pparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=23274 comm="syz-executor.5" 00:56:41 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x2b) futex$FUTEX_WAIT_MULTIPLE(&(0x7f0000000740)=[{&(0x7f0000000080)=0x1}, {&(0x7f00000000c0)=0x1, 0x8}, {&(0x7f0000000100)=0x1, 0x2}, {&(0x7f0000000140)=0x2}, {&(0x7f0000000180), 0x1}, {&(0x7f00000001c0)=0x2, 0x2}, {&(0x7f0000000200)=0x1, 0x2}, {&(0x7f0000000240)=0x1, 0x2}, {&(0x7f0000000280)=0x1}, {&(0x7f00000002c0)=0x2, 0x2}, {&(0x7f0000000300)=0x2, 0x2}, {&(0x7f0000000340)}, {&(0x7f0000000380)=0x1, 0x1}, {&(0x7f00000003c0)=0x2}, {&(0x7f0000000400)=0x2, 0x1}, {&(0x7f0000000440)=0x1}, {&(0x7f0000000480), 0x1}, {&(0x7f00000004c0), 0x2}, {&(0x7f0000000500), 0x1}, {&(0x7f0000000540)=0x2, 0x2}, {&(0x7f0000000580), 0x1}, {&(0x7f00000005c0)=0x2}, {&(0x7f0000000600)=0x2, 0x1}, {&(0x7f0000000640)}, {&(0x7f0000000680)=0x8, 0x2}, {&(0x7f00000006c0), 0x2}, {&(0x7f0000000700)=0x2, 0x2}], 0xd, 0x1b, &(0x7f0000000900)={0x0, 0x3938700}, 0x0, 0x0) [ 609.912843][T23291] xt_TPROXY: Can be used only with -p tcp or -p udp 00:56:42 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 610.041358][ T26] audit: type=1400 audit(1589677002.029:1032): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=23296 comm="syz-executor.1" 00:56:42 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpisetmime_type\x00']}, 0x6c0) 00:56:42 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) r3 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r3, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r3, &(0x7f0000000340)="5960e23b2de67fca59bc7519b5194867bb7a307076369ef20f6000f2ee3dee805a72c0823cbfe9d12862b493a24f9777b007000000a98ecb48ddb07883646e3ea7cd52213abfe3888aa28230e1fc3a5699e6e8", 0x53, 0x0, &(0x7f00000001c0)={0x2, 0x0, @private=0xa010100}, 0x10) ioctl$FS_IOC_GETFSLABEL(r3, 0x81009431, &(0x7f0000000240)) write$apparmor_current(r2, &(0x7f0000000080)=@profile={'stack ', '\x1e5\x95\xdb\x96\xed\xcf\xc3\\\xa7T\xcd&b\x02Kx\x14k\xdeq\x94\x96K\xb48EFcS%\xa0E\xb5\v\xb3\x92|\xf7\x1e[F\x9e\xb7\x96\xf0d\xddT9f\xc9\x12\x98\x86;:\xbf\nC\xee8\xd5\x91\xdd\xfae9\x18\x84i4mY)P\xf0\x91\xa4\x048t\x95\xaa\xbc\xc55\xbc.\xfe\x98\xab\xcb\xe6\x01\xa7\xeb@\xa4\x85\xf5G\xc6\xc5\x16\xec\\j\xf7[\xc2\xac\xdb\x85 \xb0O/\xa8\x0e\xf8\xcb\xac\\M\xcd4\xa2*l\x84\x15\xb0\xae\x81\xfe\xa7\x10\xfb\xab\x1e\x17_\x16\x81wS4\xd4U\xcf%\xa8\\9^BY\x9d\x1d\x10W\xa3\xaa\xeb\xca\x8b\\=jS\x9d\x8f@\xf9n\xd3id\x9c\xf9X<\x1cq\xafK\xa2\x02\x04\x8d\xf8B\xa0'}, 0xc8) [ 610.124493][ T26] audit: type=1400 audit(1589677002.069:1033): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=23296 comm="syz-executor.1" 00:56:42 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x2, 0x0, r0, 0x0, 0x7ffffffff000}]) 00:56:42 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) [ 610.262020][T23307] xt_TPROXY: Can be used only with -p tcp or -p udp [ 610.327941][T23314] xt_TPROXY: Can be used only with -p tcp or -p udp [ 610.347967][T23313] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:56:42 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x500}]) 00:56:42 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:56:42 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cplsetmime_type\x00']}, 0x6c0) 00:56:42 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:56:42 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x3, 0x0, r0, 0x0, 0x7ffffffff000}]) 00:56:42 executing program 1: socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r0, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r0, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) dup(r0) r1 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r1, &(0x7f0000000400)=@hat={'changehat ', 0x1, 0x5e, ['\x00\xe1\"\xdd\x000X\x96\xce\xb2s\x84\xe1e\xb9\xc7(\x05Iw\x1a\xa3*\x15\a8\x19\x04K\xe2F\x17)\x89\xbe\xc0\x1d\xdbe\xd4\xe1\x8aq\xd2\x04\x069\x05\xb5J<\xe9\x8e\xf7\xcd]\xbc)_I\xfaw\xd8%_\xaa\xe2\xe6\'U\xbf\x86\xb7\xc4\x9c\xe5F<\xb0\xce21\xe4\xdc\xc5\x95\xb4\x8d\x90\xcfGE\x01\xaa\"\xa7\xe2\xc2\xcc\xf0Y\xa8b2\xb2\x84\xc7\x101\xb1\x12\x9a4[\x8a\xf3\x14\xf7=47i\x05\xed\xc2H\x81\x19\xf6\x8ed:^_r\x84\x9e78\xa5\xb8\x85\x8d\xfb\xa1\xbdyn\b`\xf6\xb3\xce\xb8\x99\xc4x\xc5\xb9\xc2\xe6\x8f\x9cG \x1d\x96^\x92\xad\xb5\x92}\x1a\xaf\xfc\x97}\xc0\x17\x1c', '/proc/thread-self/attr/current\x00', '/proc/thread-self/attr/current\x00', 'em1em1\x8awlan1keyring]+\'@\x00\x86~\x1d].\x11_\xed\xef\xb1H\xd0\xb1\xd5\xa0\xf3\xeb\xcc\xb0\xceSz\xe6\xa4\x9b\xf0x\x92F\xb7\xc9\xf5aj\xc0\xfd\xb3\xcb\x9f\xa2\"EI[\x9e{\x1a\xb6\x1c\x17\x9eI\xa4G\x03SU^>y\xea\x8f\x93sM[Q\"\x12\x83U\x9d\xa4\x88\xab\x1a\xc14\xa9\xc4\x81+\x13\x85\xc7\x82\xfa#\xb3$o\x1f\xa3X\x02\xf4\x19\xe8\x89\xc3DU\xa1\xcf\xe6-\x7fs\x86\xf6\x0e\n\x8d\'\xdf\xb7\n\xf5\xa1\x18\x19\xf1\x9b3\xcd=\xc7\x86\xc8\x83U\xa2\xc1B>T\xbd\x04v\xda\x14oAgwG\aE\xa6\x18Ne\x1c\a\xa5\xd5\xfb\xa3\xe0\x99\xb4\xfew\x91\xc5\xaf\x83n\x84!