa, 0x6, @device_b}, {0xa, 0x6, @device_b}, {0xa}]}, @NL80211_ATTR_ACL_POLICY={0x8}, @NL80211_ATTR_MAC_ADDRS={0x10, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x4}, 0x800) ioctl$CDROMEJECT(r9, 0x5309) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0x0) 14:45:07 executing program 6: syz_mount_image$ext4(&(0x7f0000000140)='ext2\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x1, &(0x7f0000001480)=[{&(0x7f00000001c0)="12b46d6821e2b9780a4eef2b83e62fd8903b5db787ada822637a7a58c9", 0x1d, 0xffffffffffff7fff}], 0x2008002, &(0x7f0000001500)={[{@minixdf}, {@quota}, {@resuid={'resuid', 0x3d, 0xee01}}, {@noacl}, {@prjquota}, {@nodelalloc}, {@nobarrier}, {@orlov}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0xffffffffffffff81}}], [{@permit_directio}, {@uid_eq}, {@smackfshat={'smackfshat', 0x3d, 'ns/ipc\x00'}}, {@subj_role={'subj_role', 0x3d, 'ns/ipc\x00'}}, {@pcr={'pcr', 0x3d, 0x9}}, {@defcontext={'defcontext', 0x3d, 'sysadm_u'}}]}) stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) setresuid(0x0, r0, 0x0) stat(&(0x7f0000000180)='./file0\x00', &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000000140)='./file0\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_unix(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000100), 0xa8420, &(0x7f0000000300)={'trans=unix,', {[{@cache_fscache}, {@access_client}, {@access_any}, {@access_uid={'access', 0x3d, 0xee01}}, {@privport}, {@dfltgid={'dfltgid', 0x3d, r1}}], [{@fscontext={'fscontext', 0x3d, 'staff_u'}}, {@obj_user={'obj_user', 0x3d, 'environ\x00'}}, {@subj_role={'subj_role', 0x3d, 'environ\x00'}}, {@euid_eq={'euid', 0x3d, r2}}, {@measure}]}}) lchown(&(0x7f0000000000)='./file0\x00', r0, r1) [ 133.307033] loop6: detected capacity change from 0 to 16255 14:45:07 executing program 1: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) r4 = dup(r0) r5 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r4, 0xc0189371, &(0x7f0000000700)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) r7 = dup2(r2, r5) r8 = fspick(r6, &(0x7f0000000740)='./file0\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r7, 0xc0189371, &(0x7f0000000780)={{0x1, 0x1, 0x18, r8}, './file0\x00'}) sendmsg$NL80211_CMD_DISASSOCIATE(r2, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x30, 0x0, 0x400, 0x70bd25, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_LOCAL_STATE_CHANGE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@broadcast}]}, 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0xc000) sendmsg$NL80211_CMD_SET_MAC_ACL(r4, &(0x7f0000000a00)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000900)={0x94, 0x0, 0x100, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @val={0xc, 0x99, {0x7fffffff, 0x2f}}}}, [@NL80211_ATTR_ACL_POLICY={0x8}, @NL80211_ATTR_MAC_ADDRS={0x4c, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}, {0xa}, {0xa, 0x6, @broadcast}, {0xa, 0x6, @device_b}, {0xa, 0x6, @device_b}, {0xa}]}, @NL80211_ATTR_ACL_POLICY={0x8}, @NL80211_ATTR_MAC_ADDRS={0x10, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x4}, 0x800) ioctl$CDROMEJECT(r9, 0x5309) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0x0) [ 133.319703] EXT4-fs: Mount option "noacl" will be removed by 3.5 [ 133.319703] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 133.319703] [ 133.320907] EXT4-fs: Ignoring removed orlov option [ 133.326295] ext2: Bad value for 'debug_want_extra_isize' 14:45:07 executing program 6: syz_mount_image$ext4(&(0x7f0000000140)='ext2\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x1, &(0x7f0000001480)=[{&(0x7f00000001c0)="12b46d6821e2b9780a4eef2b83e62fd8903b5db787ada822637a7a58c9", 0x1d, 0xffffffffffff7fff}], 0x2008002, &(0x7f0000001500)={[{@minixdf}, {@quota}, {@resuid={'resuid', 0x3d, 0xee01}}, {@noacl}, {@prjquota}, {@nodelalloc}, {@nobarrier}, {@orlov}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0xffffffffffffff81}}], [{@permit_directio}, {@uid_eq}, {@smackfshat={'smackfshat', 0x3d, 'ns/ipc\x00'}}, {@subj_role={'subj_role', 0x3d, 'ns/ipc\x00'}}, {@pcr={'pcr', 0x3d, 0x9}}, {@defcontext={'defcontext', 0x3d, 'sysadm_u'}}]}) stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) setresuid(0x0, r0, 0x0) stat(&(0x7f0000000180)='./file0\x00', &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000000140)='./file0\x00', &(0x7f0000000200)) lchown(&(0x7f0000000000)='./file0\x00', r0, r1) [ 133.460348] loop6: detected capacity change from 0 to 16255 [ 133.461695] EXT4-fs: Mount option "noacl" will be removed by 3.5 [ 133.461695] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 133.461695] [ 133.462828] EXT4-fs: Ignoring removed orlov option [ 133.477324] ext2: Bad value for 'debug_want_extra_isize' [ 136.136030] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 136.137231] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 136.138119] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 136.143008] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 136.143938] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 136.144711] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 136.148046] Bluetooth: hci1: HCI_REQ-0x0c1a [ 136.456149] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 136.457140] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 136.457951] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 136.459553] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 136.460930] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3 [ 136.461709] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 136.465343] Bluetooth: hci6: HCI_REQ-0x0c1a [ 136.531925] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 136.532809] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 136.535379] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 136.543791] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 136.546146] Bluetooth: hci7: unexpected cc 0x0c25 length: 249 > 3 [ 136.546835] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 136.558851] Bluetooth: hci7: HCI_REQ-0x0c1a [ 138.181420] Bluetooth: hci1: command 0x0409 tx timeout [ 138.309363] Bluetooth: hci4: Opcode 0x c03 failed: -110 [ 138.372305] Bluetooth: hci5: Opcode 0x c03 failed: -110 [ 138.500371] Bluetooth: hci6: command 0x0409 tx timeout [ 138.565545] Bluetooth: hci7: command 0x0409 tx timeout [ 140.228348] Bluetooth: hci1: command 0x041b tx timeout [ 140.548300] Bluetooth: hci6: command 0x041b tx timeout [ 140.612318] Bluetooth: hci7: command 0x041b tx timeout [ 140.873657] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 140.874723] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 140.876914] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 140.883429] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 140.885362] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 140.886069] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 140.890696] Bluetooth: hci5: HCI_REQ-0x0c1a [ 141.006962] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 141.026133] loop4: detected capacity change from 0 to 127 [ 141.026727] ======================================================= [ 141.026727] WARNING: The mand mount option has been deprecated and [ 141.026727] and is ignored by this kernel. Remove the mand [ 141.026727] option from the mount to silence this warning. [ 141.026727] ======================================================= [ 141.141627] 9pnet: Could not find request transport: xen [ 141.145197] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 142.277301] Bluetooth: hci1: command 0x040f tx timeout [ 142.596298] Bluetooth: hci6: command 0x040f tx timeout [ 142.661300] Bluetooth: hci7: command 0x040f tx timeout [ 142.789360] Bluetooth: hci4: Opcode 0x c03 failed: -110 [ 142.916325] Bluetooth: hci5: command 0x0409 tx timeout [ 144.324464] Bluetooth: hci1: command 0x0419 tx timeout [ 144.644326] Bluetooth: hci6: command 0x0419 tx timeout [ 144.708305] Bluetooth: hci7: command 0x0419 tx timeout [ 144.964290] Bluetooth: hci5: command 0x041b tx timeout [ 145.159512] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 145.160440] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 145.161374] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 145.162849] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 145.164688] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 145.165505] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 145.167920] Bluetooth: hci4: HCI_REQ-0x0c1a [ 147.012404] Bluetooth: hci5: command 0x040f tx timeout [ 147.205328] Bluetooth: hci4: command 0x0409 tx timeout [ 149.060392] Bluetooth: hci5: command 0x0419 tx timeout [ 149.252347] Bluetooth: hci4: command 0x041b tx timeout [ 151.301300] Bluetooth: hci4: command 0x040f tx timeout [ 153.349313] Bluetooth: hci4: command 0x0419 tx timeout [ 167.296798] 9pnet_fd: Insufficient options for proto=fd [ 167.313979] 9pnet_fd: Insufficient options for proto=fd 14:45:59 executing program 1: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) r4 = dup(r0) r5 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r4, 0xc0189371, &(0x7f0000000700)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) r7 = dup2(r2, r5) r8 = fspick(r6, &(0x7f0000000740)='./file0\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r7, 0xc0189371, &(0x7f0000000780)={{0x1, 0x1, 0x18, r8}, './file0\x00'}) sendmsg$NL80211_CMD_DISASSOCIATE(r2, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x30, 0x0, 0x400, 0x70bd25, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_LOCAL_STATE_CHANGE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@broadcast}]}, 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0xc000) sendmsg$NL80211_CMD_SET_MAC_ACL(r4, &(0x7f0000000a00)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000900)={0x94, 0x0, 0x100, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @val={0xc, 0x99, {0x7fffffff, 0x2f}}}}, [@NL80211_ATTR_ACL_POLICY={0x8}, @NL80211_ATTR_MAC_ADDRS={0x4c, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}, {0xa}, {0xa, 0x6, @broadcast}, {0xa, 0x6, @device_b}, {0xa, 0x6, @device_b}, {0xa}]}, @NL80211_ATTR_ACL_POLICY={0x8}, @NL80211_ATTR_MAC_ADDRS={0x10, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x4}, 0x800) ioctl$CDROMEJECT(r9, 0x5309) 14:45:59 executing program 0: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r2, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', &(0x7f0000001d80)={{}, {0x1, 0x2}, [{0x2, 0x2, 0xffffffffffffffff}, {0x2, 0x1, r3}, {0x2, 0x3, 0xee01}, {0x2, 0x6}, {0x2, 0x1, r4}, {}, {0x2, 0x0, r6}], {}, [{0x8, 0x1, 0xee00}, {0x8, 0x4, 0xffffffffffffffff}, {0x8, 0x2, 0xffffffffffffffff}], {}, {0x20, 0x2}}, 0x74, 0x1) mkdir(&(0x7f0000001e00)='./file1\x00', 0x1a) fsetxattr$trusted_overlay_redirect(r2, &(0x7f0000001e40), &(0x7f0000001e80)='./file1/file0\x00', 0xe, 0x3) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001f00), r0) sendmsg$NL80211_CMD_TDLS_MGMT(r0, &(0x7f0000001fc0)={&(0x7f0000001ec0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001f80)={&(0x7f0000001f40)={0x2c, r7, 0x100, 0x70bd25, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000090}, 0x4001800) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) fstat(r1, &(0x7f0000002100)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {'rfdno', 0x3d, r8}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid={'access', 0x3d, r6}}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid={'dfltuid', 0x3d, r9}}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid={'dfltgid', 0x3d, r5}}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt={'euid>', r3}}, {@fowner_eq={'fowner', 0x3d, r3}}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) ioctl$BTRFS_IOC_DEFRAG_RANGE(r1, 0x40309410, &(0x7f0000002300)={0x3, 0x3, 0x0, 0x4, 0x1, [0x9, 0x2, 0x3b55, 0x9]}) ioctl$EXT4_IOC_GETSTATE(r0, 0x40046629, &(0x7f0000002340)) mkdir(&(0x7f0000002380)='./file0\x00', 0x0) 14:45:59 executing program 7: r0 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) keyctl$invalidate(0x15, r0) r1 = add_key$fscrypt_provisioning(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)={0x0, 0x0, @auto=[0x17]}, 0x9, r0) r2 = request_key(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)='-)\\${\\\\\x17\'%&][@\x7f#[,\x00', 0xfffffffffffffff9) r3 = add_key(&(0x7f0000000240)='id_legacy\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="47b91d59f63be3ffd728f1da32a417d6229b5f5355f72eacd94dde9dc2d83701375ffebf14ac11d548e515", 0x2b, 0xfffffffffffffffc) keyctl$KEYCTL_MOVE(0x1e, r1, r2, r3, 0x0) request_key(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={'syz', 0x1}, &(0x7f0000000380)='id_legacy\x00', r3) r4 = request_key(&(0x7f00000003c0)='cifs.idmap\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000440)='/\x8fy){/(@\x00', r2) r5 = request_key(&(0x7f0000000480)='syzkaller\x00', &(0x7f00000004c0)={'syz', 0x0}, &(0x7f0000000500)='\x00', 0xfffffffffffffffb) keyctl$describe(0x6, r5, &(0x7f0000000540), 0x0) r6 = add_key$keyring(&(0x7f0000000640), &(0x7f0000000680)={'syz', 0x3}, 0x0, 0x0, r3) r7 = request_key(&(0x7f0000000580)='keyring\x00', &(0x7f00000005c0)={'syz', 0x3}, &(0x7f0000000600)='{%^#]*\x00', r6) add_key$keyring(&(0x7f00000006c0), &(0x7f0000000700)={'syz', 0x3}, 0x0, 0x0, r2) r8 = add_key$fscrypt_v1(&(0x7f0000000740), &(0x7f0000000780)={'fscrypt:', @desc1}, &(0x7f00000007c0)={0x0, "1a61b170aa2e74fa2e2a58b75a62ed60ed4c0d5f2da48478b7926a7387aff5957112b698943a3a974513d87e02845c385f49f39c58dd3836a95d1b9608ab57c6", 0x15}, 0x48, r0) r9 = add_key(&(0x7f0000000840)='dns_resolver\x00', &(0x7f0000000880)={'syz', 0x0}, &(0x7f00000008c0)="b7e87711369e4d18ad73a277c2aefd84d885ee8eb2cc7c6a1d6e5a230ee77d9fe4c35454ae3ca9dd55f8e002c51506a84304535f", 0x34, 0xfffffffffffffff8) keyctl$KEYCTL_MOVE(0x1e, r8, r7, r9, 0x1) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', r4) r10 = add_key(&(0x7f00000009c0)='cifs.idmap\x00', &(0x7f0000000a00)={'syz', 0x1}, 0x0, 0x0, r7) keyctl$KEYCTL_MOVE(0x1e, r9, r3, r10, 0x1) add_key$fscrypt_v1(&(0x7f0000000a40), &(0x7f0000000a80)={'fscrypt:', @auto=[0x36, 0x35, 0x61, 0x37, 0x31, 0x37, 0x62, 0x30, 0x34, 0x61, 0x67, 0x31, 0x34, 0x34, 0x30, 0x32]}, &(0x7f0000000ac0)={0x0, "2bd2380a9e1e411b4f9228d449ab1fcf377960907d2b1e0789b9b1439d1fa0b501897c192c163643c7c4151603f56505edce47b844b8a76f7a63f55ef17ed2d4", 0x31}, 0x48, r10) 14:45:59 executing program 3: r0 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) keyctl$invalidate(0x15, r0) r1 = add_key$fscrypt_provisioning(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)={0x0, 0x0, @auto=[0x17]}, 0x9, r0) r2 = request_key(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)='-)\\${\\\\\x17\'%&][@\x7f#[,\x00', 0xfffffffffffffff9) r3 = add_key(&(0x7f0000000240)='id_legacy\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="47b91d59f63be3ffd728f1da32a417d6229b5f5355f72eacd94dde9dc2d83701375ffebf14ac11d548e515", 0x2b, 0xfffffffffffffffc) keyctl$KEYCTL_MOVE(0x1e, r1, r2, r3, 0x0) request_key(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={'syz', 0x1}, &(0x7f0000000380)='id_legacy\x00', r3) r4 = request_key(&(0x7f00000003c0)='cifs.idmap\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000440)='/\x8fy){/(@\x00', r2) r5 = request_key(&(0x7f0000000480)='syzkaller\x00', &(0x7f00000004c0)={'syz', 0x0}, &(0x7f0000000500)='\x00', 0xfffffffffffffffb) keyctl$describe(0x6, r5, &(0x7f0000000540), 0x0) r6 = add_key$keyring(&(0x7f0000000640), &(0x7f0000000680)={'syz', 0x3}, 0x0, 0x0, r3) r7 = request_key(&(0x7f0000000580)='keyring\x00', &(0x7f00000005c0)={'syz', 0x3}, &(0x7f0000000600)='{%^#]*\x00', r6) add_key$keyring(&(0x7f00000006c0), &(0x7f0000000700)={'syz', 0x3}, 0x0, 0x0, r2) r8 = add_key$fscrypt_v1(&(0x7f0000000740), &(0x7f0000000780)={'fscrypt:', @desc1}, &(0x7f00000007c0)={0x0, "1a61b170aa2e74fa2e2a58b75a62ed60ed4c0d5f2da48478b7926a7387aff5957112b698943a3a974513d87e02845c385f49f39c58dd3836a95d1b9608ab57c6", 0x15}, 0x48, r0) r9 = add_key(&(0x7f0000000840)='dns_resolver\x00', &(0x7f0000000880)={'syz', 0x0}, &(0x7f00000008c0)="b7e87711369e4d18ad73a277c2aefd84d885ee8eb2cc7c6a1d6e5a230ee77d9fe4c35454ae3ca9dd55f8e002c51506a84304535f", 0x34, 0xfffffffffffffff8) keyctl$KEYCTL_MOVE(0x1e, r8, r7, r9, 0x1) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', r4) r10 = add_key(&(0x7f00000009c0)='cifs.idmap\x00', &(0x7f0000000a00)={'syz', 0x1}, 0x0, 0x0, r7) keyctl$KEYCTL_MOVE(0x1e, r9, r3, r10, 0x1) add_key$fscrypt_v1(&(0x7f0000000a40), &(0x7f0000000a80)={'fscrypt:', @auto=[0x36, 0x35, 0x61, 0x37, 0x31, 0x37, 0x62, 0x30, 0x34, 0x61, 0x67, 0x31, 0x34, 0x34, 0x30, 0x32]}, &(0x7f0000000ac0)={0x0, "2bd2380a9e1e411b4f9228d449ab1fcf377960907d2b1e0789b9b1439d1fa0b501897c192c163643c7c4151603f56505edce47b844b8a76f7a63f55ef17ed2d4", 0x31}, 0x48, r10) 14:45:59 executing program 5: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r2, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', &(0x7f0000001d80)={{}, {0x1, 0x2}, [{0x2, 0x2, 0xffffffffffffffff}, {0x2, 0x1, r3}, {0x2, 0x3, 0xee01}, {0x2, 0x6}, {0x2, 0x1, r4}, {}, {0x2, 0x0, r6}], {}, [{0x8, 0x1, 0xee00}, {0x8, 0x4, 0xffffffffffffffff}, {0x8, 0x2, 0xffffffffffffffff}], {}, {0x20, 0x2}}, 0x74, 0x1) mkdir(&(0x7f0000001e00)='./file1\x00', 0x1a) fsetxattr$trusted_overlay_redirect(r2, &(0x7f0000001e40), &(0x7f0000001e80)='./file1/file0\x00', 0xe, 0x3) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001f00), r0) sendmsg$NL80211_CMD_TDLS_MGMT(r0, &(0x7f0000001fc0)={&(0x7f0000001ec0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001f80)={&(0x7f0000001f40)={0x2c, r7, 0x100, 0x70bd25, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000090}, 0x4001800) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) fstat(r1, &(0x7f0000002100)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {'rfdno', 0x3d, r8}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid={'access', 0x3d, r6}}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid={'dfltuid', 0x3d, r9}}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid={'dfltgid', 0x3d, r5}}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt={'euid>', r3}}, {@fowner_eq={'fowner', 0x3d, r3}}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) ioctl$BTRFS_IOC_DEFRAG_RANGE(r1, 0x40309410, &(0x7f0000002300)={0x3, 0x3, 0x0, 0x4, 0x1, [0x9, 0x2, 0x3b55, 0x9]}) ioctl$EXT4_IOC_GETSTATE(r0, 0x40046629, &(0x7f0000002340)) mkdir(&(0x7f0000002380)='./file0\x00', 0x0) 14:45:59 executing program 6: syz_mount_image$ext4(&(0x7f0000000140)='ext2\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x1, &(0x7f0000001480)=[{&(0x7f00000001c0)="12b46d6821e2b9780a4eef2b83e62fd8903b5db787ada822637a7a58c9", 0x1d, 0xffffffffffff7fff}], 0x2008002, &(0x7f0000001500)={[{@minixdf}, {@quota}, {@resuid={'resuid', 0x3d, 0xee01}}, {@noacl}, {@prjquota}, {@nodelalloc}, {@nobarrier}, {@orlov}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0xffffffffffffff81}}], [{@permit_directio}, {@uid_eq}, {@smackfshat={'smackfshat', 0x3d, 'ns/ipc\x00'}}, {@subj_role={'subj_role', 0x3d, 'ns/ipc\x00'}}, {@pcr={'pcr', 0x3d, 0x9}}, {@defcontext={'defcontext', 0x3d, 'sysadm_u'}}]}) stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) setresuid(0x0, r0, 0x0) stat(&(0x7f0000000180)='./file0\x00', &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lchown(&(0x7f0000000000)='./file0\x00', r0, r1) 14:45:59 executing program 4: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) setxattr$security_selinux(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0), &(0x7f0000000800)='system_u:object_r:shell_exec_t:s0\x00', 0x22, 0x2) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0xf0f1e000) setxattr$security_capability(&(0x7f0000000840)='./file0\x00', &(0x7f0000000880), &(0x7f00000008c0)=@v3={0x3000000, [{0x421e, 0x8001}, {0x6, 0x7}], 0xee01}, 0x18, 0x3) [ 186.091969] loop6: detected capacity change from 0 to 16255 [ 186.096134] EXT4-fs: Mount option "noacl" will be removed by 3.5 [ 186.096134] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 186.096134] [ 186.097443] EXT4-fs: Ignoring removed orlov option [ 186.097989] ext2: Bad value for 'debug_want_extra_isize' [ 186.098984] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 186.100416] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 186.118830] loop4: detected capacity change from 0 to 127 [ 186.131231] loop2: detected capacity change from 0 to 127 [ 186.140017] 9pnet_fd: Insufficient options for proto=fd ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000900)={"7f6d1f508aa7a78b4903735cf6ee0d94", 0x0, 0x0, {0x6, 0x8}, {0x9f4, 0x9}, 0x1f, [0xfcd, 0x8, 0x5, 0x3, 0x6, 0x5, 0x40, 0xffff, 0x2, 0x1, 0x6, 0x7fff, 0xc0, 0x3, 0x3]}) r2 = socket$netlink(0x10, 0x3, 0xa) ioctl$BTRFS_IOC_SCRUB(r2, 0xc400941b, &(0x7f0000000a00)={0x0, 0x689, 0x4, 0x1}) r3 = openat$incfs(r1, &(0x7f0000000e00)='.pending_reads\x00', 0x22000, 0x1c8) renameat(r3, &(0x7f0000000e40)='./file0\x00', r1, &(0x7f0000000e80)='./file0\x00') ioctl$AUTOFS_DEV_IOCTL_READY(r3, 0xc0189376, 0xfffffffffffffffe) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f00), r1) sendmsg$NL80211_CMD_SET_MAC_ACL(r3, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0x10, 0x0, 0x0, 0x1100000}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f40)={0x1c, r4, 0x200, 0x70bd2c, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_ACL_POLICY={0x8, 0xa5, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x880) syz_open_dev$mouse(&(0x7f0000001000), 0x1, 0x4181) mount$9p_xen(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x1804003, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}, {@cache_loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) 14:45:59 executing program 2: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) setxattr$security_selinux(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0), &(0x7f0000000800)='system_u:object_r:shell_exec_t:s0\x00', 0x22, 0x2) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0xf0f1e000) setxattr$security_capability(&(0x7f0000000840)='./file0\x00', &(0x7f0000000880), &(0x7f00000008c0)=@v3={0x3000000, [{0x421e, 0x8001}, {0x6, 0x7}], 0xee01}, 0x18, 0x3) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000900)={"7f6d1f508aa7a78b4903735cf6ee0d94", 0x0, 0x0, {0x6, 0x8}, {0x9f4, 0x9}, 0x1f, [0xfcd, 0x8, 0x5, 0x3, 0x6, 0x5, 0x40, 0xffff, 0x2, 0x1, 0x6, 0x7fff, 0xc0, 0x3, 0x3]}) r2 = socket$netlink(0x10, 0x3, 0xa) ioctl$BTRFS_IOC_SCRUB(r2, 0xc400941b, &(0x7f0000000a00)={0x0, 0x689, 0x4, 0x1}) r3 = openat$incfs(r1, &(0x7f0000000e00)='.pending_reads\x00', 0x22000, 0x1c8) renameat(r3, &(0x7f0000000e40)='./file0\x00', r1, &(0x7f0000000e80)='./file0\x00') ioctl$AUTOFS_DEV_IOCTL_READY(r3, 0xc0189376, 0xfffffffffffffffe) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f00), r1) sendmsg$NL80211_CMD_SET_MAC_ACL(r3, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0x10, 0x0, 0x0, 0x1100000}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f40)={0x1c, r4, 0x200, 0x70bd2c, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_ACL_POLICY={0x8, 0xa5, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x880) syz_open_dev$mouse(&(0x7f0000001000), 0x1, 0x4181) mount$9p_xen(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x1804003, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}, {@cache_loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) [ 186.178194] 9pnet_fd: Insufficient options for proto=fd [ 186.244947] 9pnet: Could not find request transport: xen [ 186.319385] 9pnet: Could not find request transport: xen 14:46:11 executing program 2: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) setxattr$security_selinux(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0), &(0x7f0000000800)='system_u:object_r:shell_exec_t:s0\x00', 0x22, 0x2) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0xf0f1e000) setxattr$security_capability(&(0x7f0000000840)='./file0\x00', &(0x7f0000000880), &(0x7f00000008c0)=@v3={0x3000000, [{0x421e, 0x8001}, {0x6, 0x7}], 0xee01}, 0x18, 0x3) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000900)={"7f6d1f508aa7a78b4903735cf6ee0d94", 0x0, 0x0, {0x6, 0x8}, {0x9f4, 0x9}, 0x1f, [0xfcd, 0x8, 0x5, 0x3, 0x6, 0x5, 0x40, 0xffff, 0x2, 0x1, 0x6, 0x7fff, 0xc0, 0x3, 0x3]}) r2 = socket$netlink(0x10, 0x3, 0xa) ioctl$BTRFS_IOC_SCRUB(r2, 0xc400941b, &(0x7f0000000a00)={0x0, 0x689, 0x4, 0x1}) r3 = openat$incfs(r1, &(0x7f0000000e00)='.pending_reads\x00', 0x22000, 0x1c8) renameat(r3, &(0x7f0000000e40)='./file0\x00', r1, &(0x7f0000000e80)='./file0\x00') ioctl$AUTOFS_DEV_IOCTL_READY(r3, 0xc0189376, 0xfffffffffffffffe) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f00), r1) sendmsg$NL80211_CMD_SET_MAC_ACL(r3, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0x10, 0x0, 0x0, 0x1100000}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f40)={0x1c, r4, 0x200, 0x70bd2c, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_ACL_POLICY={0x8, 0xa5, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x880) syz_open_dev$mouse(&(0x7f0000001000), 0x1, 0x4181) mount$9p_xen(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x1804003, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}, {@cache_loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) 14:46:11 executing program 1: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) r4 = dup(r0) r5 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r4, 0xc0189371, &(0x7f0000000700)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) r7 = dup2(r2, r5) r8 = fspick(r6, &(0x7f0000000740)='./file0\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r7, 0xc0189371, &(0x7f0000000780)={{0x1, 0x1, 0x18, r8}, './file0\x00'}) sendmsg$NL80211_CMD_DISASSOCIATE(r2, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x30, 0x0, 0x400, 0x70bd25, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_LOCAL_STATE_CHANGE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@broadcast}]}, 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0xc000) sendmsg$NL80211_CMD_SET_MAC_ACL(r4, &(0x7f0000000a00)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000900)={0x94, 0x0, 0x100, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @val={0xc, 0x99, {0x7fffffff, 0x2f}}}}, [@NL80211_ATTR_ACL_POLICY={0x8}, @NL80211_ATTR_MAC_ADDRS={0x4c, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}, {0xa}, {0xa, 0x6, @broadcast}, {0xa, 0x6, @device_b}, {0xa, 0x6, @device_b}, {0xa}]}, @NL80211_ATTR_ACL_POLICY={0x8}, @NL80211_ATTR_MAC_ADDRS={0x10, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x4}, 0x800) 14:46:11 executing program 7: r0 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) keyctl$invalidate(0x15, r0) r1 = add_key$fscrypt_provisioning(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)={0x0, 0x0, @auto=[0x17]}, 0x9, r0) r2 = request_key(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)='-)\\${\\\\\x17\'%&][@\x7f#[,\x00', 0xfffffffffffffff9) r3 = add_key(&(0x7f0000000240)='id_legacy\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="47b91d59f63be3ffd728f1da32a417d6229b5f5355f72eacd94dde9dc2d83701375ffebf14ac11d548e515", 0x2b, 0xfffffffffffffffc) keyctl$KEYCTL_MOVE(0x1e, r1, r2, r3, 0x0) request_key(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={'syz', 0x1}, &(0x7f0000000380)='id_legacy\x00', r3) r4 = request_key(&(0x7f00000003c0)='cifs.idmap\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000440)='/\x8fy){/(@\x00', r2) r5 = request_key(&(0x7f0000000480)='syzkaller\x00', &(0x7f00000004c0)={'syz', 0x0}, &(0x7f0000000500)='\x00', 0xfffffffffffffffb) keyctl$describe(0x6, r5, &(0x7f0000000540), 0x0) r6 = add_key$keyring(&(0x7f0000000640), &(0x7f0000000680)={'syz', 0x3}, 0x0, 0x0, r3) r7 = request_key(&(0x7f0000000580)='keyring\x00', &(0x7f00000005c0)={'syz', 0x3}, &(0x7f0000000600)='{%^#]*\x00', r6) add_key$keyring(&(0x7f00000006c0), &(0x7f0000000700)={'syz', 0x3}, 0x0, 0x0, r2) r8 = add_key$fscrypt_v1(&(0x7f0000000740), &(0x7f0000000780)={'fscrypt:', @desc1}, &(0x7f00000007c0)={0x0, "1a61b170aa2e74fa2e2a58b75a62ed60ed4c0d5f2da48478b7926a7387aff5957112b698943a3a974513d87e02845c385f49f39c58dd3836a95d1b9608ab57c6", 0x15}, 0x48, r0) r9 = add_key(&(0x7f0000000840)='dns_resolver\x00', &(0x7f0000000880)={'syz', 0x0}, &(0x7f00000008c0)="b7e87711369e4d18ad73a277c2aefd84d885ee8eb2cc7c6a1d6e5a230ee77d9fe4c35454ae3ca9dd55f8e002c51506a84304535f", 0x34, 0xfffffffffffffff8) keyctl$KEYCTL_MOVE(0x1e, r8, r7, r9, 0x1) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', r4) r10 = add_key(&(0x7f00000009c0)='cifs.idmap\x00', &(0x7f0000000a00)={'syz', 0x1}, 0x0, 0x0, r7) keyctl$KEYCTL_MOVE(0x1e, r9, r3, r10, 0x1) add_key$fscrypt_v1(&(0x7f0000000a40), &(0x7f0000000a80)={'fscrypt:', @auto=[0x36, 0x35, 0x61, 0x37, 0x31, 0x37, 0x62, 0x30, 0x34, 0x61, 0x67, 0x31, 0x34, 0x34, 0x30, 0x32]}, &(0x7f0000000ac0)={0x0, "2bd2380a9e1e411b4f9228d449ab1fcf377960907d2b1e0789b9b1439d1fa0b501897c192c163643c7c4151603f56505edce47b844b8a76f7a63f55ef17ed2d4", 0x31}, 0x48, r10) 14:46:11 executing program 6: syz_mount_image$ext4(&(0x7f0000000140)='ext2\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x1, &(0x7f0000001480)=[{&(0x7f00000001c0)="12b46d6821e2b9780a4eef2b83e62fd8903b5db787ada822637a7a58c9", 0x1d, 0xffffffffffff7fff}], 0x2008002, &(0x7f0000001500)={[{@minixdf}, {@quota}, {@resuid={'resuid', 0x3d, 0xee01}}, {@noacl}, {@prjquota}, {@nodelalloc}, {@nobarrier}, {@orlov}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0xffffffffffffff81}}], [{@permit_directio}, {@uid_eq}, {@smackfshat={'smackfshat', 0x3d, 'ns/ipc\x00'}}, {@subj_role={'subj_role', 0x3d, 'ns/ipc\x00'}}, {@pcr={'pcr', 0x3d, 0x9}}, {@defcontext={'defcontext', 0x3d, 'sysadm_u'}}]}) stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) setresuid(0x0, r0, 0x0) lchown(&(0x7f0000000000)='./file0\x00', r0, 0x0) 14:46:11 executing program 0: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r2, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', &(0x7f0000001d80)={{}, {0x1, 0x2}, [{0x2, 0x2, 0xffffffffffffffff}, {0x2, 0x1, r3}, {0x2, 0x3, 0xee01}, {0x2, 0x6}, {0x2, 0x1, r4}, {}, {0x2, 0x0, r6}], {}, [{0x8, 0x1, 0xee00}, {0x8, 0x4, 0xffffffffffffffff}, {0x8, 0x2, 0xffffffffffffffff}], {}, {0x20, 0x2}}, 0x74, 0x1) mkdir(&(0x7f0000001e00)='./file1\x00', 0x1a) fsetxattr$trusted_overlay_redirect(r2, &(0x7f0000001e40), &(0x7f0000001e80)='./file1/file0\x00', 0xe, 0x3) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001f00), r0) sendmsg$NL80211_CMD_TDLS_MGMT(r0, &(0x7f0000001fc0)={&(0x7f0000001ec0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001f80)={&(0x7f0000001f40)={0x2c, r7, 0x100, 0x70bd25, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000090}, 0x4001800) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) fstat(r1, &(0x7f0000002100)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {'rfdno', 0x3d, r8}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid={'access', 0x3d, r6}}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid={'dfltuid', 0x3d, r9}}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid={'dfltgid', 0x3d, r5}}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt={'euid>', r3}}, {@fowner_eq={'fowner', 0x3d, r3}}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) ioctl$BTRFS_IOC_DEFRAG_RANGE(r1, 0x40309410, &(0x7f0000002300)={0x3, 0x3, 0x0, 0x4, 0x1, [0x9, 0x2, 0x3b55, 0x9]}) ioctl$EXT4_IOC_GETSTATE(r0, 0x40046629, &(0x7f0000002340)) mkdir(&(0x7f0000002380)='./file0\x00', 0x0) 14:46:11 executing program 3: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r2, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', &(0x7f0000001d80)={{}, {0x1, 0x2}, [{0x2, 0x2, 0xffffffffffffffff}, {0x2, 0x1, r3}, {0x2, 0x3, 0xee01}, {0x2, 0x6}, {0x2, 0x1, r4}, {}, {0x2, 0x0, r6}], {}, [{0x8, 0x1, 0xee00}, {0x8, 0x4, 0xffffffffffffffff}, {0x8, 0x2, 0xffffffffffffffff}], {}, {0x20, 0x2}}, 0x74, 0x1) mkdir(&(0x7f0000001e00)='./file1\x00', 0x1a) fsetxattr$trusted_overlay_redirect(r2, &(0x7f0000001e40), &(0x7f0000001e80)='./file1/file0\x00', 0xe, 0x3) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001f00), r0) sendmsg$NL80211_CMD_TDLS_MGMT(r0, &(0x7f0000001fc0)={&(0x7f0000001ec0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001f80)={&(0x7f0000001f40)={0x2c, r7, 0x100, 0x70bd25, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000090}, 0x4001800) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) fstat(r1, &(0x7f0000002100)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {'rfdno', 0x3d, r8}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid={'access', 0x3d, r6}}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid={'dfltuid', 0x3d, r9}}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid={'dfltgid', 0x3d, r5}}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt={'euid>', r3}}, {@fowner_eq={'fowner', 0x3d, r3}}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) ioctl$BTRFS_IOC_DEFRAG_RANGE(r1, 0x40309410, &(0x7f0000002300)={0x3, 0x3, 0x0, 0x4, 0x1, [0x9, 0x2, 0x3b55, 0x9]}) ioctl$EXT4_IOC_GETSTATE(r0, 0x40046629, &(0x7f0000002340)) mkdir(&(0x7f0000002380)='./file0\x00', 0x0) 14:46:11 executing program 5: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r2, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', &(0x7f0000001d80)={{}, {0x1, 0x2}, [{0x2, 0x2, 0xffffffffffffffff}, {0x2, 0x1, r3}, {0x2, 0x3, 0xee01}, {0x2, 0x6}, {0x2, 0x1, r4}, {}, {0x2, 0x0, r6}], {}, [{0x8, 0x1, 0xee00}, {0x8, 0x4, 0xffffffffffffffff}, {0x8, 0x2, 0xffffffffffffffff}], {}, {0x20, 0x2}}, 0x74, 0x1) mkdir(&(0x7f0000001e00)='./file1\x00', 0x1a) fsetxattr$trusted_overlay_redirect(r2, &(0x7f0000001e40), &(0x7f0000001e80)='./file1/file0\x00', 0xe, 0x3) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001f00), r0) sendmsg$NL80211_CMD_TDLS_MGMT(r0, &(0x7f0000001fc0)={&(0x7f0000001ec0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001f80)={&(0x7f0000001f40)={0x2c, r7, 0x100, 0x70bd25, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000090}, 0x4001800) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) fstat(r1, &(0x7f0000002100)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {'rfdno', 0x3d, r8}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid={'access', 0x3d, r6}}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid={'dfltuid', 0x3d, r9}}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid={'dfltgid', 0x3d, r5}}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt={'euid>', r3}}, {@fowner_eq={'fowner', 0x3d, r3}}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) ioctl$BTRFS_IOC_DEFRAG_RANGE(r1, 0x40309410, &(0x7f0000002300)={0x3, 0x3, 0x0, 0x4, 0x1, [0x9, 0x2, 0x3b55, 0x9]}) ioctl$EXT4_IOC_GETSTATE(r0, 0x40046629, &(0x7f0000002340)) mkdir(&(0x7f0000002380)='./file0\x00', 0x0) 14:46:11 executing program 4: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) setxattr$security_selinux(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0), &(0x7f0000000800)='system_u:object_r:shell_exec_t:s0\x00', 0x22, 0x2) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0xf0f1e000) setxattr$security_capability(&(0x7f0000000840)='./file0\x00', &(0x7f0000000880), &(0x7f00000008c0)=@v3={0x3000000, [{0x421e, 0x8001}, {0x6, 0x7}], 0xee01}, 0x18, 0x3) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000900)={"7f6d1f508aa7a78b4903735cf6ee0d94", 0x0, 0x0, {0x6, 0x8}, {0x9f4, 0x9}, 0x1f, [0xfcd, 0x8, 0x5, 0x3, 0x6, 0x5, 0x40, 0xffff, 0x2, 0x1, 0x6, 0x7fff, 0xc0, 0x3, 0x3]}) r2 = socket$netlink(0x10, 0x3, 0xa) ioctl$BTRFS_IOC_SCRUB(r2, 0xc400941b, &(0x7f0000000a00)={0x0, 0x689, 0x4, 0x1}) r3 = openat$incfs(r1, &(0x7f0000000e00)='.pending_reads\x00', 0x22000, 0x1c8) renameat(r3, &(0x7f0000000e40)='./file0\x00', r1, &(0x7f0000000e80)='./file0\x00') ioctl$AUTOFS_DEV_IOCTL_READY(r3, 0xc0189376, 0xfffffffffffffffe) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f00), r1) sendmsg$NL80211_CMD_SET_MAC_ACL(r3, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0x10, 0x0, 0x0, 0x1100000}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f40)={0x1c, r4, 0x200, 0x70bd2c, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_ACL_POLICY={0x8, 0xa5, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x880) syz_open_dev$mouse(&(0x7f0000001000), 0x1, 0x4181) mount$9p_xen(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x1804003, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}, {@cache_loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) [ 197.505604] loop6: detected capacity change from 0 to 16255 [ 197.518629] EXT4-fs: Mount option "noacl" will be removed by 3.5 [ 197.518629] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 197.518629] [ 197.519765] EXT4-fs: Ignoring removed orlov option [ 197.525086] ext2: Bad value for 'debug_want_extra_isize' [ 197.530109] 9pnet_fd: Insufficient options for proto=fd [ 197.533659] 9pnet_fd: Insufficient options for proto=fd [ 197.551466] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 197.557745] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 197.566546] loop2: detected capacity change from 0 to 127 [ 197.572401] 9pnet_fd: Insufficient options for proto=fd [ 197.578744] loop4: detected capacity change from 0 to 127 14:46:11 executing program 3: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) r4 = dup(r0) r5 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r4, 0xc0189371, &(0x7f0000000700)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) r7 = dup2(r2, r5) r8 = fspick(r6, &(0x7f0000000740)='./file0\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r7, 0xc0189371, &(0x7f0000000780)={{0x1, 0x1, 0x18, r8}, './file0\x00'}) sendmsg$NL80211_CMD_DISASSOCIATE(r2, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x30, 0x0, 0x400, 0x70bd25, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_LOCAL_STATE_CHANGE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@broadcast}]}, 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0xc000) sendmsg$NL80211_CMD_SET_MAC_ACL(r4, &(0x7f0000000a00)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000900)={0x94, 0x0, 0x100, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @val={0xc, 0x99, {0x7fffffff, 0x2f}}}}, [@NL80211_ATTR_ACL_POLICY={0x8}, @NL80211_ATTR_MAC_ADDRS={0x4c, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}, {0xa}, {0xa, 0x6, @broadcast}, {0xa, 0x6, @device_b}, {0xa, 0x6, @device_b}, {0xa}]}, @NL80211_ATTR_ACL_POLICY={0x8}, @NL80211_ATTR_MAC_ADDRS={0x10, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x4}, 0x800) ioctl$CDROMEJECT(r9, 0x5309) 14:46:11 executing program 0: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r2, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', &(0x7f0000001d80)={{}, {0x1, 0x2}, [{0x2, 0x2, 0xffffffffffffffff}, {0x2, 0x1, r3}, {0x2, 0x3, 0xee01}, {0x2, 0x6}, {0x2, 0x1, r4}, {}, {0x2, 0x0, r6}], {}, [{0x8, 0x1, 0xee00}, {0x8, 0x4, 0xffffffffffffffff}, {0x8, 0x2, 0xffffffffffffffff}], {}, {0x20, 0x2}}, 0x74, 0x1) mkdir(&(0x7f0000001e00)='./file1\x00', 0x1a) fsetxattr$trusted_overlay_redirect(r2, &(0x7f0000001e40), &(0x7f0000001e80)='./file1/file0\x00', 0xe, 0x3) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001f00), r0) sendmsg$NL80211_CMD_TDLS_MGMT(r0, &(0x7f0000001fc0)={&(0x7f0000001ec0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001f80)={&(0x7f0000001f40)={0x2c, r7, 0x100, 0x70bd25, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000090}, 0x4001800) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) fstat(r1, &(0x7f0000002100)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {'rfdno', 0x3d, r8}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid={'access', 0x3d, r6}}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid={'dfltuid', 0x3d, r9}}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid={'dfltgid', 0x3d, r5}}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt={'euid>', r3}}, {@fowner_eq={'fowner', 0x3d, r3}}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) ioctl$BTRFS_IOC_DEFRAG_RANGE(r1, 0x40309410, &(0x7f0000002300)={0x3, 0x3, 0x0, 0x4, 0x1, [0x9, 0x2, 0x3b55, 0x9]}) ioctl$EXT4_IOC_GETSTATE(r0, 0x40046629, &(0x7f0000002340)) mkdir(&(0x7f0000002380)='./file0\x00', 0x0) 14:46:11 executing program 7: r0 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) keyctl$invalidate(0x15, r0) r1 = add_key$fscrypt_provisioning(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)={0x0, 0x0, @auto=[0x17]}, 0x9, r0) r2 = request_key(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)='-)\\${\\\\\x17\'%&][@\x7f#[,\x00', 0xfffffffffffffff9) r3 = add_key(&(0x7f0000000240)='id_legacy\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="47b91d59f63be3ffd728f1da32a417d6229b5f5355f72eacd94dde9dc2d83701375ffebf14ac11d548e515", 0x2b, 0xfffffffffffffffc) keyctl$KEYCTL_MOVE(0x1e, r1, r2, r3, 0x0) request_key(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={'syz', 0x1}, &(0x7f0000000380)='id_legacy\x00', r3) r4 = request_key(&(0x7f00000003c0)='cifs.idmap\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000440)='/\x8fy){/(@\x00', r2) r5 = request_key(&(0x7f0000000480)='syzkaller\x00', &(0x7f00000004c0)={'syz', 0x0}, &(0x7f0000000500)='\x00', 0xfffffffffffffffb) keyctl$describe(0x6, r5, &(0x7f0000000540), 0x0) r6 = add_key$keyring(&(0x7f0000000640), &(0x7f0000000680)={'syz', 0x3}, 0x0, 0x0, r3) r7 = request_key(&(0x7f0000000580)='keyring\x00', &(0x7f00000005c0)={'syz', 0x3}, &(0x7f0000000600)='{%^#]*\x00', r6) add_key$keyring(&(0x7f00000006c0), &(0x7f0000000700)={'syz', 0x3}, 0x0, 0x0, r2) r8 = add_key$fscrypt_v1(&(0x7f0000000740), &(0x7f0000000780)={'fscrypt:', @desc1}, &(0x7f00000007c0)={0x0, "1a61b170aa2e74fa2e2a58b75a62ed60ed4c0d5f2da48478b7926a7387aff5957112b698943a3a974513d87e02845c385f49f39c58dd3836a95d1b9608ab57c6", 0x15}, 0x48, r0) r9 = add_key(&(0x7f0000000840)='dns_resolver\x00', &(0x7f0000000880)={'syz', 0x0}, &(0x7f00000008c0)="b7e87711369e4d18ad73a277c2aefd84d885ee8eb2cc7c6a1d6e5a230ee77d9fe4c35454ae3ca9dd55f8e002c51506a84304535f", 0x34, 0xfffffffffffffff8) keyctl$KEYCTL_MOVE(0x1e, r8, r7, r9, 0x1) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', r4) r10 = add_key(&(0x7f00000009c0)='cifs.idmap\x00', &(0x7f0000000a00)={'syz', 0x1}, 0x0, 0x0, r7) keyctl$KEYCTL_MOVE(0x1e, r9, r3, r10, 0x1) add_key$fscrypt_v1(&(0x7f0000000a40), &(0x7f0000000a80)={'fscrypt:', @auto=[0x36, 0x35, 0x61, 0x37, 0x31, 0x37, 0x62, 0x30, 0x34, 0x61, 0x67, 0x31, 0x34, 0x34, 0x30, 0x32]}, &(0x7f0000000ac0)={0x0, "2bd2380a9e1e411b4f9228d449ab1fcf377960907d2b1e0789b9b1439d1fa0b501897c192c163643c7c4151603f56505edce47b844b8a76f7a63f55ef17ed2d4", 0x31}, 0x48, r10) 14:46:11 executing program 6: syz_mount_image$ext4(&(0x7f0000000140)='ext2\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x1, &(0x7f0000001480)=[{&(0x7f00000001c0)="12b46d6821e2b9780a4eef2b83e62fd8903b5db787ada822637a7a58c9", 0x1d, 0xffffffffffff7fff}], 0x2008002, &(0x7f0000001500)={[{@minixdf}, {@quota}, {@resuid={'resuid', 0x3d, 0xee01}}, {@noacl}, {@prjquota}, {@nodelalloc}, {@nobarrier}, {@orlov}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0xffffffffffffff81}}], [{@permit_directio}, {@uid_eq}, {@smackfshat={'smackfshat', 0x3d, 'ns/ipc\x00'}}, {@subj_role={'subj_role', 0x3d, 'ns/ipc\x00'}}, {@pcr={'pcr', 0x3d, 0x9}}, {@defcontext={'defcontext', 0x3d, 'sysadm_u'}}]}) stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) lchown(&(0x7f0000000000)='./file0\x00', r0, 0x0) [ 197.656972] loop6: detected capacity change from 0 to 16255 14:46:11 executing program 1: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) r4 = dup(r0) r5 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r4, 0xc0189371, &(0x7f0000000700)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) r7 = dup2(r2, r5) r8 = fspick(r6, &(0x7f0000000740)='./file0\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r7, 0xc0189371, &(0x7f0000000780)={{0x1, 0x1, 0x18, r8}, './file0\x00'}) sendmsg$NL80211_CMD_DISASSOCIATE(r2, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x30, 0x0, 0x400, 0x70bd25, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_LOCAL_STATE_CHANGE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@broadcast}]}, 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0xc000) [ 197.672474] EXT4-fs: Mount option "noacl" will be removed by 3.5 [ 197.672474] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 197.672474] [ 197.673563] EXT4-fs: Ignoring removed orlov option [ 197.673935] ext2: Bad value for 'debug_want_extra_isize' 14:46:11 executing program 5: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r2, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', &(0x7f0000001d80)={{}, {0x1, 0x2}, [{0x2, 0x2, 0xffffffffffffffff}, {0x2, 0x1, r3}, {0x2, 0x3, 0xee01}, {0x2, 0x6}, {0x2, 0x1, r4}, {}, {0x2, 0x0, r6}], {}, [{0x8, 0x1, 0xee00}, {0x8, 0x4, 0xffffffffffffffff}, {0x8, 0x2, 0xffffffffffffffff}], {}, {0x20, 0x2}}, 0x74, 0x1) mkdir(&(0x7f0000001e00)='./file1\x00', 0x1a) fsetxattr$trusted_overlay_redirect(r2, &(0x7f0000001e40), &(0x7f0000001e80)='./file1/file0\x00', 0xe, 0x3) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001f00), r0) sendmsg$NL80211_CMD_TDLS_MGMT(r0, &(0x7f0000001fc0)={&(0x7f0000001ec0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001f80)={&(0x7f0000001f40)={0x2c, r7, 0x100, 0x70bd25, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000090}, 0x4001800) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) fstat(r1, &(0x7f0000002100)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {'rfdno', 0x3d, r8}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid={'access', 0x3d, r6}}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid={'dfltuid', 0x3d, r9}}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid={'dfltgid', 0x3d, r5}}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt={'euid>', r3}}, {@fowner_eq={'fowner', 0x3d, r3}}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) ioctl$BTRFS_IOC_DEFRAG_RANGE(r1, 0x40309410, &(0x7f0000002300)={0x3, 0x3, 0x0, 0x4, 0x1, [0x9, 0x2, 0x3b55, 0x9]}) ioctl$EXT4_IOC_GETSTATE(r0, 0x40046629, &(0x7f0000002340)) mkdir(&(0x7f0000002380)='./file0\x00', 0x0) [ 197.692191] 9pnet_fd: Insufficient options for proto=fd 14:46:11 executing program 7: r0 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) keyctl$invalidate(0x15, r0) r1 = add_key$fscrypt_provisioning(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)={0x0, 0x0, @auto=[0x17]}, 0x9, r0) r2 = request_key(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)='-)\\${\\\\\x17\'%&][@\x7f#[,\x00', 0xfffffffffffffff9) r3 = add_key(&(0x7f0000000240)='id_legacy\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="47b91d59f63be3ffd728f1da32a417d6229b5f5355f72eacd94dde9dc2d83701375ffebf14ac11d548e515", 0x2b, 0xfffffffffffffffc) keyctl$KEYCTL_MOVE(0x1e, r1, r2, r3, 0x0) request_key(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={'syz', 0x1}, &(0x7f0000000380)='id_legacy\x00', r3) r4 = request_key(&(0x7f00000003c0)='cifs.idmap\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000440)='/\x8fy){/(@\x00', r2) r5 = request_key(&(0x7f0000000480)='syzkaller\x00', &(0x7f00000004c0)={'syz', 0x0}, &(0x7f0000000500)='\x00', 0xfffffffffffffffb) keyctl$describe(0x6, r5, &(0x7f0000000540), 0x0) r6 = add_key$keyring(&(0x7f0000000640), &(0x7f0000000680)={'syz', 0x3}, 0x0, 0x0, r3) r7 = request_key(&(0x7f0000000580)='keyring\x00', &(0x7f00000005c0)={'syz', 0x3}, &(0x7f0000000600)='{%^#]*\x00', r6) add_key$keyring(&(0x7f00000006c0), &(0x7f0000000700)={'syz', 0x3}, 0x0, 0x0, r2) r8 = add_key$fscrypt_v1(&(0x7f0000000740), &(0x7f0000000780)={'fscrypt:', @desc1}, &(0x7f00000007c0)={0x0, "1a61b170aa2e74fa2e2a58b75a62ed60ed4c0d5f2da48478b7926a7387aff5957112b698943a3a974513d87e02845c385f49f39c58dd3836a95d1b9608ab57c6", 0x15}, 0x48, r0) r9 = add_key(&(0x7f0000000840)='dns_resolver\x00', &(0x7f0000000880)={'syz', 0x0}, &(0x7f00000008c0)="b7e87711369e4d18ad73a277c2aefd84d885ee8eb2cc7c6a1d6e5a230ee77d9fe4c35454ae3ca9dd55f8e002c51506a84304535f", 0x34, 0xfffffffffffffff8) keyctl$KEYCTL_MOVE(0x1e, r8, r7, r9, 0x1) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', r4) r10 = add_key(&(0x7f00000009c0)='cifs.idmap\x00', &(0x7f0000000a00)={'syz', 0x1}, 0x0, 0x0, r7) keyctl$KEYCTL_MOVE(0x1e, r9, r3, r10, 0x1) 14:46:11 executing program 6: syz_mount_image$ext4(&(0x7f0000000140)='ext2\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x1, &(0x7f0000001480)=[{&(0x7f00000001c0)="12b46d6821e2b9780a4eef2b83e62fd8903b5db787ada822637a7a58c9", 0x1d, 0xffffffffffff7fff}], 0x2008002, &(0x7f0000001500)={[{@minixdf}, {@quota}, {@resuid={'resuid', 0x3d, 0xee01}}, {@noacl}, {@prjquota}, {@nodelalloc}, {@nobarrier}, {@orlov}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0xffffffffffffff81}}], [{@permit_directio}, {@uid_eq}, {@smackfshat={'smackfshat', 0x3d, 'ns/ipc\x00'}}, {@subj_role={'subj_role', 0x3d, 'ns/ipc\x00'}}, {@pcr={'pcr', 0x3d, 0x9}}, {@defcontext={'defcontext', 0x3d, 'sysadm_u'}}]}) stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) lchown(&(0x7f0000000000)='./file0\x00', r0, 0x0) [ 197.763761] 9pnet_fd: Insufficient options for proto=fd [ 197.848751] 9pnet: Could not find request transport: xen [ 197.860477] 9pnet: Could not find request transport: xen [ 200.132391] Bluetooth: hci0: command 0x0406 tx timeout [ 200.132449] Bluetooth: hci3: command 0x0406 tx timeout 14:46:24 executing program 3: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) r4 = dup(r0) r5 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r4, 0xc0189371, &(0x7f0000000700)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) r7 = dup2(r2, r5) r8 = fspick(r6, &(0x7f0000000740)='./file0\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r7, 0xc0189371, &(0x7f0000000780)={{0x1, 0x1, 0x18, r8}, './file0\x00'}) sendmsg$NL80211_CMD_DISASSOCIATE(r2, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x30, 0x0, 0x400, 0x70bd25, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_LOCAL_STATE_CHANGE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@broadcast}]}, 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0xc000) sendmsg$NL80211_CMD_SET_MAC_ACL(r4, &(0x7f0000000a00)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000900)={0x94, 0x0, 0x100, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @val={0xc, 0x99, {0x7fffffff, 0x2f}}}}, [@NL80211_ATTR_ACL_POLICY={0x8}, @NL80211_ATTR_MAC_ADDRS={0x4c, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}, {0xa}, {0xa, 0x6, @broadcast}, {0xa, 0x6, @device_b}, {0xa, 0x6, @device_b}, {0xa}]}, @NL80211_ATTR_ACL_POLICY={0x8}, @NL80211_ATTR_MAC_ADDRS={0x10, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x4}, 0x800) ioctl$CDROMEJECT(r9, 0x5309) 14:46:24 executing program 4: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) setxattr$security_selinux(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0), &(0x7f0000000800)='system_u:object_r:shell_exec_t:s0\x00', 0x22, 0x2) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0xf0f1e000) setxattr$security_capability(&(0x7f0000000840)='./file0\x00', &(0x7f0000000880), &(0x7f00000008c0)=@v3={0x3000000, [{0x421e, 0x8001}, {0x6, 0x7}], 0xee01}, 0x18, 0x3) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000900)={"7f6d1f508aa7a78b4903735cf6ee0d94", 0x0, 0x0, {0x6, 0x8}, {0x9f4, 0x9}, 0x1f, [0xfcd, 0x8, 0x5, 0x3, 0x6, 0x5, 0x40, 0xffff, 0x2, 0x1, 0x6, 0x7fff, 0xc0, 0x3, 0x3]}) r2 = socket$netlink(0x10, 0x3, 0xa) ioctl$BTRFS_IOC_SCRUB(r2, 0xc400941b, &(0x7f0000000a00)={0x0, 0x689, 0x4, 0x1}) r3 = openat$incfs(r1, &(0x7f0000000e00)='.pending_reads\x00', 0x22000, 0x1c8) renameat(r3, &(0x7f0000000e40)='./file0\x00', r1, &(0x7f0000000e80)='./file0\x00') ioctl$AUTOFS_DEV_IOCTL_READY(r3, 0xc0189376, 0xfffffffffffffffe) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f00), r1) sendmsg$NL80211_CMD_SET_MAC_ACL(r3, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0x10, 0x0, 0x0, 0x1100000}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f40)={0x1c, r4, 0x200, 0x70bd2c, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_ACL_POLICY={0x8, 0xa5, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x880) syz_open_dev$mouse(&(0x7f0000001000), 0x1, 0x4181) mount$9p_xen(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x1804003, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}, {@cache_loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) 14:46:24 executing program 2: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) setxattr$security_selinux(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0), &(0x7f0000000800)='system_u:object_r:shell_exec_t:s0\x00', 0x22, 0x2) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0xf0f1e000) setxattr$security_capability(&(0x7f0000000840)='./file0\x00', &(0x7f0000000880), &(0x7f00000008c0)=@v3={0x3000000, [{0x421e, 0x8001}, {0x6, 0x7}], 0xee01}, 0x18, 0x3) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000900)={"7f6d1f508aa7a78b4903735cf6ee0d94", 0x0, 0x0, {0x6, 0x8}, {0x9f4, 0x9}, 0x1f, [0xfcd, 0x8, 0x5, 0x3, 0x6, 0x5, 0x40, 0xffff, 0x2, 0x1, 0x6, 0x7fff, 0xc0, 0x3, 0x3]}) r2 = socket$netlink(0x10, 0x3, 0xa) ioctl$BTRFS_IOC_SCRUB(r2, 0xc400941b, &(0x7f0000000a00)={0x0, 0x689, 0x4, 0x1}) r3 = openat$incfs(r1, &(0x7f0000000e00)='.pending_reads\x00', 0x22000, 0x1c8) renameat(r3, &(0x7f0000000e40)='./file0\x00', r1, &(0x7f0000000e80)='./file0\x00') ioctl$AUTOFS_DEV_IOCTL_READY(r3, 0xc0189376, 0xfffffffffffffffe) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f00), r1) sendmsg$NL80211_CMD_SET_MAC_ACL(r3, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0x10, 0x0, 0x0, 0x1100000}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f40)={0x1c, r4, 0x200, 0x70bd2c, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_ACL_POLICY={0x8, 0xa5, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x880) syz_open_dev$mouse(&(0x7f0000001000), 0x1, 0x4181) mount$9p_xen(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x1804003, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}, {@cache_loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) 14:46:24 executing program 7: r0 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) keyctl$invalidate(0x15, r0) r1 = add_key$fscrypt_provisioning(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)={0x0, 0x0, @auto=[0x17]}, 0x9, r0) r2 = request_key(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)='-)\\${\\\\\x17\'%&][@\x7f#[,\x00', 0xfffffffffffffff9) r3 = add_key(&(0x7f0000000240)='id_legacy\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="47b91d59f63be3ffd728f1da32a417d6229b5f5355f72eacd94dde9dc2d83701375ffebf14ac11d548e515", 0x2b, 0xfffffffffffffffc) keyctl$KEYCTL_MOVE(0x1e, r1, r2, r3, 0x0) request_key(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={'syz', 0x1}, &(0x7f0000000380)='id_legacy\x00', r3) r4 = request_key(&(0x7f00000003c0)='cifs.idmap\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000440)='/\x8fy){/(@\x00', r2) r5 = request_key(&(0x7f0000000480)='syzkaller\x00', &(0x7f00000004c0)={'syz', 0x0}, &(0x7f0000000500)='\x00', 0xfffffffffffffffb) keyctl$describe(0x6, r5, &(0x7f0000000540), 0x0) r6 = add_key$keyring(&(0x7f0000000640), &(0x7f0000000680)={'syz', 0x3}, 0x0, 0x0, r3) r7 = request_key(&(0x7f0000000580)='keyring\x00', &(0x7f00000005c0)={'syz', 0x3}, &(0x7f0000000600)='{%^#]*\x00', r6) add_key$keyring(&(0x7f00000006c0), &(0x7f0000000700)={'syz', 0x3}, 0x0, 0x0, r2) r8 = add_key$fscrypt_v1(&(0x7f0000000740), &(0x7f0000000780)={'fscrypt:', @desc1}, &(0x7f00000007c0)={0x0, "1a61b170aa2e74fa2e2a58b75a62ed60ed4c0d5f2da48478b7926a7387aff5957112b698943a3a974513d87e02845c385f49f39c58dd3836a95d1b9608ab57c6", 0x15}, 0x48, r0) r9 = add_key(&(0x7f0000000840)='dns_resolver\x00', &(0x7f0000000880)={'syz', 0x0}, &(0x7f00000008c0)="b7e87711369e4d18ad73a277c2aefd84d885ee8eb2cc7c6a1d6e5a230ee77d9fe4c35454ae3ca9dd55f8e002c51506a84304535f", 0x34, 0xfffffffffffffff8) keyctl$KEYCTL_MOVE(0x1e, r8, r7, r9, 0x1) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', r4) add_key(&(0x7f00000009c0)='cifs.idmap\x00', &(0x7f0000000a00)={'syz', 0x1}, 0x0, 0x0, r7) 14:46:24 executing program 5: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r2, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', &(0x7f0000001d80)={{}, {0x1, 0x2}, [{0x2, 0x2, 0xffffffffffffffff}, {0x2, 0x1, r3}, {0x2, 0x3, 0xee01}, {0x2, 0x6}, {0x2, 0x1, r4}, {}, {0x2, 0x0, r6}], {}, [{0x8, 0x1, 0xee00}, {0x8, 0x4, 0xffffffffffffffff}, {0x8, 0x2, 0xffffffffffffffff}], {}, {0x20, 0x2}}, 0x74, 0x1) mkdir(&(0x7f0000001e00)='./file1\x00', 0x1a) fsetxattr$trusted_overlay_redirect(r2, &(0x7f0000001e40), &(0x7f0000001e80)='./file1/file0\x00', 0xe, 0x3) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001f00), r0) sendmsg$NL80211_CMD_TDLS_MGMT(r0, &(0x7f0000001fc0)={&(0x7f0000001ec0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001f80)={&(0x7f0000001f40)={0x2c, r7, 0x100, 0x70bd25, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000090}, 0x4001800) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) fstat(r1, &(0x7f0000002100)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {'rfdno', 0x3d, r8}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid={'access', 0x3d, r6}}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid={'dfltuid', 0x3d, r9}}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid={'dfltgid', 0x3d, r5}}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt={'euid>', r3}}, {@fowner_eq={'fowner', 0x3d, r3}}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) ioctl$BTRFS_IOC_DEFRAG_RANGE(r1, 0x40309410, &(0x7f0000002300)={0x3, 0x3, 0x0, 0x4, 0x1, [0x9, 0x2, 0x3b55, 0x9]}) ioctl$EXT4_IOC_GETSTATE(r0, 0x40046629, &(0x7f0000002340)) 14:46:24 executing program 0: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r2, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', &(0x7f0000001d80)={{}, {0x1, 0x2}, [{0x2, 0x2, 0xffffffffffffffff}, {0x2, 0x1, r3}, {0x2, 0x3, 0xee01}, {0x2, 0x6}, {0x2, 0x1, r4}, {}, {0x2, 0x0, r6}], {}, [{0x8, 0x1, 0xee00}, {0x8, 0x4, 0xffffffffffffffff}, {0x8, 0x2, 0xffffffffffffffff}], {}, {0x20, 0x2}}, 0x74, 0x1) mkdir(&(0x7f0000001e00)='./file1\x00', 0x1a) fsetxattr$trusted_overlay_redirect(r2, &(0x7f0000001e40), &(0x7f0000001e80)='./file1/file0\x00', 0xe, 0x3) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001f00), r0) sendmsg$NL80211_CMD_TDLS_MGMT(r0, &(0x7f0000001fc0)={&(0x7f0000001ec0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001f80)={&(0x7f0000001f40)={0x2c, r7, 0x100, 0x70bd25, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000090}, 0x4001800) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) fstat(r1, &(0x7f0000002100)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {'rfdno', 0x3d, r8}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid={'access', 0x3d, r6}}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid={'dfltuid', 0x3d, r9}}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid={'dfltgid', 0x3d, r5}}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt={'euid>', r3}}, {@fowner_eq={'fowner', 0x3d, r3}}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) ioctl$BTRFS_IOC_DEFRAG_RANGE(r1, 0x40309410, &(0x7f0000002300)={0x3, 0x3, 0x0, 0x4, 0x1, [0x9, 0x2, 0x3b55, 0x9]}) ioctl$EXT4_IOC_GETSTATE(r0, 0x40046629, &(0x7f0000002340)) 14:46:24 executing program 6: syz_mount_image$ext4(&(0x7f0000000140)='ext2\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x1, &(0x7f0000001480)=[{&(0x7f00000001c0)="12b46d6821e2b9780a4eef2b83e62fd8903b5db787ada822637a7a58c9", 0x1d, 0xffffffffffff7fff}], 0x2008002, &(0x7f0000001500)={[{@minixdf}, {@quota}, {@resuid={'resuid', 0x3d, 0xee01}}, {@noacl}, {@prjquota}, {@nodelalloc}, {@nobarrier}, {@orlov}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0xffffffffffffff81}}], [{@permit_directio}, {@uid_eq}, {@smackfshat={'smackfshat', 0x3d, 'ns/ipc\x00'}}, {@subj_role={'subj_role', 0x3d, 'ns/ipc\x00'}}, {@pcr={'pcr', 0x3d, 0x9}}, {@defcontext={'defcontext', 0x3d, 'sysadm_u'}}]}) stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) lchown(&(0x7f0000000000)='./file0\x00', r0, 0x0) 14:46:24 executing program 1: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) r4 = dup(r0) r5 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r4, 0xc0189371, &(0x7f0000000700)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) r7 = dup2(r2, r5) r8 = fspick(r6, &(0x7f0000000740)='./file0\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r7, 0xc0189371, &(0x7f0000000780)={{0x1, 0x1, 0x18, r8}, './file0\x00'}) [ 211.004637] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 211.008932] loop6: detected capacity change from 0 to 16255 [ 211.011413] loop2: detected capacity change from 0 to 127 [ 211.020306] EXT4-fs: Mount option "noacl" will be removed by 3.5 [ 211.020306] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 211.020306] [ 211.021416] EXT4-fs: Ignoring removed orlov option [ 211.026549] 9pnet_fd: Insufficient options for proto=fd [ 211.027364] ext2: Bad value for 'debug_want_extra_isize' [ 211.036751] 9pnet_fd: Insufficient options for proto=fd [ 211.049064] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 211.067511] loop4: detected capacity change from 0 to 127 14:46:24 executing program 3: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) r4 = dup(r0) r5 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r4, 0xc0189371, &(0x7f0000000700)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) r7 = dup2(r2, r5) r8 = fspick(r6, &(0x7f0000000740)='./file0\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r7, 0xc0189371, &(0x7f0000000780)={{0x1, 0x1, 0x18, r8}, './file0\x00'}) sendmsg$NL80211_CMD_DISASSOCIATE(r2, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x30, 0x0, 0x400, 0x70bd25, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_LOCAL_STATE_CHANGE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@broadcast}]}, 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0xc000) sendmsg$NL80211_CMD_SET_MAC_ACL(r4, &(0x7f0000000a00)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000900)={0x94, 0x0, 0x100, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @val={0xc, 0x99, {0x7fffffff, 0x2f}}}}, [@NL80211_ATTR_ACL_POLICY={0x8}, @NL80211_ATTR_MAC_ADDRS={0x4c, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}, {0xa}, {0xa, 0x6, @broadcast}, {0xa, 0x6, @device_b}, {0xa, 0x6, @device_b}, {0xa}]}, @NL80211_ATTR_ACL_POLICY={0x8}, @NL80211_ATTR_MAC_ADDRS={0x10, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x4}, 0x800) ioctl$CDROMEJECT(r9, 0x5309) 14:46:24 executing program 6: syz_mount_image$ext4(&(0x7f0000000140)='ext2\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x1, &(0x7f0000001480)=[{&(0x7f00000001c0)="12b46d6821e2b9780a4eef2b83e62fd8903b5db787ada822637a7a58c9", 0x1d, 0xffffffffffff7fff}], 0x2008002, &(0x7f0000001500)={[{@minixdf}, {@quota}, {@resuid={'resuid', 0x3d, 0xee01}}, {@noacl}, {@prjquota}, {@nodelalloc}, {@nobarrier}, {@orlov}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0xffffffffffffff81}}], [{@permit_directio}, {@uid_eq}, {@smackfshat={'smackfshat', 0x3d, 'ns/ipc\x00'}}, {@subj_role={'subj_role', 0x3d, 'ns/ipc\x00'}}, {@pcr={'pcr', 0x3d, 0x9}}, {@defcontext={'defcontext', 0x3d, 'sysadm_u'}}]}) setresuid(0x0, 0x0, 0x0) lchown(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) 14:46:24 executing program 5: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r2, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', &(0x7f0000001d80)={{}, {0x1, 0x2}, [{0x2, 0x2, 0xffffffffffffffff}, {0x2, 0x1, r3}, {0x2, 0x3, 0xee01}, {0x2, 0x6}, {0x2, 0x1, r4}, {}, {0x2, 0x0, r6}], {}, [{0x8, 0x1, 0xee00}, {0x8, 0x4, 0xffffffffffffffff}, {0x8, 0x2, 0xffffffffffffffff}], {}, {0x20, 0x2}}, 0x74, 0x1) mkdir(&(0x7f0000001e00)='./file1\x00', 0x1a) fsetxattr$trusted_overlay_redirect(r2, &(0x7f0000001e40), &(0x7f0000001e80)='./file1/file0\x00', 0xe, 0x3) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001f00), r0) sendmsg$NL80211_CMD_TDLS_MGMT(r0, &(0x7f0000001fc0)={&(0x7f0000001ec0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001f80)={&(0x7f0000001f40)={0x2c, r7, 0x100, 0x70bd25, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000090}, 0x4001800) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) fstat(r1, &(0x7f0000002100)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {'rfdno', 0x3d, r8}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid={'access', 0x3d, r6}}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid={'dfltuid', 0x3d, r9}}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid={'dfltgid', 0x3d, r5}}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt={'euid>', r3}}, {@fowner_eq={'fowner', 0x3d, r3}}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) ioctl$BTRFS_IOC_DEFRAG_RANGE(r1, 0x40309410, &(0x7f0000002300)={0x3, 0x3, 0x0, 0x4, 0x1, [0x9, 0x2, 0x3b55, 0x9]}) 14:46:25 executing program 0: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r2, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', &(0x7f0000001d80)={{}, {0x1, 0x2}, [{0x2, 0x2, 0xffffffffffffffff}, {0x2, 0x1, r3}, {0x2, 0x3, 0xee01}, {0x2, 0x6}, {0x2, 0x1, r4}, {}, {0x2, 0x0, r6}], {}, [{0x8, 0x1, 0xee00}, {0x8, 0x4, 0xffffffffffffffff}, {0x8, 0x2, 0xffffffffffffffff}], {}, {0x20, 0x2}}, 0x74, 0x1) mkdir(&(0x7f0000001e00)='./file1\x00', 0x1a) fsetxattr$trusted_overlay_redirect(r2, &(0x7f0000001e40), &(0x7f0000001e80)='./file1/file0\x00', 0xe, 0x3) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001f00), r0) sendmsg$NL80211_CMD_TDLS_MGMT(r0, &(0x7f0000001fc0)={&(0x7f0000001ec0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001f80)={&(0x7f0000001f40)={0x2c, r7, 0x100, 0x70bd25, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000090}, 0x4001800) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) fstat(r1, &(0x7f0000002100)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {'rfdno', 0x3d, r8}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid={'access', 0x3d, r6}}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid={'dfltuid', 0x3d, r9}}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid={'dfltgid', 0x3d, r5}}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt={'euid>', r3}}, {@fowner_eq={'fowner', 0x3d, r3}}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) ioctl$BTRFS_IOC_DEFRAG_RANGE(r1, 0x40309410, &(0x7f0000002300)={0x3, 0x3, 0x0, 0x4, 0x1, [0x9, 0x2, 0x3b55, 0x9]}) 14:46:25 executing program 7: r0 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) keyctl$invalidate(0x15, r0) r1 = add_key$fscrypt_provisioning(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)={0x0, 0x0, @auto=[0x17]}, 0x9, r0) r2 = request_key(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)='-)\\${\\\\\x17\'%&][@\x7f#[,\x00', 0xfffffffffffffff9) r3 = add_key(&(0x7f0000000240)='id_legacy\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="47b91d59f63be3ffd728f1da32a417d6229b5f5355f72eacd94dde9dc2d83701375ffebf14ac11d548e515", 0x2b, 0xfffffffffffffffc) keyctl$KEYCTL_MOVE(0x1e, r1, r2, r3, 0x0) request_key(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={'syz', 0x1}, &(0x7f0000000380)='id_legacy\x00', r3) r4 = request_key(&(0x7f00000003c0)='cifs.idmap\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000440)='/\x8fy){/(@\x00', r2) r5 = request_key(&(0x7f0000000480)='syzkaller\x00', &(0x7f00000004c0)={'syz', 0x0}, &(0x7f0000000500)='\x00', 0xfffffffffffffffb) keyctl$describe(0x6, r5, &(0x7f0000000540), 0x0) r6 = add_key$keyring(&(0x7f0000000640), &(0x7f0000000680)={'syz', 0x3}, 0x0, 0x0, r3) r7 = request_key(&(0x7f0000000580)='keyring\x00', &(0x7f00000005c0)={'syz', 0x3}, &(0x7f0000000600)='{%^#]*\x00', r6) add_key$keyring(&(0x7f00000006c0), &(0x7f0000000700)={'syz', 0x3}, 0x0, 0x0, r2) r8 = add_key$fscrypt_v1(&(0x7f0000000740), &(0x7f0000000780)={'fscrypt:', @desc1}, &(0x7f00000007c0)={0x0, "1a61b170aa2e74fa2e2a58b75a62ed60ed4c0d5f2da48478b7926a7387aff5957112b698943a3a974513d87e02845c385f49f39c58dd3836a95d1b9608ab57c6", 0x15}, 0x48, r0) r9 = add_key(&(0x7f0000000840)='dns_resolver\x00', &(0x7f0000000880)={'syz', 0x0}, &(0x7f00000008c0)="b7e87711369e4d18ad73a277c2aefd84d885ee8eb2cc7c6a1d6e5a230ee77d9fe4c35454ae3ca9dd55f8e002c51506a84304535f", 0x34, 0xfffffffffffffff8) keyctl$KEYCTL_MOVE(0x1e, r8, r7, r9, 0x1) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', r4) [ 211.166111] loop6: detected capacity change from 0 to 16255 [ 211.184963] 9pnet_fd: Insufficient options for proto=fd [ 211.188666] 9pnet_fd: Insufficient options for proto=fd [ 211.195381] EXT4-fs: Mount option "noacl" will be removed by 3.5 [ 211.195381] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 211.195381] [ 211.197949] EXT4-fs: Ignoring removed orlov option 14:46:25 executing program 1: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) r4 = dup(r0) r5 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r4, 0xc0189371, &(0x7f0000000700)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) dup2(r2, r5) fspick(r6, &(0x7f0000000740)='./file0\x00', 0x0) [ 211.230000] ext2: Bad value for 'debug_want_extra_isize' [ 211.281690] 9pnet: Could not find request transport: xen [ 211.350339] 9pnet: Could not find request transport: xen [ 212.420449] Bluetooth: hci2: command 0x0406 tx timeout 14:46:36 executing program 4: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) setxattr$security_selinux(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0), &(0x7f0000000800)='system_u:object_r:shell_exec_t:s0\x00', 0x22, 0x2) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0xf0f1e000) setxattr$security_capability(&(0x7f0000000840)='./file0\x00', &(0x7f0000000880), &(0x7f00000008c0)=@v3={0x3000000, [{0x421e, 0x8001}, {0x6, 0x7}], 0xee01}, 0x18, 0x3) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000900)={"7f6d1f508aa7a78b4903735cf6ee0d94", 0x0, 0x0, {0x6, 0x8}, {0x9f4, 0x9}, 0x1f, [0xfcd, 0x8, 0x5, 0x3, 0x6, 0x5, 0x40, 0xffff, 0x2, 0x1, 0x6, 0x7fff, 0xc0, 0x3, 0x3]}) r2 = socket$netlink(0x10, 0x3, 0xa) ioctl$BTRFS_IOC_SCRUB(r2, 0xc400941b, &(0x7f0000000a00)={0x0, 0x689, 0x4, 0x1}) r3 = openat$incfs(r1, &(0x7f0000000e00)='.pending_reads\x00', 0x22000, 0x1c8) renameat(r3, &(0x7f0000000e40)='./file0\x00', r1, &(0x7f0000000e80)='./file0\x00') ioctl$AUTOFS_DEV_IOCTL_READY(r3, 0xc0189376, 0xfffffffffffffffe) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f00), r1) sendmsg$NL80211_CMD_SET_MAC_ACL(r3, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0x10, 0x0, 0x0, 0x1100000}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f40)={0x1c, r4, 0x200, 0x70bd2c, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_ACL_POLICY={0x8, 0xa5, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x880) mount$9p_xen(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x1804003, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}, {@cache_loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) 14:46:36 executing program 3: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) r4 = dup(r0) r5 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r4, 0xc0189371, &(0x7f0000000700)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) r7 = dup2(r2, r5) r8 = fspick(r6, &(0x7f0000000740)='./file0\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r7, 0xc0189371, &(0x7f0000000780)={{0x1, 0x1, 0x18, r8}, './file0\x00'}) sendmsg$NL80211_CMD_DISASSOCIATE(r2, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x30, 0x0, 0x400, 0x70bd25, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_LOCAL_STATE_CHANGE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@broadcast}]}, 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0xc000) sendmsg$NL80211_CMD_SET_MAC_ACL(r4, &(0x7f0000000a00)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000900)={0x94, 0x0, 0x100, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @val={0xc, 0x99, {0x7fffffff, 0x2f}}}}, [@NL80211_ATTR_ACL_POLICY={0x8}, @NL80211_ATTR_MAC_ADDRS={0x4c, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}, {0xa}, {0xa, 0x6, @broadcast}, {0xa, 0x6, @device_b}, {0xa, 0x6, @device_b}, {0xa}]}, @NL80211_ATTR_ACL_POLICY={0x8}, @NL80211_ATTR_MAC_ADDRS={0x10, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x4}, 0x800) 14:46:36 executing program 1: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) r4 = dup(r0) r5 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r4, 0xc0189371, &(0x7f0000000700)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) dup2(r2, r5) 14:46:36 executing program 5: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r2, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', &(0x7f0000001d80)={{}, {0x1, 0x2}, [{0x2, 0x2, 0xffffffffffffffff}, {0x2, 0x1, r3}, {0x2, 0x3, 0xee01}, {0x2, 0x6}, {0x2, 0x1, r4}, {}, {0x2, 0x0, r6}], {}, [{0x8, 0x1, 0xee00}, {0x8, 0x4, 0xffffffffffffffff}, {0x8, 0x2, 0xffffffffffffffff}], {}, {0x20, 0x2}}, 0x74, 0x1) mkdir(&(0x7f0000001e00)='./file1\x00', 0x1a) fsetxattr$trusted_overlay_redirect(r2, &(0x7f0000001e40), &(0x7f0000001e80)='./file1/file0\x00', 0xe, 0x3) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001f00), r0) sendmsg$NL80211_CMD_TDLS_MGMT(r0, &(0x7f0000001fc0)={&(0x7f0000001ec0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001f80)={&(0x7f0000001f40)={0x2c, r7, 0x100, 0x70bd25, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000090}, 0x4001800) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) fstat(r1, &(0x7f0000002100)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {'rfdno', 0x3d, r8}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid={'access', 0x3d, r6}}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid={'dfltuid', 0x3d, r9}}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid={'dfltgid', 0x3d, r5}}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt={'euid>', r3}}, {@fowner_eq={'fowner', 0x3d, r3}}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:46:36 executing program 0: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r2, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', &(0x7f0000001d80)={{}, {0x1, 0x2}, [{0x2, 0x2, 0xffffffffffffffff}, {0x2, 0x1, r3}, {0x2, 0x3, 0xee01}, {0x2, 0x6}, {0x2, 0x1, r4}, {}, {0x2, 0x0, r6}], {}, [{0x8, 0x1, 0xee00}, {0x8, 0x4, 0xffffffffffffffff}, {0x8, 0x2, 0xffffffffffffffff}], {}, {0x20, 0x2}}, 0x74, 0x1) mkdir(&(0x7f0000001e00)='./file1\x00', 0x1a) fsetxattr$trusted_overlay_redirect(r2, &(0x7f0000001e40), &(0x7f0000001e80)='./file1/file0\x00', 0xe, 0x3) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001f00), r0) sendmsg$NL80211_CMD_TDLS_MGMT(r0, &(0x7f0000001fc0)={&(0x7f0000001ec0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001f80)={&(0x7f0000001f40)={0x2c, r7, 0x100, 0x70bd25, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000090}, 0x4001800) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) fstat(r1, &(0x7f0000002100)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {'rfdno', 0x3d, r8}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid={'access', 0x3d, r6}}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid={'dfltuid', 0x3d, r9}}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid={'dfltgid', 0x3d, r5}}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt={'euid>', r3}}, {@fowner_eq={'fowner', 0x3d, r3}}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:46:36 executing program 7: r0 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) keyctl$invalidate(0x15, r0) r1 = add_key$fscrypt_provisioning(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)={0x0, 0x0, @auto=[0x17]}, 0x9, r0) r2 = request_key(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)='-)\\${\\\\\x17\'%&][@\x7f#[,\x00', 0xfffffffffffffff9) r3 = add_key(&(0x7f0000000240)='id_legacy\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="47b91d59f63be3ffd728f1da32a417d6229b5f5355f72eacd94dde9dc2d83701375ffebf14ac11d548e515", 0x2b, 0xfffffffffffffffc) keyctl$KEYCTL_MOVE(0x1e, r1, r2, r3, 0x0) request_key(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={'syz', 0x1}, &(0x7f0000000380)='id_legacy\x00', r3) request_key(&(0x7f00000003c0)='cifs.idmap\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000440)='/\x8fy){/(@\x00', r2) r4 = request_key(&(0x7f0000000480)='syzkaller\x00', &(0x7f00000004c0)={'syz', 0x0}, &(0x7f0000000500)='\x00', 0xfffffffffffffffb) keyctl$describe(0x6, r4, &(0x7f0000000540), 0x0) r5 = add_key$keyring(&(0x7f0000000640), &(0x7f0000000680)={'syz', 0x3}, 0x0, 0x0, r3) r6 = request_key(&(0x7f0000000580)='keyring\x00', &(0x7f00000005c0)={'syz', 0x3}, &(0x7f0000000600)='{%^#]*\x00', r5) add_key$keyring(&(0x7f00000006c0), &(0x7f0000000700)={'syz', 0x3}, 0x0, 0x0, r2) r7 = add_key$fscrypt_v1(&(0x7f0000000740), &(0x7f0000000780)={'fscrypt:', @desc1}, &(0x7f00000007c0)={0x0, "1a61b170aa2e74fa2e2a58b75a62ed60ed4c0d5f2da48478b7926a7387aff5957112b698943a3a974513d87e02845c385f49f39c58dd3836a95d1b9608ab57c6", 0x15}, 0x48, r0) r8 = add_key(&(0x7f0000000840)='dns_resolver\x00', &(0x7f0000000880)={'syz', 0x0}, &(0x7f00000008c0)="b7e87711369e4d18ad73a277c2aefd84d885ee8eb2cc7c6a1d6e5a230ee77d9fe4c35454ae3ca9dd55f8e002c51506a84304535f", 0x34, 0xfffffffffffffff8) keyctl$KEYCTL_MOVE(0x1e, r7, r6, r8, 0x1) 14:46:36 executing program 2: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) setxattr$security_selinux(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0), &(0x7f0000000800)='system_u:object_r:shell_exec_t:s0\x00', 0x22, 0x2) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0xf0f1e000) setxattr$security_capability(&(0x7f0000000840)='./file0\x00', &(0x7f0000000880), &(0x7f00000008c0)=@v3={0x3000000, [{0x421e, 0x8001}, {0x6, 0x7}], 0xee01}, 0x18, 0x3) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000900)={"7f6d1f508aa7a78b4903735cf6ee0d94", 0x0, 0x0, {0x6, 0x8}, {0x9f4, 0x9}, 0x1f, [0xfcd, 0x8, 0x5, 0x3, 0x6, 0x5, 0x40, 0xffff, 0x2, 0x1, 0x6, 0x7fff, 0xc0, 0x3, 0x3]}) r2 = socket$netlink(0x10, 0x3, 0xa) ioctl$BTRFS_IOC_SCRUB(r2, 0xc400941b, &(0x7f0000000a00)={0x0, 0x689, 0x4, 0x1}) r3 = openat$incfs(r1, &(0x7f0000000e00)='.pending_reads\x00', 0x22000, 0x1c8) renameat(r3, &(0x7f0000000e40)='./file0\x00', r1, &(0x7f0000000e80)='./file0\x00') ioctl$AUTOFS_DEV_IOCTL_READY(r3, 0xc0189376, 0xfffffffffffffffe) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f00), r1) sendmsg$NL80211_CMD_SET_MAC_ACL(r3, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0x10, 0x0, 0x0, 0x1100000}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f40)={0x1c, r4, 0x200, 0x70bd2c, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_ACL_POLICY={0x8, 0xa5, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x880) syz_open_dev$mouse(&(0x7f0000001000), 0x1, 0x4181) 14:46:36 executing program 6: syz_mount_image$ext4(&(0x7f0000000140)='ext2\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x1, &(0x7f0000001480)=[{&(0x7f00000001c0)="12b46d6821e2b9780a4eef2b83e62fd8903b5db787ada822637a7a58c9", 0x1d, 0xffffffffffff7fff}], 0x2008002, &(0x7f0000001500)={[{@minixdf}, {@quota}, {@resuid={'resuid', 0x3d, 0xee01}}, {@noacl}, {@prjquota}, {@nodelalloc}, {@nobarrier}, {@orlov}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0xffffffffffffff81}}], [{@permit_directio}, {@uid_eq}, {@smackfshat={'smackfshat', 0x3d, 'ns/ipc\x00'}}, {@subj_role={'subj_role', 0x3d, 'ns/ipc\x00'}}, {@pcr={'pcr', 0x3d, 0x9}}, {@defcontext={'defcontext', 0x3d, 'sysadm_u'}}]}) setresuid(0x0, 0x0, 0x0) lchown(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) [ 222.619623] loop6: detected capacity change from 0 to 16255 [ 222.624979] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 222.630304] EXT4-fs: Mount option "noacl" will be removed by 3.5 [ 222.630304] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 222.630304] [ 222.632294] EXT4-fs: Ignoring removed orlov option [ 222.635009] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 222.643373] 9pnet_fd: Insufficient options for proto=fd [ 222.643459] loop2: detected capacity change from 0 to 127 [ 222.645147] ext2: Bad value for 'debug_want_extra_isize' [ 222.647233] 9pnet_fd: Insufficient options for proto=fd [ 222.655810] loop4: detected capacity change from 0 to 127 14:46:36 executing program 7: r0 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) keyctl$invalidate(0x15, r0) r1 = add_key$fscrypt_provisioning(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)={0x0, 0x0, @auto=[0x17]}, 0x9, r0) r2 = request_key(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)='-)\\${\\\\\x17\'%&][@\x7f#[,\x00', 0xfffffffffffffff9) r3 = add_key(&(0x7f0000000240)='id_legacy\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="47b91d59f63be3ffd728f1da32a417d6229b5f5355f72eacd94dde9dc2d83701375ffebf14ac11d548e515", 0x2b, 0xfffffffffffffffc) keyctl$KEYCTL_MOVE(0x1e, r1, r2, r3, 0x0) request_key(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={'syz', 0x1}, &(0x7f0000000380)='id_legacy\x00', r3) request_key(&(0x7f00000003c0)='cifs.idmap\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000440)='/\x8fy){/(@\x00', r2) r4 = request_key(&(0x7f0000000480)='syzkaller\x00', &(0x7f00000004c0)={'syz', 0x0}, &(0x7f0000000500)='\x00', 0xfffffffffffffffb) keyctl$describe(0x6, r4, &(0x7f0000000540), 0x0) r5 = add_key$keyring(&(0x7f0000000640), &(0x7f0000000680)={'syz', 0x3}, 0x0, 0x0, r3) request_key(&(0x7f0000000580)='keyring\x00', &(0x7f00000005c0)={'syz', 0x3}, &(0x7f0000000600)='{%^#]*\x00', r5) add_key$keyring(&(0x7f00000006c0), &(0x7f0000000700)={'syz', 0x3}, 0x0, 0x0, r2) add_key$fscrypt_v1(&(0x7f0000000740), &(0x7f0000000780)={'fscrypt:', @desc1}, &(0x7f00000007c0)={0x0, "1a61b170aa2e74fa2e2a58b75a62ed60ed4c0d5f2da48478b7926a7387aff5957112b698943a3a974513d87e02845c385f49f39c58dd3836a95d1b9608ab57c6", 0x15}, 0x48, r0) add_key(&(0x7f0000000840)='dns_resolver\x00', &(0x7f0000000880)={'syz', 0x0}, &(0x7f00000008c0)="b7e87711369e4d18ad73a277c2aefd84d885ee8eb2cc7c6a1d6e5a230ee77d9fe4c35454ae3ca9dd55f8e002c51506a84304535f", 0x34, 0xfffffffffffffff8) 14:46:36 executing program 0: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r2, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', &(0x7f0000001d80)={{}, {0x1, 0x2}, [{0x2, 0x2, 0xffffffffffffffff}, {0x2, 0x1, r3}, {0x2, 0x3, 0xee01}, {0x2, 0x6}, {0x2, 0x1, r4}, {}, {0x2, 0x0, r5}], {}, [{0x8, 0x1, 0xee00}, {0x8, 0x4, 0xffffffffffffffff}, {0x8, 0x2, 0xffffffffffffffff}], {}, {0x20, 0x2}}, 0x74, 0x1) mkdir(&(0x7f0000001e00)='./file1\x00', 0x1a) fsetxattr$trusted_overlay_redirect(r2, &(0x7f0000001e40), &(0x7f0000001e80)='./file1/file0\x00', 0xe, 0x3) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001f00), r0) sendmsg$NL80211_CMD_TDLS_MGMT(r0, &(0x7f0000001fc0)={&(0x7f0000001ec0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001f80)={&(0x7f0000001f40)={0x2c, r6, 0x100, 0x70bd25, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000090}, 0x4001800) open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) fstat(r1, &(0x7f0000002100)) 14:46:36 executing program 1: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) dup(r0) r4 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) dup2(r2, r4) 14:46:36 executing program 5: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r1, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', &(0x7f0000001d80)={{}, {0x1, 0x2}, [{0x2, 0x2, 0xffffffffffffffff}, {0x2, 0x1, r2}, {0x2, 0x3, 0xee01}, {0x2, 0x6}, {0x2, 0x1, r3}, {}, {0x2, 0x0, r5}], {}, [{0x8, 0x1, 0xee00}, {0x8, 0x4, 0xffffffffffffffff}, {0x8, 0x2, 0xffffffffffffffff}], {}, {0x20, 0x2}}, 0x74, 0x1) mkdir(&(0x7f0000001e00)='./file1\x00', 0x1a) fsetxattr$trusted_overlay_redirect(r1, &(0x7f0000001e40), &(0x7f0000001e80)='./file1/file0\x00', 0xe, 0x3) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001f00), r0) sendmsg$NL80211_CMD_TDLS_MGMT(r0, &(0x7f0000001fc0)={&(0x7f0000001ec0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001f80)={&(0x7f0000001f40)={0x2c, r6, 0x100, 0x70bd25, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000090}, 0x4001800) r7 = open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {'rfdno', 0x3d, r7}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid={'access', 0x3d, r5}}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid={'dfltgid', 0x3d, r4}}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt={'euid>', r2}}, {@fowner_eq={'fowner', 0x3d, r2}}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:46:36 executing program 6: syz_mount_image$ext4(&(0x7f0000000140)='ext2\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x1, &(0x7f0000001480)=[{&(0x7f00000001c0)="12b46d6821e2b9780a4eef2b83e62fd8903b5db787ada822637a7a58c9", 0x1d, 0xffffffffffff7fff}], 0x2008002, &(0x7f0000001500)={[{@minixdf}, {@quota}, {@resuid={'resuid', 0x3d, 0xee01}}, {@noacl}, {@prjquota}, {@nodelalloc}, {@nobarrier}, {@orlov}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0xffffffffffffff81}}], [{@permit_directio}, {@uid_eq}, {@smackfshat={'smackfshat', 0x3d, 'ns/ipc\x00'}}, {@subj_role={'subj_role', 0x3d, 'ns/ipc\x00'}}, {@pcr={'pcr', 0x3d, 0x9}}, {@defcontext={'defcontext', 0x3d, 'sysadm_u'}}]}) setresuid(0x0, 0x0, 0x0) lchown(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) 14:46:36 executing program 3: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) r4 = dup(r0) r5 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r4, 0xc0189371, &(0x7f0000000700)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) r7 = dup2(r2, r5) r8 = fspick(r6, &(0x7f0000000740)='./file0\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r7, 0xc0189371, &(0x7f0000000780)={{0x1, 0x1, 0x18, r8}, './file0\x00'}) sendmsg$NL80211_CMD_DISASSOCIATE(r2, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x30, 0x0, 0x400, 0x70bd25, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_LOCAL_STATE_CHANGE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@broadcast}]}, 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0xc000) 14:46:36 executing program 2: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) setxattr$security_selinux(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0), &(0x7f0000000800)='system_u:object_r:shell_exec_t:s0\x00', 0x22, 0x2) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0xf0f1e000) setxattr$security_capability(&(0x7f0000000840)='./file0\x00', &(0x7f0000000880), &(0x7f00000008c0)=@v3={0x3000000, [{0x421e, 0x8001}, {0x6, 0x7}], 0xee01}, 0x18, 0x3) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000900)={"7f6d1f508aa7a78b4903735cf6ee0d94", 0x0, 0x0, {0x6, 0x8}, {0x9f4, 0x9}, 0x1f, [0xfcd, 0x8, 0x5, 0x3, 0x6, 0x5, 0x40, 0xffff, 0x2, 0x1, 0x6, 0x7fff, 0xc0, 0x3, 0x3]}) r2 = socket$netlink(0x10, 0x3, 0xa) ioctl$BTRFS_IOC_SCRUB(r2, 0xc400941b, &(0x7f0000000a00)={0x0, 0x689, 0x4, 0x1}) r3 = openat$incfs(r1, &(0x7f0000000e00)='.pending_reads\x00', 0x22000, 0x1c8) renameat(r3, &(0x7f0000000e40)='./file0\x00', r1, &(0x7f0000000e80)='./file0\x00') ioctl$AUTOFS_DEV_IOCTL_READY(r3, 0xc0189376, 0xfffffffffffffffe) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f00), r1) sendmsg$NL80211_CMD_SET_MAC_ACL(r3, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0x10, 0x0, 0x0, 0x1100000}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f40)={0x1c, r4, 0x200, 0x70bd2c, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_ACL_POLICY={0x8, 0xa5, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x880) [ 222.891398] loop6: detected capacity change from 0 to 16255 [ 222.897563] EXT4-fs: Mount option "noacl" will be removed by 3.5 [ 222.897563] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 222.897563] [ 222.899594] EXT4-fs: Ignoring removed orlov option [ 222.904461] 9pnet_fd: Insufficient options for proto=fd [ 222.905432] 9pnet: Could not find request transport: xen [ 222.906527] ext2: Bad value for 'debug_want_extra_isize' 14:46:36 executing program 7: r0 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) keyctl$invalidate(0x15, r0) r1 = add_key$fscrypt_provisioning(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)={0x0, 0x0, @auto=[0x17]}, 0x9, r0) r2 = request_key(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)='-)\\${\\\\\x17\'%&][@\x7f#[,\x00', 0xfffffffffffffff9) r3 = add_key(&(0x7f0000000240)='id_legacy\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="47b91d59f63be3ffd728f1da32a417d6229b5f5355f72eacd94dde9dc2d83701375ffebf14ac11d548e515", 0x2b, 0xfffffffffffffffc) keyctl$KEYCTL_MOVE(0x1e, r1, r2, r3, 0x0) request_key(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={'syz', 0x1}, &(0x7f0000000380)='id_legacy\x00', r3) request_key(&(0x7f00000003c0)='cifs.idmap\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000440)='/\x8fy){/(@\x00', r2) r4 = request_key(&(0x7f0000000480)='syzkaller\x00', &(0x7f00000004c0)={'syz', 0x0}, &(0x7f0000000500)='\x00', 0xfffffffffffffffb) keyctl$describe(0x6, r4, &(0x7f0000000540), 0x0) r5 = add_key$keyring(&(0x7f0000000640), &(0x7f0000000680)={'syz', 0x3}, 0x0, 0x0, r3) request_key(&(0x7f0000000580)='keyring\x00', &(0x7f00000005c0)={'syz', 0x3}, &(0x7f0000000600)='{%^#]*\x00', r5) add_key$keyring(&(0x7f00000006c0), &(0x7f0000000700)={'syz', 0x3}, 0x0, 0x0, r2) add_key$fscrypt_v1(&(0x7f0000000740), &(0x7f0000000780)={'fscrypt:', @desc1}, &(0x7f00000007c0)={0x0, "1a61b170aa2e74fa2e2a58b75a62ed60ed4c0d5f2da48478b7926a7387aff5957112b698943a3a974513d87e02845c385f49f39c58dd3836a95d1b9608ab57c6", 0x15}, 0x48, r0) [ 222.981951] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 223.010903] loop2: detected capacity change from 0 to 127 14:46:49 executing program 7: r0 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) keyctl$invalidate(0x15, r0) r1 = add_key$fscrypt_provisioning(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)={0x0, 0x0, @auto=[0x17]}, 0x9, r0) r2 = request_key(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)='-)\\${\\\\\x17\'%&][@\x7f#[,\x00', 0xfffffffffffffff9) r3 = add_key(&(0x7f0000000240)='id_legacy\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="47b91d59f63be3ffd728f1da32a417d6229b5f5355f72eacd94dde9dc2d83701375ffebf14ac11d548e515", 0x2b, 0xfffffffffffffffc) keyctl$KEYCTL_MOVE(0x1e, r1, r2, r3, 0x0) request_key(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={'syz', 0x1}, &(0x7f0000000380)='id_legacy\x00', r3) request_key(&(0x7f00000003c0)='cifs.idmap\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000440)='/\x8fy){/(@\x00', r2) r4 = request_key(&(0x7f0000000480)='syzkaller\x00', &(0x7f00000004c0)={'syz', 0x0}, &(0x7f0000000500)='\x00', 0xfffffffffffffffb) keyctl$describe(0x6, r4, &(0x7f0000000540), 0x0) r5 = add_key$keyring(&(0x7f0000000640), &(0x7f0000000680)={'syz', 0x3}, 0x0, 0x0, r3) request_key(&(0x7f0000000580)='keyring\x00', &(0x7f00000005c0)={'syz', 0x3}, &(0x7f0000000600)='{%^#]*\x00', r5) add_key$keyring(&(0x7f00000006c0), &(0x7f0000000700)={'syz', 0x3}, 0x0, 0x0, r2) 14:46:49 executing program 1: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) dup(r0) dup2(r2, 0xffffffffffffffff) 14:46:49 executing program 2: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) setxattr$security_selinux(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0), &(0x7f0000000800)='system_u:object_r:shell_exec_t:s0\x00', 0x22, 0x2) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0xf0f1e000) setxattr$security_capability(&(0x7f0000000840)='./file0\x00', &(0x7f0000000880), &(0x7f00000008c0)=@v3={0x3000000, [{0x421e, 0x8001}, {0x6, 0x7}], 0xee01}, 0x18, 0x3) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000900)={"7f6d1f508aa7a78b4903735cf6ee0d94", 0x0, 0x0, {0x6, 0x8}, {0x9f4, 0x9}, 0x1f, [0xfcd, 0x8, 0x5, 0x3, 0x6, 0x5, 0x40, 0xffff, 0x2, 0x1, 0x6, 0x7fff, 0xc0, 0x3, 0x3]}) r2 = socket$netlink(0x10, 0x3, 0xa) ioctl$BTRFS_IOC_SCRUB(r2, 0xc400941b, &(0x7f0000000a00)={0x0, 0x689, 0x4, 0x1}) r3 = openat$incfs(r1, &(0x7f0000000e00)='.pending_reads\x00', 0x22000, 0x1c8) renameat(r3, &(0x7f0000000e40)='./file0\x00', r1, &(0x7f0000000e80)='./file0\x00') ioctl$AUTOFS_DEV_IOCTL_READY(r3, 0xc0189376, 