\x1fN8\xef3o!h\xa0\a\x16\xd2\x04\xe20O\x15\xd5\x170u\x15^\x1ds\xbc1\x95_\xfc\x05\xab-\xd6\xc9j\xa9\xdb\xb5\xd6\xfc\aW\x879\xabA', '', 'th0:\x1eeh0\x02\x00', '/tvoc/a\x00\x00\x00\x00\x895W\xb3\xfa\xd3(\xe2\b\x00', '/proc/thread-self/attr/current\x00', 'permhat ', 'permprofile ', 'permhat ', '\xf2vmnet0\x00']}, 0x263) [ 610.973572][T23339] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 611.072578][T23349] xt_TPROXY: Can be used only with -p tcp or -p udp 00:56:43 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cposetmime_type\x00']}, 0x6c0) [ 611.145870][T23349] xt_TPROXY: Can be used only with -p tcp or -p udp 00:56:43 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:56:43 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000000)={0x0, @empty, @dev}, &(0x7f0000000080)=0xc) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$PIO_UNIMAPCLR(r1, 0x4b68, &(0x7f00000001c0)={0x4000, 0x6, 0x5}) r5 = dup2(r4, r3) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$VIDIOC_TRY_FMT(r5, 0xc0d05640, &(0x7f0000000240)={0x7, @win={{0x5, 0x1, 0x7ff, 0x8}, 0x6, 0x401, &(0x7f00000000c0)={{0x2, 0x6a, 0xdf93, 0x2a}}, 0x1, &(0x7f0000000100)="3def09da4a951418665b9f95643a46956d35ad74570bf2f627983700515b312fa4bfc5956a6a197e2fb7696925d299355ba22fca1c059b52527111b4e95d6633c93c2623c36bbebf04a22ebff97f37513ca0b2f83ad973fb3e29c072fdaba96c76cb1f845d377ebef8084127509be33661924eae1a1fdd2f85a8adce62d8df29868bc554058706eab41f2178a2a9e464a65c42ae", 0x4}}) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="7065726d686174203078303030303030303030300395128ae0ff5e6370757365746d696d655f7479706500"], 0x2b) 00:56:43 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x4, 0x0, r0, 0x0, 0x7ffffffff000}]) 00:56:43 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 611.349041][T23363] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 611.499253][T23376] xt_TPROXY: Can be used only with -p tcp or -p udp [ 611.526154][T23383] xt_TPROXY: Can be used only with -p tcp or -p udp 00:56:43 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cppsetmime_type\x00']}, 0x6c0) 00:56:44 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x700}]) 00:56:44 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r7, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r7], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x20, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r7}}, 0x20}}, 0x0) 00:56:44 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:56:44 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x0, r0, 0x0, 0x7ffffffff000}]) 00:56:44 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) sendmsg$NFT_MSG_GETOBJ(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x80, 0x13, 0xa, 0x801, 0x0, 0x0, {0x3, 0x0, 0x2}, [@NFTA_OBJ_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x5}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x1}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz1\x00'}]}, 0x80}, 0x1, 0x0, 0x0, 0x400c804}, 0x20000800) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x2b) 00:56:44 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpssetmime_type\x00']}, 0x6c0) [ 611.550420][T23374] AppArmor: change_hat: Invalid input '0x0000000000•Šàÿ^cpusetmime_type' [ 612.116109][T23399] xt_TPROXY: Can be used only with -p tcp or -p udp [ 612.152343][T23400] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:56:44 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpxsetmime_type\x00']}, 0x6c0) 00:56:44 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) r3 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r3, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r3, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) r4 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r4, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r4, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) write$apparmor_current(r2, &(0x7f0000000000)=ANY=[@ANYRES16=r3, @ANYRESHEX=r4], 0x2b) 00:56:44 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:56:44 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r7, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r7], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x20, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r7}}, 0x20}}, 0x0) 00:56:44 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x7, 0x0, r0, 0x0, 0x7ffffffff000}]) 00:56:44 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpu\"etmime_type\x00']}, 0x6c0) [ 612.482076][T23426] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 612.537045][T23431] xt_TPROXY: Can be used only with -p tcp or -p udp 00:56:45 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x3f00}]) 00:56:45 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:56:45 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r7, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r7], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x20, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r7}}, 0x20}}, 0x0) 00:56:45 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x8, 0x0, r0, 0x0, 0x7ffffffff000}]) 00:56:45 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpus\"tmime_type\x00']}, 0x6c0) 00:56:45 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0xfffffffdfffffffe) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x2b) [ 