0xfffffffffffffffe) syz_genetlink_get_family_id$nl80211(&(0x7f0000000f00), r1) 14:46:49 executing program 4: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) setxattr$security_selinux(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0), &(0x7f0000000800)='system_u:object_r:shell_exec_t:s0\x00', 0x22, 0x2) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0xf0f1e000) setxattr$security_capability(&(0x7f0000000840)='./file0\x00', &(0x7f0000000880), &(0x7f00000008c0)=@v3={0x3000000, [{0x421e, 0x8001}, {0x6, 0x7}], 0xee01}, 0x18, 0x3) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000900)={"7f6d1f508aa7a78b4903735cf6ee0d94", 0x0, 0x0, {0x6, 0x8}, {0x9f4, 0x9}, 0x1f, [0xfcd, 0x8, 0x5, 0x3, 0x6, 0x5, 0x40, 0xffff, 0x2, 0x1, 0x6, 0x7fff, 0xc0, 0x3, 0x3]}) r2 = socket$netlink(0x10, 0x3, 0xa) ioctl$BTRFS_IOC_SCRUB(r2, 0xc400941b, &(0x7f0000000a00)={0x0, 0x689, 0x4, 0x1}) r3 = openat$incfs(r1, &(0x7f0000000e00)='.pending_reads\x00', 0x22000, 0x1c8) renameat(r3, &(0x7f0000000e40)='./file0\x00', r1, &(0x7f0000000e80)='./file0\x00') ioctl$AUTOFS_DEV_IOCTL_READY(r3, 0xc0189376, 0xfffffffffffffffe) syz_genetlink_get_family_id$nl80211(&(0x7f0000000f00), r1) mount$9p_xen(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x1804003, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}, {@cache_loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) 14:46:49 executing program 0: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r1, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', &(0x7f0000001d80)={{}, {0x1, 0x2}, [{0x2, 0x2, 0xffffffffffffffff}, {0x2, 0x1, r2}, {0x2, 0x3, 0xee01}, {0x2, 0x6}, {0x2, 0x1, r3}, {}, {0x2, 0x0, r4}], {}, [{0x8, 0x1, 0xee00}, {0x8, 0x4, 0xffffffffffffffff}, {0x8, 0x2, 0xffffffffffffffff}], {}, {0x20, 0x2}}, 0x74, 0x1) mkdir(&(0x7f0000001e00)='./file1\x00', 0x1a) fsetxattr$trusted_overlay_redirect(r1, &(0x7f0000001e40), &(0x7f0000001e80)='./file1/file0\x00', 0xe, 0x3) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001f00), r0) sendmsg$NL80211_CMD_TDLS_MGMT(r0, &(0x7f0000001fc0)={&(0x7f0000001ec0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001f80)={&(0x7f0000001f40)={0x2c, r5, 0x100, 0x70bd25, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000090}, 0x4001800) open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) 14:46:49 executing program 3: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) r4 = dup(r0) r5 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r4, 0xc0189371, &(0x7f0000000700)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) r7 = dup2(r2, r5) r8 = fspick(r6, &(0x7f0000000740)='./file0\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r7, 0xc0189371, &(0x7f0000000780)={{0x1, 0x1, 0x18, r8}, './file0\x00'}) sendmsg$NL80211_CMD_DISASSOCIATE(r2, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x30, 0x0, 0x400, 0x70bd25, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_LOCAL_STATE_CHANGE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@broadcast}]}, 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0xc000) 14:46:49 executing program 6: stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) setresuid(0x0, r0, 0x0) lchown(&(0x7f0000000000)='./file0\x00', r0, 0x0) 14:46:49 executing program 5: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r1, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', &(0x7f0000001d80)={{}, {0x1, 0x2}, [{0x2, 0x2, 0xffffffffffffffff}, {0x2, 0x1, r2}, {0x2, 0x3, 0xee01}, {0x2, 0x6}, {0x2, 0x1, r3}, {}, {0x2, 0x0, r5}], {}, [{0x8, 0x1, 0xee00}, {0x8, 0x4, 0xffffffffffffffff}, {0x8, 0x2, 0xffffffffffffffff}], {}, {0x20, 0x2}}, 0x74, 0x1) mkdir(&(0x7f0000001e00)='./file1\x00', 0x1a) fsetxattr$trusted_overlay_redirect(r1, &(0x7f0000001e40), &(0x7f0000001e80)='./file1/file0\x00', 0xe, 0x3) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001f00), r0) sendmsg$NL80211_CMD_TDLS_MGMT(r0, &(0x7f0000001fc0)={&(0x7f0000001ec0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001f80)={&(0x7f0000001f40)={0x2c, r6, 0x100, 0x70bd25, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000090}, 0x4001800) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid={'access', 0x3d, r5}}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid={'dfltgid', 0x3d, r4}}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt={'euid>', r2}}, {@fowner_eq={'fowner', 0x3d, r2}}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) [ 235.696356] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 235.698579] 9pnet_fd: Insufficient options for proto=fd [ 235.703727] loop4: detected capacity change from 0 to 127 [ 235.727919] tmpfs: Unknown parameter 'uid<00000000000000060929' 14:46:49 executing program 1: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) dup(r0) dup2(r2, 0xffffffffffffffff) [ 235.743882] loop2: detected capacity change from 0 to 127 14:46:49 executing program 5: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r1, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', &(0x7f0000001d80)={{}, {0x1, 0x2}, [{0x2, 0x2, 0xffffffffffffffff}, {0x2, 0x1, r2}, {0x2, 0x3, 0xee01}, {0x2, 0x6}, {0x2, 0x1, r3}, {}, {0x2, 0x0, r5}], {}, [{0x8, 0x1, 0xee00}, {0x8, 0x4, 0xffffffffffffffff}, {0x8, 0x2, 0xffffffffffffffff}], {}, {0x20, 0x2}}, 0x74, 0x1) mkdir(&(0x7f0000001e00)='./file1\x00', 0x1a) fsetxattr$trusted_overlay_redirect(r1, &(0x7f0000001e40), &(0x7f0000001e80)='./file1/file0\x00', 0xe, 0x3) syz_genetlink_get_family_id$nl80211(&(0x7f0000001f00), r0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid={'access', 0x3d, r5}}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid={'dfltgid', 0x3d, r4}}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt={'euid>', r2}}, {@fowner_eq={'fowner', 0x3d, r2}}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:46:49 executing program 7: r0 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) keyctl$invalidate(0x15, r0) r1 = add_key$fscrypt_provisioning(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)={0x0, 0x0, @auto=[0x17]}, 0x9, r0) r2 = request_key(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)='-)\\${\\\\\x17\'%&][@\x7f#[,\x00', 0xfffffffffffffff9) r3 = add_key(&(0x7f0000000240)='id_legacy\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="47b91d59f63be3ffd728f1da32a417d6229b5f5355f72eacd94dde9dc2d83701375ffebf14ac11d548e515", 0x2b, 0xfffffffffffffffc) keyctl$KEYCTL_MOVE(0x1e, r1, r2, r3, 0x0) request_key(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={'syz', 0x1}, &(0x7f0000000380)='id_legacy\x00', r3) request_key(&(0x7f00000003c0)='cifs.idmap\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000440)='/\x8fy){/(@\x00', r2) r4 = request_key(&(0x7f0000000480)='syzkaller\x00', &(0x7f00000004c0)={'syz', 0x0}, &(0x7f0000000500)='\x00', 0xfffffffffffffffb) keyctl$describe(0x6, r4, &(0x7f0000000540), 0x0) r5 = add_key$keyring(&(0x7f0000000640), &(0x7f0000000680)={'syz', 0x3}, 0x0, 0x0, r3) request_key(&(0x7f0000000580)='keyring\x00', &(0x7f00000005c0)={'syz', 0x3}, &(0x7f0000000600)='{%^#]*\x00', r5) 14:46:49 executing program 6: stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) setresuid(0x0, r0, 0x0) lchown(&(0x7f0000000000)='./file0\x00', r0, 0x0) [ 235.843926] 9pnet_fd: Insufficient options for proto=fd [ 235.867383] 9pnet: Could not find request transport: xen 14:46:49 executing program 3: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) r4 = dup(r0) r5 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r4, 0xc0189371, &(0x7f0000000700)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) r7 = dup2(r2, r5) r8 = fspick(r6, &(0x7f0000000740)='./file0\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r7, 0xc0189371, &(0x7f0000000780)={{0x1, 0x1, 0x18, r8}, './file0\x00'}) 14:46:49 executing program 2: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) setxattr$security_selinux(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0), &(0x7f0000000800)='system_u:object_r:shell_exec_t:s0\x00', 0x22, 0x2) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0xf0f1e000) setxattr$security_capability(&(0x7f0000000840)='./file0\x00', &(0x7f0000000880), &(0x7f00000008c0)=@v3={0x3000000, [{0x421e, 0x8001}, {0x6, 0x7}], 0xee01}, 0x18, 0x3) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000900)={"7f6d1f508aa7a78b4903735cf6ee0d94", 0x0, 0x0, {0x6, 0x8}, {0x9f4, 0x9}, 0x1f, [0xfcd, 0x8, 0x5, 0x3, 0x6, 0x5, 0x40, 0xffff, 0x2, 0x1, 0x6, 0x7fff, 0xc0, 0x3, 0x3]}) r2 = socket$netlink(0x10, 0x3, 0xa) ioctl$BTRFS_IOC_SCRUB(r2, 0xc400941b, &(0x7f0000000a00)={0x0, 0x689, 0x4, 0x1}) r3 = openat$incfs(r1, &(0x7f0000000e00)='.pending_reads\x00', 0x22000, 0x1c8) renameat(r3, &(0x7f0000000e40)='./file0\x00', r1, &(0x7f0000000e80)='./file0\x00') ioctl$AUTOFS_DEV_IOCTL_READY(r3, 0xc0189376, 0xfffffffffffffffe) 14:46:49 executing program 1: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) dup(r0) dup2(r2, 0xffffffffffffffff) 14:46:49 executing program 0: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r1, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', &(0x7f0000001d80)={{}, {0x1, 0x2}, [{0x2, 0x2, 0xffffffffffffffff}, {0x2, 0x1, r2}, {0x2, 0x3, 0xee01}, {0x2, 0x6}, {0x2, 0x1, r3}, {}, {0x2, 0x0, r4}], {}, [{0x8, 0x1, 0xee00}, {0x8, 0x4, 0xffffffffffffffff}, {0x8, 0x2, 0xffffffffffffffff}], {}, {0x20, 0x2}}, 0x74, 0x1) mkdir(&(0x7f0000001e00)='./file1\x00', 0x1a) fsetxattr$trusted_overlay_redirect(r1, &(0x7f0000001e40), &(0x7f0000001e80)='./file1/file0\x00', 0xe, 0x3) syz_genetlink_get_family_id$nl80211(&(0x7f0000001f00), r0) open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) 14:46:49 executing program 5: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r1, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', &(0x7f0000001d80)={{}, {0x1, 0x2}, [{0x2, 0x2, 0xffffffffffffffff}, {0x2, 0x1, r2}, {0x2, 0x3, 0xee01}, {0x2, 0x6}, {0x2, 0x1, r3}, {}, {0x2, 0x0, r5}], {}, [{0x8, 0x1, 0xee00}, {0x8, 0x4, 0xffffffffffffffff}, {0x8, 0x2, 0xffffffffffffffff}], {}, {0x20, 0x2}}, 0x74, 0x1) mkdir(&(0x7f0000001e00)='./file1\x00', 0x1a) fsetxattr$trusted_overlay_redirect(r1, &(0x7f0000001e40), &(0x7f0000001e80)='./file1/file0\x00', 0xe, 0x3) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid={'access', 0x3d, r5}}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid={'dfltgid', 0x3d, r4}}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt={'euid>', r2}}, {@fowner_eq={'fowner', 0x3d, r2}}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:46:49 executing program 4: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) setxattr$security_selinux(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0), &(0x7f0000000800)='system_u:object_r:shell_exec_t:s0\x00', 0x22, 0x2) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0xf0f1e000) setxattr$security_capability(&(0x7f0000000840)='./file0\x00', &(0x7f0000000880), &(0x7f00000008c0)=@v3={0x3000000, [{0x421e, 0x8001}, {0x6, 0x7}], 0xee01}, 0x18, 0x3) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000900)={"7f6d1f508aa7a78b4903735cf6ee0d94", 0x0, 0x0, {0x6, 0x8}, {0x9f4, 0x9}, 0x1f, [0xfcd, 0x8, 0x5, 0x3, 0x6, 0x5, 0x40, 0xffff, 0x2, 0x1, 0x6, 0x7fff, 0xc0, 0x3, 0x3]}) r2 = socket$netlink(0x10, 0x3, 0xa) ioctl$BTRFS_IOC_SCRUB(r2, 0xc400941b, &(0x7f0000000a00)={0x0, 0x689, 0x4, 0x1}) r3 = openat$incfs(r1, &(0x7f0000000e00)='.pending_reads\x00', 0x22000, 0x1c8) renameat(r3, &(0x7f0000000e40)='./file0\x00', r1, &(0x7f0000000e80)='./file0\x00') ioctl$AUTOFS_DEV_IOCTL_READY(r3, 0xc0189376, 0xfffffffffffffffe) mount$9p_xen(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x1804003, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}, {@cache_loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) 14:46:49 executing program 6: stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) setresuid(0x0, r0, 0x0) lchown(&(0x7f0000000000)='./file0\x00', r0, 0x0) [ 235.997677] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 236.014951] loop2: detected capacity change from 0 to 127 [ 236.084437] 9pnet_fd: Insufficient options for proto=fd [ 236.106025] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 236.127509] loop4: detected capacity change from 0 to 127 [ 236.243120] 9pnet: Could not find request transport: xen 14:47:05 executing program 2: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) setxattr$security_selinux(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0), &(0x7f0000000800)='system_u:object_r:shell_exec_t:s0\x00', 0x22, 0x2) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0xf0f1e000) setxattr$security_capability(&(0x7f0000000840)='./file0\x00', &(0x7f0000000880), &(0x7f00000008c0)=@v3={0x3000000, [{0x421e, 0x8001}, {0x6, 0x7}], 0xee01}, 0x18, 0x3) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000900)={"7f6d1f508aa7a78b4903735cf6ee0d94", 0x0, 0x0, {0x6, 0x8}, {0x9f4, 0x9}, 0x1f, [0xfcd, 0x8, 0x5, 0x3, 0x6, 0x5, 0x40, 0xffff, 0x2, 0x1, 0x6, 0x7fff, 0xc0, 0x3, 0x3]}) r2 = socket$netlink(0x10, 0x3, 0xa) ioctl$BTRFS_IOC_SCRUB(r2, 0xc400941b, &(0x7f0000000a00)={0x0, 0x689, 0x4, 0x1}) r3 = openat$incfs(r1, &(0x7f0000000e00)='.pending_reads\x00', 0x22000, 0x1c8) renameat(r3, &(0x7f0000000e40)='./file0\x00', r1, &(0x7f0000000e80)='./file0\x00') 14:47:05 executing program 4: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) setxattr$security_selinux(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0), &(0x7f0000000800)='system_u:object_r:shell_exec_t:s0\x00', 0x22, 0x2) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0xf0f1e000) setxattr$security_capability(&(0x7f0000000840)='./file0\x00', &(0x7f0000000880), &(0x7f00000008c0)=@v3={0x3000000, [{0x421e, 0x8001}, {0x6, 0x7}], 0xee01}, 0x18, 0x3) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000900)={"7f6d1f508aa7a78b4903735cf6ee0d94", 0x0, 0x0, {0x6, 0x8}, {0x9f4, 0x9}, 0x1f, [0xfcd, 0x8, 0x5, 0x3, 0x6, 0x5, 0x40, 0xffff, 0x2, 0x1, 0x6, 0x7fff, 0xc0, 0x3, 0x3]}) r2 = socket$netlink(0x10, 0x3, 0xa) ioctl$BTRFS_IOC_SCRUB(r2, 0xc400941b, &(0x7f0000000a00)={0x0, 0x689, 0x4, 0x1}) r3 = openat$incfs(r1, &(0x7f0000000e00)='.pending_reads\x00', 0x22000, 0x1c8) renameat(r3, &(0x7f0000000e40)='./file0\x00', r1, &(0x7f0000000e80)='./file0\x00') mount$9p_xen(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x1804003, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}, {@cache_loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) 14:47:05 executing program 6: syz_mount_image$ext4(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x1, &(0x7f0000001480)=[{&(0x7f00000001c0)="12b46d6821e2b9780a4eef2b83e62fd8903b5db787ada822637a7a58c9", 0x1d, 0xffffffffffff7fff}], 0x2008002, &(0x7f0000001500)={[{@minixdf}, {@quota}, {@resuid={'resuid', 0x3d, 0xee01}}, {@noacl}, {@prjquota}, {@nodelalloc}, {@nobarrier}, {@orlov}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0xffffffffffffff81}}], [{@permit_directio}, {@uid_eq}, {@smackfshat={'smackfshat', 0x3d, 'ns/ipc\x00'}}, {@subj_role={'subj_role', 0x3d, 'ns/ipc\x00'}}, {@pcr={'pcr', 0x3d, 0x9}}, {@defcontext={'defcontext', 0x3d, 'sysadm_u'}}]}) stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) setresuid(0x0, r0, 0x0) lchown(&(0x7f0000000000)='./file0\x00', r0, 0x0) 14:47:05 executing program 1: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) r4 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) dup2(r2, r4) 14:47:05 executing program 7: r0 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) keyctl$invalidate(0x15, r0) r1 = add_key$fscrypt_provisioning(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)={0x0, 0x0, @auto=[0x17]}, 0x9, r0) r2 = request_key(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)='-)\\${\\\\\x17\'%&][@\x7f#[,\x00', 0xfffffffffffffff9) r3 = add_key(&(0x7f0000000240)='id_legacy\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="47b91d59f63be3ffd728f1da32a417d6229b5f5355f72eacd94dde9dc2d83701375ffebf14ac11d548e515", 0x2b, 0xfffffffffffffffc) keyctl$KEYCTL_MOVE(0x1e, r1, r2, r3, 0x0) request_key(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={'syz', 0x1}, &(0x7f0000000380)='id_legacy\x00', r3) request_key(&(0x7f00000003c0)='cifs.idmap\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000440)='/\x8fy){/(@\x00', r2) r4 = request_key(&(0x7f0000000480)='syzkaller\x00', &(0x7f00000004c0)={'syz', 0x0}, &(0x7f0000000500)='\x00', 0xfffffffffffffffb) keyctl$describe(0x6, r4, &(0x7f0000000540), 0x0) add_key$keyring(&(0x7f0000000640), &(0x7f0000000680)={'syz', 0x3}, 0x0, 0x0, r3) 14:47:05 executing program 0: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r1, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', &(0x7f0000001d80)={{}, {0x1, 0x2}, [{0x2, 0x2, 0xffffffffffffffff}, {0x2, 0x1, r2}, {0x2, 0x3, 0xee01}, {0x2, 0x6}, {0x2, 0x1, r3}, {}, {0x2, 0x0, r4}], {}, [{0x8, 0x1, 0xee00}, {0x8, 0x4, 0xffffffffffffffff}, {0x8, 0x2, 0xffffffffffffffff}], {}, {0x20, 0x2}}, 0x74, 0x1) mkdir(&(0x7f0000001e00)='./file1\x00', 0x1a) fsetxattr$trusted_overlay_redirect(r1, &(0x7f0000001e40), &(0x7f0000001e80)='./file1/file0\x00', 0xe, 0x3) open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) 14:47:05 executing program 5: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r1, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', &(0x7f0000001d80)={{}, {0x1, 0x2}, [{0x2, 0x2, 0xffffffffffffffff}, {0x2, 0x1, r2}, {0x2, 0x3, 0xee01}, {0x2, 0x6}, {0x2, 0x1, r3}, {}, {0x2, 0x0, r5}], {}, [{0x8, 0x1, 0xee00}, {0x8, 0x4, 0xffffffffffffffff}, {0x8, 0x2, 0xffffffffffffffff}], {}, {0x20, 0x2}}, 0x74, 0x1) mkdir(&(0x7f0000001e00)='./file1\x00', 0x1a) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid={'access', 0x3d, r5}}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid={'dfltgid', 0x3d, r4}}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt={'euid>', r2}}, {@fowner_eq={'fowner', 0x3d, r2}}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) [ 251.400510] loop6: detected capacity change from 0 to 16255 [ 251.407773] tmpfs: Unknown parameter 'uid<00000000000000060929' 14:47:05 executing program 3: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) r4 = dup(r0) r5 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r4, 0xc0189371, &(0x7f0000000700)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) dup2(r2, r5) fspick(r6, &(0x7f0000000740)='./file0\x00', 0x0) [ 251.422543] 9pnet_fd: Insufficient options for proto=fd [ 251.424860] loop4: detected capacity change from 0 to 127 14:47:05 executing program 7: r0 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) keyctl$invalidate(0x15, r0) r1 = add_key$fscrypt_provisioning(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)={0x0, 0x0, @auto=[0x17]}, 0x9, r0) r2 = request_key(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)='-)\\${\\\\\x17\'%&][@\x7f#[,\x00', 0xfffffffffffffff9) r3 = add_key(&(0x7f0000000240)='id_legacy\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="47b91d59f63be3ffd728f1da32a417d6229b5f5355f72eacd94dde9dc2d83701375ffebf14ac11d548e515", 0x2b, 0xfffffffffffffffc) keyctl$KEYCTL_MOVE(0x1e, r1, r2, r3, 0x0) request_key(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={'syz', 0x1}, &(0x7f0000000380)='id_legacy\x00', r3) request_key(&(0x7f00000003c0)='cifs.idmap\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000440)='/\x8fy){/(@\x00', r2) r4 = request_key(&(0x7f0000000480)='syzkaller\x00', &(0x7f00000004c0)={'syz', 0x0}, &(0x7f0000000500)='\x00', 0xfffffffffffffffb) keyctl$describe(0x6, r4, &(0x7f0000000540), 0x0) 14:47:05 executing program 5: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r1, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', &(0x7f0000001d80)={{}, {0x1, 0x2}, [{0x2, 0x2, 0xffffffffffffffff}, {0x2, 0x1, r2}, {0x2, 0x3, 0xee01}, {0x2, 0x6}, {0x2, 0x1, r3}, {}, {0x2, 0x0, r5}], {}, [{0x8, 0x1, 0xee00}, {0x8, 0x4, 0xffffffffffffffff}, {0x8, 0x2, 0xffffffffffffffff}], {}, {0x20, 0x2}}, 0x74, 0x1) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid={'access', 0x3d, r5}}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid={'dfltgid', 0x3d, r4}}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt={'euid>', r2}}, {@fowner_eq={'fowner', 0x3d, r2}}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) [ 251.468760] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 251.475868] loop2: detected capacity change from 0 to 127 [ 251.526394] 9pnet_fd: Insufficient options for proto=fd [ 251.567686] 9pnet: Could not find request transport: xen [ 261.572505] Bluetooth: hci1: command 0x0406 tx timeout [ 261.573465] Bluetooth: hci7: command 0x0406 tx timeout [ 261.574360] Bluetooth: hci6: command 0x0406 tx timeout 14:47:17 executing program 2: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) setxattr$security_selinux(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0), &(0x7f0000000800)='system_u:object_r:shell_exec_t:s0\x00', 0x22, 0x2) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0xf0f1e000) setxattr$security_capability(&(0x7f0000000840)='./file0\x00', &(0x7f0000000880), &(0x7f00000008c0)=@v3={0x3000000, [{0x421e, 0x8001}, {0x6, 0x7}], 0xee01}, 0x18, 0x3) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000900)={"7f6d1f508aa7a78b4903735cf6ee0d94", 0x0, 0x0, {0x6, 0x8}, {0x9f4, 0x9}, 0x1f, [0xfcd, 0x8, 0x5, 0x3, 0x6, 0x5, 0x40, 0xffff, 0x2, 0x1, 0x6, 0x7fff, 0xc0, 0x3, 0x3]}) r2 = socket$netlink(0x10, 0x3, 0xa) ioctl$BTRFS_IOC_SCRUB(r2, 0xc400941b, &(0x7f0000000a00)={0x0, 0x689, 0x4, 0x1}) openat$incfs(r1, &(0x7f0000000e00)='.pending_reads\x00', 0x22000, 0x1c8) 14:47:17 executing program 3: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) r4 = dup(r0) r5 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r4, 0xc0189371, &(0x7f0000000700)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) dup2(r2, r5) [ 263.229779] tmpfs: Unknown parameter 'uid<00000000000000060929' 14:47:17 executing program 7: r0 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) keyctl$invalidate(0x15, r0) r1 = add_key$fscrypt_provisioning(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)={0x0, 0x0, @auto=[0x17]}, 0x9, r0) r2 = request_key(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)='-)\\${\\\\\x17\'%&][@\x7f#[,\x00', 0xfffffffffffffff9) r3 = add_key(&(0x7f0000000240)='id_legacy\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="47b91d59f63be3ffd728f1da32a417d6229b5f5355f72eacd94dde9dc2d83701375ffebf14ac11d548e515", 0x2b, 0xfffffffffffffffc) keyctl$KEYCTL_MOVE(0x1e, r1, r2, r3, 0x0) request_key(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={'syz', 0x1}, &(0x7f0000000380)='id_legacy\x00', r3) request_key(&(0x7f00000003c0)='cifs.idmap\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000440)='/\x8fy){/(@\x00', r2) request_key(&(0x7f0000000480)='syzkaller\x00', &(0x7f00000004c0)={'syz', 0x0}, &(0x7f0000000500)='\x00', 0xfffffffffffffffb) 14:47:17 executing program 4: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) setxattr$security_selinux(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0), &(0x7f0000000800)='system_u:object_r:shell_exec_t:s0\x00', 0x22, 0x2) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0xf0f1e000) setxattr$security_capability(&(0x7f0000000840)='./file0\x00', &(0x7f0000000880), &(0x7f00000008c0)=@v3={0x3000000, [{0x421e, 0x8001}, {0x6, 0x7}], 0xee01}, 0x18, 0x3) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000900)={"7f6d1f508aa7a78b4903735cf6ee0d94", 0x0, 0x0, {0x6, 0x8}, {0x9f4, 0x9}, 0x1f, [0xfcd, 0x8, 0x5, 0x3, 0x6, 0x5, 0x40, 0xffff, 0x2, 0x1, 0x6, 0x7fff, 0xc0, 0x3, 0x3]}) r2 = socket$netlink(0x10, 0x3, 0xa) ioctl$BTRFS_IOC_SCRUB(r2, 0xc400941b, &(0x7f0000000a00)={0x0, 0x689, 0x4, 0x1}) openat$incfs(r1, &(0x7f0000000e00)='.pending_reads\x00', 0x22000, 0x1c8) mount$9p_xen(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x1804003, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}, {@cache_loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) 14:47:17 executing program 1: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) r4 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) dup2(r2, r4) [ 263.239608] loop2: detected capacity change from 0 to 127 14:47:17 executing program 6: syz_mount_image$ext4(0x0, 0x0, 0x0, 0x1, &(0x7f0000001480)=[{&(0x7f00000001c0)="12b46d6821e2b9780a4eef2b83e62fd8903b5db787ada822637a7a58c9", 0x1d, 0xffffffffffff7fff}], 0x2008002, &(0x7f0000001500)={[{@minixdf}, {@quota}, {@resuid={'resuid', 0x3d, 0xee01}}, {@noacl}, {@prjquota}, {@nodelalloc}, {@nobarrier}, {@orlov}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0xffffffffffffff81}}], [{@permit_directio}, {@uid_eq}, {@smackfshat={'smackfshat', 0x3d, 'ns/ipc\x00'}}, {@subj_role={'subj_role', 0x3d, 'ns/ipc\x00'}}, {@pcr={'pcr', 0x3d, 0x9}}, {@defcontext={'defcontext', 0x3d, 'sysadm_u'}}]}) stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) setresuid(0x0, r0, 0x0) lchown(&(0x7f0000000000)='./file0\x00', r0, 0x0) 14:47:17 executing program 0: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r1, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', &(0x7f0000001d80)={{}, {0x1, 0x2}, [{0x2, 0x2, 0xffffffffffffffff}, {0x2, 0x1, r2}, {0x2, 0x3, 0xee01}, {0x2, 0x6}, {0x2, 0x1, r3}, {}, {0x2, 0x0, r4}], {}, [{0x8, 0x1, 0xee00}, {0x8, 0x4, 0xffffffffffffffff}, {0x8, 0x2, 0xffffffffffffffff}], {}, {0x20, 0x2}}, 0x74, 0x1) mkdir(&(0x7f0000001e00)='./file1\x00', 0x1a) open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) 14:47:17 executing program 5: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r1, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid={'access', 0x3d, r4}}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid={'dfltgid', 0x3d, r3}}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt={'euid>', r2}}, {@fowner_eq={'fowner', 0x3d, r2}}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) [ 263.304290] loop6: detected capacity change from 0 to 16255 [ 263.311195] tmpfs: Unknown parameter 'uid<00000000000000060929' 14:47:17 executing program 0: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r1, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', &(0x7f0000001d80)={{}, {0x1, 0x2}, [{0x2, 0x2, 0xffffffffffffffff}, {0x2, 0x1, r2}, {0x2, 0x3, 0xee01}, {0x2, 0x6}, {0x2, 0x1, r3}, {}, {0x2, 0x0, r4}], {}, [{0x8, 0x1, 0xee00}, {0x8, 0x4, 0xffffffffffffffff}, {0x8, 0x2, 0xffffffffffffffff}], {}, {0x20, 0x2}}, 0x74, 0x1) open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) 14:47:17 executing program 7: r0 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) keyctl$invalidate(0x15, r0) r1 = add_key$fscrypt_provisioning(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)={0x0, 0x0, @auto=[0x17]}, 0x9, r0) r2 = request_key(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)='-)\\${\\\\\x17\'%&][@\x7f#[,\x00', 0xfffffffffffffff9) r3 = add_key(&(0x7f0000000240)='id_legacy\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="47b91d59f63be3ffd728f1da32a417d6229b5f5355f72eacd94dde9dc2d83701375ffebf14ac11d548e515", 0x2b, 0xfffffffffffffffc) keyctl$KEYCTL_MOVE(0x1e, r1, r2, r3, 0x0) request_key(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={'syz', 0x1}, &(0x7f0000000380)='id_legacy\x00', r3) request_key(&(0x7f00000003c0)='cifs.idmap\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000440)='/\x8fy){/(@\x00', r2) 14:47:17 executing program 3: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) r4 = dup(r0) r5 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r4, 0xc0189371, &(0x7f0000000700)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) [ 263.344197] loop4: detected capacity change from 0 to 127 [ 263.363597] 9pnet_fd: Insufficient options for proto=fd 14:47:17 executing program 0: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r1, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c}}], 0x20}, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) 14:47:17 executing program 2: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) setxattr$security_selinux(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0), &(0x7f0000000800)='system_u:object_r:shell_exec_t:s0\x00', 0x22, 0x2) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0xf0f1e000) setxattr$security_capability(&(0x7f0000000840)='./file0\x00', &(0x7f0000000880), &(0x7f00000008c0)=@v3={0x3000000, [{0x421e, 0x8001}, {0x6, 0x7}], 0xee01}, 0x18, 0x3) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000900)={"7f6d1f508aa7a78b4903735cf6ee0d94", 0x0, 0x0, {0x6, 0x8}, {0x9f4, 0x9}, 0x1f, [0xfcd, 0x8, 0x5, 0x3, 0x6, 0x5, 0x40, 0xffff, 0x2, 0x1, 0x6, 0x7fff, 0xc0, 0x3, 0x3]}) r2 = socket$netlink(0x10, 0x3, 0xa) ioctl$BTRFS_IOC_SCRUB(r2, 0xc400941b, &(0x7f0000000a00)={0x0, 0x689, 0x4, 0x1}) 14:47:17 executing program 1: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) r3 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) dup2(r2, r3) 14:47:17 executing program 6: syz_mount_image$ext4(0x0, 0x0, 0x0, 0x1, &(0x7f0000001480)=[{&(0x7f00000001c0)="12b46d6821e2b9780a4eef2b83e62fd8903b5db787ada822637a7a58c9", 0x1d, 0xffffffffffff7fff}], 0x2008002, &(0x7f0000001500)={[{@minixdf}, {@quota}, {@resuid={'resuid', 0x3d, 0xee01}}, {@noacl}, {@prjquota}, {@nodelalloc}, {@nobarrier}, {@orlov}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0xffffffffffffff81}}], [{@permit_directio}, {@uid_eq}, {@smackfshat={'smackfshat', 0x3d, 'ns/ipc\x00'}}, {@subj_role={'subj_role', 0x3d, 'ns/ipc\x00'}}, {@pcr={'pcr', 0x3d, 0x9}}, {@defcontext={'defcontext', 0x3d, 'sysadm_u'}}]}) stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) setresuid(0x0, r0, 0x0) lchown(&(0x7f0000000000)='./file0\x00', r0, 0x0) [ 263.466643] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 263.484928] loop2: detected capacity change from 0 to 127 14:47:17 executing program 7: r0 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) keyctl$invalidate(0x15, r0) r1 = add_key$fscrypt_provisioning(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)={0x0, 0x0, @auto=[0x17]}, 0x9, r0) r2 = request_key(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)='-)\\${\\\\\x17\'%&][@\x7f#[,\x00', 0xfffffffffffffff9) r3 = add_key(&(0x7f0000000240)='id_legacy\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="47b91d59f63be3ffd728f1da32a417d6229b5f5355f72eacd94dde9dc2d83701375ffebf14ac11d548e515", 0x2b, 0xfffffffffffffffc) keyctl$KEYCTL_MOVE(0x1e, r1, r2, r3, 0x0) request_key(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={'syz', 0x1}, &(0x7f0000000380)='id_legacy\x00', r3) [ 263.495066] 9pnet: Could not find request transport: xen 14:47:17 executing program 5: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r1, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid={'dfltgid', 0x3d, r3}}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt={'euid>', r2}}, {@fowner_eq={'fowner', 0x3d, r2}}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:47:17 executing program 0: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r1, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)) open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) [ 263.541178] loop6: detected capacity change from 0 to 16255 [ 263.584184] 9pnet_fd: Insufficient options for proto=fd 14:47:17 executing program 1: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) dup2(r2, r3) 14:47:17 executing program 3: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) dup(r0) openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) 14:47:17 executing program 7: r0 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) keyctl$invalidate(0x15, r0) r1 = add_key$fscrypt_provisioning(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)={0x0, 0x0, @auto=[0x17]}, 0x9, r0) r2 = request_key(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)='-)\\${\\\\\x17\'%&][@\x7f#[,\x00', 0xfffffffffffffff9) r3 = add_key(&(0x7f0000000240)='id_legacy\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="47b91d59f63be3ffd728f1da32a417d6229b5f5355f72eacd94dde9dc2d83701375ffebf14ac11d548e515", 0x2b, 0xfffffffffffffffc) keyctl$KEYCTL_MOVE(0x1e, r1, r2, r3, 0x0) 14:47:17 executing program 4: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) setxattr$security_selinux(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0), &(0x7f0000000800)='system_u:object_r:shell_exec_t:s0\x00', 0x22, 0x2) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0xf0f1e000) setxattr$security_capability(&(0x7f0000000840)='./file0\x00', &(0x7f0000000880), &(0x7f00000008c0)=@v3={0x3000000, [{0x421e, 0x8001}, {0x6, 0x7}], 0xee01}, 0x18, 0x3) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000900)={"7f6d1f508aa7a78b4903735cf6ee0d94", 0x0, 0x0, {0x6, 0x8}, {0x9f4, 0x9}, 0x1f, [0xfcd, 0x8, 0x5, 0x3, 0x6, 0x5, 0x40, 0xffff, 0x2, 0x1, 0x6, 0x7fff, 0xc0, 0x3, 0x3]}) r2 = socket$netlink(0x10, 0x3, 0xa) ioctl$BTRFS_IOC_SCRUB(r2, 0xc400941b, &(0x7f0000000a00)={0x0, 0x689, 0x4, 0x1}) mount$9p_xen(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x1804003, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}, {@cache_loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) 14:47:17 executing program 2: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) setxattr$security_selinux(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0), &(0x7f0000000800)='system_u:object_r:shell_exec_t:s0\x00', 0x22, 0x2) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0xf0f1e000) setxattr$security_capability(&(0x7f0000000840)='./file0\x00', &(0x7f0000000880), &(0x7f00000008c0)=@v3={0x3000000, [{0x421e, 0x8001}, {0x6, 0x7}], 0xee01}, 0x18, 0x3) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000900)={"7f6d1f508aa7a78b4903735cf6ee0d94", 0x0, 0x0, {0x6, 0x8}, {0x9f4, 0x9}, 0x1f, [0xfcd, 0x8, 0x5, 0x3, 0x6, 0x5, 0x40, 0xffff, 0x2, 0x1, 0x6, 0x7fff, 0xc0, 0x3, 0x3]}) socket$netlink(0x10, 0x3, 0xa) 14:47:17 executing program 0: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r1, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)) open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) [ 263.690847] tmpfs: Unknown parameter 'uid<00000000000000060929' 14:47:17 executing program 5: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r1, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt={'euid>', r2}}, {@fowner_eq={'fowner', 0x3d, r2}}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) [ 263.695900] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 263.718698] loop4: detected capacity change from 0 to 127 [ 263.761508] 9pnet_fd: Insufficient options for proto=fd [ 263.804980] 9pnet: Could not find request transport: xen [ 265.668385] Bluetooth: hci5: command 0x0406 tx timeout [ 269.764395] Bluetooth: hci4: command 0x0406 tx timeout 14:47:31 executing program 4: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) setxattr$security_selinux(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0), &(0x7f0000000800)='system_u:object_r:shell_exec_t:s0\x00', 0x22, 0x2) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0xf0f1e000) setxattr$security_capability(&(0x7f0000000840)='./file0\x00', &(0x7f0000000880), &(0x7f00000008c0)=@v3={0x3000000, [{0x421e, 0x8001}, {0x6, 0x7}], 0xee01}, 0x18, 0x3) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000900)={"7f6d1f508aa7a78b4903735cf6ee0d94", 0x0, 0x0, {0x6, 0x8}, {0x9f4, 0x9}, 0x1f, [0xfcd, 0x8, 0x5, 0x3, 0x6, 0x5, 0x40, 0xffff, 0x2, 0x1, 0x6, 0x7fff, 0xc0, 0x3, 0x3]}) socket$netlink(0x10, 0x3, 0xa) mount$9p_xen(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x1804003, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}, {@cache_loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) 14:47:31 executing program 6: syz_mount_image$ext4(0x0, 0x0, 0x0, 0x1, &(0x7f0000001480)=[{&(0x7f00000001c0)="12b46d6821e2b9780a4eef2b83e62fd8903b5db787ada822637a7a58c9", 0x1d, 0xffffffffffff7fff}], 0x2008002, &(0x7f0000001500)={[{@minixdf}, {@quota}, {@resuid={'resuid', 0x3d, 0xee01}}, {@noacl}, {@prjquota}, {@nodelalloc}, {@nobarrier}, {@orlov}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0xffffffffffffff81}}], [{@permit_directio}, {@uid_eq}, {@smackfshat={'smackfshat', 0x3d, 'ns/ipc\x00'}}, {@subj_role={'subj_role', 0x3d, 'ns/ipc\x00'}}, {@pcr={'pcr', 0x3d, 0x9}}, {@defcontext={'defcontext', 0x3d, 'sysadm_u'}}]}) stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) setresuid(0x0, r0, 0x0) lchown(&(0x7f0000000000)='./file0\x00', r0, 0x0) [ 278.081673] tmpfs: Unknown parameter 'uid<00000000000000060929' 14:47:31 executing program 5: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r1, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:47:31 executing program 2: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) setxattr$security_selinux(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0), &(0x7f0000000800)='system_u:object_r:shell_exec_t:s0\x00', 0x22, 0x2) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0xf0f1e000) setxattr$security_capability(&(0x7f0000000840)='./file0\x00', &(0x7f0000000880), &(0x7f00000008c0)=@v3={0x3000000, [{0x421e, 0x8001}, {0x6, 0x7}], 0xee01}, 0x18, 0x3) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000900)={"7f6d1f508aa7a78b4903735cf6ee0d94", 0x0, 0x0, {0x6, 0x8}, {0x9f4, 0x9}, 0x1f, [0xfcd, 0x8, 0x5, 0x3, 0x6, 0x5, 0x40, 0xffff, 0x2, 0x1, 0x6, 0x7fff, 0xc0, 0x3, 0x3]}) 14:47:31 executing program 3: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) dup(r0) 14:47:31 executing program 1: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) r3 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) dup2(r2, r3) 14:47:31 executing program 0: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r1, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) 14:47:31 executing program 7: r0 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) keyctl$invalidate(0x15, r0) add_key$fscrypt_provisioning(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)={0x0, 0x0, @auto=[0x17]}, 0x9, r0) request_key(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)='-)\\${\\\\\x17\'%&][@\x7f#[,\x00', 0xfffffffffffffff9) add_key(&(0x7f0000000240)='id_legacy\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="47b91d59f63be3ffd728f1da32a417d6229b5f5355f72eacd94dde9dc2d83701375ffebf14ac11d548e515", 0x2b, 0xfffffffffffffffc) [ 278.108925] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 278.110726] loop4: detected capacity change from 0 to 127 [ 278.118816] loop2: detected capacity change from 0 to 127 [ 278.121775] 9pnet_fd: Insufficient options for proto=fd [ 278.154676] loop6: detected capacity change from 0 to 16255 [ 278.220025] 9pnet: Could not find request transport: xen 14:47:44 executing program 5: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r1, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:47:44 executing program 4: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) setxattr$security_selinux(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0), &(0x7f0000000800)='system_u:object_r:shell_exec_t:s0\x00', 0x22, 0x2) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0xf0f1e000) setxattr$security_capability(&(0x7f0000000840)='./file0\x00', &(0x7f0000000880), &(0x7f00000008c0)=@v3={0x3000000, [{0x421e, 0x8001}, {0x6, 0x7}], 0xee01}, 0x18, 0x3) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000900)={"7f6d1f508aa7a78b4903735cf6ee0d94", 0x0, 0x0, {0x6, 0x8}, {0x9f4, 0x9}, 0x1f, [0xfcd, 0x8, 0x5, 0x3, 0x6, 0x5, 0x40, 0xffff, 0x2, 0x1, 0x6, 0x7fff, 0xc0, 0x3, 0x3]}) mount$9p_xen(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x1804003, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}, {@cache_loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) 14:47:44 executing program 0: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r1, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) 14:47:44 executing program 6: syz_mount_image$ext4(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x0, 0x0, 0x2008002, &(0x7f0000001500)={[{@minixdf}, {@quota}, {@resuid={'resuid', 0x3d, 0xee01}}, {@noacl}, {@prjquota}, {@nodelalloc}, {@nobarrier}, {@orlov}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0xffffffffffffff81}}], [{@permit_directio}, {@uid_eq}, {@smackfshat={'smackfshat', 0x3d, 'ns/ipc\x00'}}, {@subj_role={'subj_role', 0x3d, 'ns/ipc\x00'}}, {@pcr={'pcr', 0x3d, 0x9}}, {@defcontext={'defcontext', 0x3d, 'sysadm_u'}}]}) stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) setresuid(0x0, r0, 0x0) lchown(&(0x7f0000000000)='./file0\x00', r0, 0x0) 14:47:44 executing program 7: r0 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) keyctl$invalidate(0x15, r0) add_key$fscrypt_provisioning(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)={0x0, 0x0, @auto=[0x17]}, 0x9, r0) request_key(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)='-)\\${\\\\\x17\'%&][@\x7f#[,\x00', 0xfffffffffffffff9) 14:47:44 executing program 2: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) setxattr$security_selinux(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0), &(0x7f0000000800)='system_u:object_r:shell_exec_t:s0\x00', 0x22, 0x2) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0xf0f1e000) setxattr$security_capability(&(0x7f0000000840)='./file0\x00', &(0x7f0000000880), &(0x7f00000008c0)=@v3={0x3000000, [{0x421e, 0x8001}, {0x6, 0x7}], 0xee01}, 0x18, 0x3) 14:47:44 executing program 1: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) r3 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) dup2(r2, r3) 14:47:44 executing program 3: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) 14:47:44 executing program 0: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200), 0x800) open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) 14:47:44 executing program 6: syz_mount_image$ext4(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000001500)={[{@minixdf}, {@quota}, {@resuid={'resuid', 0x3d, 0xee01}}, {@noacl}, {@prjquota}, {@nodelalloc}, {@nobarrier}, {@orlov}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0xffffffffffffff81}}], [{@permit_directio}, {@uid_eq}, {@smackfshat={'smackfshat', 0x3d, 'ns/ipc\x00'}}, {@subj_role={'subj_role', 0x3d, 'ns/ipc\x00'}}, {@pcr={'pcr', 0x3d, 0x9}}, {@defcontext={'defcontext', 0x3d, 'sysadm_u'}}]}) stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) setresuid(0x0, r0, 0x0) lchown(&(0x7f0000000000)='./file0\x00', r0, 0x0) [ 290.696028] 9pnet_fd: Insufficient options for proto=fd [ 290.707669] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 290.710671] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 290.720857] loop2: detected capacity change from 0 to 127 [ 290.721759] loop4: detected capacity change from 0 to 127 14:47:44 executing program 3: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) 14:47:44 executing program 5: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200), 0x800) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:47:44 executing program 0: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) 14:47:44 executing program 7: r0 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) keyctl$invalidate(0x15, r0) add_key$fscrypt_provisioning(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)={0x0, 0x0, @auto=[0x17]}, 0x9, r0) 14:47:44 executing program 6: syz_mount_image$ext4(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) setresuid(0x0, r0, 0x0) lchown(&(0x7f0000000000)='./file0\x00', r0, 0x0) 14:47:44 executing program 1: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') r3 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) dup2(r2, r3) 14:47:44 executing program 2: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) setxattr$security_selinux(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0), &(0x7f0000000800)='system_u:object_r:shell_exec_t:s0\x00', 0x22, 0x2) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0xf0f1e000) [ 290.839707] 9pnet_fd: Insufficient options for proto=fd [ 290.875922] 9pnet: Could not find request transport: xen 14:47:44 executing program 4: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) setxattr$security_selinux(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0), &(0x7f0000000800)='system_u:object_r:shell_exec_t:s0\x00', 0x22, 0x2) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0xf0f1e000) setxattr$security_capability(&(0x7f0000000840)='./file0\x00', &(0x7f0000000880), &(0x7f00000008c0)=@v3={0x3000000, [{0x421e, 0x8001}, {0x6, 0x7}], 0xee01}, 0x18, 0x3) mount$9p_xen(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x1804003, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}, {@cache_loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) [ 290.950036] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 290.964727] loop2: detected capacity change from 0 to 127 [ 290.987139] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 291.000475] loop4: detected capacity change from 0 to 127 [ 291.068199] 9pnet: Could not find request transport: xen 14:47:55 executing program 4: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) setxattr$security_selinux(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0), &(0x7f0000000800)='system_u:object_r:shell_exec_t:s0\x00', 0x22, 0x2) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0xf0f1e000) mount$9p_xen(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x1804003, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}, {@cache_loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) 14:47:55 executing program 0: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) 14:47:55 executing program 2: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) setxattr$security_selinux(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0), &(0x7f0000000800)='system_u:object_r:shell_exec_t:s0\x00', 0x22, 0x2) 14:47:56 executing program 1: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) dup2(0xffffffffffffffff, r2) 14:47:56 executing program 3: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) [ 302.148810] tmpfs: Unknown parameter 'uid<00000000000000060929' 14:47:56 executing program 6: syz_mount_image$ext4(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(0x0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) setresuid(0x0, r0, 0x0) lchown(&(0x7f0000000000)='./file0\x00', r0, 0x0) 14:47:56 executing program 5: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:47:56 executing program 7: r0 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) keyctl$invalidate(0x15, r0) [ 302.161676] 9pnet_fd: Insufficient options for proto=fd [ 302.166873] loop4: detected capacity change from 0 to 127 [ 302.182229] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 302.196623] loop2: detected capacity change from 0 to 127 14:47:56 executing program 7: keyctl$invalidate(0x15, 0x0) 14:47:56 executing program 0: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) 14:47:56 executing program 3: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) 14:47:56 executing program 5: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:47:56 executing program 1: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) dup2(0xffffffffffffffff, r2) 14:47:56 executing program 6: syz_mount_image$ext4(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(0x0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) setresuid(0x0, r0, 0x0) lchown(&(0x7f0000000000)='./file0\x00', r0, 0x0) 14:47:56 executing program 0: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) 14:47:56 executing program 2: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) [ 302.356312] 9pnet: Could not find request transport: xen 14:47:56 executing program 4: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) setxattr$security_selinux(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0), &(0x7f0000000800)='system_u:object_r:shell_exec_t:s0\x00', 0x22, 0x2) mount$9p_xen(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x1804003, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}, {@cache_loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) 14:47:56 executing program 7: r0 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) keyctl$invalidate(0x15, r0) add_key$fscrypt_provisioning(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)={0x0, 0x0, @auto=[0x17]}, 0x9, r0) request_key(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)='-)\\${\\\\\x17\'%&][@\x7f#[,\x00', 0xfffffffffffffff9) add_key(&(0x7f0000000240)='id_legacy\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="47b91d59f63be3ffd728f1da32a417d6229b5f5355f72eacd94dde9dc2d83701375ffebf14ac11d548e515", 0x2b, 0xfffffffffffffffc) 14:47:56 executing program 5: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:47:56 executing program 6: syz_mount_image$ext4(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(0x0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) setresuid(0x0, r0, 0x0) lchown(&(0x7f0000000000)='./file0\x00', r0, 0x0) [ 302.432554] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 302.448075] loop2: detected capacity change from 0 to 127 [ 302.471031] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 302.486851] loop4: detected capacity change from 0 to 127 [ 302.541135] 9pnet: Could not find request transport: xen 14:48:09 executing program 0: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) 14:48:09 executing program 3: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) 14:48:09 executing program 4: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) mount$9p_xen(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x1804003, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}, {@cache_loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) 14:48:09 executing program 2: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) 14:48:09 executing program 7: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r1, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c}}], 0x20}, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) 14:48:09 executing program 5: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:48:09 executing program 6: syz_mount_image$ext4(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000240)='./file0\x00', 0x0) setresuid(0x0, 0x0, 0x0) lchown(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) 14:48:09 executing program 1: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) dup2(0xffffffffffffffff, r2) [ 315.970452] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 315.976525] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 315.987616] loop4: detected capacity change from 0 to 127 [ 315.988700] loop2: detected capacity change from 0 to 127 14:48:09 executing program 1: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) r1 = syz_open_procfs(r0, &(0x7f00000003c0)='uid_map\x00') r2 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) dup2(r1, r2) [ 316.180395] 9pnet: Could not find request transport: xen 14:48:23 executing program 1: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='uid_map\x00') r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) dup2(r0, r1) 14:48:23 executing program 6: syz_mount_image$ext4(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000240)='./file0\x00', 0x0) setresuid(0x0, 0x0, 0x0) lchown(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) 14:48:23 executing program 4: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) mount$9p_xen(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x1804003, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}, {@cache_loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) [ 329.487172] tmpfs: Unknown parameter 'uid<00000000000000060929' 14:48:23 executing program 5: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:48:23 executing program 0: mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) 14:48:23 executing program 2: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) 14:48:23 executing program 3: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') 14:48:23 executing program 7: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) setxattr$security_selinux(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0), &(0x7f0000000800)='system_u:object_r:shell_exec_t:s0\x00', 0x22, 0x2) mount$9p_xen(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x1804003, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}, {@cache_loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) [ 329.497389] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 329.507292] 9pnet_fd: Insufficient options for proto=fd [ 329.508121] loop2: detected capacity change from 0 to 127 [ 329.535943] loop4: detected capacity change from 0 to 127 [ 329.554343] tmpfs: Unknown parameter 'uid<00000000000000060929' 14:48:23 executing program 0: mkdir(0x0, 0xd0) open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) 14:48:23 executing program 1: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='uid_map\x00') r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) dup2(r0, r1) 14:48:23 executing program 2: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) [ 329.585402] loop7: detected capacity change from 0 to 127 14:48:23 executing program 3: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) 14:48:23 executing program 5: mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) [ 329.647045] tmpfs: Unknown parameter 'uid<00000000000000060929' 14:48:23 executing program 6: syz_mount_image$ext4(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000240)='./file0\x00', 0x0) setresuid(0x0, 0x0, 0x0) lchown(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) [ 329.687566] 9pnet_fd: Insufficient options for proto=fd 14:48:23 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='uid_map\x00') r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) dup2(r0, r1) 14:48:23 executing program 2: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) 14:48:23 executing program 3: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5}) 14:48:23 executing program 5: mkdir(0x0, 0xd0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) [ 329.761051] 9pnet: Could not find request transport: xen [ 329.846377] 9pnet: Could not find request transport: xen 14:48:23 executing program 5: mkdir(0x0, 0xd0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:48:23 executing program 0: mkdir(0x0, 0xd0) open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) 14:48:23 executing program 1: r0 = syz_open_procfs(0x0, 0x0) r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) dup2(r0, r1) 14:48:23 executing program 3: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5}) 14:48:23 executing program 4: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) mount$9p_xen(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x1804003, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}, {@cache_loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) [ 329.929832] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 329.940795] loop4: detected capacity change from 0 to 127 [ 330.032565] 9pnet: Could not find request transport: xen 14:48:36 executing program 4: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) mount$9p_xen(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x1804003, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}, {@cache_loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) 14:48:36 executing program 6: syz_mount_image$ext4(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) setresuid(0x0, 0x0, 0x0) lchown(&(0x7f0000000000)='./file0\x00', r0, 0x0) 14:48:36 executing program 1: r0 = syz_open_procfs(0x0, 0x0) r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) dup2(r0, r1) 14:48:36 executing program 3: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5}) 14:48:36 executing program 2: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) 14:48:36 executing program 7: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:48:36 executing program 0: mkdir(0x0, 0xd0) open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) 14:48:36 executing program 5: mkdir(0x0, 0xd0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) [ 343.137516] tmpfs: Unknown parameter 'uid<00000000000000060929' 14:48:37 executing program 6: syz_mount_image$ext4(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) setresuid(0x0, 0x0, 0x0) lchown(&(0x7f0000000000)='./file0\x00', r0, 0x0) [ 343.143795] 9pnet_fd: Insufficient options for proto=fd [ 343.157768] loop4: detected capacity change from 0 to 127 [ 343.163018] tmpfs: Unknown parameter 'uid<00000000000000060929' 14:48:37 executing program 5: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:48:37 executing program 2: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) [ 343.234029] 9pnet_fd: Insufficient options for proto=fd [ 343.270347] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 343.316173] 9pnet: Could not find request transport: xen 14:48:48 executing program 3: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5}) 14:48:48 executing program 0: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) 14:48:48 executing program 4: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) mount$9p_xen(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x1804003, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}, {@cache_loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) 14:48:48 executing program 2: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) 14:48:48 executing program 5: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, 0x0, &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:48:48 executing program 7: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:48:48 executing program 1: r0 = syz_open_procfs(0x0, 0x0) r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) dup2(r0, r1) 14:48:48 executing program 6: syz_mount_image$ext4(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) setresuid(0x0, 0x0, 0x0) lchown(&(0x7f0000000000)='./file0\x00', r0, 0x0) [ 355.005955] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 355.026152] 9pnet_fd: Insufficient options for proto=fd 14:48:48 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='uid_map\x00') r1 = openat$cdrom(0xffffffffffffff9c, 0x0, 0x80a83, 0x0) dup2(r0, r1) 14:48:48 executing program 7: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) [ 355.081999] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 355.132377] 9pnet_fd: Insufficient options for proto=fd 14:48:49 executing program 5: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, 0x0, &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:48:49 executing program 2: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) 14:48:49 executing program 0: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) open_tree(0xffffffffffffff9c, 0x0, 0x101) 14:48:49 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='uid_map\x00') r1 = openat$cdrom(0xffffffffffffff9c, 0x0, 0x80a83, 0x0) dup2(r0, r1) 14:48:49 executing program 7: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:48:49 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5}) 14:48:49 executing program 6: syz_mount_image$ext4(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) setresuid(0x0, r0, 0x0) lchown(0x0, r0, 0x0) 14:48:49 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='uid_map\x00') r1 = openat$cdrom(0xffffffffffffff9c, 0x0, 0x80a83, 0x0) dup2(r0, r1) [ 355.282650] 9pnet: Could not find request transport: xen 14:48:49 executing program 4: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) mount$9p_xen(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x1804003, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}, {@cache_loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) 14:48:49 executing program 7: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:48:49 executing program 5: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, 0x0, &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) [ 355.372694] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 355.421449] 9pnet: Could not find request transport: xen 14:49:02 executing program 3: r0 = syz_open_dev$loop(0x0, 0xaeab, 0x400) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5}) 14:49:02 executing program 2: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) 14:49:02 executing program 4: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) mount$9p_xen(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x1804003, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}, {@cache_loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) 14:49:02 executing program 0: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) open_tree(0xffffffffffffff9c, 0x0, 0x101) 14:49:02 executing program 7: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:49:02 executing program 5: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', 0x0, 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:49:02 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='uid_map\x00') r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x0, 0x0) dup2(r0, r1) 14:49:02 executing program 6: syz_mount_image$ext4(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) setresuid(0x0, r0, 0x0) lchown(0x0, r0, 0x0) 14:49:02 executing program 7: mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) [ 368.387281] 9pnet_fd: Insufficient options for proto=fd 14:49:02 executing program 6: syz_mount_image$ext4(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) setresuid(0x0, r0, 0x0) lchown(0x0, r0, 0x0) 14:49:02 executing program 5: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', 0x0, 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:49:02 executing program 4: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) mount$9p_xen(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x1804003, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}, {@cache_loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) 14:49:02 executing program 0: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) open_tree(0xffffffffffffff9c, 0x0, 0x101) 14:49:02 executing program 2: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) 14:49:02 executing program 7: mkdir(0x0, 0xd0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:49:02 executing program 3: r0 = syz_open_dev$loop(0x0, 0xaeab, 0x400) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5}) 14:49:02 executing program 6: syz_mount_image$ext4(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) setresuid(0x0, r0, 0x0) lchown(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) 14:49:02 executing program 5: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', 0x0, 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:49:15 executing program 5: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:49:15 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='uid_map\x00') r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x0, 0x0) dup2(r0, r1) 14:49:15 executing program 2: syz_mount_image$tmpfs(&(0x7f0000000040), 0x0, 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) 14:49:15 executing program 3: r0 = syz_open_dev$loop(0x0, 0xaeab, 0x400) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5}) 14:49:15 executing program 0: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x0) 14:49:15 executing program 4: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) mount$9p_xen(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x1804003, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}, {@cache_loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) 14:49:15 executing program 6: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) r4 = dup(r0) r5 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r4, 0xc0189371, &(0x7f0000000700)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) dup2(r2, r5) fspick(r6, &(0x7f0000000740)='./file0\x00', 0x0) 14:49:15 executing program 7: mkdir(0x0, 0xd0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) [ 381.233869] 9pnet_fd: Insufficient options for proto=fd 14:49:15 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000000), 0x0, 0x400) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5}) 14:49:15 executing program 7: mkdir(0x0, 0xd0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:49:15 executing program 5: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, 0x0) 14:49:15 executing program 4: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) mount$9p_xen(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x1804003, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}, {@cache_loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) [ 381.431624] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 381.526971] 9pnet: Could not find request transport: xen 14:49:27 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) mount$9p_xen(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x1804003, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}, {@cache_loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) 14:49:27 executing program 0: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x0) 14:49:27 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000000), 0x0, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5}) 14:49:27 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='uid_map\x00') r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x0, 0x0) dup2(r0, r1) 14:49:27 executing program 2: syz_mount_image$tmpfs(&(0x7f0000000040), 0x0, 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) 14:49:27 executing program 6: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) setxattr$security_selinux(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0), &(0x7f0000000800)='system_u:object_r:shell_exec_t:s0\x00', 0x22, 0x2) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0xf0f1e000) setxattr$security_capability(&(0x7f0000000840)='./file0\x00', &(0x7f0000000880), &(0x7f00000008c0)=@v3={0x3000000, [{0x421e, 0x8001}, {0x6, 0x7}], 0xee01}, 0x18, 0x3) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000900)={"7f6d1f508aa7a78b4903735cf6ee0d94", 0x0, 0x0, {0x6, 0x8}, {0x9f4, 0x9}, 0x1f, [0xfcd, 0x8, 0x5, 0x3, 0x6, 0x5, 0x40, 0xffff, 0x2, 0x1, 0x6, 0x7fff, 0xc0, 0x3, 0x3]}) r2 = socket$netlink(0x10, 0x3, 0xa) ioctl$BTRFS_IOC_SCRUB(r2, 0xc400941b, &(0x7f0000000a00)={0x0, 0x689, 0x4, 0x1}) r3 = openat$incfs(r1, &(0x7f0000000e00)='.pending_reads\x00', 0x22000, 0x1c8) renameat(r3, &(0x7f0000000e40)='./file0\x00', r1, &(0x7f0000000e80)='./file0\x00') mount$9p_xen(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x1804003, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}, {@cache_loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) 14:49:27 executing program 7: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:49:27 executing program 5: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, 0x0) 14:49:27 executing program 3: syz_open_dev$loop(&(0x7f0000000000), 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5}) 14:49:27 executing program 2: syz_mount_image$tmpfs(&(0x7f0000000040), 0x0, 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) [ 394.130621] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 394.135139] 9pnet_fd: Insufficient options for proto=fd 14:49:28 executing program 5: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, 0x0) [ 394.152224] loop6: detected capacity change from 0 to 127 [ 394.232085] 9pnet: Could not find request transport: xen [ 394.299781] 9pnet: Could not find request transport: xen 14:49:42 executing program 3: syz_open_dev$loop(&(0x7f0000000000), 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5}) 14:49:42 executing program 6: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) setxattr$security_selinux(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0), &(0x7f0000000800)='system_u:object_r:shell_exec_t:s0\x00', 0x22, 0x2) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0xf0f1e000) setxattr$security_capability(&(0x7f0000000840)='./file0\x00', &(0x7f0000000880), &(0x7f00000008c0)=@v3={0x3000000, [{0x421e, 0x8001}, {0x6, 0x7}], 0xee01}, 0x18, 0x3) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000900)={"7f6d1f508aa7a78b4903735cf6ee0d94", 0x0, 0x0, {0x6, 0x8}, {0x9f4, 0x9}, 0x1f, [0xfcd, 0x8, 0x5, 0x3, 0x6, 0x5, 0x40, 0xffff, 0x2, 0x1, 0x6, 0x7fff, 0xc0, 0x3, 0x3]}) r2 = socket$netlink(0x10, 0x3, 0xa) ioctl$BTRFS_IOC_SCRUB(r2, 0xc400941b, &(0x7f0000000a00)={0x0, 0x689, 0x4, 0x1}) r3 = openat$incfs(r1, &(0x7f0000000e00)='.pending_reads\x00', 0x22000, 0x1c8) renameat(r3, &(0x7f0000000e40)='./file0\x00', r1, &(0x7f0000000e80)='./file0\x00') mount$9p_xen(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x1804003, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}, {@cache_loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) 14:49:42 executing program 5: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:49:42 executing program 1: syz_open_procfs(0x0, &(0x7f00000003c0)='uid_map\x00') r0 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) dup2(0xffffffffffffffff, r0) 14:49:42 executing program 2: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) 14:49:42 executing program 0: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x0) 14:49:42 executing program 7: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, 0x0, &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:49:42 executing program 4: syz_mount_image$tmpfs(0x0, 0x0, 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) mount$9p_xen(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x1804003, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}, {@cache_loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) [ 409.069677] 9pnet_fd: Insufficient options for proto=fd [ 409.081949] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 409.087188] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 409.108879] loop6: detected capacity change from 0 to 127 14:49:43 executing program 3: syz_open_dev$loop(&(0x7f0000000000), 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5}) 14:49:43 executing program 1: syz_open_procfs(0x0, &(0x7f00000003c0)='uid_map\x00') r0 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) dup2(0xffffffffffffffff, r0) 14:49:43 executing program 4: syz_mount_image$tmpfs(0x0, 0x0, 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) mount$9p_xen(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x1804003, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}, {@cache_loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) 14:49:43 executing program 5: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:49:43 executing program 7: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, 0x0, &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:49:43 executing program 2: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) [ 409.233099] 9pnet_fd: Insufficient options for proto=fd [ 409.252853] tmpfs: Unknown parameter 'uid<00000000000000060929' 14:49:43 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000000), 0x0, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, 0x0) 14:49:43 executing program 4: syz_mount_image$tmpfs(0x0, 0x0, 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) mount$9p_xen(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x1804003, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}, {@cache_loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) [ 409.329218] 9pnet: Could not find request transport: xen 14:49:55 executing program 6: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) setxattr$security_selinux(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0), &(0x7f0000000800)='system_u:object_r:shell_exec_t:s0\x00', 0x22, 0x2) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0xf0f1e000) setxattr$security_capability(&(0x7f0000000840)='./file0\x00', &(0x7f0000000880), &(0x7f00000008c0)=@v3={0x3000000, [{0x421e, 0x8001}, {0x6, 0x7}], 0xee01}, 0x18, 0x3) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000900)={"7f6d1f508aa7a78b4903735cf6ee0d94", 0x0, 0x0, {0x6, 0x8}, {0x9f4, 0x9}, 0x1f, [0xfcd, 0x8, 0x5, 0x3, 0x6, 0x5, 0x40, 0xffff, 0x2, 0x1, 0x6, 0x7fff, 0xc0, 0x3, 0x3]}) r2 = socket$netlink(0x10, 0x3, 0xa) ioctl$BTRFS_IOC_SCRUB(r2, 0xc400941b, &(0x7f0000000a00)={0x0, 0x689, 0x4, 0x1}) r3 = openat$incfs(r1, &(0x7f0000000e00)='.pending_reads\x00', 0x22000, 0x1c8) renameat(r3, &(0x7f0000000e40)='./file0\x00', r1, &(0x7f0000000e80)='./file0\x00') mount$9p_xen(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x1804003, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}, {@cache_loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) 14:49:55 executing program 2: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) 14:49:55 executing program 7: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, 0x0, &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:49:55 executing program 0: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, 0x0) 14:49:55 executing program 1: syz_open_procfs(0x0, &(0x7f00000003c0)='uid_map\x00') r0 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) dup2(0xffffffffffffffff, r0) 14:49:55 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000000), 0x0, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, 0x0) 14:49:55 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) mount$9p_xen(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x1804003, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}, {@cache_loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) 14:49:55 executing program 5: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) [ 421.719865] tmpfs: Unknown parameter 'uid<00000000000000060929' 14:49:55 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000000), 0x0, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, 0x0) [ 421.756101] 9pnet_fd: Insufficient options for proto=fd [ 421.774785] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 421.801907] loop6: detected capacity change from 0 to 127 14:49:55 executing program 2: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 14:49:55 executing program 7: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', 0x0, 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:49:55 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000000), 0x0, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, 0x0) 14:49:55 executing program 5: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:49:55 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='uid_map\x00') openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) dup2(r0, 0xffffffffffffffff) 14:49:55 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000000), 0x0, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, 0x0) [ 422.026000] 9pnet_fd: Insufficient options for proto=fd [ 422.027219] 9pnet: Could not find request transport: xen 14:49:55 executing program 2: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) [ 422.092088] 9pnet: Could not find request transport: xen 14:50:07 executing program 7: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', 0x0, 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:50:07 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='uid_map\x00') openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) dup2(r0, 0xffffffffffffffff) 14:50:07 executing program 2: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 14:50:07 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000000), 0x0, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, 0x0) 14:50:07 executing program 5: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@noextend}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:50:07 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000000), 0x0, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x0, 0x0, 0x4, 0x6, 0x5}) 14:50:07 executing program 6: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) setxattr$security_selinux(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0), &(0x7f0000000800)='system_u:object_r:shell_exec_t:s0\x00', 0x22, 0x2) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0xf0f1e000) setxattr$security_capability(&(0x7f0000000840)='./file0\x00', &(0x7f0000000880), &(0x7f00000008c0)=@v3={0x3000000, [{0x421e, 0x8001}, {0x6, 0x7}], 0xee01}, 0x18, 0x3) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000900)={"7f6d1f508aa7a78b4903735cf6ee0d94", 0x0, 0x0, {0x6, 0x8}, {0x9f4, 0x9}, 0x1f, [0xfcd, 0x8, 0x5, 0x3, 0x6, 0x5, 0x40, 0xffff, 0x2, 0x1, 0x6, 0x7fff, 0xc0, 0x3, 0x3]}) r2 = socket$netlink(0x10, 0x3, 0xa) ioctl$BTRFS_IOC_SCRUB(r2, 0xc400941b, &(0x7f0000000a00)={0x0, 0x689, 0x4, 0x1}) r3 = openat$incfs(r1, &(0x7f0000000e00)='.pending_reads\x00', 0x22000, 0x1c8) renameat(r3, &(0x7f0000000e40)='./file0\x00', r1, &(0x7f0000000e80)='./file0\x00') 14:50:07 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) mount$9p_xen(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x1804003, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}, {@cache_loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) [ 434.021010] 9pnet_fd: Insufficient options for proto=fd [ 434.025003] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 434.043130] loop6: detected capacity change from 0 to 127 14:50:07 executing program 2: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) 14:50:07 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='uid_map\x00') openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) dup2(r0, 0xffffffffffffffff) 14:50:07 executing program 0: ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, 0x0) 14:50:08 executing program 7: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', 0x0, 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:50:08 executing program 5: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@noextend}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:50:08 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000000), 0x0, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x0, 0x0, 0x0, 0x6, 0x5}) [ 434.209511] tmpfs: Unknown parameter 'uid<00000000000000060929' 14:50:08 executing program 6: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) setxattr$security_selinux(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0), &(0x7f0000000800)='system_u:object_r:shell_exec_t:s0\x00', 0x22, 0x2) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0xf0f1e000) setxattr$security_capability(&(0x7f0000000840)='./file0\x00', &(0x7f0000000880), &(0x7f00000008c0)=@v3={0x3000000, [{0x421e, 0x8001}, {0x6, 0x7}], 0xee01}, 0x18, 0x3) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000900)={"7f6d1f508aa7a78b4903735cf6ee0d94", 0x0, 0x0, {0x6, 0x8}, {0x9f4, 0x9}, 0x1f, [0xfcd, 0x8, 0x5, 0x3, 0x6, 0x5, 0x40, 0xffff, 0x2, 0x1, 0x6, 0x7fff, 0xc0, 0x3, 0x3]}) r2 = socket$netlink(0x10, 0x3, 0xa) ioctl$BTRFS_IOC_SCRUB(r2, 0xc400941b, &(0x7f0000000a00)={0x0, 0x689, 0x4, 0x1}) openat$incfs(r1, &(0x7f0000000e00)='.pending_reads\x00', 0x22000, 0x1c8) [ 434.239201] 9pnet: Could not find request transport: xen [ 434.299017] 9pnet_fd: Insufficient options for proto=fd [ 434.332790] tmpfs: Unknown parameter 'uid<00000000000000060929' 14:50:08 executing program 2: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) 14:50:08 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) mount$9p_xen(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x1804003, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}, {@cache_loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) 14:50:08 executing program 0: ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, 0x0) [ 434.425201] tmpfs: Unknown parameter 'uid<00000000000000060929' 14:50:08 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='uid_map\x00') r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x0, 0x0) dup2(r0, r1) 14:50:08 executing program 7: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:50:08 executing program 6: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) setxattr$security_selinux(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0), &(0x7f0000000800)='system_u:object_r:shell_exec_t:s0\x00', 0x22, 0x2) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0xf0f1e000) setxattr$security_capability(&(0x7f0000000840)='./file0\x00', &(0x7f0000000880), &(0x7f00000008c0)=@v3={0x3000000, [{0x421e, 0x8001}, {0x6, 0x7}], 0xee01}, 0x18, 0x3) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000900)={"7f6d1f508aa7a78b4903735cf6ee0d94", 0x0, 0x0, {0x6, 0x8}, {0x9f4, 0x9}, 0x1f, [0xfcd, 0x8, 0x5, 0x3, 0x6, 0x5, 0x40, 0xffff, 0x2, 0x1, 0x6, 0x7fff, 0xc0, 0x3, 0x3]}) r2 = socket$netlink(0x10, 0x3, 0xa) ioctl$BTRFS_IOC_SCRUB(r2, 0xc400941b, &(0x7f0000000a00)={0x0, 0x689, 0x4, 0x1}) 14:50:08 executing program 5: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@noextend}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) [ 434.504812] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 434.511820] loop6: detected capacity change from 0 to 127 [ 434.516083] 9pnet_fd: Insufficient options for proto=fd [ 434.531845] 9pnet_fd: Insufficient options for proto=fd [ 434.564919] 9pnet: Could not find request transport: xen 14:50:21 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(&(0x7f0000001040), &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x1804003, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}, {@cache_loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) 14:50:21 executing program 5: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@noextend}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:50:21 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000000), 0x0, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x0, 0x0, 0x0, 0x0, 0x5}) 14:50:22 executing program 1: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) setxattr$security_selinux(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0), &(0x7f0000000800)='system_u:object_r:shell_exec_t:s0\x00', 0x22, 0x2) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0xf0f1e000) setxattr$security_capability(&(0x7f0000000840)='./file0\x00', &(0x7f0000000880), &(0x7f00000008c0)=@v3={0x3000000, [{0x421e, 0x8001}, {0x6, 0x7}], 0xee01}, 0x18, 0x3) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000900)={"7f6d1f508aa7a78b4903735cf6ee0d94", 0x0, 0x0, {0x6, 0x8}, {0x9f4, 0x9}, 0x1f, [0xfcd, 0x8, 0x5, 0x3, 0x6, 0x5, 0x40, 0xffff, 0x2, 0x1, 0x6, 0x7fff, 0xc0, 0x3, 0x3]}) r2 = socket$netlink(0x10, 0x3, 0xa) ioctl$BTRFS_IOC_SCRUB(r2, 0xc400941b, &(0x7f0000000a00)={0x0, 0x689, 0x4, 0x1}) r3 = openat$incfs(r1, &(0x7f0000000e00)='.pending_reads\x00', 0x22000, 0x1c8) renameat(r3, &(0x7f0000000e40)='./file0\x00', r1, &(0x7f0000000e80)='./file0\x00') 14:50:22 executing program 2: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) 14:50:22 executing program 0: ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, 0x0) 14:50:22 executing program 6: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) setxattr$security_selinux(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0), &(0x7f0000000800)='system_u:object_r:shell_exec_t:s0\x00', 0x22, 0x2) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0xf0f1e000) setxattr$security_capability(&(0x7f0000000840)='./file0\x00', &(0x7f0000000880), &(0x7f00000008c0)=@v3={0x3000000, [{0x421e, 0x8001}, {0x6, 0x7}], 0xee01}, 0x18, 0x3) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000900)={"7f6d1f508aa7a78b4903735cf6ee0d94", 0x0, 0x0, {0x6, 0x8}, {0x9f4, 0x9}, 0x1f, [0xfcd, 0x8, 0x5, 0x3, 0x6, 0x5, 0x40, 0xffff, 0x2, 0x1, 0x6, 0x7fff, 0xc0, 0x3, 0x3]}) socket$netlink(0x10, 0x3, 0xa) 14:50:22 executing program 7: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, 0x0) [ 448.157364] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 448.163428] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 448.173700] 9pnet_fd: Insufficient options for proto=fd [ 448.177353] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 448.179046] loop6: detected capacity change from 0 to 127 [ 448.183089] loop1: detected capacity change from 0 to 127 14:50:22 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000000), 0x0, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)) [ 448.281639] 9pnet: Could not find request transport: xen [ 462.270105] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 462.273497] 9pnet: Could not find request transport: xen 14:50:36 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x1804003, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}, {@cache_loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) 14:50:36 executing program 7: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, 0x0) 14:50:36 executing program 1: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) setxattr$security_selinux(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0), &(0x7f0000000800)='system_u:object_r:shell_exec_t:s0\x00', 0x22, 0x2) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0xf0f1e000) setxattr$security_capability(&(0x7f0000000840)='./file0\x00', &(0x7f0000000880), &(0x7f00000008c0)=@v3={0x3000000, [{0x421e, 0x8001}, {0x6, 0x7}], 0xee01}, 0x18, 0x3) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000900)={"7f6d1f508aa7a78b4903735cf6ee0d94", 0x0, 0x0, {0x6, 0x8}, {0x9f4, 0x9}, 0x1f, [0xfcd, 0x8, 0x5, 0x3, 0x6, 0x5, 0x40, 0xffff, 0x2, 0x1, 0x6, 0x7fff, 0xc0, 0x3, 0x3]}) r2 = socket$netlink(0x10, 0x3, 0xa) ioctl$BTRFS_IOC_SCRUB(r2, 0xc400941b, &(0x7f0000000a00)={0x0, 0x689, 0x4, 0x1}) r3 = openat$incfs(r1, &(0x7f0000000e00)='.pending_reads\x00', 0x22000, 0x1c8) renameat(r3, &(0x7f0000000e40)='./file0\x00', r1, &(0x7f0000000e80)='./file0\x00') 14:50:36 executing program 5: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@noextend}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:50:36 executing program 0: r0 = syz_open_dev$loop(0x0, 0x0, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, 0x0) 14:50:36 executing program 6: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) setxattr$security_selinux(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0), &(0x7f0000000800)='system_u:object_r:shell_exec_t:s0\x00', 0x22, 0x2) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0xf0f1e000) setxattr$security_capability(&(0x7f0000000840)='./file0\x00', &(0x7f0000000880), &(0x7f00000008c0)=@v3={0x3000000, [{0x421e, 0x8001}, {0x6, 0x7}], 0xee01}, 0x18, 0x3) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000900)={"7f6d1f508aa7a78b4903735cf6ee0d94", 0x0, 0x0, {0x6, 0x8}, {0x9f4, 0x9}, 0x1f, [0xfcd, 0x8, 0x5, 0x3, 0x6, 0x5, 0x40, 0xffff, 0x2, 0x1, 0x6, 0x7fff, 0xc0, 0x3, 0x3]}) 14:50:36 executing program 2: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}]}) 14:50:36 executing program 3: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) [ 462.303213] tmpfs: Unknown parameter 'uid<00000000000000060929' 14:50:36 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, 0x0, &(0x7f00000010c0), 0x1804003, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}, {@cache_loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) [ 462.326338] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 462.329412] 9pnet_fd: Insufficient options for proto=fd [ 462.331204] tmpfs: Unknown parameter 'uid<00000000000000060929' 14:50:36 executing program 2: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}]}) [ 462.346929] loop6: detected capacity change from 0 to 127 [ 462.350712] loop1: detected capacity change from 0 to 127 14:50:36 executing program 3: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) r4 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) dup2(r2, r4) 14:50:36 executing program 0: r0 = syz_open_dev$loop(0x0, 0x0, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, 0x0) [ 462.403427] tmpfs: Unknown parameter 'uid<00000000000000060929' 14:50:36 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, 0x0, &(0x7f00000010c0), 0x1804003, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}, {@cache_loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) 14:50:36 executing program 7: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, 0x0) 14:50:36 executing program 5: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@noextend}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:50:36 executing program 2: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}]}) 14:50:36 executing program 0: r0 = syz_open_dev$loop(0x0, 0x0, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, 0x0) 14:50:36 executing program 6: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) setxattr$security_selinux(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0), &(0x7f0000000800)='system_u:object_r:shell_exec_t:s0\x00', 0x22, 0x2) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0xf0f1e000) setxattr$security_capability(&(0x7f0000000840)='./file0\x00', &(0x7f0000000880), &(0x7f00000008c0)=@v3={0x3000000, [{0x421e, 0x8001}, {0x6, 0x7}], 0xee01}, 0x18, 0x3) [ 462.511199] tmpfs: Unknown parameter 'uid<00000000000000060929' 14:50:36 executing program 1: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r1, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', &(0x7f0000001d80)={{}, {0x1, 0x2}, [{0x2, 0x2, 0xffffffffffffffff}, {0x2, 0x1, r2}, {0x2, 0x3, 0xee01}, {0x2, 0x6}, {0x2, 0x1, r3}, {}, {0x2, 0x0, r4}], {}, [{0x8, 0x1, 0xee00}, {0x8, 0x4, 0xffffffffffffffff}, {0x8, 0x2, 0xffffffffffffffff}], {}, {0x20, 0x2}}, 0x74, 0x1) mkdir(&(0x7f0000001e00)='./file1\x00', 0x1a) fsetxattr$trusted_overlay_redirect(r1, &(0x7f0000001e40), &(0x7f0000001e80)='./file1/file0\x00', 0xe, 0x3) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001f00), r0) sendmsg$NL80211_CMD_TDLS_MGMT(r0, &(0x7f0000001fc0)={&(0x7f0000001ec0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001f80)={&(0x7f0000001f40)={0x2c, r5, 0x100, 0x70bd25, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000090}, 0x4001800) open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) 14:50:36 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, 0x0, &(0x7f00000010c0), 0x1804003, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}, {@cache_loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) 14:50:36 executing program 2: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) [ 462.577677] 9pnet_fd: Insufficient options for proto=fd 14:50:36 executing program 0: syz_open_dev$loop(&(0x7f0000000000), 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, 0x0) 14:50:36 executing program 3: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) setxattr$security_selinux(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0), &(0x7f0000000800)='system_u:object_r:shell_exec_t:s0\x00', 0x22, 0x2) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0xf0f1e000) setxattr$security_capability(&(0x7f0000000840)='./file0\x00', &(0x7f0000000880), &(0x7f00000008c0)=@v3={0x3000000, [{0x421e, 0x8001}, {0x6, 0x7}], 0xee01}, 0x18, 0x3) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000900)={"7f6d1f508aa7a78b4903735cf6ee0d94", 0x0, 0x0, {0x6, 0x8}, {0x9f4, 0x9}, 0x1f, [0xfcd, 0x8, 0x5, 0x3, 0x6, 0x5, 0x40, 0xffff, 0x2, 0x1, 0x6, 0x7fff, 0xc0, 0x3, 0x3]}) r2 = socket$netlink(0x10, 0x3, 0xa) ioctl$BTRFS_IOC_SCRUB(r2, 0xc400941b, &(0x7f0000000a00)={0x0, 0x689, 0x4, 0x1}) r3 = openat$incfs(r1, &(0x7f0000000e00)='.pending_reads\x00', 0x22000, 0x1c8) renameat(r3, &(0x7f0000000e40)='./file0\x00', r1, &(0x7f0000000e80)='./file0\x00') ioctl$AUTOFS_DEV_IOCTL_READY(r3, 0xc0189376, 0xfffffffffffffffe) syz_genetlink_get_family_id$nl80211(&(0x7f0000000f00), r1) [ 462.609081] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 462.618095] loop6: detected capacity change from 0 to 127 14:50:36 executing program 7: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) [ 462.663157] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 462.667838] 9pnet_fd: Insufficient options for proto=fd 14:50:36 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', 0x0, 0x1804003, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}, {@cache_loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) [ 462.678864] loop3: detected capacity change from 0 to 127 14:50:50 executing program 0: syz_open_dev$loop(&(0x7f0000000000), 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, 0x0) 14:50:50 executing program 5: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@noextend}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:50:50 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', 0x0, 0x1804003, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}, {@cache_loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) 14:50:50 executing program 7: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:50:50 executing program 6: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) setxattr$security_selinux(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0), &(0x7f0000000800)='system_u:object_r:shell_exec_t:s0\x00', 0x22, 0x2) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x8010, r1, 0xf0f1e000) 14:50:50 executing program 3: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) 14:50:50 executing program 1: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) dup(r0) r4 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) dup2(r2, r4) 14:50:50 executing program 2: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r1, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', &(0x7f0000001d80)={{}, {0x1, 0x2}, [{0x2, 0x2, 0xffffffffffffffff}, {0x2, 0x1, r2}, {0x2, 0x3, 0xee01}, {0x2, 0x6}, {0x2, 0x1, r3}, {}, {0x2, 0x0, r5}], {}, [{0x8, 0x1, 0xee00}, {0x8, 0x4, 0xffffffffffffffff}, {0x8, 0x2, 0xffffffffffffffff}], {}, {0x20, 0x2}}, 0x74, 0x1) mkdir(&(0x7f0000001e00)='./file1\x00', 0x1a) fsetxattr$trusted_overlay_redirect(r1, &(0x7f0000001e40), &(0x7f0000001e80)='./file1/file0\x00', 0xe, 0x3) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001f00), r0) sendmsg$NL80211_CMD_TDLS_MGMT(r0, &(0x7f0000001fc0)={&(0x7f0000001ec0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001f80)={&(0x7f0000001f40)={0x2c, r6, 0x100, 0x70bd25, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000090}, 0x4001800) r7 = open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {'rfdno', 0x3d, r7}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid={'access', 0x3d, r5}}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid={'dfltgid', 0x3d, r4}}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt={'euid>', r2}}, {@fowner_eq={'fowner', 0x3d, r2}}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) [ 476.956358] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 476.967631] 9pnet_fd: Insufficient options for proto=fd [ 476.986309] loop6: detected capacity change from 0 to 127 [ 476.994207] 9pnet_fd: Insufficient options for proto=fd [ 477.018994] 9pnet_fd: Insufficient options for proto=fd 14:50:50 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@noextend}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:50:50 executing program 5: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:50:51 executing program 7: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:50:51 executing program 0: syz_open_dev$loop(&(0x7f0000000000), 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, 0x0) 14:50:51 executing program 6: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) setxattr$security_selinux(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0), &(0x7f0000000800)='system_u:object_r:shell_exec_t:s0\x00', 0x22, 0x2) 14:50:51 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', 0x0, 0x1804003, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}, {@cache_loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) [ 477.182666] 9pnet_fd: Insufficient options for proto=fd [ 477.201061] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 477.205726] 9pnet_fd: Insufficient options for proto=fd [ 477.214661] 9pnet_fd: Insufficient options for proto=fd 14:51:03 executing program 1: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) r4 = dup(r0) r5 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r4, 0xc0189371, &(0x7f0000000700)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) r7 = dup2(r2, r5) r8 = fspick(r6, &(0x7f0000000740)='./file0\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r7, 0xc0189371, &(0x7f0000000780)={{0x1, 0x1, 0x18, r8}, './file0\x00'}) sendmsg$NL80211_CMD_DISASSOCIATE(r2, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x30, 0x0, 0x400, 0x70bd25, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_LOCAL_STATE_CHANGE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@broadcast}]}, 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0xc000) 14:51:03 executing program 7: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) [ 490.028917] 9pnet_fd: Insufficient options for proto=fd 14:51:03 executing program 3: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) 14:51:03 executing program 2: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) r4 = dup(r0) r5 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r4, 0xc0189371, &(0x7f0000000700)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) r7 = dup2(r2, r5) r8 = fspick(r6, &(0x7f0000000740)='./file0\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r7, 0xc0189371, &(0x7f0000000780)={{0x1, 0x1, 0x18, r8}, './file0\x00'}) sendmsg$NL80211_CMD_DISASSOCIATE(r2, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x30, 0x0, 0x400, 0x70bd25, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_LOCAL_STATE_CHANGE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@broadcast}]}, 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0xc000) 14:51:03 executing program 6: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) 14:51:03 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}, {@cache_loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) 14:51:03 executing program 5: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}]}}) 14:51:03 executing program 0: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) r4 = dup(r0) r5 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r4, 0xc0189371, &(0x7f0000000700)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) r7 = dup2(r2, r5) r8 = fspick(r6, &(0x7f0000000740)='./file0\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r7, 0xc0189371, &(0x7f0000000780)={{0x1, 0x1, 0x18, r8}, './file0\x00'}) sendmsg$NL80211_CMD_DISASSOCIATE(r2, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x30, 0x0, 0x400, 0x70bd25, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_LOCAL_STATE_CHANGE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@broadcast}]}, 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0xc000) sendmsg$NL80211_CMD_SET_MAC_ACL(r4, &(0x7f0000000a00)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000900)={0x94, 0x0, 0x100, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @val={0xc, 0x99, {0x7fffffff, 0x2f}}}}, [@NL80211_ATTR_ACL_POLICY={0x8}, @NL80211_ATTR_MAC_ADDRS={0x4c, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}, {0xa}, {0xa, 0x6, @broadcast}, {0xa, 0x6, @device_b}, {0xa, 0x6, @device_b}, {0xa}]}, @NL80211_ATTR_ACL_POLICY={0x8}, @NL80211_ATTR_MAC_ADDRS={0x10, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x4}, 0x800) 14:51:03 executing program 7: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@noextend}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) [ 490.092909] 9pnet_fd: Insufficient options for proto=fd [ 490.114212] 9pnet_fd: Insufficient options for proto=fd [ 490.122078] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 490.130224] loop6: detected capacity change from 0 to 127 14:51:04 executing program 1: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r2, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', &(0x7f0000001d80)={{}, {0x1, 0x2}, [{0x2, 0x2, 0xffffffffffffffff}, {0x2, 0x1, r3}, {0x2, 0x3, 0xee01}, {0x2, 0x6}, {0x2, 0x1, r4}, {}, {0x2, 0x0, r6}], {}, [{0x8, 0x1, 0xee00}, {0x8, 0x4, 0xffffffffffffffff}, {0x8, 0x2, 0xffffffffffffffff}], {}, {0x20, 0x2}}, 0x74, 0x1) mkdir(&(0x7f0000001e00)='./file1\x00', 0x1a) fsetxattr$trusted_overlay_redirect(r2, &(0x7f0000001e40), &(0x7f0000001e80)='./file1/file0\x00', 0xe, 0x3) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001f00), r0) sendmsg$NL80211_CMD_TDLS_MGMT(r0, &(0x7f0000001fc0)={&(0x7f0000001ec0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001f80)={&(0x7f0000001f40)={0x2c, r7, 0x100, 0x70bd25, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000090}, 0x4001800) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) fstat(r1, &(0x7f0000002100)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {'rfdno', 0x3d, r8}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid={'access', 0x3d, r6}}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid={'dfltuid', 0x3d, r9}}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid={'dfltgid', 0x3d, r5}}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt={'euid>', r3}}, {@fowner_eq={'fowner', 0x3d, r3}}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) [ 490.141406] 9pnet: Could not find request transport: xen 14:51:04 executing program 7: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@noextend}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:51:04 executing program 5: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}]}}) 14:51:04 executing program 6: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) 14:51:04 executing program 3: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) [ 490.215499] 9pnet_fd: Insufficient options for proto=fd [ 490.220436] 9pnet_fd: Insufficient options for proto=fd 14:51:04 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, 0x0) [ 490.307445] 9pnet_fd: Insufficient options for proto=fd [ 490.330739] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 490.341077] loop6: detected capacity change from 0 to 127 14:51:18 executing program 7: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@noextend}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) [ 504.303230] tmpfs: Unknown parameter 'uid<00000000000000060929' 14:51:18 executing program 0: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) r4 = dup(r0) r5 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r4, 0xc0189371, &(0x7f0000000700)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) r7 = dup2(r2, r5) r8 = fspick(r6, &(0x7f0000000740)='./file0\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r7, 0xc0189371, &(0x7f0000000780)={{0x1, 0x1, 0x18, r8}, './file0\x00'}) sendmsg$NL80211_CMD_DISASSOCIATE(r2, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x30, 0x0, 0x400, 0x70bd25, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_LOCAL_STATE_CHANGE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@broadcast}]}, 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0xc000) sendmsg$NL80211_CMD_SET_MAC_ACL(r4, &(0x7f0000000a00)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000900)={0x94, 0x0, 0x100, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @val={0xc, 0x99, {0x7fffffff, 0x2f}}}}, [@NL80211_ATTR_ACL_POLICY={0x8}, @NL80211_ATTR_MAC_ADDRS={0x4c, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}, {0xa}, {0xa, 0x6, @broadcast}, {0xa, 0x6, @device_b}, {0xa, 0x6, @device_b}, {0xa}]}, @NL80211_ATTR_ACL_POLICY={0x8}, @NL80211_ATTR_MAC_ADDRS={0x10, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x4}, 0x800) 14:51:18 executing program 6: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) 14:51:18 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, 0x0) 14:51:18 executing program 1: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r2, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', &(0x7f0000001d80)={{}, {0x1, 0x2}, [{0x2, 0x2, 0xffffffffffffffff}, {0x2, 0x1, r3}, {0x2, 0x3, 0xee01}, {0x2, 0x6}, {0x2, 0x1, r4}, {}, {0x2, 0x0, r6}], {}, [{0x8, 0x1, 0xee00}, {0x8, 0x4, 0xffffffffffffffff}, {0x8, 0x2, 0xffffffffffffffff}], {}, {0x20, 0x2}}, 0x74, 0x1) mkdir(&(0x7f0000001e00)='./file1\x00', 0x1a) fsetxattr$trusted_overlay_redirect(r2, &(0x7f0000001e40), &(0x7f0000001e80)='./file1/file0\x00', 0xe, 0x3) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001f00), r0) sendmsg$NL80211_CMD_TDLS_MGMT(r0, &(0x7f0000001fc0)={&(0x7f0000001ec0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001f80)={&(0x7f0000001f40)={0x2c, r7, 0x100, 0x70bd25, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000090}, 0x4001800) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) fstat(r1, &(0x7f0000002100)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {'rfdno', 0x3d, r8}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid={'access', 0x3d, r6}}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid={'dfltuid', 0x3d, r9}}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid={'dfltgid', 0x3d, r5}}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt={'euid>', r3}}, {@fowner_eq={'fowner', 0x3d, r3}}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:51:18 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) 14:51:18 executing program 5: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}]}}) 14:51:18 executing program 2: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) r0 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) r1 = openat2(r0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x82, 0x40, 0x8}, 0x18) accept4(r1, &(0x7f00000006c0)=@can, &(0x7f0000000740)=0x80, 0x1000) syncfs(r0) [ 504.318116] loop2: detected capacity change from 0 to 127 [ 504.332408] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 504.340200] 9pnet_fd: Insufficient options for proto=fd [ 504.344154] loop6: detected capacity change from 0 to 127 [ 504.349970] 9pnet_fd: Insufficient options for proto=fd [ 504.356335] 9pnet_fd: Insufficient options for proto=fd 14:51:18 executing program 0: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) r4 = dup(r0) r5 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r4, 0xc0189371, &(0x7f0000000700)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) dup2(r2, r5) 14:51:18 executing program 2: syz_mount_image$ext4(&(0x7f0000000140)='ext2\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x1, &(0x7f0000001480)=[{&(0x7f00000001c0)="12b46d6821e2b9780a4eef2b83e62fd8903b5db787ada822637a7a58c9", 0x1d, 0xffffffffffff7fff}], 0x2008002, &(0x7f0000001500)={[{@minixdf}, {@quota}, {@resuid={'resuid', 0x3d, 0xee01}}, {@noacl}, {@prjquota}, {@nodelalloc}, {@nobarrier}, {@orlov}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0xffffffffffffff81}}], [{@permit_directio}, {@uid_eq}, {@smackfshat={'smackfshat', 0x3d, 'ns/ipc\x00'}}, {@subj_role={'subj_role', 0x3d, 'ns/ipc\x00'}}, {@pcr={'pcr', 0x3d, 0x9}}, {@defcontext={'defcontext', 0x3d, 'sysadm_u'}}]}) setresuid(0x0, 0x0, 0x0) lchown(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) 14:51:18 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) 14:51:18 executing program 5: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}], [{@permit_directio}, {@dont_measure}, {@appraise_type}]}}) 14:51:18 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, 0x0) [ 504.431884] loop2: detected capacity change from 0 to 16255 [ 504.437593] EXT4-fs: Mount option "noacl" will be removed by 3.5 [ 504.437593] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 504.437593] [ 504.438762] EXT4-fs: Ignoring removed orlov option [ 504.444768] ext2: Bad value for 'debug_want_extra_isize' 14:51:18 executing program 7: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@noextend}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:51:18 executing program 1: r0 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) keyctl$invalidate(0x15, r0) r1 = add_key$fscrypt_provisioning(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)={0x0, 0x0, @auto=[0x17]}, 0x9, r0) r2 = request_key(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)='-)\\${\\\\\x17\'%&][@\x7f#[,\x00', 0xfffffffffffffff9) r3 = add_key(&(0x7f0000000240)='id_legacy\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="47b91d59f63be3ffd728f1da32a417d6229b5f5355f72eacd94dde9dc2d83701375ffebf14ac11d548e515", 0x2b, 0xfffffffffffffffc) keyctl$KEYCTL_MOVE(0x1e, r1, r2, r3, 0x0) request_key(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={'syz', 0x1}, &(0x7f0000000380)='id_legacy\x00', r3) r4 = request_key(&(0x7f00000003c0)='cifs.idmap\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000440)='/\x8fy){/(@\x00', r2) r5 = request_key(&(0x7f0000000480)='syzkaller\x00', &(0x7f00000004c0)={'syz', 0x0}, &(0x7f0000000500)='\x00', 0xfffffffffffffffb) keyctl$describe(0x6, r5, &(0x7f0000000540), 0x0) r6 = add_key$keyring(&(0x7f0000000640), &(0x7f0000000680)={'syz', 0x3}, 0x0, 0x0, r3) r7 = request_key(&(0x7f0000000580)='keyring\x00', &(0x7f00000005c0)={'syz', 0x3}, &(0x7f0000000600)='{%^#]*\x00', r6) add_key$keyring(&(0x7f00000006c0), &(0x7f0000000700)={'syz', 0x3}, 0x0, 0x0, r2) r8 = add_key$fscrypt_v1(&(0x7f0000000740), &(0x7f0000000780)={'fscrypt:', @desc1}, &(0x7f00000007c0)={0x0, "1a61b170aa2e74fa2e2a58b75a62ed60ed4c0d5f2da48478b7926a7387aff5957112b698943a3a974513d87e02845c385f49f39c58dd3836a95d1b9608ab57c6", 0x15}, 0x48, r0) r9 = add_key(&(0x7f0000000840)='dns_resolver\x00', &(0x7f0000000880)={'syz', 0x0}, &(0x7f00000008c0)="b7e87711369e4d18ad73a277c2aefd84d885ee8eb2cc7c6a1d6e5a230ee77d9fe4c35454ae3ca9dd55f8e002c51506a84304535f", 0x34, 0xfffffffffffffff8) keyctl$KEYCTL_MOVE(0x1e, r8, r7, r9, 0x1) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', r4) 14:51:18 executing program 6: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file0\x00', 0x7, 0x3, &(0x7f0000000580)=[{&(0x7f0000000380)="a4271f37856e3677aaf5ca5f846e5f1a899fad8875fa1acba595437763e1dcdffc05e24b3e3695649e8b43a4b1904e2ac696c421e8389b211f40fe48120d4b750600a5148aedc79b9a1493904a61cde8406e041e48511227cdf031ec56d50409a7dc151ca0d33fd5506cfb841b249bf2d1cb2bc018234455b6437ba26d23975f2ce41a9895c94c89ff6b0903e414365aa58135c25e4b3df727261fe4e3b5ca6dff8e1b1c21586d1a4945790e9a27231d41fede1d29c96ea12a6dc1", 0xbb, 0x7}, {&(0x7f0000000440)="d60ef0cd7a2d65fff6c9e489685be5caa0c665e641ee0cfd6d2faa01f85861385d121b632ded084d60cd08864285468decabf7fa5cc035bd4e6a26edec584122034ccda59131b04b70df4ec302fa98ae4fa23be0c3563641319523b6a72e5858acfcec134e6b1af36f99b689d905caa9a3a8c5d2e518c079047e4274e45d", 0x7e, 0x7fff}, {&(0x7f00000004c0)="8731abadd735985f2bef63314d3b628f859fb345194c33b5bbb367cb09dc89aa56a24843eb28db6751298538f6e89fe956a7ea5dbdbf7b419b136447a64de91458daf043b057cdacab591ea18d87dc12c748d8ad2bb38e9435ab12751654b098409cbb9acbe1fb23e1df9ae07b393bab062dded7692523e2d459a3d8e89d0cdb56c2d6f4", 0x84, 0x80}], 0x220060, &(0x7f0000000600)={[{@fat=@nfs}, {@fat=@dos1xfloppy}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}) [ 504.511098] 9pnet_fd: Insufficient options for proto=fd [ 504.552097] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 504.552825] 9pnet_fd: Insufficient options for proto=fd [ 504.582664] loop6: detected capacity change from 0 to 127 14:51:32 executing program 6: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280), &(0x7f00000002c0)=@v1={0x1000000, [{0x40, 0xffffff42}]}, 0xc, 0x3) 14:51:32 executing program 0: r0 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) keyctl$invalidate(0x15, r0) r1 = add_key$fscrypt_provisioning(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)={0x0, 0x0, @auto=[0x17]}, 0x9, r0) r2 = request_key(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)='-)\\${\\\\\x17\'%&][@\x7f#[,\x00', 0xfffffffffffffff9) r3 = add_key(&(0x7f0000000240)='id_legacy\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="47b91d59f63be3ffd728f1da32a417d6229b5f5355f72eacd94dde9dc2d83701375ffebf14ac11d548e515", 0x2b, 0xfffffffffffffffc) keyctl$KEYCTL_MOVE(0x1e, r1, r2, r3, 0x0) request_key(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={'syz', 0x1}, &(0x7f0000000380)='id_legacy\x00', r3) r4 = request_key(&(0x7f00000003c0)='cifs.idmap\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000440)='/\x8fy){/(@\x00', r2) r5 = request_key(&(0x7f0000000480)='syzkaller\x00', &(0x7f00000004c0)={'syz', 0x0}, &(0x7f0000000500)='\x00', 0xfffffffffffffffb) keyctl$describe(0x6, r5, &(0x7f0000000540), 0x0) r6 = add_key$keyring(&(0x7f0000000640), &(0x7f0000000680)={'syz', 0x3}, 0x0, 0x0, r3) r7 = request_key(&(0x7f0000000580)='keyring\x00', &(0x7f00000005c0)={'syz', 0x3}, &(0x7f0000000600)='{%^#]*\x00', r6) add_key$keyring(&(0x7f00000006c0), &(0x7f0000000700)={'syz', 0x3}, 0x0, 0x0, r2) r8 = add_key$fscrypt_v1(&(0x7f0000000740), &(0x7f0000000780)={'fscrypt:', @desc1}, &(0x7f00000007c0)={0x0, "1a61b170aa2e74fa2e2a58b75a62ed60ed4c0d5f2da48478b7926a7387aff5957112b698943a3a974513d87e02845c385f49f39c58dd3836a95d1b9608ab57c6", 0x15}, 0x48, r0) r9 = add_key(&(0x7f0000000840)='dns_resolver\x00', &(0x7f0000000880)={'syz', 0x0}, &(0x7f00000008c0)="b7e87711369e4d18ad73a277c2aefd84d885ee8eb2cc7c6a1d6e5a230ee77d9fe4c35454ae3ca9dd55f8e002c51506a84304535f", 0x34, 0xfffffffffffffff8) keyctl$KEYCTL_MOVE(0x1e, r8, r7, r9, 0x1) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', r4) r10 = add_key(&(0x7f00000009c0)='cifs.idmap\x00', &(0x7f0000000a00)={'syz', 0x1}, 0x0, 0x0, r7) keyctl$KEYCTL_MOVE(0x1e, r9, r3, r10, 0x1) [ 519.137096] 9pnet_fd: Insufficient options for proto=fd [ 519.144452] tmpfs: Unknown parameter 'uid<00000000000000060929' 14:51:32 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}, {@loose}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) 14:51:32 executing program 7: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@noextend}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:51:32 executing program 2: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r2, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', &(0x7f0000001d80)={{}, {0x1, 0x2}, [{0x2, 0x2, 0xffffffffffffffff}, {0x2, 0x1, r3}, {0x2, 0x3, 0xee01}, {0x2, 0x6}, {0x2, 0x1, r4}, {}, {0x2, 0x0, r6}], {}, [{0x8, 0x1, 0xee00}, {0x8, 0x4, 0xffffffffffffffff}, {0x8, 0x2, 0xffffffffffffffff}], {}, {0x20, 0x2}}, 0x74, 0x1) mkdir(&(0x7f0000001e00)='./file1\x00', 0x1a) fsetxattr$trusted_overlay_redirect(r2, &(0x7f0000001e40), &(0x7f0000001e80)='./file1/file0\x00', 0xe, 0x3) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001f00), r0) sendmsg$NL80211_CMD_TDLS_MGMT(r0, &(0x7f0000001fc0)={&(0x7f0000001ec0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001f80)={&(0x7f0000001f40)={0x2c, r7, 0x100, 0x70bd25, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000090}, 0x4001800) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) fstat(r1, &(0x7f0000002100)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {'rfdno', 0x3d, r8}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid={'access', 0x3d, r6}}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid={'dfltuid', 0x3d, r9}}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid={'dfltgid', 0x3d, r5}}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt={'euid>', r3}}, {@fowner_eq={'fowner', 0x3d, r3}}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) ioctl$BTRFS_IOC_DEFRAG_RANGE(r1, 0x40309410, &(0x7f0000002300)={0x3, 0x3, 0x0, 0x4, 0x1, [0x9, 0x2, 0x3b55, 0x9]}) ioctl$EXT4_IOC_GETSTATE(r0, 0x40046629, &(0x7f0000002340)) 14:51:32 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) 14:51:33 executing program 1: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r2, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', &(0x7f0000001d80)={{}, {0x1, 0x2}, [{0x2, 0x2, 0xffffffffffffffff}, {0x2, 0x1, r3}, {0x2, 0x3, 0xee01}, {0x2, 0x6}, {0x2, 0x1, r4}, {}, {0x2, 0x0, r6}], {}, [{0x8, 0x1, 0xee00}, {0x8, 0x4, 0xffffffffffffffff}, {0x8, 0x2, 0xffffffffffffffff}], {}, {0x20, 0x2}}, 0x74, 0x1) mkdir(&(0x7f0000001e00)='./file1\x00', 0x1a) fsetxattr$trusted_overlay_redirect(r2, &(0x7f0000001e40), &(0x7f0000001e80)='./file1/file0\x00', 0xe, 0x3) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001f00), r0) sendmsg$NL80211_CMD_TDLS_MGMT(r0, &(0x7f0000001fc0)={&(0x7f0000001ec0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001f80)={&(0x7f0000001f40)={0x2c, r7, 0x100, 0x70bd25, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000090}, 0x4001800) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) fstat(r1, &(0x7f0000002100)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {'rfdno', 0x3d, r8}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid={'access', 0x3d, r6}}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid={'dfltuid', 0x3d, r9}}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid={'dfltgid', 0x3d, r5}}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt={'euid>', r3}}, {@fowner_eq={'fowner', 0x3d, r3}}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) ioctl$BTRFS_IOC_DEFRAG_RANGE(r1, 0x40309410, &(0x7f0000002300)={0x3, 0x3, 0x0, 0x4, 0x1, [0x9, 0x2, 0x3b55, 0x9]}) ioctl$EXT4_IOC_GETSTATE(r0, 0x40046629, &(0x7f0000002340)) 14:51:33 executing program 5: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}], [{@permit_directio}, {@dont_measure}]}}) [ 519.150292] 9pnet_fd: Insufficient options for proto=fd [ 519.164323] 9pnet_fd: Insufficient options for proto=fd [ 519.164892] 9pnet_fd: Insufficient options for proto=fd 14:51:33 executing program 6: fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff, 0x1000) syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) 14:51:33 executing program 1: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r2, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', &(0x7f0000001d80)={{}, {0x1, 0x2}, [{0x2, 0x2, 0xffffffffffffffff}, {0x2, 0x1, r3}, {0x2, 0x3, 0xee01}, {0x2, 0x6}, {0x2, 0x1, r4}, {}, {0x2, 0x0, r6}], {}, [{0x8, 0x1, 0xee00}, {0x8, 0x4, 0xffffffffffffffff}, {0x8, 0x2, 0xffffffffffffffff}], {}, {0x20, 0x2}}, 0x74, 0x1) mkdir(&(0x7f0000001e00)='./file1\x00', 0x1a) fsetxattr$trusted_overlay_redirect(r2, &(0x7f0000001e40), &(0x7f0000001e80)='./file1/file0\x00', 0xe, 0x3) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001f00), r0) sendmsg$NL80211_CMD_TDLS_MGMT(r0, &(0x7f0000001fc0)={&(0x7f0000001ec0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001f80)={&(0x7f0000001f40)={0x2c, r7, 0x100, 0x70bd25, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000090}, 0x4001800) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) fstat(r1, &(0x7f0000002100)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {'rfdno', 0x3d, r8}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid={'access', 0x3d, r6}}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid={'dfltuid', 0x3d, r9}}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid={'dfltgid', 0x3d, r5}}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt={'euid>', r3}}, {@fowner_eq={'fowner', 0x3d, r3}}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) ioctl$BTRFS_IOC_DEFRAG_RANGE(r1, 0x40309410, &(0x7f0000002300)={0x3, 0x3, 0x0, 0x4, 0x1, [0x9, 0x2, 0x3b55, 0x9]}) ioctl$EXT4_IOC_GETSTATE(r0, 0x40046629, &(0x7f0000002340)) 14:51:33 executing program 2: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r2, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', &(0x7f0000001d80)={{}, {0x1, 0x2}, [{0x2, 0x2, 0xffffffffffffffff}, {0x2, 0x1, r3}, {0x2, 0x3, 0xee01}, {0x2, 0x6}, {0x2, 0x1, r4}, {}, {0x2, 0x0, r6}], {}, [{0x8, 0x1, 0xee00}, {0x8, 0x4, 0xffffffffffffffff}, {0x8, 0x2, 0xffffffffffffffff}], {}, {0x20, 0x2}}, 0x74, 0x1) mkdir(&(0x7f0000001e00)='./file1\x00', 0x1a) fsetxattr$trusted_overlay_redirect(r2, &(0x7f0000001e40), &(0x7f0000001e80)='./file1/file0\x00', 0xe, 0x3) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001f00), r0) sendmsg$NL80211_CMD_TDLS_MGMT(r0, &(0x7f0000001fc0)={&(0x7f0000001ec0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001f80)={&(0x7f0000001f40)={0x2c, r7, 0x100, 0x70bd25, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000090}, 0x4001800) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) fstat(r1, &(0x7f0000002100)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {'rfdno', 0x3d, r8}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid={'access', 0x3d, r6}}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid={'dfltuid', 0x3d, r9}}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid={'dfltgid', 0x3d, r5}}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt={'euid>', r3}}, {@fowner_eq={'fowner', 0x3d, r3}}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) ioctl$BTRFS_IOC_DEFRAG_RANGE(r1, 0x40309410, &(0x7f0000002300)={0x3, 0x3, 0x0, 0x4, 0x1, [0x9, 0x2, 0x3b55, 0x9]}) ioctl$EXT4_IOC_GETSTATE(r0, 0x40046629, &(0x7f0000002340)) 14:51:33 executing program 0: r0 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) keyctl$invalidate(0x15, r0) r1 = add_key$fscrypt_provisioning(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)={0x0, 0x0, @auto=[0x17]}, 0x9, r0) r2 = request_key(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)='-)\\${\\\\\x17\'%&][@\x7f#[,\x00', 0xfffffffffffffff9) r3 = add_key(&(0x7f0000000240)='id_legacy\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="47b91d59f63be3ffd728f1da32a417d6229b5f5355f72eacd94dde9dc2d83701375ffebf14ac11d548e515", 0x2b, 0xfffffffffffffffc) keyctl$KEYCTL_MOVE(0x1e, r1, r2, r3, 0x0) request_key(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={'syz', 0x1}, &(0x7f0000000380)='id_legacy\x00', r3) r4 = request_key(&(0x7f00000003c0)='cifs.idmap\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000440)='/\x8fy){/(@\x00', r2) r5 = request_key(&(0x7f0000000480)='syzkaller\x00', &(0x7f00000004c0)={'syz', 0x0}, &(0x7f0000000500)='\x00', 0xfffffffffffffffb) keyctl$describe(0x6, r5, &(0x7f0000000540), 0x0) r6 = add_key$keyring(&(0x7f0000000640), &(0x7f0000000680)={'syz', 0x3}, 0x0, 0x0, r3) r7 = request_key(&(0x7f0000000580)='keyring\x00', &(0x7f00000005c0)={'syz', 0x3}, &(0x7f0000000600)='{%^#]*\x00', r6) add_key$keyring(&(0x7f00000006c0), &(0x7f0000000700)={'syz', 0x3}, 0x0, 0x0, r2) r8 = add_key$fscrypt_v1(&(0x7f0000000740), &(0x7f0000000780)={'fscrypt:', @desc1}, &(0x7f00000007c0)={0x0, "1a61b170aa2e74fa2e2a58b75a62ed60ed4c0d5f2da48478b7926a7387aff5957112b698943a3a974513d87e02845c385f49f39c58dd3836a95d1b9608ab57c6", 0x15}, 0x48, r0) r9 = add_key(&(0x7f0000000840)='dns_resolver\x00', &(0x7f0000000880)={'syz', 0x0}, &(0x7f00000008c0)="b7e87711369e4d18ad73a277c2aefd84d885ee8eb2cc7c6a1d6e5a230ee77d9fe4c35454ae3ca9dd55f8e002c51506a84304535f", 0x34, 0xfffffffffffffff8) keyctl$KEYCTL_MOVE(0x1e, r8, r7, r9, 0x1) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', r4) r10 = add_key(&(0x7f00000009c0)='cifs.idmap\x00', &(0x7f0000000a00)={'syz', 0x1}, 0x0, 0x0, r7) keyctl$KEYCTL_MOVE(0x1e, r9, r3, r10, 0x1) 14:51:33 executing program 5: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}], [{@permit_directio}]}}) [ 519.282617] tmpfs: Unknown parameter 'uid<00000000000000060929' 14:51:33 executing program 3: syz_mount_image$tmpfs(&(0x7f0000000040), 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) 14:51:33 executing program 7: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@noextend}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) [ 519.321194] 9pnet_fd: Insufficient options for proto=fd [ 519.324049] 9pnet_fd: Insufficient options for proto=fd [ 519.331372] 9pnet_fd: Insufficient options for proto=fd [ 519.366321] 9pnet: Could not find request transport: xen [ 519.390858] 9pnet_fd: Insufficient options for proto=fd 14:51:44 executing program 3: syz_mount_image$tmpfs(&(0x7f0000000040), 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) 14:51:44 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) 14:51:44 executing program 2: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r2, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', &(0x7f0000001d80)={{}, {0x1, 0x2}, [{0x2, 0x2, 0xffffffffffffffff}, {0x2, 0x1, r3}, {0x2, 0x3, 0xee01}, {0x2, 0x6}, {0x2, 0x1, r4}, {}, {0x2, 0x0, r6}], {}, [{0x8, 0x1, 0xee00}, {0x8, 0x4, 0xffffffffffffffff}, {0x8, 0x2, 0xffffffffffffffff}], {}, {0x20, 0x2}}, 0x74, 0x1) mkdir(&(0x7f0000001e00)='./file1\x00', 0x1a) fsetxattr$trusted_overlay_redirect(r2, &(0x7f0000001e40), &(0x7f0000001e80)='./file1/file0\x00', 0xe, 0x3) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001f00), r0) sendmsg$NL80211_CMD_TDLS_MGMT(r0, &(0x7f0000001fc0)={&(0x7f0000001ec0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001f80)={&(0x7f0000001f40)={0x2c, r7, 0x100, 0x70bd25, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000090}, 0x4001800) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) fstat(r1, &(0x7f0000002100)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {'rfdno', 0x3d, r8}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid={'access', 0x3d, r6}}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid={'dfltuid', 0x3d, r9}}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid={'dfltgid', 0x3d, r5}}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt={'euid>', r3}}, {@fowner_eq={'fowner', 0x3d, r3}}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) ioctl$BTRFS_IOC_DEFRAG_RANGE(r1, 0x40309410, &(0x7f0000002300)={0x3, 0x3, 0x0, 0x4, 0x1, [0x9, 0x2, 0x3b55, 0x9]}) ioctl$EXT4_IOC_GETSTATE(r0, 0x40046629, &(0x7f0000002340)) 14:51:44 executing program 7: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@noextend}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:51:44 executing program 5: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) 14:51:44 executing program 0: r0 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) keyctl$invalidate(0x15, r0) r1 = add_key$fscrypt_provisioning(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)={0x0, 0x0, @auto=[0x17]}, 0x9, r0) r2 = request_key(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)='-)\\${\\\\\x17\'%&][@\x7f#[,\x00', 0xfffffffffffffff9) r3 = add_key(&(0x7f0000000240)='id_legacy\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="47b91d59f63be3ffd728f1da32a417d6229b5f5355f72eacd94dde9dc2d83701375ffebf14ac11d548e515", 0x2b, 0xfffffffffffffffc) keyctl$KEYCTL_MOVE(0x1e, r1, r2, r3, 0x0) request_key(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={'syz', 0x1}, &(0x7f0000000380)='id_legacy\x00', r3) r4 = request_key(&(0x7f00000003c0)='cifs.idmap\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000440)='/\x8fy){/(@\x00', r2) r5 = request_key(&(0x7f0000000480)='syzkaller\x00', &(0x7f00000004c0)={'syz', 0x0}, &(0x7f0000000500)='\x00', 0xfffffffffffffffb) keyctl$describe(0x6, r5, &(0x7f0000000540), 0x0) r6 = add_key$keyring(&(0x7f0000000640), &(0x7f0000000680)={'syz', 0x3}, 0x0, 0x0, r3) r7 = request_key(&(0x7f0000000580)='keyring\x00', &(0x7f00000005c0)={'syz', 0x3}, &(0x7f0000000600)='{%^#]*\x00', r6) add_key$keyring(&(0x7f00000006c0), &(0x7f0000000700)={'syz', 0x3}, 0x0, 0x0, r2) r8 = add_key$fscrypt_v1(&(0x7f0000000740), &(0x7f0000000780)={'fscrypt:', @desc1}, &(0x7f00000007c0)={0x0, "1a61b170aa2e74fa2e2a58b75a62ed60ed4c0d5f2da48478b7926a7387aff5957112b698943a3a974513d87e02845c385f49f39c58dd3836a95d1b9608ab57c6", 0x15}, 0x48, r0) r9 = add_key(&(0x7f0000000840)='dns_resolver\x00', &(0x7f0000000880)={'syz', 0x0}, &(0x7f00000008c0)="b7e87711369e4d18ad73a277c2aefd84d885ee8eb2cc7c6a1d6e5a230ee77d9fe4c35454ae3ca9dd55f8e002c51506a84304535f", 0x34, 0xfffffffffffffff8) keyctl$KEYCTL_MOVE(0x1e, r8, r7, r9, 0x1) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', r4) r10 = add_key(&(0x7f00000009c0)='cifs.idmap\x00', &(0x7f0000000a00)={'syz', 0x1}, 0x0, 0x0, r7) keyctl$KEYCTL_MOVE(0x1e, r9, r3, r10, 0x1) 14:51:44 executing program 1: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r2, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', &(0x7f0000001d80)={{}, {0x1, 0x2}, [{0x2, 0x2, 0xffffffffffffffff}, {0x2, 0x1, r3}, {0x2, 0x3, 0xee01}, {0x2, 0x6}, {0x2, 0x1, r4}, {}, {0x2, 0x0, r6}], {}, [{0x8, 0x1, 0xee00}, {0x8, 0x4, 0xffffffffffffffff}, {0x8, 0x2, 0xffffffffffffffff}], {}, {0x20, 0x2}}, 0x74, 0x1) mkdir(&(0x7f0000001e00)='./file1\x00', 0x1a) fsetxattr$trusted_overlay_redirect(r2, &(0x7f0000001e40), &(0x7f0000001e80)='./file1/file0\x00', 0xe, 0x3) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001f00), r0) sendmsg$NL80211_CMD_TDLS_MGMT(r0, &(0x7f0000001fc0)={&(0x7f0000001ec0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001f80)={&(0x7f0000001f40)={0x2c, r7, 0x100, 0x70bd25, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000090}, 0x4001800) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) fstat(r1, &(0x7f0000002100)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {'rfdno', 0x3d, r8}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid={'access', 0x3d, r6}}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid={'dfltuid', 0x3d, r9}}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid={'dfltgid', 0x3d, r5}}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt={'euid>', r3}}, {@fowner_eq={'fowner', 0x3d, r3}}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) ioctl$BTRFS_IOC_DEFRAG_RANGE(r1, 0x40309410, &(0x7f0000002300)={0x3, 0x3, 0x0, 0x4, 0x1, [0x9, 0x2, 0x3b55, 0x9]}) ioctl$EXT4_IOC_GETSTATE(r0, 0x40046629, &(0x7f0000002340)) 14:51:44 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}, {@privport}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) [ 530.612896] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 530.649837] 9pnet_fd: Insufficient options for proto=fd [ 530.655362] 9pnet_fd: Insufficient options for proto=fd [ 530.662195] 9pnet_fd: Insufficient options for proto=fd 14:51:44 executing program 6: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) [ 530.695176] 9pnet_fd: Insufficient options for proto=fd 14:51:44 executing program 3: syz_mount_image$tmpfs(&(0x7f0000000040), 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) [ 530.720734] 9pnet: Could not find request transport: xen 14:51:44 executing program 0: r0 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) keyctl$invalidate(0x15, r0) r1 = add_key$fscrypt_provisioning(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)={0x0, 0x0, @auto=[0x17]}, 0x9, r0) r2 = request_key(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)='-)\\${\\\\\x17\'%&][@\x7f#[,\x00', 0xfffffffffffffff9) r3 = add_key(&(0x7f0000000240)='id_legacy\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="47b91d59f63be3ffd728f1da32a417d6229b5f5355f72eacd94dde9dc2d83701375ffebf14ac11d548e515", 0x2b, 0xfffffffffffffffc) keyctl$KEYCTL_MOVE(0x1e, r1, r2, r3, 0x0) request_key(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={'syz', 0x1}, &(0x7f0000000380)='id_legacy\x00', r3) r4 = request_key(&(0x7f00000003c0)='cifs.idmap\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000440)='/\x8fy){/(@\x00', r2) r5 = request_key(&(0x7f0000000480)='syzkaller\x00', &(0x7f00000004c0)={'syz', 0x0}, &(0x7f0000000500)='\x00', 0xfffffffffffffffb) keyctl$describe(0x6, r5, &(0x7f0000000540), 0x0) r6 = add_key$keyring(&(0x7f0000000640), &(0x7f0000000680)={'syz', 0x3}, 0x0, 0x0, r3) r7 = request_key(&(0x7f0000000580)='keyring\x00', &(0x7f00000005c0)={'syz', 0x3}, &(0x7f0000000600)='{%^#]*\x00', r6) add_key$keyring(&(0x7f00000006c0), &(0x7f0000000700)={'syz', 0x3}, 0x0, 0x0, r2) r8 = add_key$fscrypt_v1(&(0x7f0000000740), &(0x7f0000000780)={'fscrypt:', @desc1}, &(0x7f00000007c0)={0x0, "1a61b170aa2e74fa2e2a58b75a62ed60ed4c0d5f2da48478b7926a7387aff5957112b698943a3a974513d87e02845c385f49f39c58dd3836a95d1b9608ab57c6", 0x15}, 0x48, r0) r9 = add_key(&(0x7f0000000840)='dns_resolver\x00', &(0x7f0000000880)={'syz', 0x0}, &(0x7f00000008c0)="b7e87711369e4d18ad73a277c2aefd84d885ee8eb2cc7c6a1d6e5a230ee77d9fe4c35454ae3ca9dd55f8e002c51506a84304535f", 0x34, 0xfffffffffffffff8) keyctl$KEYCTL_MOVE(0x1e, r8, r7, r9, 0x1) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', r4) add_key(&(0x7f00000009c0)='cifs.idmap\x00', &(0x7f0000000a00)={'syz', 0x1}, 0x0, 0x0, r7) 14:51:44 executing program 2: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r2, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', &(0x7f0000001d80)={{}, {0x1, 0x2}, [{0x2, 0x2, 0xffffffffffffffff}, {0x2, 0x1, r3}, {0x2, 0x3, 0xee01}, {0x2, 0x6}, {0x2, 0x1, r4}, {}, {0x2, 0x0, r6}], {}, [{0x8, 0x1, 0xee00}, {0x8, 0x4, 0xffffffffffffffff}, {0x8, 0x2, 0xffffffffffffffff}], {}, {0x20, 0x2}}, 0x74, 0x1) mkdir(&(0x7f0000001e00)='./file1\x00', 0x1a) fsetxattr$trusted_overlay_redirect(r2, &(0x7f0000001e40), &(0x7f0000001e80)='./file1/file0\x00', 0xe, 0x3) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001f00), r0) sendmsg$NL80211_CMD_TDLS_MGMT(r0, &(0x7f0000001fc0)={&(0x7f0000001ec0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001f80)={&(0x7f0000001f40)={0x2c, r7, 0x100, 0x70bd25, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000090}, 0x4001800) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) fstat(r1, &(0x7f0000002100)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {'rfdno', 0x3d, r8}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid={'access', 0x3d, r6}}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid={'dfltuid', 0x3d, r9}}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid={'dfltgid', 0x3d, r5}}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt={'euid>', r3}}, {@fowner_eq={'fowner', 0x3d, r3}}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) ioctl$BTRFS_IOC_DEFRAG_RANGE(r1, 0x40309410, &(0x7f0000002300)={0x3, 0x3, 0x0, 0x4, 0x1, [0x9, 0x2, 0x3b55, 0x9]}) 14:51:44 executing program 7: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:51:44 executing program 1: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) r4 = dup(r0) r5 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r4, 0xc0189371, &(0x7f0000000700)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) r7 = dup2(r2, r5) r8 = fspick(r6, &(0x7f0000000740)='./file0\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r7, 0xc0189371, &(0x7f0000000780)={{0x1, 0x1, 0x18, r8}, './file0\x00'}) sendmsg$NL80211_CMD_DISASSOCIATE(r2, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x30, 0x0, 0x400, 0x70bd25, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_LOCAL_STATE_CHANGE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@broadcast}]}, 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0xc000) sendmsg$NL80211_CMD_SET_MAC_ACL(r4, &(0x7f0000000a00)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000900)={0x94, 0x0, 0x100, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @val={0xc, 0x99, {0x7fffffff, 0x2f}}}}, [@NL80211_ATTR_ACL_POLICY={0x8}, @NL80211_ATTR_MAC_ADDRS={0x4c, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}, {0xa}, {0xa, 0x6, @broadcast}, {0xa, 0x6, @device_b}, {0xa, 0x6, @device_b}, {0xa}]}, @NL80211_ATTR_ACL_POLICY={0x8}, @NL80211_ATTR_MAC_ADDRS={0x10, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x4}, 0x800) [ 530.799965] 9pnet_fd: Insufficient options for proto=fd 14:51:44 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}, {@aname}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) 14:51:44 executing program 5: syz_mount_image$ext4(&(0x7f0000000140)='ext2\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x1, &(0x7f0000001480)=[{&(0x7f00000001c0)="12b46d6821e2b9780a4eef2b83e62fd8903b5db787ada822637a7a58c9", 0x1d, 0xffffffffffff7fff}], 0x2008002, &(0x7f0000001500)={[{@minixdf}, {@quota}, {@resuid={'resuid', 0x3d, 0xee01}}, {@noacl}, {@prjquota}, {@nodelalloc}, {@nobarrier}, {@orlov}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0xffffffffffffff81}}], [{@permit_directio}, {@uid_eq}, {@smackfshat={'smackfshat', 0x3d, 'ns/ipc\x00'}}, {@subj_role={'subj_role', 0x3d, 'ns/ipc\x00'}}, {@pcr={'pcr', 0x3d, 0x9}}, {@defcontext={'defcontext', 0x3d, 'sysadm_u'}}]}) stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) setresuid(0x0, r0, 0x0) lchown(&(0x7f0000000000)='./file0\x00', r0, 0x0) [ 530.844412] 9pnet_fd: Insufficient options for proto=fd 14:51:44 executing program 2: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r2, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', &(0x7f0000001d80)={{}, {0x1, 0x2}, [{0x2, 0x2, 0xffffffffffffffff}, {0x2, 0x1, r3}, {0x2, 0x3, 0xee01}, {0x2, 0x6}, {0x2, 0x1, r4}, {}, {0x2, 0x0, r6}], {}, [{0x8, 0x1, 0xee00}, {0x8, 0x4, 0xffffffffffffffff}, {0x8, 0x2, 0xffffffffffffffff}], {}, {0x20, 0x2}}, 0x74, 0x1) mkdir(&(0x7f0000001e00)='./file1\x00', 0x1a) fsetxattr$trusted_overlay_redirect(r2, &(0x7f0000001e40), &(0x7f0000001e80)='./file1/file0\x00', 0xe, 0x3) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001f00), r0) sendmsg$NL80211_CMD_TDLS_MGMT(r0, &(0x7f0000001fc0)={&(0x7f0000001ec0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001f80)={&(0x7f0000001f40)={0x2c, r7, 0x100, 0x70bd25, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000090}, 0x4001800) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) fstat(r1, &(0x7f0000002100)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {'rfdno', 0x3d, r8}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid={'access', 0x3d, r6}}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid={'dfltuid', 0x3d, r9}}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid={'dfltgid', 0x3d, r5}}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt={'euid>', r3}}, {@fowner_eq={'fowner', 0x3d, r3}}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:51:44 executing program 0: r0 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) keyctl$invalidate(0x15, r0) r1 = add_key$fscrypt_provisioning(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)={0x0, 0x0, @auto=[0x17]}, 0x9, r0) r2 = request_key(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)='-)\\${\\\\\x17\'%&][@\x7f#[,\x00', 0xfffffffffffffff9) r3 = add_key(&(0x7f0000000240)='id_legacy\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="47b91d59f63be3ffd728f1da32a417d6229b5f5355f72eacd94dde9dc2d83701375ffebf14ac11d548e515", 0x2b, 0xfffffffffffffffc) keyctl$KEYCTL_MOVE(0x1e, r1, r2, r3, 0x0) request_key(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={'syz', 