613.232925][ T26] kauditd_printk_skb: 10 callbacks suppressed [ 613.232938][ T26] audit: type=1400 audit(1589677005.220:1044): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=23454 comm="syz-executor.1" [ 613.265463][T23459] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 613.347074][ T26] audit: type=1400 audit(1589677005.330:1045): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=23455 comm="syz-executor.5" 00:56:45 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:56:45 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x300, 0x0, r0, 0x0, 0x7ffffffff000}]) 00:56:45 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r7, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r7], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r7}, [@IFLA_MASTER={0x8}]}, 0x28}}, 0x0) 00:56:45 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpus%tmime_type\x00']}, 0x6c0) 00:56:45 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 613.614959][T23484] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 613.627636][ T26] audit: type=1400 audit(1589677005.610:1046): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=23481 comm="syz-executor.5" 00:56:45 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) 00:56:46 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x4000}]) 00:56:46 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpuse\"mime_type\x00']}, 0x6c0) 00:56:46 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:56:46 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r7, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r7], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r7}, [@IFLA_MASTER={0x8}]}, 0x28}}, 0x0) 00:56:46 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r0) r1 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0x3f, 0x8301) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x4) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r2, &(0x7f0000000040)=ANY=[@ANYBLOB='permhat 0x>000000setmime_type\x00'/43], 0x2b) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup2(r4, r3) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$SEG6(&(0x7f0000001480)='SEG6\x00') sendmsg$SEG6_CMD_DUMPHMAC(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x14, r7, 0x301}, 0x14}}, 0x0) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r5, 0x84, 0x8, &(0x7f0000000180), &(0x7f00000001c0)=0x4) sendmsg$SEG6_CMD_SET_TUNSRC(r5, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x34, r7, 0x8, 0x70bd26, 0x25dfdbfe, {}, [@SEG6_ATTR_DSTLEN={0x8, 0x2, 0x1000}, @SEG6_ATTR_SECRET={0x10, 0x4, [0x2, 0x480000, 0x2]}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x9fcc}]}, 0x34}}, 0x40) 00:56:46 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x2, r0, 0x0, 0x7ffffffff000}]) [ 614.306012][ T26] audit: type=1400 audit(1589677006.290:1047): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=23510 comm="syz-executor.5" [ 614.313035][T23516] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:56:46 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpuse%mime_type\x00']}, 0x6c0) 00:56:46 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r7, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r7], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r7}, [@IFLA_MASTER={0x8}]}, 0x28}}, 0x0) 00:56:46 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x4, r0, 0x0, 0x7ffffffff000}]) 00:56:46 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$sock_rose_SIOCDELRT(r1, 0x890c, &(0x7f0000000080)={@dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x7, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={'nr', 0x0}, 0x5, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @null]}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000100)='batadv\x00') sendmsg$BATADV_CMD_SET_MESH(r1, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, r3, 0x300, 0x70bd26, 0x25dfdbfe, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x240000c4}, 0x45) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x2b) 00:56:46 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 614.371427][T23521] AppArmor: change_hat: Invalid input '0x>000000setmime_type' [ 614.604376][ T26] audit: type=1400 audit(1589677006.590:1048): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=23536 comm="syz-executor.5" 00:56:46 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpuset%ime_type\x00']}, 0x6c0) [ 614.675767][T23547] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 614.744273][ T26] audit: type=1400 audit(1589677006.650:1049): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=23541 comm="syz-executor.1" [ 614.887130][ T26] audit: type=1400 audit(1589677006.870:1050): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=23560 comm="syz-executor.5" 00:56:47 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0xeffd}]) 00:56:47 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x6, r0, 0x0, 0x7ffffffff000}]) 00:56:47 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:56:47 