0x1}, &(0x7f0000000380)='id_legacy\x00', r3) r4 = request_key(&(0x7f00000003c0)='cifs.idmap\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000440)='/\x8fy){/(@\x00', r2) r5 = request_key(&(0x7f0000000480)='syzkaller\x00', &(0x7f00000004c0)={'syz', 0x0}, &(0x7f0000000500)='\x00', 0xfffffffffffffffb) keyctl$describe(0x6, r5, &(0x7f0000000540), 0x0) r6 = add_key$keyring(&(0x7f0000000640), &(0x7f0000000680)={'syz', 0x3}, 0x0, 0x0, r3) r7 = request_key(&(0x7f0000000580)='keyring\x00', &(0x7f00000005c0)={'syz', 0x3}, &(0x7f0000000600)='{%^#]*\x00', r6) add_key$keyring(&(0x7f00000006c0), &(0x7f0000000700)={'syz', 0x3}, 0x0, 0x0, r2) r8 = add_key$fscrypt_v1(&(0x7f0000000740), &(0x7f0000000780)={'fscrypt:', @desc1}, &(0x7f00000007c0)={0x0, "1a61b170aa2e74fa2e2a58b75a62ed60ed4c0d5f2da48478b7926a7387aff5957112b698943a3a974513d87e02845c385f49f39c58dd3836a95d1b9608ab57c6", 0x15}, 0x48, r0) r9 = add_key(&(0x7f0000000840)='dns_resolver\x00', &(0x7f0000000880)={'syz', 0x0}, &(0x7f00000008c0)="b7e87711369e4d18ad73a277c2aefd84d885ee8eb2cc7c6a1d6e5a230ee77d9fe4c35454ae3ca9dd55f8e002c51506a84304535f", 0x34, 0xfffffffffffffff8) keyctl$KEYCTL_MOVE(0x1e, r8, r7, r9, 0x1) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', r4) [ 530.879652] loop5: detected capacity change from 0 to 16255 [ 530.888062] EXT4-fs: Mount option "noacl" will be removed by 3.5 [ 530.888062] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 530.888062] [ 530.890175] EXT4-fs: Ignoring removed orlov option [ 530.900004] ext2: Bad value for 'debug_want_extra_isize' 14:51:44 executing program 6: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) 14:51:44 executing program 7: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}]}}) [ 530.917798] 9pnet_fd: Insufficient options for proto=fd [ 530.949605] 9pnet: Could not find request transport: xen [ 531.035202] 9pnet_fd: Insufficient options for proto=fd 14:51:57 executing program 3: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 14:51:57 executing program 7: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}]}}) 14:51:57 executing program 0: r0 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) keyctl$invalidate(0x15, r0) r1 = add_key$fscrypt_provisioning(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)={0x0, 0x0, @auto=[0x17]}, 0x9, r0) r2 = request_key(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)='-)\\${\\\\\x17\'%&][@\x7f#[,\x00', 0xfffffffffffffff9) r3 = add_key(&(0x7f0000000240)='id_legacy\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="47b91d59f63be3ffd728f1da32a417d6229b5f5355f72eacd94dde9dc2d83701375ffebf14ac11d548e515", 0x2b, 0xfffffffffffffffc) keyctl$KEYCTL_MOVE(0x1e, r1, r2, r3, 0x0) request_key(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={'syz', 0x1}, &(0x7f0000000380)='id_legacy\x00', r3) r4 = request_key(&(0x7f00000003c0)='cifs.idmap\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000440)='/\x8fy){/(@\x00', r2) r5 = request_key(&(0x7f0000000480)='syzkaller\x00', &(0x7f00000004c0)={'syz', 0x0}, &(0x7f0000000500)='\x00', 0xfffffffffffffffb) keyctl$describe(0x6, r5, &(0x7f0000000540), 0x0) r6 = add_key$keyring(&(0x7f0000000640), &(0x7f0000000680)={'syz', 0x3}, 0x0, 0x0, r3) request_key(&(0x7f0000000580)='keyring\x00', &(0x7f00000005c0)={'syz', 0x3}, &(0x7f0000000600)='{%^#]*\x00', r6) add_key$keyring(&(0x7f00000006c0), &(0x7f0000000700)={'syz', 0x3}, 0x0, 0x0, r2) add_key$fscrypt_v1(&(0x7f0000000740), &(0x7f0000000780)={'fscrypt:', @desc1}, &(0x7f00000007c0)={0x0, "1a61b170aa2e74fa2e2a58b75a62ed60ed4c0d5f2da48478b7926a7387aff5957112b698943a3a974513d87e02845c385f49f39c58dd3836a95d1b9608ab57c6", 0x15}, 0x48, r0) add_key(&(0x7f0000000840)='dns_resolver\x00', &(0x7f0000000880)={'syz', 0x0}, &(0x7f00000008c0)="b7e87711369e4d18ad73a277c2aefd84d885ee8eb2cc7c6a1d6e5a230ee77d9fe4c35454ae3ca9dd55f8e002c51506a84304535f", 0x34, 0xfffffffffffffff8) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', r4) 14:51:57 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}, {@access_uid}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) 14:51:57 executing program 2: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r1, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', &(0x7f0000001d80)={{}, {0x1, 0x2}, [{0x2, 0x2, 0xffffffffffffffff}, {0x2, 0x1, r2}, {0x2, 0x3, 0xee01}, {0x2, 0x6}, {0x2, 0x1, r3}, {}, {0x2, 0x0, r5}], {}, [{0x8, 0x1, 0xee00}, {0x8, 0x4, 0xffffffffffffffff}, {0x8, 0x2, 0xffffffffffffffff}], {}, {0x20, 0x2}}, 0x74, 0x1) mkdir(&(0x7f0000001e00)='./file1\x00', 0x1a) fsetxattr$trusted_overlay_redirect(r1, &(0x7f0000001e40), &(0x7f0000001e80)='./file1/file0\x00', 0xe, 0x3) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001f00), r0) sendmsg$NL80211_CMD_TDLS_MGMT(r0, &(0x7f0000001fc0)={&(0x7f0000001ec0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001f80)={&(0x7f0000001f40)={0x2c, r6, 0x100, 0x70bd25, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000090}, 0x4001800) r7 = open_tree(0xffffffffffffff9c, &(0x7f0000002080)='./file1\x00', 0x101) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {'rfdno', 0x3d, r7}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid={'access', 0x3d, r5}}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid={'dfltgid', 0x3d, r4}}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt={'euid>', r2}}, {@fowner_eq={'fowner', 0x3d, r2}}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:51:57 executing program 5: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) r4 = dup(r0) r5 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r4, 0xc0189371, &(0x7f0000000700)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) r7 = dup2(r2, r5) r8 = fspick(r6, &(0x7f0000000740)='./file0\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r7, 0xc0189371, &(0x7f0000000780)={{0x1, 0x1, 0x18, r8}, './file0\x00'}) sendmsg$NL80211_CMD_DISASSOCIATE(r2, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x30, 0x0, 0x400, 0x70bd25, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_LOCAL_STATE_CHANGE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@broadcast}]}, 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0xc000) sendmsg$NL80211_CMD_SET_MAC_ACL(r4, &(0x7f0000000a00)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000900)={0x94, 0x0, 0x100, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @val={0xc, 0x99, {0x7fffffff, 0x2f}}}}, [@NL80211_ATTR_ACL_POLICY={0x8}, @NL80211_ATTR_MAC_ADDRS={0x4c, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}, {0xa}, {0xa, 0x6, @broadcast}, {0xa, 0x6, @device_b}, {0xa, 0x6, @device_b}, {0xa}]}, @NL80211_ATTR_ACL_POLICY={0x8}, @NL80211_ATTR_MAC_ADDRS={0x10, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x4}, 0x800) ioctl$CDROMEJECT(r9, 0x5309) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0x0) 14:51:57 executing program 6: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) 14:51:57 executing program 1: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) r4 = dup(r0) r5 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r4, 0xc0189371, &(0x7f0000000700)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) r7 = dup2(r2, r5) r8 = fspick(r6, &(0x7f0000000740)='./file0\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r7, 0xc0189371, &(0x7f0000000780)={{0x1, 0x1, 0x18, r8}, './file0\x00'}) sendmsg$NL80211_CMD_DISASSOCIATE(r2, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x30, 0x0, 0x400, 0x70bd25, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_LOCAL_STATE_CHANGE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@broadcast}]}, 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0xc000) sendmsg$NL80211_CMD_SET_MAC_ACL(r4, &(0x7f0000000a00)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000900)={0x94, 0x0, 0x100, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @val={0xc, 0x99, {0x7fffffff, 0x2f}}}}, [@NL80211_ATTR_ACL_POLICY={0x8}, @NL80211_ATTR_MAC_ADDRS={0x4c, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}, {0xa}, {0xa, 0x6, @broadcast}, {0xa, 0x6, @device_b}, {0xa, 0x6, @device_b}, {0xa}]}, @NL80211_ATTR_ACL_POLICY={0x8}, @NL80211_ATTR_MAC_ADDRS={0x10, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x4}, 0x800) ioctl$CDROMEJECT(r9, 0x5309) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0x0) 14:51:57 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), 0x0, 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) [ 543.205663] 9pnet_fd: Insufficient options for proto=fd [ 543.207994] 9pnet_fd: Insufficient options for proto=fd 14:51:57 executing program 3: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 14:51:57 executing program 0: r0 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) keyctl$invalidate(0x15, r0) r1 = add_key$fscrypt_provisioning(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)={0x0, 0x0, @auto=[0x17]}, 0x9, r0) r2 = request_key(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)='-)\\${\\\\\x17\'%&][@\x7f#[,\x00', 0xfffffffffffffff9) r3 = add_key(&(0x7f0000000240)='id_legacy\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="47b91d59f63be3ffd728f1da32a417d6229b5f5355f72eacd94dde9dc2d83701375ffebf14ac11d548e515", 0x2b, 0xfffffffffffffffc) keyctl$KEYCTL_MOVE(0x1e, r1, r2, r3, 0x0) request_key(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={'syz', 0x1}, &(0x7f0000000380)='id_legacy\x00', r3) r4 = request_key(&(0x7f00000003c0)='cifs.idmap\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000440)='/\x8fy){/(@\x00', r2) r5 = request_key(&(0x7f0000000480)='syzkaller\x00', &(0x7f00000004c0)={'syz', 0x0}, &(0x7f0000000500)='\x00', 0xfffffffffffffffb) keyctl$describe(0x6, r5, &(0x7f0000000540), 0x0) r6 = add_key$keyring(&(0x7f0000000640), &(0x7f0000000680)={'syz', 0x3}, 0x0, 0x0, r3) request_key(&(0x7f0000000580)='keyring\x00', &(0x7f00000005c0)={'syz', 0x3}, &(0x7f0000000600)='{%^#]*\x00', r6) add_key$keyring(&(0x7f00000006c0), &(0x7f0000000700)={'syz', 0x3}, 0x0, 0x0, r2) add_key$fscrypt_v1(&(0x7f0000000740), &(0x7f0000000780)={'fscrypt:', @desc1}, &(0x7f00000007c0)={0x0, "1a61b170aa2e74fa2e2a58b75a62ed60ed4c0d5f2da48478b7926a7387aff5957112b698943a3a974513d87e02845c385f49f39c58dd3836a95d1b9608ab57c6", 0x15}, 0x48, r0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', r4) 14:51:57 executing program 7: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}]}}) [ 543.373709] 9pnet_fd: Insufficient options for proto=fd [ 543.377122] 9pnet: Could not find request transport: xen 14:52:11 executing program 5: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) r4 = dup(r0) r5 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r4, 0xc0189371, &(0x7f0000000700)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) r7 = dup2(r2, r5) r8 = fspick(r6, &(0x7f0000000740)='./file0\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r7, 0xc0189371, &(0x7f0000000780)={{0x1, 0x1, 0x18, r8}, './file0\x00'}) sendmsg$NL80211_CMD_DISASSOCIATE(r2, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x30, 0x0, 0x400, 0x70bd25, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_LOCAL_STATE_CHANGE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@broadcast}]}, 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0xc000) sendmsg$NL80211_CMD_SET_MAC_ACL(r4, &(0x7f0000000a00)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000900)={0x94, 0x0, 0x100, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @val={0xc, 0x99, {0x7fffffff, 0x2f}}}}, [@NL80211_ATTR_ACL_POLICY={0x8}, @NL80211_ATTR_MAC_ADDRS={0x4c, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}, {0xa}, {0xa, 0x6, @broadcast}, {0xa, 0x6, @device_b}, {0xa, 0x6, @device_b}, {0xa}]}, @NL80211_ATTR_ACL_POLICY={0x8}, @NL80211_ATTR_MAC_ADDRS={0x10, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x4}, 0x800) ioctl$CDROMEJECT(r9, 0x5309) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0x0) 14:52:11 executing program 2: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r1, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', &(0x7f0000001d80)={{}, {0x1, 0x2}, [{0x2, 0x2, 0xffffffffffffffff}, {0x2, 0x1, r2}, {0x2, 0x3, 0xee01}, {0x2, 0x6}, {0x2, 0x1, r3}, {}, {0x2, 0x0, r5}], {}, [{0x8, 0x1, 0xee00}, {0x8, 0x4, 0xffffffffffffffff}, {0x8, 0x2, 0xffffffffffffffff}], {}, {0x20, 0x2}}, 0x74, 0x1) mkdir(&(0x7f0000001e00)='./file1\x00', 0x1a) fsetxattr$trusted_overlay_redirect(r1, &(0x7f0000001e40), &(0x7f0000001e80)='./file1/file0\x00', 0xe, 0x3) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001f00), r0) sendmsg$NL80211_CMD_TDLS_MGMT(r0, &(0x7f0000001fc0)={&(0x7f0000001ec0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001f80)={&(0x7f0000001f40)={0x2c, r6, 0x100, 0x70bd25, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000090}, 0x4001800) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid={'access', 0x3d, r5}}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid={'dfltgid', 0x3d, r4}}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt={'euid>', r2}}, {@fowner_eq={'fowner', 0x3d, r2}}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:52:11 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}, {@dfltgid}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) 14:52:11 executing program 7: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}], [{@permit_directio}, {@dont_measure}, {@appraise_type}]}}) 14:52:11 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) (fail_nth: 1) 14:52:11 executing program 3: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 14:52:11 executing program 0: r0 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) keyctl$invalidate(0x15, r0) r1 = add_key$fscrypt_provisioning(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)={0x0, 0x0, @auto=[0x17]}, 0x9, r0) r2 = request_key(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)='-)\\${\\\\\x17\'%&][@\x7f#[,\x00', 0xfffffffffffffff9) r3 = add_key(&(0x7f0000000240)='id_legacy\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="47b91d59f63be3ffd728f1da32a417d6229b5f5355f72eacd94dde9dc2d83701375ffebf14ac11d548e515", 0x2b, 0xfffffffffffffffc) keyctl$KEYCTL_MOVE(0x1e, r1, r2, r3, 0x0) request_key(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={'syz', 0x1}, &(0x7f0000000380)='id_legacy\x00', r3) r4 = request_key(&(0x7f00000003c0)='cifs.idmap\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000440)='/\x8fy){/(@\x00', r2) r5 = request_key(&(0x7f0000000480)='syzkaller\x00', &(0x7f00000004c0)={'syz', 0x0}, &(0x7f0000000500)='\x00', 0xfffffffffffffffb) keyctl$describe(0x6, r5, &(0x7f0000000540), 0x0) r6 = add_key$keyring(&(0x7f0000000640), &(0x7f0000000680)={'syz', 0x3}, 0x0, 0x0, r3) request_key(&(0x7f0000000580)='keyring\x00', &(0x7f00000005c0)={'syz', 0x3}, &(0x7f0000000600)='{%^#]*\x00', r6) add_key$keyring(&(0x7f00000006c0), &(0x7f0000000700)={'syz', 0x3}, 0x0, 0x0, r2) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', r4) 14:52:11 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), 0x0, 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) [ 557.354268] 9pnet_fd: Insufficient options for proto=fd [ 557.392405] 9pnet_fd: Insufficient options for proto=fd 14:52:11 executing program 5: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) r4 = dup(r0) r5 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r4, 0xc0189371, &(0x7f0000000700)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) r7 = dup2(r2, r5) r8 = fspick(r6, &(0x7f0000000740)='./file0\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r7, 0xc0189371, &(0x7f0000000780)={{0x1, 0x1, 0x18, r8}, './file0\x00'}) sendmsg$NL80211_CMD_DISASSOCIATE(r2, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x30, 0x0, 0x400, 0x70bd25, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_LOCAL_STATE_CHANGE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@broadcast}]}, 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0xc000) sendmsg$NL80211_CMD_SET_MAC_ACL(r4, &(0x7f0000000a00)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000900)={0x94, 0x0, 0x100, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @val={0xc, 0x99, {0x7fffffff, 0x2f}}}}, [@NL80211_ATTR_ACL_POLICY={0x8}, @NL80211_ATTR_MAC_ADDRS={0x4c, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}, {0xa}, {0xa, 0x6, @broadcast}, {0xa, 0x6, @device_b}, {0xa, 0x6, @device_b}, {0xa}]}, @NL80211_ATTR_ACL_POLICY={0x8}, @NL80211_ATTR_MAC_ADDRS={0x10, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x4}, 0x800) ioctl$CDROMEJECT(r9, 0x5309) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0x0) 14:52:11 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) (fail_nth: 2) 14:52:11 executing program 0: r0 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) keyctl$invalidate(0x15, r0) r1 = add_key$fscrypt_provisioning(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)={0x0, 0x0, @auto=[0x17]}, 0x9, r0) r2 = request_key(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)='-)\\${\\\\\x17\'%&][@\x7f#[,\x00', 0xfffffffffffffff9) r3 = add_key(&(0x7f0000000240)='id_legacy\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="47b91d59f63be3ffd728f1da32a417d6229b5f5355f72eacd94dde9dc2d83701375ffebf14ac11d548e515", 0x2b, 0xfffffffffffffffc) keyctl$KEYCTL_MOVE(0x1e, r1, r2, r3, 0x0) request_key(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={'syz', 0x1}, &(0x7f0000000380)='id_legacy\x00', r3) r4 = request_key(&(0x7f00000003c0)='cifs.idmap\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000440)='/\x8fy){/(@\x00', r2) r5 = request_key(&(0x7f0000000480)='syzkaller\x00', &(0x7f00000004c0)={'syz', 0x0}, &(0x7f0000000500)='\x00', 0xfffffffffffffffb) keyctl$describe(0x6, r5, &(0x7f0000000540), 0x0) r6 = add_key$keyring(&(0x7f0000000640), &(0x7f0000000680)={'syz', 0x3}, 0x0, 0x0, r3) request_key(&(0x7f0000000580)='keyring\x00', &(0x7f00000005c0)={'syz', 0x3}, &(0x7f0000000600)='{%^#]*\x00', r6) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', r4) 14:52:11 executing program 7: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}], [{@permit_directio}, {@dont_measure}]}}) 14:52:11 executing program 3: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)) 14:52:11 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), 0x0, 0x9, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) 14:52:11 executing program 2: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r1, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', &(0x7f0000001d80)={{}, {0x1, 0x2}, [{0x2, 0x2, 0xffffffffffffffff}, {0x2, 0x1, r2}, {0x2, 0x3, 0xee01}, {0x2, 0x6}, {0x2, 0x1, r3}, {}, {0x2, 0x0, r5}], {}, [{0x8, 0x1, 0xee00}, {0x8, 0x4, 0xffffffffffffffff}, {0x8, 0x2, 0xffffffffffffffff}], {}, {0x20, 0x2}}, 0x74, 0x1) mkdir(&(0x7f0000001e00)='./file1\x00', 0x1a) fsetxattr$trusted_overlay_redirect(r1, &(0x7f0000001e40), &(0x7f0000001e80)='./file1/file0\x00', 0xe, 0x3) syz_genetlink_get_family_id$nl80211(&(0x7f0000001f00), r0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid={'access', 0x3d, r5}}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid={'dfltgid', 0x3d, r4}}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt={'euid>', r2}}, {@fowner_eq={'fowner', 0x3d, r2}}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) [ 557.535607] 9pnet: Could not find request transport: xen [ 557.538764] 9pnet_fd: Insufficient options for proto=fd [ 557.607838] 9pnet_fd: Insufficient options for proto=fd 14:52:11 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) 14:52:11 executing program 0: r0 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) keyctl$invalidate(0x15, r0) r1 = add_key$fscrypt_provisioning(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)={0x0, 0x0, @auto=[0x17]}, 0x9, r0) r2 = request_key(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)='-)\\${\\\\\x17\'%&][@\x7f#[,\x00', 0xfffffffffffffff9) r3 = add_key(&(0x7f0000000240)='id_legacy\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="47b91d59f63be3ffd728f1da32a417d6229b5f5355f72eacd94dde9dc2d83701375ffebf14ac11d548e515", 0x2b, 0xfffffffffffffffc) keyctl$KEYCTL_MOVE(0x1e, r1, r2, r3, 0x0) request_key(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={'syz', 0x1}, &(0x7f0000000380)='id_legacy\x00', r3) r4 = request_key(&(0x7f00000003c0)='cifs.idmap\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000440)='/\x8fy){/(@\x00', r2) r5 = request_key(&(0x7f0000000480)='syzkaller\x00', &(0x7f00000004c0)={'syz', 0x0}, &(0x7f0000000500)='\x00', 0xfffffffffffffffb) keyctl$describe(0x6, r5, &(0x7f0000000540), 0x0) add_key$keyring(&(0x7f0000000640), &(0x7f0000000680)={'syz', 0x3}, 0x0, 0x0, r3) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', r4) 14:52:11 executing program 7: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}], [{@permit_directio}]}}) [ 557.643195] 9pnet_fd: Insufficient options for proto=fd 14:52:11 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) 14:52:11 executing program 5: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) r4 = dup(r0) r5 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r4, 0xc0189371, &(0x7f0000000700)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) r7 = dup2(r2, r5) r8 = fspick(r6, &(0x7f0000000740)='./file0\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r7, 0xc0189371, &(0x7f0000000780)={{0x1, 0x1, 0x18, r8}, './file0\x00'}) sendmsg$NL80211_CMD_DISASSOCIATE(r2, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x30, 0x0, 0x400, 0x70bd25, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_LOCAL_STATE_CHANGE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@broadcast}]}, 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0xc000) sendmsg$NL80211_CMD_SET_MAC_ACL(r4, &(0x7f0000000a00)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000900)={0x94, 0x0, 0x100, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @val={0xc, 0x99, {0x7fffffff, 0x2f}}}}, [@NL80211_ATTR_ACL_POLICY={0x8}, @NL80211_ATTR_MAC_ADDRS={0x4c, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}, {0xa}, {0xa, 0x6, @broadcast}, {0xa, 0x6, @device_b}, {0xa, 0x6, @device_b}, {0xa}]}, @NL80211_ATTR_ACL_POLICY={0x8}, @NL80211_ATTR_MAC_ADDRS={0x10, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x4}, 0x800) ioctl$CDROMEJECT(r9, 0x5309) [ 557.694083] 9pnet_fd: Insufficient options for proto=fd 14:52:11 executing program 3: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)) [ 557.806074] 9pnet: Could not find request transport: xen 14:52:22 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) (fail_nth: 3) 14:52:22 executing program 3: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)) 14:52:22 executing program 7: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) 14:52:22 executing program 2: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r1, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', &(0x7f0000001d80)={{}, {0x1, 0x2}, [{0x2, 0x2, 0xffffffffffffffff}, {0x2, 0x1, r2}, {0x2, 0x3, 0xee01}, {0x2, 0x6}, {0x2, 0x1, r3}, {}, {0x2, 0x0, r5}], {}, [{0x8, 0x1, 0xee00}, {0x8, 0x4, 0xffffffffffffffff}, {0x8, 0x2, 0xffffffffffffffff}], {}, {0x20, 0x2}}, 0x74, 0x1) mkdir(&(0x7f0000001e00)='./file1\x00', 0x1a) fsetxattr$trusted_overlay_redirect(r1, &(0x7f0000001e40), &(0x7f0000001e80)='./file1/file0\x00', 0xe, 0x3) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid={'access', 0x3d, r5}}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid={'dfltgid', 0x3d, r4}}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt={'euid>', r2}}, {@fowner_eq={'fowner', 0x3d, r2}}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:52:22 executing program 0: r0 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) keyctl$invalidate(0x15, r0) r1 = add_key$fscrypt_provisioning(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)={0x0, 0x0, @auto=[0x17]}, 0x9, r0) r2 = request_key(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)='-)\\${\\\\\x17\'%&][@\x7f#[,\x00', 0xfffffffffffffff9) r3 = add_key(&(0x7f0000000240)='id_legacy\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="47b91d59f63be3ffd728f1da32a417d6229b5f5355f72eacd94dde9dc2d83701375ffebf14ac11d548e515", 0x2b, 0xfffffffffffffffc) keyctl$KEYCTL_MOVE(0x1e, r1, r2, r3, 0x0) request_key(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={'syz', 0x1}, &(0x7f0000000380)='id_legacy\x00', r3) r4 = request_key(&(0x7f00000003c0)='cifs.idmap\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000440)='/\x8fy){/(@\x00', r2) r5 = request_key(&(0x7f0000000480)='syzkaller\x00', &(0x7f00000004c0)={'syz', 0x0}, &(0x7f0000000500)='\x00', 0xfffffffffffffffb) keyctl$describe(0x6, r5, &(0x7f0000000540), 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', r4) 14:52:22 executing program 5: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) r4 = dup(r0) r5 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r4, 0xc0189371, &(0x7f0000000700)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) r7 = dup2(r2, r5) r8 = fspick(r6, &(0x7f0000000740)='./file0\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r7, 0xc0189371, &(0x7f0000000780)={{0x1, 0x1, 0x18, r8}, './file0\x00'}) sendmsg$NL80211_CMD_DISASSOCIATE(r2, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x30, 0x0, 0x400, 0x70bd25, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_LOCAL_STATE_CHANGE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@broadcast}]}, 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0xc000) sendmsg$NL80211_CMD_SET_MAC_ACL(r4, &(0x7f0000000a00)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000900)={0x94, 0x0, 0x100, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @val={0xc, 0x99, {0x7fffffff, 0x2f}}}}, [@NL80211_ATTR_ACL_POLICY={0x8}, @NL80211_ATTR_MAC_ADDRS={0x4c, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}, {0xa}, {0xa, 0x6, @broadcast}, {0xa, 0x6, @device_b}, {0xa, 0x6, @device_b}, {0xa}]}, @NL80211_ATTR_ACL_POLICY={0x8}, @NL80211_ATTR_MAC_ADDRS={0x10, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x4}, 0x800) 14:52:22 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) 14:52:22 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) [ 568.948762] 9pnet_fd: Insufficient options for proto=fd [ 568.966372] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 568.967965] FAULT_INJECTION: forcing a failure. [ 568.967965] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 568.969554] CPU: 1 PID: 7399 Comm: syz-executor.1 Not tainted 6.0.0-rc6-next-20220921 #1 [ 568.970636] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 568.972112] Call Trace: [ 568.972479] [ 568.972802] dump_stack_lvl+0x8b/0xb3 [ 568.973361] should_fail.cold+0x5/0xa [ 568.973922] _copy_from_user+0x2a/0x170 [ 568.974497] memdup_user+0x6e/0xd0 [ 568.975008] strndup_user+0x74/0xe0 [ 568.975534] __x64_sys_mount+0x133/0x300 [ 568.976104] ? path_mount+0x1e20/0x1e20 [ 568.976664] ? syscall_enter_from_user_mode+0x1d/0x50 [ 568.977393] ? syscall_enter_from_user_mode+0x1d/0x50 [ 568.978127] do_syscall_64+0x3b/0x90 [ 568.978665] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 568.979407] RIP: 0033:0x7f14e0f8fb19 [ 568.979931] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 568.982397] RSP: 002b:00007f14de505188 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 568.983436] RAX: ffffffffffffffda RBX: 00007f14e10a2f60 RCX: 00007f14e0f8fb19 [ 568.984422] RDX: 0000000020002040 RSI: 0000000020002000 RDI: 0000000000000000 [ 568.985386] RBP: 00007f14de5051d0 R08: 0000000020002180 R09: 0000000000000000 [ 568.986361] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 568.987337] R13: 00007ffd3b74d26f R14: 00007f14de505300 R15: 0000000000022000 [ 568.988385] [ 569.014859] 9pnet_fd: Insufficient options for proto=fd 14:52:22 executing program 0: r0 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) keyctl$invalidate(0x15, r0) r1 = add_key$fscrypt_provisioning(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)={0x0, 0x0, @auto=[0x17]}, 0x9, r0) r2 = request_key(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)='-)\\${\\\\\x17\'%&][@\x7f#[,\x00', 0xfffffffffffffff9) r3 = add_key(&(0x7f0000000240)='id_legacy\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="47b91d59f63be3ffd728f1da32a417d6229b5f5355f72eacd94dde9dc2d83701375ffebf14ac11d548e515", 0x2b, 0xfffffffffffffffc) keyctl$KEYCTL_MOVE(0x1e, r1, r2, r3, 0x0) request_key(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={'syz', 0x1}, &(0x7f0000000380)='id_legacy\x00', r3) r4 = request_key(&(0x7f00000003c0)='cifs.idmap\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000440)='/\x8fy){/(@\x00', r2) r5 = request_key(&(0x7f0000000480)='syzkaller\x00', &(0x7f00000004c0)={'syz', 0x0}, &(0x7f0000000500)='\x00', 0xfffffffffffffffb) keyctl$describe(0x6, r5, &(0x7f0000000540), 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', r4) 14:52:22 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) 14:52:22 executing program 5: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) r4 = dup(r0) r5 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r4, 0xc0189371, &(0x7f0000000700)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) r7 = dup2(r2, r5) r8 = fspick(r6, &(0x7f0000000740)='./file0\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r7, 0xc0189371, &(0x7f0000000780)={{0x1, 0x1, 0x18, r8}, './file0\x00'}) sendmsg$NL80211_CMD_DISASSOCIATE(r2, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x30, 0x0, 0x400, 0x70bd25, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_LOCAL_STATE_CHANGE={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@broadcast}]}, 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0xc000) [ 569.162561] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 569.167583] 9pnet: Could not find request transport: xen 14:52:34 executing program 5: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) r4 = dup(r0) r5 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r4, 0xc0189371, &(0x7f0000000700)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) r7 = dup2(r2, r5) r8 = fspick(r6, &(0x7f0000000740)='./file0\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r7, 0xc0189371, &(0x7f0000000780)={{0x1, 0x1, 0x18, r8}, './file0\x00'}) 14:52:34 executing program 7: r0 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) keyctl$invalidate(0x15, r0) r1 = add_key$fscrypt_provisioning(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)={0x0, 0x0, @auto=[0x17]}, 0x9, r0) r2 = request_key(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)='-)\\${\\\\\x17\'%&][@\x7f#[,\x00', 0xfffffffffffffff9) r3 = add_key(&(0x7f0000000240)='id_legacy\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="47b91d59f63be3ffd728f1da32a417d6229b5f5355f72eacd94dde9dc2d83701375ffebf14ac11d548e515", 0x2b, 0xfffffffffffffffc) keyctl$KEYCTL_MOVE(0x1e, r1, r2, r3, 0x0) request_key(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={'syz', 0x1}, &(0x7f0000000380)='id_legacy\x00', r3) r4 = request_key(&(0x7f00000003c0)='cifs.idmap\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000440)='/\x8fy){/(@\x00', r2) r5 = request_key(&(0x7f0000000480)='syzkaller\x00', &(0x7f00000004c0)={'syz', 0x0}, &(0x7f0000000500)='\x00', 0xfffffffffffffffb) keyctl$describe(0x6, r5, &(0x7f0000000540), 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', r4) 14:52:34 executing program 0: r0 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) keyctl$invalidate(0x15, r0) r1 = add_key$fscrypt_provisioning(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)={0x0, 0x0, @auto=[0x17]}, 0x9, r0) r2 = request_key(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)='-)\\${\\\\\x17\'%&][@\x7f#[,\x00', 0xfffffffffffffff9) r3 = add_key(&(0x7f0000000240)='id_legacy\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="47b91d59f63be3ffd728f1da32a417d6229b5f5355f72eacd94dde9dc2d83701375ffebf14ac11d548e515", 0x2b, 0xfffffffffffffffc) keyctl$KEYCTL_MOVE(0x1e, r1, r2, r3, 0x0) request_key(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={'syz', 0x1}, &(0x7f0000000380)='id_legacy\x00', r3) r4 = request_key(&(0x7f00000003c0)='cifs.idmap\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000440)='/\x8fy){/(@\x00', r2) r5 = request_key(&(0x7f0000000480)='syzkaller\x00', &(0x7f00000004c0)={'syz', 0x0}, &(0x7f0000000500)='\x00', 0xfffffffffffffffb) keyctl$describe(0x6, r5, &(0x7f0000000540), 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', r4) 14:52:34 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)={'trans=xen,', {[], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) 14:52:34 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) (fail_nth: 4) 14:52:34 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) 14:52:34 executing program 3: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000180)=[{&(0x7f00000000c0)="145f14063aeed8a19bdf4eca4838878e2aa5bea19674a14333364c7e740409f7be8f89c7dccea9479e583a9029dcb3b80972a018759bb6e72c30b5e1517ec359e1cd91bde864c8cffeffc4925ac5bbbed49d3a2b5514", 0x56, 0x9}, {&(0x7f0000000140)="1b8e867c2b753d2d64", 0x9, 0x6}], 0x1000c03, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) [ 581.092125] tmpfs: Unknown parameter 'uid<00000000000000060929' 14:52:34 executing program 2: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r1, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', &(0x7f0000001d80)={{}, {0x1, 0x2}, [{0x2, 0x2, 0xffffffffffffffff}, {0x2, 0x1, r2}, {0x2, 0x3, 0xee01}, {0x2, 0x6}, {0x2, 0x1, r3}, {}, {0x2, 0x0, r5}], {}, [{0x8, 0x1, 0xee00}, {0x8, 0x4, 0xffffffffffffffff}, {0x8, 0x2, 0xffffffffffffffff}], {}, {0x20, 0x2}}, 0x74, 0x1) mkdir(&(0x7f0000001e00)='./file1\x00', 0x1a) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid={'access', 0x3d, r5}}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid={'dfltgid', 0x3d, r4}}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt={'euid>', r2}}, {@fowner_eq={'fowner', 0x3d, r2}}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:52:34 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) [ 581.149915] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 581.189956] 9pnet_fd: Insufficient options for proto=fd 14:52:35 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)={'trans=xen,', {[{@cache_fscache}, {@cache_none}], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}, {@context={'context', 0x3d, 'sysadm_u'}}]}}) 14:52:35 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) [ 581.251400] 9pnet: Could not find request transport: xen 14:52:35 executing program 5: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) r4 = dup(r0) r5 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r4, 0xc0189371, &(0x7f0000000700)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) dup2(r2, r5) fspick(r6, &(0x7f0000000740)='./file0\x00', 0x0) 14:52:35 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) (fail_nth: 5) 14:52:35 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)={'trans=xen,', {[], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}]}}) 14:52:35 executing program 0: r0 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) keyctl$invalidate(0x15, r0) r1 = add_key$fscrypt_provisioning(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)={0x0, 0x0, @auto=[0x17]}, 0x9, r0) r2 = request_key(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)='-)\\${\\\\\x17\'%&][@\x7f#[,\x00', 0xfffffffffffffff9) r3 = add_key(&(0x7f0000000240)='id_legacy\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="47b91d59f63be3ffd728f1da32a417d6229b5f5355f72eacd94dde9dc2d83701375ffebf14ac11d548e515", 0x2b, 0xfffffffffffffffc) keyctl$KEYCTL_MOVE(0x1e, r1, r2, r3, 0x0) request_key(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={'syz', 0x1}, &(0x7f0000000380)='id_legacy\x00', r3) r4 = request_key(&(0x7f00000003c0)='cifs.idmap\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000440)='/\x8fy){/(@\x00', r2) request_key(&(0x7f0000000480)='syzkaller\x00', &(0x7f00000004c0)={'syz', 0x0}, &(0x7f0000000500)='\x00', 0xfffffffffffffffb) add_key$keyring(&(0x7f0000000640), &(0x7f0000000680)={'syz', 0x3}, 0x0, 0x0, r3) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', r4) 14:52:35 executing program 2: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r1, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', &(0x7f0000001d80)={{}, {0x1, 0x2}, [{0x2, 0x2, 0xffffffffffffffff}, {0x2, 0x1, r2}, {0x2, 0x3, 0xee01}, {0x2, 0x6}, {0x2, 0x1, r3}, {}, {0x2, 0x0, r5}], {}, [{0x8, 0x1, 0xee00}, {0x8, 0x4, 0xffffffffffffffff}, {0x8, 0x2, 0xffffffffffffffff}], {}, {0x20, 0x2}}, 0x74, 0x1) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid={'access', 0x3d, r5}}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid={'dfltgid', 0x3d, r4}}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt={'euid>', r2}}, {@fowner_eq={'fowner', 0x3d, r2}}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:52:35 executing program 7: r0 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) keyctl$invalidate(0x15, r0) r1 = add_key$fscrypt_provisioning(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)={0x0, 0x0, @auto=[0x17]}, 0x9, r0) r2 = request_key(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)='-)\\${\\\\\x17\'%&][@\x7f#[,\x00', 0xfffffffffffffff9) r3 = add_key(&(0x7f0000000240)='id_legacy\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="47b91d59f63be3ffd728f1da32a417d6229b5f5355f72eacd94dde9dc2d83701375ffebf14ac11d548e515", 0x2b, 0xfffffffffffffffc) keyctl$KEYCTL_MOVE(0x1e, r1, r2, r3, 0x0) request_key(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={'syz', 0x1}, &(0x7f0000000380)='id_legacy\x00', r3) r4 = request_key(&(0x7f00000003c0)='cifs.idmap\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000440)='/\x8fy){/(@\x00', r2) r5 = request_key(&(0x7f0000000480)='syzkaller\x00', &(0x7f00000004c0)={'syz', 0x0}, &(0x7f0000000500)='\x00', 0xfffffffffffffffb) keyctl$describe(0x6, r5, &(0x7f0000000540), 0x0) add_key$keyring(&(0x7f0000000640), &(0x7f0000000680)={'syz', 0x3}, 0x0, 0x0, r3) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', r4) [ 581.367536] 9pnet_fd: Insufficient options for proto=fd 14:52:35 executing program 5: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) r4 = dup(r0) r5 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r4, 0xc0189371, &(0x7f0000000700)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) dup2(r2, r5) 14:52:35 executing program 0: r0 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) keyctl$invalidate(0x15, r0) r1 = add_key$fscrypt_provisioning(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)={0x0, 0x0, @auto=[0x17]}, 0x9, r0) r2 = request_key(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)='-)\\${\\\\\x17\'%&][@\x7f#[,\x00', 0xfffffffffffffff9) r3 = add_key(&(0x7f0000000240)='id_legacy\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="47b91d59f63be3ffd728f1da32a417d6229b5f5355f72eacd94dde9dc2d83701375ffebf14ac11d548e515", 0x2b, 0xfffffffffffffffc) keyctl$KEYCTL_MOVE(0x1e, r1, r2, r3, 0x0) request_key(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={'syz', 0x1}, &(0x7f0000000380)='id_legacy\x00', r3) r4 = request_key(&(0x7f00000003c0)='cifs.idmap\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000440)='/\x8fy){/(@\x00', r2) add_key$keyring(&(0x7f0000000640), &(0x7f0000000680)={'syz', 0x3}, 0x0, 0x0, r3) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', r4) 14:52:35 executing program 7: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r1, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', &(0x7f0000001d80)={{}, {0x1, 0x2}, [{0x2, 0x2, 0xffffffffffffffff}, {0x2, 0x1, r2}, {0x2, 0x3, 0xee01}, {0x2, 0x6}, {0x2, 0x1, r3}, {}, {0x2, 0x0, r5}], {}, [{0x8, 0x1, 0xee00}, {0x8, 0x4, 0xffffffffffffffff}, {0x8, 0x2, 0xffffffffffffffff}], {}, {0x20, 0x2}}, 0x74, 0x1) mkdir(&(0x7f0000001e00)='./file1\x00', 0x1a) fsetxattr$trusted_overlay_redirect(r1, &(0x7f0000001e40), &(0x7f0000001e80)='./file1/file0\x00', 0xe, 0x3) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001f00), r0) sendmsg$NL80211_CMD_TDLS_MGMT(r0, &(0x7f0000001fc0)={&(0x7f0000001ec0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001f80)={&(0x7f0000001f40)={0x2c, r6, 0x100, 0x70bd25, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000090}, 0x4001800) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid={'access', 0x3d, r5}}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid={'dfltgid', 0x3d, r4}}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt={'euid>', r2}}, {@fowner_eq={'fowner', 0x3d, r2}}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) [ 581.430085] 9pnet_fd: Insufficient options for proto=fd 14:52:35 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 14:52:35 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) (fail_nth: 6) [ 581.504082] 9pnet: Could not find request transport: xen 14:52:35 executing program 5: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) r4 = dup(r0) r5 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r4, 0xc0189371, &(0x7f0000000700)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) 14:52:35 executing program 2: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r1, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid={'access', 0x3d, r4}}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid={'dfltgid', 0x3d, r3}}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt={'euid>', r2}}, {@fowner_eq={'fowner', 0x3d, r2}}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) [ 581.533874] 9pnet_fd: Insufficient options for proto=fd [ 581.542810] FAULT_INJECTION: forcing a failure. [ 581.542810] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 581.543668] CPU: 1 PID: 7469 Comm: syz-executor.1 Not tainted 6.0.0-rc6-next-20220921 #1 [ 581.544220] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 581.544982] Call Trace: [ 581.545173] [ 581.545339] dump_stack_lvl+0x8b/0xb3 [ 581.545629] should_fail.cold+0x5/0xa [ 581.545921] _copy_from_user+0x2a/0x170 [ 581.546214] copy_mount_options+0x76/0x180 [ 581.546527] __x64_sys_mount+0x1a8/0x300 [ 581.546818] ? path_mount+0x1e20/0x1e20 [ 581.547101] ? syscall_enter_from_user_mode+0x1d/0x50 [ 581.547470] ? syscall_enter_from_user_mode+0x1d/0x50 [ 581.547833] do_syscall_64+0x3b/0x90 [ 581.548104] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 581.548469] RIP: 0033:0x7f14e0f8fb19 [ 581.548734] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 581.549949] RSP: 002b:00007f14de505188 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 581.550471] RAX: ffffffffffffffda RBX: 00007f14e10a2f60 RCX: 00007f14e0f8fb19 [ 581.550959] RDX: 0000000020002040 RSI: 0000000020002000 RDI: 0000000000000000 [ 581.551455] RBP: 00007f14de5051d0 R08: 0000000020002180 R09: 0000000000000000 [ 581.551942] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 581.552431] R13: 00007ffd3b74d26f R14: 00007f14de505300 R15: 0000000000022000 [ 581.552934] [ 581.578732] 9pnet_fd: Insufficient options for proto=fd [ 581.585651] 9pnet: Could not find request transport: xen [ 581.604840] 9pnet_fd: Insufficient options for proto=fd 14:52:35 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)={'trans=xen,', {[], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}]}}) [ 581.732695] 9pnet: Could not find request transport: xen 14:52:48 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)={'trans=xen,', {[], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}]}}) 14:52:48 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) 14:52:48 executing program 0: r0 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) keyctl$invalidate(0x15, r0) r1 = add_key$fscrypt_provisioning(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)={0x0, 0x0, @auto=[0x17]}, 0x9, r0) r2 = request_key(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)='-)\\${\\\\\x17\'%&][@\x7f#[,\x00', 0xfffffffffffffff9) r3 = add_key(&(0x7f0000000240)='id_legacy\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="47b91d59f63be3ffd728f1da32a417d6229b5f5355f72eacd94dde9dc2d83701375ffebf14ac11d548e515", 0x2b, 0xfffffffffffffffc) keyctl$KEYCTL_MOVE(0x1e, r1, r2, r3, 0x0) request_key(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={'syz', 0x1}, &(0x7f0000000380)='id_legacy\x00', r3) add_key$keyring(&(0x7f0000000640), &(0x7f0000000680)={'syz', 0x3}, 0x0, 0x0, r3) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', 0x0) 14:52:48 executing program 5: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) dup(r0) openat$cdrom(0xffffffffffffff9c, &(0x7f00000006c0), 0x80a83, 0x0) 14:52:48 executing program 2: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r1, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid={'dfltgid', 0x3d, r3}}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt={'euid>', r2}}, {@fowner_eq={'fowner', 0x3d, r2}}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:52:48 executing program 7: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r1, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid={'access', 0x3d, r4}}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid={'dfltgid', 0x3d, r3}}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt={'euid>', r2}}, {@fowner_eq={'fowner', 0x3d, r2}}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:52:48 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) (fail_nth: 7) 14:52:48 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)={'trans=xen,', {[], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}]}}) [ 594.158921] 9pnet_fd: Insufficient options for proto=fd 14:52:48 executing program 7: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)={'trans=xen,', {[], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'system_u:object_r:shell_exec_t:s0\x00'}}]}}) [ 594.199983] 9pnet_fd: Insufficient options for proto=fd [ 594.230554] tmpfs: Unknown parameter 'uid<00000000000000060929' 14:52:48 executing program 2: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r1, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt={'euid>', r2}}, {@fowner_eq={'fowner', 