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$inet(0x2, 0x6000000000000003, 0x6) sendto$inet(0xffffffffffffffff, &(0x7f0000000240)="3767f7da98a61de65dcbc38329cf689471d0293fc15ecb645a0e2695845d979ebcb1f4de968785d626c1b5ef54fd7992ce47297636e8bef879bb3ac3da3fffdb29bd0707a6e30f54dd5974f81b844ea39665dd31eb37ea852e5e227e7bcacdb5eae6439b50076c971fbec43642c134ae53e0a9332eb77b9f7be724cf4b2d29ca3f44a8bd7a9323fbd414cbead31fcba0124f247ca754c85784b0b7cec4b2c032f9f0494897b36eea0788ff520cc4ffb2dc19cd7298596969410b2d8c4c3c26654aeb50cd3a8a752fc96097ab48b01d83a2bcc5fdd20cff21642cf6eb45d7c12acea5ca789859e8859ec4cd59e0166f9a60e84b23b99050659e56661485ac0c8be963ae18cee3706c9af6df366cf037ade8a1f316bae7f56a39cb56800aa27bd3d96d52dcbff5272ab2e70c00f2b62daba22a631f2c85f641843e6be15ea5328d49bd4c49a8d00eeeb9a8bc9df23e3ba3c6c25c260017081be34b8082ccf1c491f4e1d2ae53091ec079eb5a199793eb344a2c6afe1ac46e382353", 0x17a, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x25, &(0x7f000059aff8)={r4}, &(0x7f000034f000)=0xfeb5) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f00000003c0)={r4, 0x6, 0x30}, 0xc) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r3, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r3, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f0000000040)={r3}) sendmsg$NFNL_MSG_ACCT_GET(r5, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x1, 0x7, 0x401, 0x0, 0x0, {0xa, 0x0, 0x8}, [@NFACCT_FLAGS={0x8, 0x5, 0x1, 0x0, 0x2}, @NFACCT_PKTS={0xc}, @NFACCT_BYTES={0xc, 0x3, 0x1, 0x0, 0x1000}, @NFACCT_QUOTA={0xc, 0x6, 0x1, 0x0, 0x50b}, @NFACCT_QUOTA={0xc, 0x6, 0x1, 0x0, 0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000004}, 0x40000c1) r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r7 = dup(r6) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) r8 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r8, &(0x7f0000000000)=ANY=[@ANYBLOB='permhat 0x0000000000000000^cpume_type\x00'], 0x2b) 00:56:47 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cplsetmime_type\x00']}, 0x6c0) 00:56:47 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetm\"me_type\x00']}, 0x6c0) [ 615.447757][ T26] audit: type=1400 audit(1589677007.430:1051): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=23570 comm="syz-executor.2" [ 615.496429][T23577] tproxy_tg6_check: 10 callbacks suppressed [ 615.496436][T23577] xt_TPROXY: Can be used only with -p tcp or -p udp 00:56:47 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetm%me_type\x00']}, 0x6c0) 00:56:47 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x100000001) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x2b) [ 615.563469][ T26] audit: type=1400 audit(1589677007.500:1052): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=23571 comm="syz-executor.1" 00:56:47 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x600, r0, 0x0, 0x7ffffffff000}]) [ 615.628185][T23587] xt_TPROXY: Can be used only with -p tcp or -p udp 00:56:47 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000000)={0x0, @multicast1, @initdev}, &(0x7f0000000180)=0xc) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup2(r6, r5) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)={0x2, 0x8, 0x8de6, 0x1f, 0x520, r3, 0x8, [], r4, r7, 0x1, 0x3, 0x3}, 0x40) r8 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) r9 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) r10 = syz_open_dev$video4linux(&(0x7f0000000240)='/dev/v4l-subdev#\x00', 0x9, 0x0) ioctl$VIDIOC_SUBDEV_G_CROP(r10, 0xc038563b, &(0x7f0000000280)={0x0, 0x0, {0x101, 0x5, 0x8, 0x2b25}}) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r9, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x2b) getrandom(&(0x7f0000000080)=""/235, 0xeb, 0x0) [ 615.690989][ T26] audit: type=1400 audit(1589677007.510:1053): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=23573 comm="syz-executor.5" 00:56:47 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:56:47 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmi%e_type\x00']}, 0x6c0) [ 615.855509][T23600] xt_TPROXY: Can be used only with -p tcp or -p udp [ 615.887358][T23601] xt_TPROXY: Can be used only with -p tcp or -p udp 00:56:48 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0xfcfd}]) 00:56:48 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:56:48 executing program 2 (fault-call:13 fault-nth:0): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:56:48 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x440200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x2b) 00:56:48 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x4000, r0, 0x0, 0x7ffffffff000}]) 00:56:48 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmim\"_type\x00']}, 0x6c0) [ 616.535043][T23618] xt_TPROXY: Can be used only with -p tcp or -p udp [ 616.583466][T23622] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:56:48 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x800040}]) 00:56:48 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$MON_IOCT_RING_SIZE(r1, 0x9204, 0x10dad7) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x2b) 00:56:48 