0x3d, r2}}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) [ 594.268525] 9pnet: Could not find request transport: xen [ 594.270976] 9pnet: Could not find request transport: xen [ 594.308324] 9pnet: Could not find request transport: xen [ 594.350515] 9pnet_fd: Insufficient options for proto=fd 14:53:00 executing program 2: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r1, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:53:00 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)={'trans=xen,', {[], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}]}}) 14:53:00 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) 14:53:00 executing program 5: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) dup(r0) 14:53:00 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) (fail_nth: 8) 14:53:00 executing program 7: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r1, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x7) stat(&(0x7f0000000680)='./file1/file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r0, &(0x7f0000000740)='./file0\x00', 0x100, 0x500, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001d40)={&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000900)=""/185, 0xb9}, {&(0x7f00000009c0)=""/178, 0xb2}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/63, 0x3f}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/4096, 0x1000}], 0x8, &(0x7f0000001d00)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x20}, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', &(0x7f0000001d80)={{}, {0x1, 0x2}, [{0x2, 0x2, 0xffffffffffffffff}, {0x2, 0x1, r2}, {0x2, 0x3, 0xee01}, {0x2, 0x6}, {0x2, 0x1, r3}, {}, {0x2, 0x0, r5}], {}, [{0x8, 0x1, 0xee00}, {0x8, 0x4, 0xffffffffffffffff}, {0x8, 0x2, 0xffffffffffffffff}], {}, {0x20, 0x2}}, 0x74, 0x1) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid={'access', 0x3d, r5}}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid={'dfltgid', 0x3d, r4}}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt={'euid>', r2}}, {@fowner_eq={'fowner', 0x3d, r2}}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:53:00 executing program 0: r0 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) keyctl$invalidate(0x15, r0) r1 = add_key$fscrypt_provisioning(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)={0x0, 0x0, @auto=[0x17]}, 0x9, r0) r2 = request_key(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)='-)\\${\\\\\x17\'%&][@\x7f#[,\x00', 0xfffffffffffffff9) r3 = add_key(&(0x7f0000000240)='id_legacy\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="47b91d59f63be3ffd728f1da32a417d6229b5f5355f72eacd94dde9dc2d83701375ffebf14ac11d548e515", 0x2b, 0xfffffffffffffffc) keyctl$KEYCTL_MOVE(0x1e, r1, r2, r3, 0x0) add_key$keyring(&(0x7f0000000640), &(0x7f0000000680)={'syz', 0x3}, 0x0, 0x0, r3) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', 0x0) 14:53:00 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)={'trans=xen,', {[], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}]}}) [ 606.438982] 9pnet_fd: Insufficient options for proto=fd [ 606.443065] 9pnet_fd: Insufficient options for proto=fd [ 606.443275] 9pnet_fd: Insufficient options for proto=fd [ 606.456441] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 606.543998] 9pnet: Could not find request transport: xen [ 606.549883] 9pnet: Could not find request transport: xen 14:53:12 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)={'trans=xen,', {[], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}]}}) 14:53:12 executing program 0: r0 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) keyctl$invalidate(0x15, r0) add_key$fscrypt_provisioning(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)={0x0, 0x0, @auto=[0x17]}, 0x9, r0) request_key(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)='-)\\${\\\\\x17\'%&][@\x7f#[,\x00', 0xfffffffffffffff9) r1 = add_key(&(0x7f0000000240)='id_legacy\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="47b91d59f63be3ffd728f1da32a417d6229b5f5355f72eacd94dde9dc2d83701375ffebf14ac11d548e515", 0x2b, 0xfffffffffffffffc) add_key$keyring(&(0x7f0000000640), &(0x7f0000000680)={'syz', 0x3}, 0x0, 0x0, r1) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', 0x0) 14:53:12 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)={'trans=xen,', {[], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}]}}) 14:53:12 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}, {@seclabel}]}) 14:53:12 executing program 7: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 1) 14:53:12 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) (fail_nth: 9) 14:53:12 executing program 5: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f00000005c0)) 14:53:12 executing program 2: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RREADLINK(r1, &(0x7f0000000240)={0x10, 0x17, 0x1, {0x7, './file1'}}, 0x10) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) [ 618.592730] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 618.595508] FAULT_INJECTION: forcing a failure. [ 618.595508] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 618.596561] CPU: 0 PID: 7549 Comm: syz-executor.1 Not tainted 6.0.0-rc6-next-20220921 #1 [ 618.597352] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 618.598462] Call Trace: [ 618.598725] [ 618.598955] dump_stack_lvl+0x8b/0xb3 [ 618.599365] should_fail.cold+0x5/0xa [ 618.599776] strncpy_from_user+0x34/0x3e0 [ 618.600185] getname_flags.part.0+0x95/0x4f0 [ 618.600643] getname_flags+0x9a/0xe0 [ 618.601020] user_path_at_empty+0x2b/0x60 [ 618.601420] __x64_sys_mount+0x1e9/0x300 [ 618.601819] ? path_mount+0x1e20/0x1e20 [ 618.602219] ? syscall_enter_from_user_mode+0x1d/0x50 [ 618.602738] ? syscall_enter_from_user_mode+0x1d/0x50 [ 618.603233] do_syscall_64+0x3b/0x90 [ 618.603613] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 618.603978] RIP: 0033:0x7f14e0f8fb19 [ 618.604330] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 618.606106] RSP: 002b:00007f14de505188 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 618.606866] RAX: ffffffffffffffda RBX: 00007f14e10a2f60 RCX: 00007f14e0f8fb19 [ 618.607562] RDX: 0000000020002040 RSI: 0000000020002000 RDI: 0000000000000000 [ 618.608265] RBP: 00007f14de5051d0 R08: 0000000020002180 R09: 0000000000000000 [ 618.608964] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 618.609668] R13: 00007ffd3b74d26f R14: 00007f14de505300 R15: 0000000000022000 [ 618.610384] [ 618.637293] 9pnet_fd: Insufficient options for proto=fd 14:53:12 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@dont_appraise}]}) 14:53:12 executing program 0: r0 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) keyctl$invalidate(0x15, r0) add_key$fscrypt_provisioning(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)={0x0, 0x0, @auto=[0x17]}, 0x9, r0) request_key(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)='-)\\${\\\\\x17\'%&][@\x7f#[,\x00', 0xfffffffffffffff9) add_key$keyring(&(0x7f0000000640), &(0x7f0000000680)={'syz', 0x3}, 0x0, 0x0, 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', 0x0) 14:53:12 executing program 5: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400c1, 0x0) [ 618.710861] tmpfs: Unknown parameter 'uid<00000000000000060929' 14:53:12 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) (fail_nth: 10) 14:53:12 executing program 7: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 2) 14:53:12 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}]}) 14:53:12 executing program 0: r0 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) keyctl$invalidate(0x15, r0) add_key$fscrypt_provisioning(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000140)={0x0, 0x0, @auto=[0x17]}, 0x9, r0) add_key$keyring(&(0x7f0000000640), &(0x7f0000000680)={'syz', 0x3}, 0x0, 0x0, 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', 0x0) [ 618.782976] 9pnet: Could not find request transport: xen 14:53:12 executing program 5: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000540)) [ 618.822294] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 618.832613] 9pnet: Could not find request transport: xen 14:53:24 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)={'trans=xen,', {[], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}]}}) 14:53:24 executing program 0: r0 = request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) keyctl$invalidate(0x15, r0) add_key$keyring(&(0x7f0000000640), &(0x7f0000000680)={'syz', 0x3}, 0x0, 0x0, 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', 0x0) 14:53:24 executing program 2: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) pipe2$9p(&(0x7f0000000200), 0x800) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:53:24 executing program 5: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x0, 0x4, 0x5, 0xfffffffffffff522, 0x6, r1}) 14:53:24 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) (fail_nth: 11) 14:53:24 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}], [{@uid_lt={'uid<', 0xee01}}]}) 14:53:24 executing program 3: mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)={'trans=xen,', {[], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}]}}) 14:53:24 executing program 7: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 3) [ 631.122047] tmpfs: Unknown parameter 'uid<00000000000000060929' [ 631.124120] 9pnet_fd: Insufficient options for proto=fd [ 631.131012] 9pnet_fd: Insufficient options for proto=fd [ 631.153076] FAULT_INJECTION: forcing a failure. [ 631.153076] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 631.154725] CPU: 1 PID: 7594 Comm: syz-executor.7 Not tainted 6.0.0-rc6-next-20220921 #1 [ 631.155801] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 631.157293] Call Trace: [ 631.157642] [ 631.157957] dump_stack_lvl+0x8b/0xb3 [ 631.158491] should_fail.cold+0x5/0xa [ 631.159027] strncpy_from_user+0x34/0x3e0 [ 631.159611] getname_flags.part.0+0x95/0x4f0 [ 631.160230] __x64_sys_mkdir+0xda/0x140 [ 631.160771] do_syscall_64+0x3b/0x90 [ 631.161299] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 631.162036] RIP: 0033:0x7fe3c0671c27 [ 631.162582] Code: 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 53 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 631.164986] RSP: 002b:00007fe3bdbe7fa8 EFLAGS: 00000246 ORIG_RAX: 0000000000000053 [ 631.165980] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fe3c0671c27 [ 631.166918] RDX: 0000000000000000 RSI: 00000000000001ff RDI: 0000000020000080 [ 631.167852] RBP: 00007fe3bdbe8040 R08: 0000000000000000 R09: 0000000000000000 [ 631.168797] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000020000040 [ 631.169721] R13: 0000000020000080 R14: 00007fe3bdbe8000 R15: 00000000200001c0 [ 631.170674] 14:53:25 executing program 2: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:53:25 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) (fail_nth: 12) [ 631.231445] 9pnet_fd: Insufficient options for proto=fd [ 631.236918] 9pnet: Could not find request transport: xen 14:53:25 executing program 3: mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)={'trans=xen,', {[], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}]}}) 14:53:25 executing program 0: request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='\x81\x00', 0xfffffffffffffff8) add_key$keyring(&(0x7f0000000640), &(0x7f0000000680)={'syz', 0x3}, 0x0, 0x0, 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', 0x0) 14:53:25 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) 14:53:25 executing program 5: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) r2 = syz_open_procfs(r1, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) 14:53:25 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)={'trans=xen,', {[], [{@euid_gt}, {@fowner_gt}]}}) 14:53:25 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) (fail_nth: 13) 14:53:25 executing program 7: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 4) 14:53:25 executing program 2: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) [ 631.377010] 9pnet_fd: Insufficient options for proto=fd 14:53:25 executing program 0: add_key$keyring(&(0x7f0000000640), &(0x7f0000000680)={'syz', 0x3}, 0x0, 0x0, 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', 0x0) 14:53:25 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) (fail_nth: 14) 14:53:25 executing program 3: mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)={'trans=xen,', {[], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}]}}) 14:53:25 executing program 5: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) read(0xffffffffffffffff, &(0x7f0000000400)=""/146, 0x92) 14:53:25 executing program 0: add_key$keyring(0x0, &(0x7f0000000680)={'syz', 0x3}, 0x0, 0x0, 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', 0x0) 14:53:25 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) (fail_nth: 15) 14:53:25 executing program 2: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:53:25 executing program 6: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)={'trans=xen,', {[], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}]}}) 14:53:25 executing program 7: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 5) [ 631.609854] 9pnet: Could not find request transport: xen 14:53:25 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', 0x0) 14:53:25 executing program 3: syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)={'trans=xen,', {[], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}]}}) [ 631.778035] 9pnet: Could not find request transport: xen 14:53:37 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)={'trans=xen,', {[], [{@euid_gt}]}}) 14:53:37 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 1) 14:53:37 executing program 7: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 6) 14:53:37 executing program 2: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000210}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x98, 0x0, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x84, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6d}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x65}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5e9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x46}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000080}, 0x1) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:53:38 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) (fail_nth: 16) 14:53:38 executing program 5: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) read(0xffffffffffffffff, &(0x7f0000000400)=""/146, 0x92) 14:53:38 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) request_key(0x0, &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', 0x0) 14:53:38 executing program 3: syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)={'trans=xen,', {[], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}]}}) [ 644.298609] 9pnet: Could not find request transport: xen 14:53:51 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 2) 14:53:51 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)) 14:53:51 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) (fail_nth: 17) 14:53:51 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) request_key(0x0, &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', 0x0) 14:53:51 executing program 5: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={'\x00', 0x5, 0x0, 0x4, 0x6, 0x5, r1}) read(0xffffffffffffffff, &(0x7f0000000400)=""/146, 0x92) 14:53:51 executing program 2: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:53:51 executing program 7: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 7) 14:53:51 executing program 3: syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)={'trans=xen,', {[], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}]}}) [ 657.440204] 9pnet_fd: Insufficient options for proto=fd [ 657.447038] 9pnet_fd: Insufficient options for proto=fd 14:53:51 executing program 5: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/134, 0x86}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x20010020) r1 = syz_open_procfs(r0, &(0x7f00000003c0)='uid_map\x00') read(r1, &(0x7f0000000400)=""/146, 0x92) 14:53:51 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, 0x0, &(0x7f00000010c0), 0x0, &(0x7f00000012c0)={'trans=xen,', {[], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}]}}) 14:53:51 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 3) 14:53:51 executing program 2: mkdir(&(0x7f00000001c0)='./file1\x00', 0xd0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) [ 657.541416] FAULT_INJECTION: forcing a failure. [ 657.541416] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 657.543523] CPU: 1 PID: 7691 Comm: syz-executor.6 Not tainted 6.0.0-rc6-next-20220921 #1 [ 657.544617] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 657.546824] Call Trace: [ 657.547195] [ 657.547635] dump_stack_lvl+0x8b/0xb3 [ 657.548200] should_fail.cold+0x5/0xa [ 657.548768] strncpy_from_user+0x34/0x3e0 [ 657.549386] getname_flags.part.0+0x95/0x4f0 [ 657.550019] __x64_sys_mkdir+0xda/0x140 [ 657.550792] do_syscall_64+0x3b/0x90 [ 657.551331] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 657.552365] RIP: 0033:0x7efd0e02fc27 [ 657.552883] Code: 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 53 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 657.556487] RSP: 002b:00007efd0b5a5fa8 EFLAGS: 00000246 ORIG_RAX: 0000000000000053 [ 657.557525] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007efd0e02fc27 [ 657.558543] RDX: 0000000000000000 RSI: 00000000000001ff RDI: 0000000020000080 [ 657.559588] RBP: 00007efd0b5a6040 R08: 0000000000000000 R09: 0000000000000000 [ 657.560651] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000020000040 [ 657.561699] R13: 0000000020000080 R14: 00007efd0b5a6000 R15: 00000000200001c0 [ 657.562780] 14:53:51 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) request_key(0x0, &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', 0x0) 14:53:51 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) (fail_nth: 18) 14:53:51 executing program 7: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 8) [ 657.620346] 9pnet_fd: Insufficient options for proto=fd [ 657.640333] 9pnet: Could not find request transport: xen 14:54:04 executing program 7: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 9) 14:54:04 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, 0x0, &(0x7f00000010c0), 0x0, &(0x7f00000012c0)={'trans=xen,', {[], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}]}}) 14:54:04 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', 0x0, &(0x7f0000000980)='\x00', 0x0) 14:54:04 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 4) 14:54:04 executing program 5: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) syz_open_dev$loop(&(0x7f0000000000), 0xaeab, 0x400) r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='uid_map\x00') read(r0, &(0x7f0000000400)=""/146, 0x92) 14:54:04 executing program 2: mkdir(0x0, 0xd0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:54:04 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) (fail_nth: 19) 14:54:04 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)) (fail_nth: 1) 14:54:04 executing program 2: mkdir(0x0, 0xd0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:54:04 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', 0x0, &(0x7f0000000980)='\x00', 0x0) 14:54:04 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, 0x0, &(0x7f00000010c0), 0x0, &(0x7f00000012c0)={'trans=xen,', {[], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}]}}) [ 670.881927] 9pnet_fd: Insufficient options for proto=fd 14:54:04 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)) (fail_nth: 2) 14:54:04 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 5) 14:54:04 executing program 5: ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='uid_map\x00') read(r0, &(0x7f0000000400)=""/146, 0x92) 14:54:04 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', 0x0, &(0x7f0000000980)='\x00', 0x0) 14:54:04 executing program 7: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 10) 14:54:04 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) (fail_nth: 20) [ 671.036654] EXT4-fs error (device sda) in __ext4_new_inode:1085: Out of memory [ 671.162188] 9pnet: Could not find request transport: xen [ 683.147031] 9pnet_fd: Insufficient options for proto=fd 14:54:17 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)) (fail_nth: 3) 14:54:17 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) (fail_nth: 21) 14:54:17 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', 0x0, 0x0, &(0x7f00000012c0)={'trans=xen,', {[], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}]}}) 14:54:17 executing program 7: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 11) 14:54:17 executing program 2: mkdir(0x0, 0xd0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:54:17 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, 0x0, 0x0) 14:54:17 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 6) 14:54:17 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='uid_map\x00') read(r0, &(0x7f0000000400)=""/146, 0x92) 14:54:17 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) (fail_nth: 22) [ 683.202885] FAULT_INJECTION: forcing a failure. [ 683.202885] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 683.203751] CPU: 1 PID: 7757 Comm: syz-executor.4 Not tainted 6.0.0-rc6-next-20220921 #1 [ 683.204291] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 683.205054] Call Trace: [ 683.205234] [ 683.205410] dump_stack_lvl+0x8b/0xb3 [ 683.205695] should_fail.cold+0x5/0xa [ 683.205970] _copy_from_user+0x2a/0x170 [ 683.206250] memdup_user+0x6e/0xd0 [ 683.206505] strndup_user+0x74/0xe0 [ 683.206763] __x64_sys_mount+0x133/0x300 [ 683.207045] ? path_mount+0x1e20/0x1e20 [ 683.207354] ? syscall_enter_from_user_mode+0x1d/0x50 [ 683.207710] ? syscall_enter_from_user_mode+0x1d/0x50 [ 683.208064] do_syscall_64+0x3b/0x90 [ 683.208331] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 683.208727] RIP: 0033:0x7f1dc5377b19 [ 683.208985] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 683.210181] RSP: 002b:00007f1dc28ed188 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 683.210690] RAX: ffffffffffffffda RBX: 00007f1dc548af60 RCX: 00007f1dc5377b19 [ 683.211166] RDX: 00000000200010c0 RSI: 0000000020001080 RDI: 0000000000000000 [ 683.211643] RBP: 00007f1dc28ed1d0 R08: 00000000200012c0 R09: 0000000000000000 [ 683.212118] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 683.212646] R13: 00007ffdee8be6bf R14: 00007f1dc28ed300 R15: 0000000000022000 [ 683.213138] 14:54:17 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 7) 14:54:17 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) (fail_nth: 23) 14:54:17 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)) (fail_nth: 4) 14:54:17 executing program 5: r0 = syz_open_procfs(0x0, 0x0) read(r0, &(0x7f0000000400)=""/146, 0x92) 14:54:17 executing program 2: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:54:17 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, 0x0, 0x0) 14:54:17 executing program 7: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 12) 14:54:17 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', 0x0, 0x0, &(0x7f00000012c0)={'trans=xen,', {[], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}]}}) [ 683.353602] 9pnet_fd: Insufficient options for proto=fd [ 683.362594] 9pnet_fd: Insufficient options for proto=fd 14:54:30 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 8) 14:54:30 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, 0x0, 0x0) 14:54:30 executing program 7: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 13) 14:54:30 executing program 2: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, 0x0, &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:54:30 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) (fail_nth: 24) 14:54:30 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)) (fail_nth: 5) 14:54:30 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', 0x0, 0x0, &(0x7f00000012c0)={'trans=xen,', {[], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_gt={'euid>', 0xffffffffffffffff}}]}}) 14:54:30 executing program 5: r0 = syz_open_procfs(0x0, 0x0) read(r0, &(0x7f0000000400)=""/146, 0x92) 14:54:30 executing program 7: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 14) 14:54:30 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, 0x0) 14:54:30 executing program 5: r0 = syz_open_procfs(0x0, 0x0) read(r0, &(0x7f0000000400)=""/146, 0x92) 14:54:30 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', 0x0) (fail_nth: 1) [ 696.869818] FAULT_INJECTION: forcing a failure. [ 696.869818] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 696.871697] CPU: 1 PID: 7813 Comm: syz-executor.0 Not tainted 6.0.0-rc6-next-20220921 #1 [ 696.872926] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 696.874580] Call Trace: [ 696.874984] [ 696.875345] dump_stack_lvl+0x8b/0xb3 [ 696.875953] should_fail.cold+0x5/0xa [ 696.876565] strncpy_from_user+0x34/0x3e0 [ 696.877232] __do_sys_request_key+0x85/0x3b0 [ 696.877916] ? fput+0x2b/0x190 [ 696.878422] ? __ia32_sys_add_key+0x150/0x150 [ 696.879136] ? syscall_enter_from_user_mode+0x1d/0x50 [ 696.880139] ? syscall_enter_from_user_mode+0x1d/0x50 [ 696.880954] do_syscall_64+0x3b/0x90 [ 696.881546] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 696.882326] RIP: 0033:0x7f94fb110b19 [ 696.882894] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 696.885545] RSP: 002b:00007f94f8686188 EFLAGS: 00000246 ORIG_RAX: 00000000000000f9 [ 696.886682] RAX: ffffffffffffffda RBX: 00007f94fb223f60 RCX: 00007f94fb110b19 [ 696.887740] RDX: 0000000020000980 RSI: 0000000020000940 RDI: 0000000020000900 [ 696.888809] RBP: 00007f94f86861d0 R08: 0000000000000000 R09: 0000000000000000 [ 696.889865] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 696.890925] R13: 00007ffe7a0c825f R14: 00007f94f8686300 R15: 0000000000022000 [ 696.892011] [ 696.950096] 9pnet: Could not find request transport: xen 14:54:43 executing program 7: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 15) 14:54:43 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)) (fail_nth: 6) 14:54:43 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 9) 14:54:43 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', 0x0) (fail_nth: 2) 14:54:43 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, 0x0) 14:54:43 executing program 5: syz_open_procfs(0x0, &(0x7f00000003c0)='uid_map\x00') read(0xffffffffffffffff, &(0x7f0000000400)=""/146, 0x92) 14:54:43 executing program 2: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, 0x0, &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:54:43 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) (fail_nth: 25) [ 709.759337] FAULT_INJECTION: forcing a failure. [ 709.759337] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 709.761293] CPU: 1 PID: 7831 Comm: syz-executor.4 Not tainted 6.0.0-rc6-next-20220921 #1 [ 709.762515] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 709.764065] Call Trace: [ 709.764449] [ 709.764803] dump_stack_lvl+0x8b/0xb3 [ 709.765410] should_fail.cold+0x5/0xa [ 709.766006] _copy_from_user+0x2a/0x170 [ 709.766585] copy_mount_options+0x76/0x180 [ 709.767236] __x64_sys_mount+0x1a8/0x300 [ 709.767834] ? path_mount+0x1e20/0x1e20 [ 709.768405] ? syscall_enter_from_user_mode+0x1d/0x50 [ 709.769195] ? syscall_enter_from_user_mode+0x1d/0x50 [ 709.769978] do_syscall_64+0x3b/0x90 [ 709.770546] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 709.771342] RIP: 0033:0x7f1dc5377b19 [ 709.771911] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 709.774633] RSP: 002b:00007f1dc28ed188 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 709.775738] RAX: ffffffffffffffda RBX: 00007f1dc548af60 RCX: 00007f1dc5377b19 [ 709.776821] RDX: 00000000200010c0 RSI: 0000000020001080 RDI: 0000000000000000 [ 709.777915] RBP: 00007f1dc28ed1d0 R08: 00000000200012c0 R09: 0000000000000000 [ 709.778986] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 709.780060] R13: 00007ffdee8be6bf R14: 00007f1dc28ed300 R15: 0000000000022000 [ 709.781190] 14:54:43 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, 0x0) [ 709.787366] 9pnet_fd: Insufficient options for proto=fd 14:54:43 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', 0x0) (fail_nth: 3) 14:54:43 executing program 7: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 16) 14:54:43 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 10) 14:54:43 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)={'trans=xen,', {[], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}]}}) 14:54:43 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', 0x0) (fail_nth: 4) 14:54:43 executing program 7: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 17) 14:54:43 executing program 5: syz_open_procfs(0x0, &(0x7f00000003c0)='uid_map\x00') read(0xffffffffffffffff, &(0x7f0000000400)=""/146, 0x92) 14:54:43 executing program 2: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, 0x0, &(0x7f0000002040), 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:54:43 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) (fail_nth: 26) [ 709.969570] FAULT_INJECTION: forcing a failure. [ 709.969570] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 709.970609] CPU: 0 PID: 7848 Comm: syz-executor.0 Not tainted 6.0.0-rc6-next-20220921 #1 [ 709.971424] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 709.972542] Call Trace: [ 709.972809] [ 709.973051] dump_stack_lvl+0x8b/0xb3 [ 709.973446] should_fail.cold+0x5/0xa [ 709.973848] _copy_from_user+0x2a/0x170 [ 709.974269] memdup_user+0x6e/0xd0 [ 709.974642] strndup_user+0x74/0xe0 [ 709.975017] __do_sys_request_key+0x107/0x3b0 [ 709.975488] ? fput+0x2b/0x190 [ 709.975825] ? __ia32_sys_add_key+0x150/0x150 [ 709.976283] ? syscall_enter_from_user_mode+0x1d/0x50 [ 709.976797] ? syscall_enter_from_user_mode+0x1d/0x50 [ 709.977344] do_syscall_64+0x3b/0x90 [ 709.977723] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 709.978235] RIP: 0033:0x7f94fb110b19 [ 709.978621] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 709.980431] RSP: 002b:00007f94f8686188 EFLAGS: 00000246 ORIG_RAX: 00000000000000f9 [ 709.981187] RAX: ffffffffffffffda RBX: 00007f94fb223f60 RCX: 00007f94fb110b19 [ 709.981889] RDX: 0000000020000980 RSI: 0000000020000940 RDI: 0000000020000900 [ 709.982598] RBP: 00007f94f86861d0 R08: 0000000000000000 R09: 0000000000000000 [ 709.983303] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 709.984002] R13: 00007ffe7a0c825f R14: 00007f94f8686300 R15: 0000000000022000 [ 709.984723] [ 709.995627] EXT4-fs error (device sda) in __ext4_new_inode:1085: Out of memory [ 710.116018] 9pnet: Could not find request transport: xen [ 710.120919] 9pnet_fd: Insufficient options for proto=fd [ 710.157276] 9pnet: Could not find request transport: xen 14:54:44 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)) (fail_nth: 7) 14:54:44 executing program 7: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 18) 14:54:44 executing program 5: syz_open_procfs(0x0, &(0x7f00000003c0)='uid_map\x00') read(0xffffffffffffffff, &(0x7f0000000400)=""/146, 0x92) 14:54:44 executing program 2: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', 0x0, 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:54:44 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', 0x0) (fail_nth: 5) 14:54:44 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 11) 14:54:55 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 12) 14:54:55 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', 0x0) (fail_nth: 6) 14:54:56 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)={'trans=xen,', {[], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}, {@audit}]}}) 14:54:56 executing program 2: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', 0x0, 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:54:56 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) (fail_nth: 27) 14:54:56 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='uid_map\x00') read(r0, 0x0, 0x0) 14:54:56 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)) (fail_nth: 8) 14:54:56 executing program 7: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 19) [ 722.169766] 9pnet_fd: Insufficient options for proto=fd 14:54:56 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 13) 14:54:56 executing program 7: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 20) 14:54:56 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='uid_map\x00') read(r0, 0x0, 0x0) 14:54:56 executing program 2: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', 0x0, 0x81, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:54:56 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', 0x0) (fail_nth: 7) [ 722.310893] 9pnet: Could not find request transport: xen [ 722.340555] FAULT_INJECTION: forcing a failure. [ 722.340555] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 722.342330] CPU: 1 PID: 7903 Comm: syz-executor.0 Not tainted 6.0.0-rc6-next-20220921 #1 [ 722.343523] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 722.345162] Call Trace: [ 722.345555] [ 722.345903] dump_stack_lvl+0x8b/0xb3 [ 722.346503] should_fail.cold+0x5/0xa [ 722.347099] _copy_from_user+0x2a/0x170 [ 722.347703] memdup_user+0x6e/0xd0 [ 722.348250] strndup_user+0x74/0xe0 [ 722.348804] __do_sys_request_key+0x146/0x3b0 [ 722.349492] ? fput+0x2b/0x190 [ 722.349988] ? __ia32_sys_add_key+0x150/0x150 [ 722.350675] ? syscall_enter_from_user_mode+0x1d/0x50 [ 722.351435] ? syscall_enter_from_user_mode+0x1d/0x50 [ 722.352207] do_syscall_64+0x3b/0x90 [ 722.352779] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 722.353547] RIP: 0033:0x7f94fb110b19 [ 722.354107] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 722.356720] RSP: 002b:00007f94f8686188 EFLAGS: 00000246 ORIG_RAX: 00000000000000f9 [ 722.357834] RAX: ffffffffffffffda RBX: 00007f94fb223f60 RCX: 00007f94fb110b19 [ 722.358868] RDX: 0000000020000980 RSI: 0000000020000940 RDI: 0000000020000900 [ 722.359904] RBP: 00007f94f86861d0 R08: 0000000000000000 R09: 0000000000000000 [ 722.360932] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 722.361969] R13: 00007ffe7a0c825f R14: 00007f94f8686300 R15: 0000000000022000 [ 722.363033] [ 722.383768] 9pnet: Could not find request transport: xen 14:55:07 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', 0x0) (fail_nth: 8) 14:55:07 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) (fail_nth: 28) 14:55:07 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='uid_map\x00') read(r0, 0x0, 0x0) [ 733.567209] 9pnet_fd: Insufficient options for proto=fd 14:55:07 executing program 2: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}, {@dfltgid}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:55:07 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 14) 14:55:07 executing program 7: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 21) 14:55:07 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)={'trans=xen,', {[], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}, {@smackfshat={'smackfshat', 0x3d, '+z,\xf3/^!!'}}]}}) 14:55:07 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)) (fail_nth: 9) [ 733.605813] FAULT_INJECTION: forcing a failure. [ 733.605813] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 733.607075] CPU: 1 PID: 7920 Comm: syz-executor.0 Not tainted 6.0.0-rc6-next-20220921 #1 [ 733.607791] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 733.608769] Call Trace: [ 733.609006] [ 733.609217] dump_stack_lvl+0x8b/0xb3 [ 733.609605] should_fail.cold+0x5/0xa [ 733.609943] _copy_to_user+0x2a/0x140 [ 733.610291] simple_read_from_buffer+0xcc/0x160 [ 733.610707] proc_fail_nth_read+0x198/0x230 [ 733.611092] ? proc_sessionid_read+0x230/0x230 [ 733.611521] ? security_file_permission+0xb1/0xe0 [ 733.611974] vfs_read+0x253/0x930 [ 733.612299] ? proc_sessionid_read+0x230/0x230 [ 733.612704] ? kernel_read+0x1c0/0x1c0 [ 733.613084] ? __fget_files+0x270/0x450 [ 733.613484] ksys_read+0x127/0x250 [ 733.613819] ? __ia32_sys_pwrite64+0x220/0x220 [ 733.614253] ? syscall_enter_from_user_mode+0x1d/0x50 [ 733.614710] ? syscall_enter_from_user_mode+0x1d/0x50 [ 733.615184] do_syscall_64+0x3b/0x90 [ 733.615520] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 733.615957] RIP: 0033:0x7f94fb0c369c [ 733.616275] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48 [ 733.617784] RSP: 002b:00007f94f8686170 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 733.618416] RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 00007f94fb0c369c [ 733.619009] RDX: 000000000000000f RSI: 00007f94f86861e0 RDI: 0000000000000003 [ 733.619597] RBP: 00007f94f86861d0 R08: 0000000000000000 R09: 0000000000000000 [ 733.620201] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 733.620683] R13: 00007ffe7a0c825f R14: 00007f94f8686300 R15: 0000000000022000 [ 733.621434] 14:55:07 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) (fail_nth: 29) [ 733.631488] 9pnet_fd: Insufficient options for proto=fd [ 733.632631] FAULT_INJECTION: forcing a failure. [ 733.632631] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 733.633525] CPU: 1 PID: 7921 Comm: syz-executor.4 Not tainted 6.0.0-rc6-next-20220921 #1 [ 733.634307] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 733.635052] Call Trace: [ 733.635297] [ 733.635462] dump_stack_lvl+0x8b/0xb3 [ 733.635837] should_fail.cold+0x5/0xa [ 733.636116] strncpy_from_user+0x34/0x3e0 [ 733.636554] getname_flags.part.0+0x95/0x4f0 [ 733.636951] getname_flags+0x9a/0xe0 [ 733.637265] user_path_at_empty+0x2b/0x60 [ 733.637562] __x64_sys_mount+0x1e9/0x300 [ 733.637850] ? path_mount+0x1e20/0x1e20 [ 733.638130] ? syscall_enter_from_user_mode+0x1d/0x50 [ 733.638541] ? syscall_enter_from_user_mode+0x1d/0x50 [ 733.638982] do_syscall_64+0x3b/0x90 [ 733.639256] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 733.639608] RIP: 0033:0x7f1dc5377b19 [ 733.639869] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 733.641225] RSP: 002b:00007f1dc28ed188 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 733.641755] RAX: ffffffffffffffda RBX: 00007f1dc548af60 RCX: 00007f1dc5377b19 [ 733.642242] RDX: 00000000200010c0 RSI: 0000000020001080 RDI: 0000000000000000 [ 733.642769] RBP: 00007f1dc28ed1d0 R08: 00000000200012c0 R09: 0000000000000000 [ 733.643355] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 733.643838] R13: 00007ffdee8be6bf R14: 00007f1dc28ed300 R15: 0000000000022000 [ 733.644339] [ 733.709005] 9pnet_fd: Insufficient options for proto=fd 14:55:07 executing program 5: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, 0x0) [ 733.739591] 9pnet: Could not find request transport: xen 14:55:22 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)) (fail_nth: 10) 14:55:22 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) (fail_nth: 30) 14:55:22 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='uid_map\x00') read(r0, &(0x7f0000000400)=""/146, 0x92) (fail_nth: 1) 14:55:22 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)={'trans=xen,', {[], [{@euid_gt}, {@fowner_gt}, {@obj_type={'obj_type', 0x3d, '.{W@'}}]}}) 14:55:22 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 15) 14:55:22 executing program 2: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, 0x0) 14:55:22 executing program 7: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 22) 14:55:22 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', 0x0) [ 748.360605] 9pnet_fd: Insufficient options for proto=fd 14:55:22 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) (fail_nth: 31) 14:55:22 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 16) [ 748.452736] 9pnet_fd: Insufficient options for proto=fd 14:55:22 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='uid_map\x00') read(r0, &(0x7f0000000400)=""/146, 0x92) (fail_nth: 2) 14:55:22 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)) (fail_nth: 11) 14:55:22 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) (fail_nth: 32) 14:55:22 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 17) 14:55:22 executing program 2: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, 0x0) 14:55:22 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', 0x0) 14:55:22 executing program 7: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 23) 14:55:22 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='uid_map\x00') read(r0, &(0x7f0000000400)=""/146, 0x92) (fail_nth: 3) [ 748.581297] 9pnet_fd: Insufficient options for proto=fd [ 748.587299] FAULT_INJECTION: forcing a failure. [ 748.587299] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 748.588156] CPU: 0 PID: 7961 Comm: syz-executor.1 Not tainted 6.0.0-rc6-next-20220921 #1 [ 748.588773] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 748.589619] Call Trace: [ 748.589821] [ 748.590000] dump_stack_lvl+0x8b/0xb3 [ 748.590312] should_fail.cold+0x5/0xa [ 748.590621] _copy_to_user+0x2a/0x140 [ 748.590930] simple_read_from_buffer+0xcc/0x160 [ 748.591305] proc_fail_nth_read+0x198/0x230 [ 748.591649] ? proc_sessionid_read+0x230/0x230 [ 748.592009] ? security_file_permission+0xb1/0xe0 [ 748.592393] vfs_read+0x253/0x930 [ 748.592672] ? proc_sessionid_read+0x230/0x230 [ 748.593030] ? kernel_read+0x1c0/0x1c0 [ 748.593338] ? __fget_files+0x270/0x450 [ 748.593674] ksys_read+0x127/0x250 [ 748.593966] ? __ia32_sys_pwrite64+0x220/0x220 [ 748.594323] ? syscall_enter_from_user_mode+0x1d/0x50 [ 748.594723] ? syscall_enter_from_user_mode+0x1d/0x50 [ 748.595116] do_syscall_64+0x3b/0x90 [ 748.595410] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 748.595802] RIP: 0033:0x7f14e0f4269c [ 748.596090] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48 [ 748.597462] RSP: 002b:00007f14de505170 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 748.598044] RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 00007f14e0f4269c [ 748.598587] RDX: 000000000000000f RSI: 00007f14de5051e0 RDI: 0000000000000003 [ 748.599132] RBP: 00007f14de5051d0 R08: 0000000000000000 R09: 0000000000000000 [ 748.599674] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 748.600215] R13: 00007ffd3b74d26f R14: 00007f14de505300 R15: 0000000000022000 [ 748.600770] [ 748.615031] 9pnet: Could not find request transport: xen 14:55:22 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)={'trans=xen,', {[], [{@euid_gt}, {@fowner_gt}]}}) [ 748.652370] FAULT_INJECTION: forcing a failure. [ 748.652370] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 748.654252] CPU: 1 PID: 7967 Comm: syz-executor.5 Not tainted 6.0.0-rc6-next-20220921 #1 [ 748.655351] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 748.656826] Call Trace: [ 748.657182] [ 748.657504] dump_stack_lvl+0x8b/0xb3 [ 748.658042] should_fail.cold+0x5/0xa [ 748.658579] copyout+0x19/0x120 [ 748.659067] _copy_to_iter+0x576/0x1360 [ 748.659631] ? seq_file_path+0x30/0x30 [ 748.660166] ? memcg_slab_post_alloc_hook+0x20b/0x440 [ 748.660868] ? _copy_from_iter_nocache+0x1080/0x1080 [ 748.661563] ? map_id_up+0x178/0x2f0 [ 748.662085] ? userns_owner+0x40/0x40 [ 748.662617] ? __virt_addr_valid+0xfe/0x340 [ 748.663230] ? __check_object_size+0x380/0x700 [ 748.663865] seq_read_iter+0xdcb/0x12b0 [ 748.664450] seq_read+0x16d/0x210 [ 748.664945] ? seq_read_iter+0x12b0/0x12b0 [ 748.665586] ? inode_security+0x105/0x140 [ 748.666199] ? security_file_permission+0xb1/0xe0 [ 748.666911] vfs_read+0x253/0x930 [ 748.667428] ? seq_read_iter+0x12b0/0x12b0 [ 748.668035] ? kernel_read+0x1c0/0x1c0 [ 748.668621] ? __fget_files+0x270/0x450 [ 748.669231] ksys_read+0x127/0x250 [ 748.669771] ? __ia32_sys_pwrite64+0x220/0x220 [ 748.670429] ? syscall_enter_from_user_mode+0x1d/0x50 [ 748.671151] ? syscall_enter_from_user_mode+0x1d/0x50 [ 748.671890] do_syscall_64+0x3b/0x90 [ 748.672444] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 748.673172] RIP: 0033:0x7f6df369fb19 [ 748.673716] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 748.676187] RSP: 002b:00007f6df0c15188 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 748.677227] RAX: ffffffffffffffda RBX: 00007f6df37b2f60 RCX: 00007f6df369fb19 [ 748.678213] RDX: 0000000000000092 RSI: 0000000020000400 RDI: 0000000000000003 [ 748.679208] RBP: 00007f6df0c151d0 R08: 0000000000000000 R09: 0000000000000000 [ 748.680187] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 748.681159] R13: 00007ffdad67c02f R14: 00007f6df0c15300 R15: 0000000000022000 [ 748.682188] 14:55:22 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) 14:55:22 executing program 7: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 24) 14:55:22 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3, 0x2}, &(0x7f0000000980)='\x00', 0x0) 14:55:22 executing program 2: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, 0x0) [ 748.780829] 9pnet_fd: Insufficient options for proto=fd [ 748.855676] 9pnet: Could not find request transport: xen [ 748.879034] 9pnet: Could not find request transport: xen [ 760.553421] 9pnet_fd: Insufficient options for proto=fd 14:55:34 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 18) 14:55:34 executing program 2: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}, {@noextend}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:55:34 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='uid_map\x00') read(r0, &(0x7f0000000400)=""/146, 0x92) (fail_nth: 4) 14:55:34 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)) (fail_nth: 12) 14:55:34 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x2, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) 14:55:34 executing program 7: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 25) 14:55:34 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)={'trans=xen,', {[], [{@euid_gt}]}}) 14:55:34 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3, 0x5}, &(0x7f0000000980)='\x00', 0x0) 14:55:34 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3, 0xf}, &(0x7f0000000980)='\x00', 0x0) 14:55:34 executing program 2: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) [ 760.624953] FAULT_INJECTION: forcing a failure. [ 760.624953] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 760.626769] CPU: 0 PID: 8009 Comm: syz-executor.5 Not tainted 6.0.0-rc6-next-20220921 #1 [ 760.627972] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 760.629617] Call Trace: [ 760.630015] [ 760.630363] dump_stack_lvl+0x8b/0xb3 [ 760.630959] should_fail.cold+0x5/0xa [ 760.631555] _copy_to_user+0x2a/0x140 [ 760.632140] simple_read_from_buffer+0xcc/0x160 [ 760.632861] proc_fail_nth_read+0x198/0x230 [ 760.633522] ? proc_sessionid_read+0x230/0x230 [ 760.634229] ? security_file_permission+0xb1/0xe0 [ 760.634999] vfs_read+0x253/0x930 [ 760.635549] ? proc_sessionid_read+0x230/0x230 [ 760.636244] ? kernel_read+0x1c0/0x1c0 [ 760.636856] ? __fget_files+0x270/0x450 [ 760.637493] ksys_read+0x127/0x250 [ 760.638068] ? __ia32_sys_pwrite64+0x220/0x220 [ 760.638772] ? syscall_enter_from_user_mode+0x1d/0x50 [ 760.639544] ? syscall_enter_from_user_mode+0x1d/0x50 [ 760.640335] do_syscall_64+0x3b/0x90 [ 760.640920] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 760.641688] RIP: 0033:0x7f6df365269c [ 760.642231] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48 [ 760.644751] RSP: 002b:00007f6df0c15170 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 760.645835] RAX: ffffffffffffffda RBX: 0000000000000021 RCX: 00007f6df365269c [ 760.646852] RDX: 000000000000000f RSI: 00007f6df0c151e0 RDI: 0000000000000004 [ 760.647855] RBP: 00007f6df0c151d0 R08: 0000000000000000 R09: 0000000000000000 [ 760.648907] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 760.649985] R13: 00007ffdad67c02f R14: 00007f6df0c15300 R15: 0000000000022000 [ 760.651089] 14:55:34 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x3, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) [ 760.684740] 9pnet_fd: Insufficient options for proto=fd 14:55:34 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)) (fail_nth: 13) 14:55:34 executing program 7: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 26) 14:55:34 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 19) 14:55:34 executing program 2: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) [ 760.756301] 9pnet: Could not find request transport: xen 14:55:34 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x02', 0x0) [ 760.786485] ENOMEM in journal_alloc_journal_head, retrying. 14:55:34 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x4, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) [ 760.822941] 9pnet_fd: Insufficient options for proto=fd [ 760.926350] 9pnet: Could not find request transport: xen 14:55:49 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)) (fail_nth: 14) 14:55:49 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x5, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) 14:55:49 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)) 14:55:49 executing program 2: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@loose}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:55:49 executing program 7: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 27) 14:55:49 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='uid_map\x00') read(r0, &(0x7f0000000400)=""/146, 0x92) 14:55:49 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 20) 14:55:49 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x05', 0x0) [ 775.469607] 9pnet_fd: Insufficient options for proto=fd [ 775.479308] 9pnet: Could not find request transport: xen 14:56:02 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='uid_map\x00') read(r0, &(0x7f0000000400)=""/146, 0x21) 14:56:02 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)) (fail_nth: 15) 14:56:02 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x6, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) 14:56:02 executing program 2: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@posixacl}, {@noextend}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:56:02 executing program 7: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 28) 14:56:02 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\b', 0x0) 14:56:02 executing program 3: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3, 0x5}, &(0x7f0000000980)='\x00', 0x0) 14:56:02 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 21) [ 788.472564] 9pnet_fd: Insufficient options for proto=fd 14:56:02 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x0f', 0x0) 14:56:02 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x7, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) 14:56:02 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='uid_map\x00') read(r0, &(0x7f0000000400)=""/146, 0x7ffffffff000) 14:56:02 executing program 2: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@dfltuid}, {@noextend}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:56:02 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 22) 14:56:02 executing program 3: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3, 0x5}, &(0x7f0000000980)='\x00', 0x0) 14:56:02 executing program 7: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 29) [ 788.674667] 9pnet: Could not find request transport: xen [ 788.689775] 9pnet_fd: Insufficient options for proto=fd 14:56:02 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)) (fail_nth: 16) 14:56:19 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)) (fail_nth: 17) 14:56:19 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x8, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) 14:56:19 executing program 3: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3, 0x5}, &(0x7f0000000980)='\x00', 0x0) 14:56:19 executing program 7: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 30) 14:56:19 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', 0x0) 14:56:19 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 23) 14:56:19 executing program 2: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@access_client}, {@noextend}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:56:19 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='uid_map\x00') syz_open_dev$vcsu(&(0x7f0000000000), 0x10001, 0x400) read(r0, &(0x7f0000000400)=""/146, 0x92) [ 805.349659] FAULT_INJECTION: forcing a failure. 14:56:19 executing program 3: request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3, 0x5}, &(0x7f0000000980)='\x00', 0x0) [ 805.349659] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 805.351494] CPU: 1 PID: 8106 Comm: syz-executor.7 Not tainted 6.0.0-rc6-next-20220921 #1 [ 805.352563] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 805.354023] Call Trace: [ 805.354398] [ 805.354710] dump_stack_lvl+0x8b/0xb3 [ 805.355261] should_fail.cold+0x5/0xa [ 805.355794] _copy_from_user+0x2a/0x170 [ 805.356341] memdup_user+0x6e/0xd0 [ 805.356830] strndup_user+0x74/0xe0 [ 805.357334] __x64_sys_mount+0x133/0x300 [ 805.357892] ? path_mount+0x1e20/0x1e20 [ 805.358447] ? syscall_enter_from_user_mode+0x1d/0x50 [ 805.359170] ? syscall_enter_from_user_mode+0x1d/0x50 [ 805.359890] do_syscall_64+0x3b/0x90 [ 805.360437] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 805.361155] RIP: 0033:0x7fe3c067404a [ 805.361684] Code: 48 c7 c2 bc ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 805.364177] RSP: 002b:00007fe3bdbe7fa8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 [ 805.365234] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fe3c067404a [ 805.366226] RDX: 0000000020000040 RSI: 0000000020000080 RDI: 0000000000000000 [ 805.367198] RBP: 00007fe3bdbe8040 R08: 00007fe3bdbe8040 R09: 0000000020000040 [ 805.368186] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000020000040 [ 805.369169] R13: 0000000020000080 R14: 00007fe3bdbe8000 R15: 00000000200001c0 [ 805.370187] [ 805.382703] 9pnet_fd: Insufficient options for proto=fd 14:56:19 executing program 5: r0 = fork() getpgid(r0) r1 = syz_open_procfs(r0, &(0x7f0000000280)='cgroup\x00') read(r1, &(0x7f0000000400)=""/146, 0x92) sendmsg$802154_dgram(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x24, @long={0x3, 0xbdbad45b6a7f6e35, {0xaaaaaaaaaaaa0002}}}, 0x14, &(0x7f00000000c0)={&(0x7f0000000040)="88bb044d33f8952569951931595ee0c60960468bf5e3443c71b24280ebe5b3de48dada44e6ee1ba91f1cb2201fdea633902497a1e23ffc8570e79cd525838e115ea0a76600f0ba21df287832aefecbc8e70c01b1ed", 0x55}, 0x1, 0x0, 0x0, 0x20000000}, 0x4004000) sendmsg$inet(r1, &(0x7f0000000240)={&(0x7f0000000180)={0x2, 0x4e21, @rand_addr=0x64010100}, 0x10, &(0x7f0000000200)=[{&(0x7f00000001c0)}], 0x1}, 0x20000800) openat$hpet(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) r2 = openat(r1, &(0x7f0000000100)='./file0\x00', 0x400, 0x44) sendfile(r2, 0xffffffffffffffff, 0x0, 0x1ff) ioctl$BINDER_FREEZE(r2, 0x400c620e, &(0x7f00000001c0)={r0, 0x1, 0x14125300}) fcntl$F_SET_FILE_RW_HINT(r1, 0x40e, &(0x7f0000000140)=0x2) 14:56:19 executing program 3: request_key(0x0, &(0x7f0000000940)={'syz', 0x3, 0x5}, &(0x7f0000000980)='\x00', 0x0) 14:56:19 executing program 2: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@cache_fscache}, {@noextend}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:56:19 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 24) 14:56:19 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', 0x0) [ 805.474476] 9pnet: Could not find request transport: xen 14:56:19 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x9, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) 14:56:19 executing program 7: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 31) 14:56:19 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)) (fail_nth: 18) [ 805.531701] 9pnet_fd: Insufficient options for proto=fd 14:56:19 executing program 3: request_key(0x0, &(0x7f0000000940)={'syz', 0x3, 0x5}, &(0x7f0000000980)='\x00', 0x0) 14:56:19 executing program 2: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@aname={'aname', 0x3d, '(Z$'}}, {@noextend}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:56:19 executing program 7: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 32) 14:56:19 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)) (fail_nth: 19) [ 805.653994] 9pnet_fd: Insufficient options for proto=fd 14:56:19 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0xa, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) [ 805.762512] 9pnet: Could not find request transport: xen 14:56:33 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)) (fail_nth: 20) 14:56:33 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', 0x0) 14:56:33 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 25) 14:56:33 executing program 2: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@access_uid}, {@noextend}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:56:33 executing program 3: request_key(0x0, &(0x7f0000000940)={'syz', 0x3, 0x5}, &(0x7f0000000980)='\x00', 0x0) 14:56:33 executing program 7: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 33) 14:56:33 executing program 5: fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000040)={0x0, 0x0}) r1 = syz_open_procfs(r0, &(0x7f0000000000)='timers\x00') read(r1, &(0x7f0000000400)=""/146, 0x92) 14:56:33 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0xb, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) [ 819.154159] 9pnet_fd: Insufficient options for proto=fd [ 819.177019] FAULT_INJECTION: forcing a failure. [ 819.177019] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 819.179430] CPU: 0 PID: 8167 Comm: syz-executor.7 Not tainted 6.0.0-rc6-next-20220921 #1 [ 819.180911] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 819.182754] Call Trace: [ 819.183135] [ 819.183481] dump_stack_lvl+0x8b/0xb3 [ 819.184067] should_fail.cold+0x5/0xa [ 819.184654] _copy_from_user+0x2a/0x170 [ 819.185252] copy_mount_options+0x76/0x180 [ 819.185888] __x64_sys_mount+0x1a8/0x300 [ 819.186445] ? path_mount+0x1e20/0x1e20 [ 819.187020] ? syscall_enter_from_user_mode+0x1d/0x50 [ 819.187762] ? syscall_enter_from_user_mode+0x1d/0x50 [ 819.188513] do_syscall_64+0x3b/0x90 [ 819.189084] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 819.189836] RIP: 0033:0x7fe3c067404a [ 819.190400] Code: 48 c7 c2 bc ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 819.193072] RSP: 002b:00007fe3bdbe7fa8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 [ 819.194229] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fe3c067404a [ 819.195356] RDX: 0000000020000040 RSI: 0000000020000080 RDI: 0000000000000000 [ 819.196454] RBP: 00007fe3bdbe8040 R08: 00007fe3bdbe8040 R09: 0000000020000040 [ 819.197575] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000020000040 [ 819.198690] R13: 0000000020000080 R14: 00007fe3bdbe8000 R15: 00000000200001c0 [ 819.199836] 14:56:33 executing program 3: request_key(&(0x7f0000000900)='dns_resolver\x00', 0x0, &(0x7f0000000980)='\x00', 0x0) 14:56:33 executing program 7: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 34) 14:56:33 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)) (fail_nth: 21) 14:56:33 executing program 5: r0 = socket$nl_audit(0x10, 0x3, 0x9) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'sit0\x00', 0x0}) ioctl$sock_inet6_SIOCDIFADDR(r1, 0x8916, &(0x7f0000000080)={@mcast1, 0x0, r2}) r3 = syz_open_procfs(0x0, &(0x7f00000003c0)='uid_map\x00') read(r3, &(0x7f0000000400)=""/146, 0x92) 14:56:33 executing program 2: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@version_L}, {@noextend}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:56:33 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', 0x0) 14:56:33 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 26) [ 819.434083] 9pnet_fd: Insufficient options for proto=fd [ 819.528545] ENOMEM in journal_alloc_journal_head, retrying. [ 819.601848] 9pnet: Could not find request transport: xen 14:56:46 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)) (fail_nth: 22) 14:56:46 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x10, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) 14:56:46 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 27) 14:56:46 executing program 3: request_key(&(0x7f0000000900)='dns_resolver\x00', 0x0, &(0x7f0000000980)='\x00', 0x0) 14:56:46 executing program 7: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 35) 14:56:46 executing program 2: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}, {@subj_type={'subj_type', 0x3d, ',['}}]}}) 14:56:46 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', 0x0) 14:56:46 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='uid_map\x00') r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = openat(r1, &(0x7f0000000040)='./file0\x00', 0x202000, 0x80) ioctl$AUTOFS_IOC_EXPIRE(r1, 0x810c9365, &(0x7f0000000080)={{0x7fff, 0x4}, 0x100, './file0\x00'}) r3 = fork() getpgid(r3) r4 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_int(r4, 0x0, 0x19, 0x0, &(0x7f00000001c0)) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r2, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r0, {0x2}}, './file0\x00'}) kcmp$KCMP_EPOLL_TFD(0xffffffffffffffff, r3, 0x7, r4, &(0x7f0000000200)={r5, r0, 0x1f}) [ 832.494894] 9pnet_fd: Insufficient options for proto=fd 14:56:46 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x67, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) 14:56:46 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)) (fail_nth: 23) 14:56:46 executing program 2: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}, {@fowner_eq}]}}) 14:56:46 executing program 3: request_key(&(0x7f0000000900)='dns_resolver\x00', 0x0, &(0x7f0000000980)='\x00', 0x0) 14:56:46 executing program 5: r0 = fork() r1 = syz_open_procfs(r0, &(0x7f00000003c0)='uid_map\x00') r2 = accept$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000040)=0x14) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0) sendfile(r3, 0xffffffffffffffff, 0x0, 0x1ff) r4 = inotify_init() io_submit(0x0, 0x2, &(0x7f00000001c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x5, 0x2, r2, &(0x7f0000000080)="22a589d4e0a96fd880484b506dec8526972daeb52ff6c4539b705836911adccc011b582a54cc08f87c6194d36357a616e07fc334ddd2327e4739874de6bebe0f0bb3b0682ae3e6553fa37a338dccede10534489d54b3b7a156677abb73bd558ab0", 0x61, 0x0, 0x0, 0x1, r3}, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2, 0x2, r4, &(0x7f0000000140)="e449aca627fd93823194d1", 0xb, 0xb23, 0x0, 0x0, r1}]) read(r1, &(0x7f0000000400)=""/146, 0x92) 14:56:46 executing program 7: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 36) 14:56:46 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 28) 14:56:46 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', 0x0) [ 832.663499] 9pnet_fd: Insufficient options for proto=fd [ 832.739628] FAULT_INJECTION: forcing a failure. [ 832.739628] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 832.740707] CPU: 0 PID: 8233 Comm: syz-executor.7 Not tainted 6.0.0-rc6-next-20220921 #1 [ 832.741336] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 832.742197] Call Trace: [ 832.742410] [ 832.742600] dump_stack_lvl+0x8b/0xb3 [ 832.742916] should_fail.cold+0x5/0xa [ 832.743228] strncpy_from_user+0x34/0x3e0 [ 832.743567] getname_flags.part.0+0x95/0x4f0 [ 832.743919] getname_flags+0x9a/0xe0 [ 832.744217] user_path_at_empty+0x2b/0x60 [ 832.744542] __x64_sys_mount+0x1e9/0x300 [ 832.744862] ? path_mount+0x1e20/0x1e20 [ 832.745172] ? syscall_enter_from_user_mode+0x1d/0x50 [ 832.745570] ? syscall_enter_from_user_mode+0x1d/0x50 [ 832.745975] do_syscall_64+0x3b/0x90 [ 832.746278] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 832.746689] RIP: 0033:0x7fe3c067404a [ 832.746976] Code: 48 c7 c2 bc ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 832.748324] RSP: 002b:00007fe3bdbe7fa8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 [ 832.748900] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fe3c067404a [ 832.749435] RDX: 0000000020000040 RSI: 0000000020000080 RDI: 0000000000000000 [ 832.749982] RBP: 00007fe3bdbe8040 R08: 00007fe3bdbe8040 R09: 0000000020000040 [ 832.750534] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000020000040 [ 832.751069] R13: 0000000020000080 R14: 00007fe3bdbe8000 R15: 00000000200001c0 [ 832.751625] [ 832.792917] 9pnet: Could not find request transport: xen 14:56:58 executing program 5: syz_io_uring_setup(0x1221, &(0x7f0000000100)={0x0, 0x6377, 0x0, 0x2, 0xb09}, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='uid_map\x00') read(r0, &(0x7f0000000400)=""/146, 0x92) syz_io_uring_setup(0x9b4, &(0x7f0000000000)={0x0, 0xbfd1, 0x2, 0x1, 0x1a5, 0x0, r0}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) 14:56:58 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)) (fail_nth: 24) 14:56:58 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', 0x0) 14:56:58 executing program 3: request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3, 0x5}, 0x0, 0x0) 14:56:58 executing program 2: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}, {@euid_gt}]}}) 14:56:58 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 29) 14:56:58 executing program 7: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 37) 14:56:58 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0xbc, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) 14:56:58 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 30) [ 845.020881] 9pnet_fd: Insufficient options for proto=fd [ 845.052173] FAULT_INJECTION: forcing a failure. [ 845.052173] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 845.053158] CPU: 1 PID: 8260 Comm: syz-executor.6 Not tainted 6.0.0-rc6-next-20220921 #1 [ 845.053795] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 845.054648] Call Trace: [ 845.054882] [ 845.055063] dump_stack_lvl+0x8b/0xb3 [ 845.055380] should_fail.cold+0x5/0xa [ 845.055690] _copy_from_user+0x2a/0x170 [ 845.056009] memdup_user+0x6e/0xd0 [ 845.056302] strndup_user+0x74/0xe0 [ 845.056601] __x64_sys_mount+0x133/0x300 [ 845.056923] ? path_mount+0x1e20/0x1e20 [ 845.057243] ? syscall_enter_from_user_mode+0x1d/0x50 [ 845.057661] ? syscall_enter_from_user_mode+0x1d/0x50 [ 845.058060] do_syscall_64+0x3b/0x90 [ 845.058369] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 845.058793] RIP: 0033:0x7efd0e03204a [ 845.059092] Code: 48 c7 c2 bc ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 845.060487] RSP: 002b:00007efd0b5a5fa8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 [ 845.061077] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007efd0e03204a [ 845.061628] RDX: 0000000020000040 RSI: 0000000020000080 RDI: 0000000000000000 [ 845.062188] RBP: 00007efd0b5a6040 R08: 00007efd0b5a6040 R09: 0000000020000040 [ 845.062761] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000020000040 [ 845.063323] R13: 0000000020000080 R14: 00007efd0b5a6000 R15: 00000000200001c0 [ 845.063890] 14:56:58 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='uid_map\x00') read(r0, &(0x7f0000000400)=""/146, 0x92) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000040), 0x404202, 0x0) r4 = fspick(r0, &(0x7f0000000080)='./file0\x00', 0x1) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r1, 0xc0189378, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r1, @ANYRES32=r1, @ANYBLOB="00000000850db451c1632e2fc161ab0d1d6b1ab5dc5ad8dc9021d4c8f44d49c135bd34b22c1e98b0efef56931ebbce61cf9ff5dd08929d730423dcc161654fc155cc886c2f36da98f18d5ad916d270ca536de7f1a1444d56d860a2c730fb2a33ca7aa3907bd6f1d62742e0d8945d491917174306fc701633dd5d5e3203cd79daf675871e4fac6040cf381ba42d605437d302eda90ce7"]) io_uring_register$IORING_REGISTER_FILES(r3, 0x2, &(0x7f0000000100)=[r4, r5, r2], 0x3) ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0) 14:56:58 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x300, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) 14:56:58 executing program 2: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}], [{@permit_directio}, {@dont_measure}, {@appraise_type}, {@seclabel}]}}) 14:56:59 executing program 7: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 38) 14:56:59 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', 0x0) 14:56:59 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)) (fail_nth: 25) [ 845.239624] 9pnet_fd: Insufficient options for proto=fd [ 845.349001] 9pnet: Could not find request transport: xen [ 856.591627] 9pnet: Could not find request transport: xen [ 856.593764] 9pnet_fd: Insufficient options for proto=fd 14:57:10 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)) (fail_nth: 26) 14:57:10 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x500, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) 14:57:10 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 31) 14:57:10 executing program 2: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}], [{@permit_directio}, {@dont_measure}, {@appraise_type}]}}) 14:57:10 executing program 3: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', 0x0) 14:57:10 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', 0x0) 14:57:10 executing program 7: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 39) 14:57:10 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='status\x00') read(r0, &(0x7f0000000400)=""/146, 0x92) 14:57:10 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)) (fail_nth: 27) 14:57:10 executing program 3: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', 0x0) 14:57:10 executing program 7: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 40) 14:57:10 executing program 5: syz_open_procfs(0x0, &(0x7f00000003c0)='uid_map\x00') r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000001840)={0x1c, r3, 0x1, 0x0, 0x0, {}, [@NL80211_ATTR_USER_REG_HINT_TYPE={0x8, 0x9a, 0x2}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_PROTOCOL_FEATURES(r1, &(0x7f0000000180)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, r3, 0x2, 0x70bd25, 0x25dfdbfd, {}, ["", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4000}, 0x200000c1) r4 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_int(r4, 0x0, 0x19, 0x0, &(0x7f00000001c0)) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f0000000800)) getsockopt$inet_int(r0, 0x0, 0x19, 0x0, &(0x7f00000001c0)) r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0) sendfile(r5, 0xffffffffffffffff, 0x0, 0x1ff) syz_genetlink_get_family_id$ipvs(&(0x7f0000000200), r5) read(r0, &(0x7f0000000000)=""/153, 0x99) 14:57:10 executing program 2: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}], [{@permit_directio}, {@dont_measure}]}}) 14:57:10 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x59e, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) 14:57:10 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 32) 14:57:10 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', 0x0) [ 856.788940] 9pnet: Could not find request transport: xen [ 856.796861] 9pnet_fd: Insufficient options for proto=fd 14:57:10 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)) (fail_nth: 28) [ 856.887053] 9pnet: Could not find request transport: xen 14:57:24 executing program 3: syz_open_procfs(0x0, &(0x7f00000003c0)='uid_map\x00') r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000001840)={0x1c, r3, 0x1, 0x0, 0x0, {}, [@NL80211_ATTR_USER_REG_HINT_TYPE={0x8, 0x9a, 0x2}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_GET_PROTOCOL_FEATURES(r1, &(0x7f0000000180)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, r3, 0x2, 0x70bd25, 0x25dfdbfd, {}, ["", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4000}, 0x200000c1) r4 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_int(r4, 0x0, 0x19, 0x0, &(0x7f00000001c0)) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f0000000800)) getsockopt$inet_int(r0, 0x0, 0x19, 0x0, &(0x7f00000001c0)) r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0) sendfile(r5, 0xffffffffffffffff, 0x0, 0x1ff) syz_genetlink_get_family_id$ipvs(&(0x7f0000000200), r5) read(r0, &(0x7f0000000000)=""/153, 0x99) 14:57:24 executing program 6: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 33) 14:57:24 executing program 2: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}], [{@permit_directio}]}}) 14:57:24 executing program 4: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$9p_xen(0x0, &(0x7f0000001080)='./file0\x00', &(0x7f00000010c0), 0x0, &(0x7f00000012c0)) (fail_nth: 29) 14:57:24 executing program 7: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 41) 14:57:24 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', 0x0) 14:57:24 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x600, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) 14:57:24 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='sessionid\x00') r1 = dup(r0) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000900)={0x7f, 0x630, 0x2, 0x2}, &(0x7f0000000940)) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x0) fcntl$dupfd(r2, 0x0, 0xffffffffffffffff) ioctl$TUNSETOFFLOAD(r2, 0x400454d0, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_int(r3, 0x0, 0x19, 0x0, &(0x7f00000001c0)) write$P9_RUNLINKAT(r0, &(0x7f00000008c0)={0x7, 0x4d, 0x2}, 0x7) sendmsg(r1, &(0x7f00000002c0)={&(0x7f0000000140)=@pppol2tpv3in6={0x18, 0x1, {0x0, r3, 0x3, 0x3, 0x0, 0x2, {0xa, 0x4e21, 0x494, @empty, 0xaf5}}}, 0x80, &(0x7f0000000280)=[{&(0x7f00000000c0)="9bf528f58f28", 0x6}, {&(0x7f00000001c0)="57fa0d4186241481d7be3ee783fa25ee56ddc6490a81d73157cc58da664dd9e1a820e48bd676f2ebcb0e5b0034a7e070b39c604b7b2324526609677d26e67c3b646ccbcf1bafd9a1cc3b691506347a091375d40cff5d469ce44f9491136c510bc51c34638957c439414d57ec059fc38c543255f15d29942fdae86390810bbe8dd91a726663b860476b497cf8f1d72281c0", 0x91}], 0x2}, 0x20004001) r4 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./file1\x00', 0x141042, 0x93) sendfile(r4, 0xffffffffffffffff, 0x0, 0x1ff) r5 = getpid() syz_open_procfs(r5, &(0x7f0000000300)='net\x00') move_mount(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', r4, &(0x7f0000000080)='./file0\x00', 0x10) timerfd_create(0x3, 0x80800) read(r2, &(0x7f0000000400)=""/142, 0x8e) r6 = openat$cgroup_ro(r0, &(0x7f0000000000)='memory.numa_stat\x00', 0x0, 0x0) pivot_root(&(0x7f0000000340)='./file0\x00', &(0x7f0000000380)='./file1\x00') ioctl$BTRFS_IOC_FS_INFO(r6, 0x8400941f, &(0x7f00000004c0)) [ 870.189603] FAULT_INJECTION: forcing a failure. [ 870.189603] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 870.190554] CPU: 1 PID: 8340 Comm: syz-executor.6 Not tainted 6.0.0-rc6-next-20220921 #1 [ 870.191152] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 870.191991] Call Trace: [ 870.192188] [ 870.192365] dump_stack_lvl+0x8b/0xb3 [ 870.192674] should_fail.cold+0x5/0xa [ 870.192985] _copy_from_user+0x2a/0x170 [ 870.193300] copy_mount_options+0x76/0x180 [ 870.193637] __x64_sys_mount+0x1a8/0x300 [ 870.193958] ? path_mount+0x1e20/0x1e20 [ 870.194267] ? syscall_enter_from_user_mode+0x1d/0x50 [ 870.194663] ? syscall_enter_from_user_mode+0x1d/0x50 [ 870.195061] do_syscall_64+0x3b/0x90 [ 870.195352] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 870.195737] RIP: 0033:0x7efd0e03204a [ 870.196024] Code: 48 c7 c2 bc ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 870.197340] RSP: 002b:00007efd0b5a5fa8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 [ 870.197920] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007efd0e03204a [ 870.198456] RDX: 0000000020000040 RSI: 0000000020000080 RDI: 0000000000000000 [ 870.199004] RBP: 00007efd0b5a6040 R08: 00007efd0b5a6040 R09: 0000000020000040 [ 870.199530] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000020000040 [ 870.200055] R13: 0000000020000080 R14: 00007efd0b5a6000 R15: 00000000200001c0 [ 870.200593] 14:57:24 executing program 1: mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mount$9p_fd(0x700, &(0x7f0000002000)='./file1\x00', &(0x7f0000002040), 0x0, &(0x7f0000002180)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@noextend}]}}) 14:57:24 executing program 7: syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={[{@uid={'uid', 0x3d, 0xee01}}]}) (fail_nth: 42) [ 870.216774] 9pnet_fd: Insufficient options for proto=fd 14:57:24 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) request_key(&(0x7f0000000900)='dns_resolver\x00', &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)='\x00', 0x0) 14:57:24 executing program 5: r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0xc3, 0x7, 0x6, 0x7f, 0x0, 0x8, 0x20000, 0x2, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, @perf_config_ext={0x7f, 0x400}, 0x400, 0xffffffffffffffff, 0xf950, 0x4, 0x9, 0x3, 0x775c, 0x0, 0x1, 0x0, 0x2}, 0x0, 0xc, r0, 0x1) r1 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x80, 0xc3, 0x7, 0x6, 0x7f, 0x0, 0x8, 0x20000, 0x2, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, @perf_config_ext={0x7f, 0x400}, 0x400, 0xffffffffffffffff, 0xf950, 0x4, 0x9, 0x3, 0x775c, 0x0, 0x1, 0x0, 0x2}, 0x0, 0xc, r1, 0x1) fremovexattr(r1, &(0x7f0000000000)=@known='security.apparmor\x00') ioctl$BTRFS_IOC_RESIZE(r0, 0x50009403, &(0x7f0000000280)=ANY=[@ANYRES32, @ANYBLOB="000000006d613892e4f28a02339c78d83a6890b8852aa6c9b0afb6281bb42abd5a4b1ac928bd39e0e91d3022c628e73778645ce520356f94c97343874e64cc50edb28cdcaf80216ad1bb420692d8a85098a6caba44ffccf13c67b3f4fa0c72f336407b2905aeff9a1bcd5a7ebbcf822905d670c1d43058c87d556d34c54bc0e8ee35dcbfc9bbc102734d40820231b2126e301dd2ea15f8aeafc1f4c7b1a3fca6c4639a487c558d437d071aad01388159c6f908ac8f329bb3b1462ee02acffdcb7ecd944a4dc707d858267208301630ddbaca062f9b7da444774e25eb581d9631c980d310f8a6ac299ca6a4bd3c1285f555650b35d95a503d706afd7534600b6c037351817366043951d9576b09214314eaefa5f1bcf61f7e1a4d"]) r2 = syz_open_procfs(0x0, &(0x7f00000003c0)='uid_map\x00') read(r2, &(0x7f0000000400)=""/146, 0x92) [ 870.325103] audit: type=1400 audit(1663772244.213:7): avc: denied { open } for pid=8351 comm="syz-executor.5" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1 [ 870.326655] audit: type=1400 audit(1663772244.213:8): avc: denied { kernel } for pid=8351 comm="syz-executor.5" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1 [ 870.332610] 9pnet: Could not find request transport: xen [ 870.342536] ------------[ cut here ]------------ [ 870.342554] [ 870.342556] ====================================================== [ 870.342560] WARNING: possible circular locking dependency detected [ 870.342564] 6.0.0-rc6-next-20220921 #1 Not tainted [ 870.342570] ------------------------------------------------------ [ 870.342573] syz-executor.5/8352 is trying to acquire lock: [ 870.342580] ffffffff853faab8 ((console_sem).lock){....}-{2:2}, at: down_trylock+0xe/0x70 [ 870.342619] [ 870.342619] but task is already holding lock: [ 870.342622] ffff88800e066c20 (&ctx->lock){....}-{2:2}, at: __perf_event_task_sched_out+0x53b/0x18d0 [ 870.342651] [ 870.342651] which lock already depends on the new lock. [ 870.342651] [ 870.342654] [ 870.342654] the existing dependency chain (in reverse order) is: [ 870.342657] [ 870.342657] -> #3 (&ctx->lock){....}-{2:2}: [ 870.342672] _raw_spin_lock+0x2a/0x40 [ 870.342692] __perf_event_task_sched_out+0x53b/0x18d0 [ 870.342705] __schedule+0xedd/0x2470 [ 870.342718] schedule+0xda/0x1b0 [ 870.342732] exit_to_user_mode_prepare+0x114/0x1a0 [ 870.342744] syscall_exit_to_user_mode+0x19/0x40 [ 870.342756] do_syscall_64+0x48/0x90 [ 870.342773] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 870.342785] [ 870.342785] -> #2 (&rq->__lock){-.-.}-{2:2}: [ 870.342800] _raw_spin_lock_nested+0x30/0x40 [ 870.342819] raw_spin_rq_lock_nested+0x1e/0x30 [ 870.342833] task_fork_fair+0x63/0x4d0 [ 870.342852] sched_cgroup_fork+0x3d0/0x540 [ 870.342867] copy_process+0x4183/0x6e20 [ 870.342878] kernel_clone+0xe7/0x890 [ 870.342887] user_mode_thread+0xad/0xf0 [ 870.342898] rest_init+0x24/0x250 [ 870.342909] arch_call_rest_init+0xf/0x14 [ 870.342926] start_kernel+0x4c1/0x4e6 [ 870.342941] secondary_startup_64_no_verify+0xe0/0xeb [ 870.342955] [ 870.342955] -> #1 (&p->pi_lock){-.-.}-{2:2}: [ 870.342970] _raw_spin_lock_irqsave+0x39/0x60 [ 870.342996] try_to_wake_up+0xab/0x1930 [ 870.343010] up+0x75/0xb0 [ 870.343024] __up_console_sem+0x6e/0x80 [ 870.343041] console_unlock+0x46a/0x590 [ 870.343059] do_con_write+0xc05/0x1d50 [ 870.343071] con_write+0x21/0x40 [ 870.343081] n_tty_write+0x4d4/0xfe0 [ 870.343095] file_tty_write.constprop.0+0x49c/0x8f0 [ 870.343108] vfs_write+0x9c3/0xd90 [ 870.343130] ksys_write+0x127/0x250 [ 870.343152] do_syscall_64+0x3b/0x90 [ 870.343169] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 870.343183] [ 870.343183] -> #0 ((console_sem).lock){....}-{2:2}: [ 870.343198] __lock_acquire+0x2a02/0x5e70 [ 870.343216] lock_acquire+0x1a2/0x530 [ 870.343233] _raw_spin_lock_irqsave+0x39/0x60 [ 870.343255] down_trylock+0xe/0x70 [ 870.343270] __down_trylock_console_sem+0x3b/0xd0 [ 870.343288] vprintk_emit+0x16b/0x560 [ 870.343305] vprintk+0x84/0xa0 [ 870.343323] _printk+0xba/0xf1 [ 870.343334] report_bug.cold+0x72/0xab [ 870.343350] handle_bug+0x3c/0x70 [ 870.343367] exc_invalid_op+0x14/0x50 [ 870.343385] asm_exc_invalid_op+0x16/0x20 [ 870.343396] group_sched_out.part.0+0x2c7/0x460 [ 870.343407] ctx_sched_out+0x8f1/0xc10 [ 870.343418] __perf_event_task_sched_out+0x6d0/0x18d0 [ 870.343431] __schedule+0xedd/0x2470 [ 870.343444] schedule+0xda/0x1b0 [ 870.343457] exit_to_user_mode_prepare+0x114/0x1a0 [ 870.343468] syscall_exit_to_user_mode+0x19/0x40 [ 870.343480] do_syscall_64+0x48/0x90 [ 870.343497] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 870.343509] [ 870.343509] other info that might help us debug this: [ 870.343509] [ 870.343512] Chain exists of: [ 870.343512] (console_sem).lock --> &rq->__lock --> &ctx->lock [ 870.343512] [ 870.343528] Possible unsafe locking scenario: [ 870.343528] [ 870.343530] CPU0 CPU1 [ 870.343533] ---- ---- [ 870.343535] lock(&ctx->lock); [ 870.343541] lock(&rq->__lock); [ 870.343548] lock(&ctx->lock); [ 870.343554] lock((console_sem).lock); [ 870.343560] [ 870.343560] *** DEADLOCK *** [ 870.343560] [ 870.343562] 2 locks held by syz-executor.5/8352: [ 870.343569] #0: ffff88806cf37d18 (&rq->__lock){-.-.}-{2:2}, at: __schedule+0x1cf/0x2470 [ 870.343599] #1: ffff88800e066c20 (&ctx->lock){....}-{2:2}, at: __perf_event_task_sched_out+0x53b/0x18d0 [ 870.343629] [ 870.343629] stack backtrace: [ 870.343632] CPU: 1 PID: 8352 Comm: syz-executor.5 Not tainted 6.0.0-rc6-next-20220921 #1 [ 870.343645] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 870.343653] Call Trace: [ 870.343656] [ 870.343660] dump_stack_lvl+0x8b/0xb3 [ 870.343679] check_noncircular+0x263/0x2e0 [ 870.343697] ? format_decode+0x26c/0xb50 [ 870.343714] ? print_circular_bug+0x450/0x450 [ 870.343732] ? enable_ptr_key_workfn+0x20/0x20 [ 870.343749] ? format_decode+0x26c/0xb50 [ 870.343767] ? alloc_chain_hlocks+0x1ec/0x5a0 [ 870.343786] __lock_acquire+0x2a02/0x5e70 [ 870.343809] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 870.343833] lock_acquire+0x1a2/0x530 [ 870.343851] ? down_trylock+0xe/0x70 [ 870.343869] ? lock_release+0x750/0x750 [ 870.343891] ? vprintk+0x84/0xa0 [ 870.343911] _raw_spin_lock_irqsave+0x39/0x60 [ 870.343931] ? down_trylock+0xe/0x70 [ 870.343947] down_trylock+0xe/0x70 [ 870.343963] ? vprintk+0x84/0xa0 [ 870.343982] __down_trylock_console_sem+0x3b/0xd0 [ 870.344001] vprintk_emit+0x16b/0x560 [ 870.344021] vprintk+0x84/0xa0 [ 870.344040] _printk+0xba/0xf1 [ 870.344052] ? record_print_text.cold+0x16/0x16 [ 870.344067] ? report_bug.cold+0x66/0xab [ 870.344086] ? group_sched_out.part.0+0x2c7/0x460 [ 870.344098] report_bug.cold+0x72/0xab [ 870.344117] handle_bug+0x3c/0x70 [ 870.344135] exc_invalid_op+0x14/0x50 [ 870.344154] asm_exc_invalid_op+0x16/0x20 [ 870.344166] RIP: 0010:group_sched_out.part.0+0x2c7/0x460 [ 870.344180] Code: 5e 41 5f e9 9b b9 ef ff e8 96 b9 ef ff 65 8b 1d 2b 12 ac 7e 31 ff 89 de e8 36 b6 ef ff 85 db 0f 84 8a 00 00 00 e8 79 b9 ef ff <0f> 0b e9 a5 fe ff ff e8 6d b9 ef ff 48 8d 7d 10 48 b8 00 00 00 00 [ 870.344192] RSP: 0018:ffff88804199fc48 EFLAGS: 00010006 [ 870.344202] RAX: 0000000040000002 RBX: 0000000000000000 RCX: 0000000000000000 [ 870.344210] RDX: ffff888018589ac0 RSI: ffffffff815663a7 RDI: 0000000000000005 [ 870.344218] RBP: ffff888041578000 R08: 0000000000000005 R09: 0000000000000001 [ 870.344226] R10: 0000000000000000 R11: ffffffff865b005b R12: ffff88800e066c00 [ 870.344234] R13: ffff88806cf3d140 R14: ffffffff8547cf80 R15: 0000000000000002 [ 870.344245] ? group_sched_out.part.0+0x2c7/0x460 [ 870.344259] ? group_sched_out.part.0+0x2c7/0x460 [ 870.344272] ctx_sched_out+0x8f1/0xc10 [ 870.344286] __perf_event_task_sched_out+0x6d0/0x18d0 [ 870.344302] ? lock_is_held_type+0xd7/0x130 [ 870.344315] ? __perf_cgroup_move+0x160/0x160 [ 870.344328] ? set_next_entity+0x304/0x550 [ 870.344347] ? update_curr+0x267/0x740 [ 870.344367] ? lock_is_held_type+0xd7/0x130 [ 870.344381] __schedule+0xedd/0x2470 [ 870.344398] ? io_schedule_timeout+0x150/0x150 [ 870.344414] ? rcu_read_lock_sched_held+0x3e/0x80 [ 870.344436] schedule+0xda/0x1b0 [ 870.344451] exit_to_user_mode_prepare+0x114/0x1a0 [ 870.344463] syscall_exit_to_user_mode+0x19/0x40 [ 870.344476] do_syscall_64+0x48/0x90 [ 870.344495] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 870.344507] RIP: 0033:0x7f6df369fb19 [ 870.344516] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 870.344528] RSP: 002b:00007f6df0c15218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 870.344539] RAX: 0000000000000001 RBX: 00007f6df37b2f68 RCX: 00007f6df369fb19 [ 870.344547] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f6df37b2f6c [ 870.344555] RBP: 00007f6df37b2f60 R08: 000000000000000e R09: 0000000000000000 [ 870.344562] R10: 0000000000000003 R11: 0000000000000246 R12: 00007f6df37b2f6c [ 870.344570] R13: 00007ffdad67c02f R14: 00007f6df0c15300 R15: 0000000000022000 [ 870.344583] [ 870.400696] WARNING: CPU: 1 PID: 8352 at kernel/events/core.c:2309 group_sched_out.part.0+0x2c7/0x460 [ 870.401371] Modules linked in: [ 870.401613] CPU: 1 PID: 8352 Comm: syz-executor.5 Not tainted 6.0.0-rc6-next-20220921 #1 [ 870.402201] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 870.403033] RIP: 0010:group_sched_out.part.0+0x2c7/0x460 [ 870.403438] Code: 5e 41 5f e9 9b b9 ef ff e8 96 b9 ef ff 65 8b 1d 2b 12 ac 7e 31 ff 89 de e8 36 b6 ef ff 85 db 0f 84 8a 00 00 00 e8 79 b9 ef ff <0f> 0b e9 a5 fe ff ff e8 6d b9 ef ff 48 8d 7d 10 48 b8 00 00 00 00 [ 870.404753] RSP: 0018:ffff88804199fc48 EFLAGS: 00010006 [ 870.405142] RAX: 0000000040000002 RBX: 0000000000000000 RCX: 0000000000000000 [ 870.405662] RDX: ffff888018589ac0 RSI: ffffffff815663a7 RDI: 0000000000000005 [ 870.406184] RBP: ffff888041578000 R08: 0000000000000005 R09: 0000000000000001 [ 870.406696] R10: 0000000000000000 R11: ffffffff865b005b R12: ffff88800e066c00 [ 870.407222] R13: ffff88806cf3d140 R14: ffffffff8547cf80 R15: 0000000000000002 [ 870.407749] FS: 00007f6df0c15700(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000 [ 870.408331] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 870.408753] CR2: 00007f6df37b3018 CR3: 0000000041226000 CR4: 0000000000350ee0 [ 870.409273] Call Trace: [ 870.409465] [ 870.409637] ctx_sched_out+0x8f1/0xc10 [ 870.409936] __perf_event_task_sched_out+0x6d0/0x18d0 [ 870.410325] ? lock_is_held_type+0xd7/0x130 [ 870.410642] ? __perf_cgroup_move+0x160/0x160 [ 870.410980] ? set_next_entity+0x304/0x550 [ 870.411313] ? update_curr+0x267/0x740 [ 870.411612] ? lock_is_held_type+0xd7/0x130 [ 870.411936] __schedule+0xedd/0x2470 [ 870.412222] ? io_schedule_timeout+0x150/0x150 [ 870.412566] ? rcu_read_lock_sched_held+0x3e/0x80 [ 870.412938] schedule+0xda/0x1b0 [ 870.413196] exit_to_user_mode_prepare+0x114/0x1a0 [ 870.413557] syscall_exit_to_user_mode+0x19/0x40 [ 870.413917] do_syscall_64+0x48/0x90 [ 870.414201] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 870.414583] RIP: 0033:0x7f6df369fb19 [ 870.414859] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 870.416176] RSP: 002b:00007f6df0c15218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 870.416737] RAX: 0000000000000001 RBX: 00007f6df37b2f68 RCX: 00007f6df369fb19 [ 870.417264] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f6df37b2f6c [ 870.417780] RBP: 00007f6df37b2f60 R08: 000000000000000e R09: 0000000000000000 [ 870.418306] R10: 0000000000000003 R11: 0000000000000246 R12: 00007f6df37b2f6c [ 870.418820] R13: 00007ffdad67c02f R14: 00007f6df0c15300 R15: 0000000000022000 [ 870.419352] [ 870.419524] irq event stamp: 860 [ 870.419770] hardirqs last enabled at (859): [] exit_to_user_mode_prepare+0x109/0x1a0 [ 870.420450] hardirqs last disabled at (860): [] __schedule+0x1225/0x2470 [ 870.421049] softirqs last enabled at (830): [] __irq_exit_rcu+0x11b/0x180 [ 870.421673] softirqs last disabled at (825): [] __irq_exit_rcu+0x11b/0x180 [ 870.422301] ---[ end trace 0000000000000000 ]--- [ 870.475824] audit: type=1400 audit(1663772244.364:9): avc: denied { write } for pid=8351 comm="syz-executor.5" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1 VM DIAGNOSIS: 14:57:24 Registers: info registers vcpu 0 RAX=0000000080000002 RBX=0000000000000001 RCX=0000000080000002 RDX=ffff88800ff58000 RSI=ffffffff815ac7f4 RDI=0000000000000005 RBP=ffffffff848ccbe0 RSP=ffff8880422c7af0 R8 =0000000000000005 R9 =0000000000000000 R10=0000000000000001 R11=0000000000000001 R12=4000000000000002 R13=4000000000000000 R14=0000000008caa45c R15=ffff88800ced0280 RIP=ffffffff81461d2d RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 0000555556bb8400 00000000 00000000 GS =0000 ffff88806ce00000 00000000 00000000 LDT=0000 fffffe0000000000 00000000 00000000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f94fb190540 CR3=000000003093e000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 YMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM01=0000000000000000 0000000000000000 ffffffffffffffff ffffffffffffffff YMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM04=0000000000000000 0000000000000000 0000000000000000 00000000000000ff YMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM06=0000000000000000 0000000000000000 0000000000000000 000000524f525245 YMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM08=0000000000000000 0000000000000000 0000000000000000 00524f5252450040 YMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 1 RAX=000000000000002b RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff822b1c91 RDI=ffffffff87645ba0 RBP=ffffffff87645b60 RSP=ffff88804199f698 R8 =0000000000000001 R9 =000000000000000a R10=000000000000002b R11=0000000000000001 R12=000000000000002b R13=ffffffff87645b60 R14=0000000000000010 R15=ffffffff822b1c80 RIP=ffffffff822b1ce9 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 00007f6df0c15700 00000000 00000000 GS =0000 ffff88806cf00000 00000000 00000000 LDT=0000 fffffe0000000000 00000000 00000000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f6df37b3018 CR3=0000000041226000 CR4=00350ee0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 YMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM01=0000000000000000 0000000000000000 00007f6df37867c0 00007f6df37867c8 YMM02=0000000000000000 0000000000000000 00007f6df37867e0 00007f6df37867c0 YMM03=0000000000000000 0000000000000000 00007f6df37867c8 00007f6df37867c0 YMM04=0000000000000000 0000000000000000 ffffffffffffffff ffffffff00000000 YMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM06=0000000000000000 0000000000000000 0000000000000000 000000524f525245 YMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM08=0000000000000000 0000000000000000 0000000000000000 00524f5252450040 YMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000