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmim%_type\x00']}, 0x6c0) [ 616.678976][T23622] FAULT_INJECTION: forcing a failure. [ 616.678976][T23622] name failslab, interval 1, probability 0, space 0, times 0 [ 616.763315][T23622] CPU: 0 PID: 23622 Comm: syz-executor.2 Not tainted 5.7.0-rc1-next-20200415-syzkaller #0 [ 616.773244][T23622] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 616.783333][T23622] Call Trace: [ 616.786660][T23622] dump_stack+0x188/0x20d [ 616.791026][T23622] should_fail.cold+0x5/0x14 [ 616.795631][T23622] ? lock_downgrade+0x840/0x840 [ 616.800516][T23622] ? setup_fault_attr+0x1e0/0x1e0 [ 616.805561][T23622] should_failslab+0x5/0xf [ 616.809985][T23622] kmem_cache_alloc_node+0x25c/0x760 [ 616.815295][T23622] __alloc_skb+0xba/0x5a0 [ 616.819640][T23622] ? __kmalloc_reserve.isra.0+0xe0/0xe0 [ 616.825262][T23622] ? netlink_autobind.isra.0+0x21b/0x300 [ 616.833342][T23622] netlink_sendmsg+0x97b/0xe10 [ 616.838151][T23622] ? aa_af_perm+0x260/0x260 [ 616.842667][T23622] ? netlink_unicast+0x740/0x740 [ 616.847627][T23622] ? netlink_unicast+0x740/0x740 [ 616.852581][T23622] sock_sendmsg+0xcf/0x120 [ 616.857013][T23622] ____sys_sendmsg+0x6bf/0x7e0 [ 616.861815][T23622] ? kernel_sendmsg+0x50/0x50 [ 616.866518][T23622] ? _parse_integer+0x180/0x180 [ 616.871408][T23622] ___sys_sendmsg+0x100/0x170 [ 616.876127][T23622] ? sendmsg_copy_msghdr+0x70/0x70 [ 616.881341][T23622] ? __fget_files+0x32f/0x500 [ 616.886048][T23622] ? do_dup2+0x520/0x520 [ 616.890432][T23622] ? __fget_light+0x20e/0x270 [ 616.895128][T23622] __sys_sendmsg+0xec/0x1b0 [ 616.899643][T23622] ? __sys_sendmsg_sock+0xb0/0xb0 [ 616.904679][T23622] ? vfs_write+0x161/0x5d0 [ 616.909114][T23622] ? trace_hardirqs_off_caller+0x55/0x230 [ 616.914846][T23622] ? do_syscall_64+0x21/0x7d0 [ 616.919628][T23622] do_syscall_64+0xf6/0x7d0 [ 616.924422][T23622] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 616.930317][T23622] RIP: 0033:0x45ca29 [ 616.934278][T23622] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 616.953889][T23622] RSP: 002b:00007fa3082eec78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e 00:56:48 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_\"ype\x00']}, 0x6c0) 00:56:49 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 616.963875][T23622] RAX: ffffffffffffffda RBX: 0000000000500f40 RCX: 000000000045ca29 [ 616.971865][T23622] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000000000005 [ 616.980291][T23622] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 616.988294][T23622] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000000a [ 616.996413][T23622] R13: 0000000000000a04 R14: 00000000004ccdcc R15: 00007fa3082ef6d4 00:56:49 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 617.054647][T23652] xt_TPROXY: Can be used only with -p tcp or -p udp [ 617.064536][T23653] xt_TPROXY: Can be used only with -p tcp or -p udp [ 617.253672][T23661] xt_TPROXY: Can be used only with -p tcp or -p udp [ 617.283932][T23662] xt_TPROXY: Can be used only with -p tcp or -p udp 00:56:49 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0xfdef}]) 00:56:49 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x20000040}]) 00:56:49 executing program 2 (fault-call:13 fault-nth:1): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:56:49 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup2(r4, r3) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$KDFONTOP_SET(r5, 0x4b72, &(0x7f0000000080)={0x0, 0x1, 0xd, 0xe, 0x200, &(0x7f0000000240)="038f5bd98443b4aac2f4f4120c3e14b4ac3d3e47459f5772461245bc9a67c80e4227a2db3ad4065920635ce62df4a12a1224d58dcd2b9a68914712d7ae4c7a10f1c41ae596724a234f727e7bfe575c2a506f2f216665c058f423702ecad3d7d74ad627e409a7c019c47d5ae4e39599df045223877754f86f28427b747e940da171029d346c837b9b70232126ce9abb237b6e90c7a3ff279cc2f9ab1ad53b93756f3c05c5ce8ccabcdaa1808be0ffd17b0d33f7b62d82f9203a6d137e08e8aacea75da48022334bf01bafa309b41efe95961ed9d1a64088678e57172b795f545c23de14d9194b3934638a90b1aacfa004bcd146082c5269b8448358dc1aa38d9a1af4a5a857d82b38cecc722fe03319ba8027a74b2b03e29f39da9a23f38068e9ecaaf09e4e93980a22a28a4879d265ddfff3118ed00b2d66bd603f61c40d6b1ecf9301a6fa8e9ceb820e256a93f375087a26e306dfe687cc314d84451934006641dbfebff06f56a4e48df47bdb5f0f3b724acd7db98a31f1ec163bc86b432eaa860e0b2b6ce979f6e1050b7307ad36cdbea6faad1d92fa89ec36b1e3b0b1b4944fcddea4bb9fb368c493cab4ce58951cdb7baa5fc11606b5b927bfab68d45505c9abd87a527b56a0cf60f6ed44396955d8f6a9db5b3ed27dbb9ae8d44d6178e4a88c04e6aa6d865c070e6a6d418f7fb22f1400e213c0f2f3b7c1478350e37e8de90ee9a60a0430e3af82bcd69d9d90fe66cd16c2ecef7f57bd758d29b22b602ecf896ae4a2e0edcc051f2071c3d975b1061367b5be3b03e5aa57b8adb1f329ae8ac5e66044c79c476b363d8f29bd83e65a3577242f92d262d017d1190f66a17898d600684a949149c0265f90832de8aca48022435e47e19cb72a4a8ee3a46e526315260751bfe4525449fc69bd0d6d40ce5b9bd85707510a3df3ddb9bf82bd2791d88c912067b54afc6ab2b03a0ddc05047eee45097cf7a88c34c19487a530dff2025fb3068130cb32130ca24102b45a58ed3250ce4aeb7ee34bd4758152dadb58752b155ed7d942a0ddc0b76e0885f3533853a7e5d2094856b3293fa9d504eeef35dace6edd7ccd95374c2783215f8cc1e0c4162903246b50c201c4bf486c385b0a4d38f538df9b06617e4147b1c0f74da85b11252b487c241c4b99d01735988f1aed8000f86f676f3a09627c51f7e57fd1cd12b3ae7fe1cbc3125833b7589edbffddcffc5acba12f4247b14d292022a03f212c6c2d33ca235b495310ec17d556951e70d6f752043e4173c36149826e4575a4f6127e26a1b394aac176282b3cd4d0019666f3f3d319625e70ac358b384e75df6c77a734e79780b0cbe43a741de0023ddfb45f20dc3680b09df497e1a22abf80193e38721de16ddc77e56fac3a6863199f394740cc84eebedc22b81f9881522348a75960c57952c07168229dd4"}) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) r6 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x400, 0x0) ioctl$VIDIOC_S_HW_FREQ_SEEK(r6, 0x40305652, &(0x7f0000000040)={0x1, 0x5, 0x3, 0xe4, 0x6, 0x9, 0x1}) write$apparmor_current(r2, &(0x7f00000000c0)=ANY=[@ANYRESDEC=r2], 0x2b) 00:56:49 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_%ype\x00']}, 0x6c0) 00:56:49 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:56:49 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_t\"pe\x00']}, 0x6c0) [ 617.696374][T23676] xt_TPROXY: Can be used only with -p tcp or -p udp [ 617.714397][T23677] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:56:49 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x82200, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) 00:56:49 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 617.806144][T23677] FAULT_INJECTION: forcing a failure. [ 617.806144][T23677] name failslab, interval 1, probability 0, space 0, times 0 [ 617.865030][T23677] CPU: 0 PID: 23677 Comm: syz-executor.2 Not tainted 5.7.0-rc1-next-20200415-syzkaller #0 [ 617.874947][T23677] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 617.885027][T23677] Call Trace: [ 617.888330][T23677] dump_stack+0x188/0x20d [ 617.892677][T23677] should_fail.cold+0x5/0x14 [ 617.897283][T23677] ? lock_downgrade+0x840/0x840 [ 617.902144][T23677] ? setup_fault_attr+0x1e0/0x1e0 [ 617.907189][T23677] should_failslab+0x5/0xf [ 617.911616][T23677] kmem_cache_alloc_node_trace+0x27c/0x790 [ 617.917432][T23677] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 617.923430][T23677] __kmalloc_node_track_caller+0x38/0x60 [ 617.929076][T23677] __kmalloc_reserve.isra.0+0x39/0xe0 [ 617.934463][T23677] __alloc_skb+0xef/0x5a0 [ 617.938803][T23677] ? __kmalloc_reserve.isra.0+0xe0/0xe0 [ 617.945404][T23677] ? netlink_autobind.isra.0+0x21b/0x300 [ 617.951048][T23677] netlink_sendmsg+0x97b/0xe10 [ 617.955825][T23677] ? aa_af_perm+0x260/0x260 [ 617.960334][T23677] ? netlink_unicast+0x740/0x740 [ 617.965292][T23677] ? netlink_unicast+0x740/0x740 [ 617.971371][T23677] sock_sendmsg+0xcf/0x120 [ 617.975801][T23677] ____sys_sendmsg+0x6bf/0x7e0 [ 617.980579][T23677] ? kernel_sendmsg+0x50/0x50 [ 617.985270][T23677] ? _parse_integer+0x180/0x180 [ 617.990227][T23677] ___sys_sendmsg+0x100/0x170 [ 617.994922][T23677] ? sendmsg_copy_msghdr+0x70/0x70 [ 618.000050][T23677] ? __fget_files+0x32f/0x500 [ 618.004738][T23677] ? do_dup2+0x520/0x520 [ 618.008998][T23677] ? __fget_light+0x20e/0x270 [ 618.013687][T23677] __sys_sendmsg+0xec/0x1b0 [ 618.018196][T23677] ? __sys_sendmsg_sock+0xb0/0xb0 [ 618.023225][T23677] ? vfs_write+0x161/0x5d0 [ 618.027656][T23677] ? trace_hardirqs_off_caller+0x55/0x230 [ 618.033385][T23677] ? do_syscall_64+0x21/0x7d0 [ 618.038070][T23677] do_syscall_64+0xf6/0x7d0 [ 618.042583][T23677] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 618.048473][T23677] RIP: 0033:0x45ca29 [ 618.052369][T23677] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 618.071978][T23677] RSP: 002b:00007fa3082eec78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 618.080401][T23677] RAX: ffffffffffffffda RBX: 0000000000500f40 RCX: 000000000045ca29 [ 618.088391][T23677] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000000000005 [ 618.096370][T23677] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 618.104350][T23677] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000000a 00:56:50 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_ty%e\x00']}, 0x6c0) [ 618.112329][T23677] R13: 0000000000000a04 R14: 00000000004ccdcc R15: 00007fa3082ef6d4 00:56:50 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffff000}]) 00:56:50 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_typ\"\x00']}, 0x6c0) [ 618.374187][ T26] kauditd_printk_skb: 12 callbacks suppressed [ 618.374199][ T26] audit: type=1400 audit(1589677010.360:1066): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=23705 comm="syz-executor.5" 00:56:50 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0xfdfc}]) 00:56:50 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup2(r3, r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TIOCNXCL(r4, 0x540d) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r5 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r5, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x2b) 00:56:50 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:56:50 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_typ%\x00']}, 0x6c0) 00:56:50 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff002}]) 00:56:50 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) [ 618.813153][ T26] audit: type=1400 audit(1589677010.790:1067): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=23718 comm="syz-executor.5" 00:56:50 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 618.899603][T23726] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 618.920878][ T26] audit: type=1400 audit(1589677010.820:1068): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=23721 comm="syz-executor.1" 00:56:50 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff004}]) 00:56:50 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x02']}, 0x6c0) [ 619.092479][T23739] bond0: (slave veth313): Enslaving as an active interface with an up link 00:56:51 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 619.186071][ T26] audit: type=1400 audit(1589677011.160:1069): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=23746 comm="syz-executor.5" 00:56:51 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x03']}, 0x6c0) 00:56:51 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff006}]) [ 619.475945][ T26] audit: type=1400 audit(1589677011.450:1070): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=23756 comm="syz-executor.5" 00:56:51 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0xfdfe}]) 00:56:51 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:56:51 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:56:51 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x04']}, 0x6c0) 00:56:51 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0xffffffffffffffff}]) [ 619.945243][ T26] audit: type=1400 audit(1589677011.920:1071): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=23770 comm="syz-executor.5" [ 619.948067][T23775] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:56:52 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x05']}, 0x6c0) 00:56:52 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 620.190697][T23785] bond0: (slave veth315): Enslaving as an active interface with an up link 00:56:52 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000, 0x2}]) [ 620.419511][ T26] audit: type=1400 audit(1589677012.400:1072): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=23794 comm="syz-executor.5" [ 620.605207][T23802] tproxy_tg6_check: 12 callbacks suppressed [ 620.605212][T23802] xt_TPROXY: Can be used only with -p tcp or -p udp 00:56:52 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x2, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:56:52 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000, 0x4}]) 00:56:52 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x06']}, 0x6c0) 00:56:52 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 620.833883][T23809] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 620.901611][ T26] audit: type=1400 audit(1589677012.880:1073): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=23806 comm="syz-executor.5" [ 620.929736][T23814] xt_TPROXY: Can be used only with -p tcp or -p udp [ 620.953502][T23809] bond0: (slave veth317): Enslaving as an active interface with an up link [ 620.985052][T23824] xt_TPROXY: Can be used only with -p tcp or -p udp 00:56:53 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0xfe00}]) 00:56:53 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\a']}, 0x6c0) 00:56:53 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000, 0x6}]) 00:56:53 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 621.257502][ T26] audit: type=1400 audit(1589677013.230:1074): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=23828 comm="syz-executor.5" [ 621.286109][T23838] xt_TPROXY: Can be used only with -p tcp or -p udp [ 621.433792][T23838] xt_TPROXY: Can be used only with -p tcp or -p udp 00:56:53 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\t']}, 0x6c0) 00:56:53 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x3, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:56:53 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000, 0x600}]) 00:56:53 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 621.668605][ T26] audit: type=1400 audit(1589677013.650:1075): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=23840 comm="syz-executor.5" 00:56:53 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x10']}, 0x6c0) [ 621.732876][T23845] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 621.733008][T23847] xt_TPROXY: Can be used only with -p tcp or -p udp [ 621.866028][T23855] bond0: (slave veth319): Enslaving as an active interface with an up link [ 621.907399][T23861] xt_TPROXY: Can be used only with -p tcp or -p udp 00:56:53 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:56:54 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000, 0x4000}]) 00:56:54 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0xfefd}]) [ 622.158843][T23872] xt_TPROXY: Can be used only with -p tcp or -p udp [ 622.247546][T23872] xt_TPROXY: Can be used only with -p tcp or -p udp 00:56:54 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:56:54 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_typeH']}, 0x6c0) 00:56:54 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:56:54 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000, 0x1000000}]) [ 622.470226][T23881] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:56:54 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_typeL']}, 0x6c0) [ 622.564448][T23884] xt_TPROXY: Can be used only with -p tcp or -p udp [ 622.593102][T23881] bond0: (slave veth321): Enslaving as an active interface with an up link 00:56:54 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:56:54 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000, 0x2000000}]) 00:56:55 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x5, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:56:55 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_typeh']}, 0x6c0) 00:56:55 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:56:55 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000, 0x4000000}]) [ 623.216758][T23917] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:56:55 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0xfeffff}]) 00:56:55 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 623.339804][T23930] bond0: (slave veth323): Enslaving as an active interface with an up link 00:56:55 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_typel']}, 0x6c0) 00:56:55 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000, 0x6000000}]) [ 623.604671][ T26] kauditd_printk_skb: 4 callbacks suppressed [ 623.604686][ T26] audit: type=1400 audit(1589677015.580:1080): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=23937 comm="syz-executor.5" 00:56:55 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:56:55 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x6, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:56:55 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_typet']}, 0x6c0) 00:56:55 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000, 0x40000000}]) 00:56:55 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup2(r4, r3) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$KVM_CREATE_DEVICE(r2, 0xc00caee0, &(0x7f0000000000)={0x4, r5}) r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r7 = dup(r6) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000080)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff}}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000240)=""/202, 0xca}, {&(0x7f0000000100)=""/27, 0x1b}], 0x2, &(0x7f00000001c0)=""/47, 0x2f}, 0x10000) r9 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000000c0)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICREMOVE(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="0100e0ef69aa779932392f74bd52c40001a69fa57cc1b1f73b78b721ba22a3c775221eb4cd1571c72167bd23befe43f69575ae000000000000000000000000000000000000170000000000", @ANYRES16=r9, @ANYBLOB="90002cbd7000fbdbdf250400000005000100010000001400020000000000000000000000fc0040000001080005000000000008000601800000000000000005000100000000467c555700000000000000000000000000005264ab1400"/102], 0x3}, 0x1, 0x0, 0x0, 0x4004080}, 0x20000054) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f00000004c0)={0x2}) sendmsg$NLBL_UNLABEL_C_LIST(r8, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x44, r9, 0x20, 0x70bd2c, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_ACPTFLG={0x5, 0x1, 0x1}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @remote}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'hsr0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x14}, 0x4000820) r10 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r10, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x2b) 00:56:56 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 623.942213][ T26] audit: type=1400 audit(1589677015.920:1081): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=23952 comm="syz-executor.1" [ 623.974740][T23953] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:56:56 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup2(r3, r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) sendmsg$OSF_MSG_ADD(r4, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000240)={0x1508, 0x0, 0x5, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [{{0x254, 0x1, {{0x2, 0x7ff}, 0x80, 0xda, 0x3, 0x5, 0x28, 'syz0\x00', "a29ef831f8f1579fd2623506a0e6e5f42e7020a33da2cda5d02f6eccf635247c", "20d866756e76957ddabef97684c76a0aef621f7a6979aad37bbaba4c0ab45278", [{0x8, 0x8, {0x1, 0x8}}, {0x8, 0x9, {0x2, 0xa7}}, {0x81, 0x6, {0x3, 0x7fd}}, {0x401, 0x7ff, {0x2, 0x20}}, {0x3, 0x3, {0x0, 0x6}}, {0x40, 0x7, {0x1, 0x10f5}}, {0x4, 0xfffc, {0x0, 0x4}}, {0x8, 0x55b, {0x1, 0x8}}, {0x6, 0x2, {0x1, 0x9}}, {0x810, 0x627c, {0x3, 0x8}}, {0xa063, 0x20, {0x1, 0xfffffffc}}, {0x1, 0x80, {0x0, 0xffffffff}}, {0x8, 0x3f, {0x1, 0x7}}, {0x0, 0x400, {0x0, 0x3f}}, {0x6, 0xff, {0x1, 0x8001}}, {0xb9ce, 0x3, {0x0, 0x2}}, {0xfff7, 0x9, {0x1, 0x60}}, {0x566d, 0xffff, {0x0, 0x4}}, {0x9, 0x1, {0x2, 0x4}}, {0x1, 0x9, {0x2, 0x401}}, {0xe97b, 0x8, {0x1, 0x5}}, {0x3, 0x0, {0x0, 0x6}}, {0x5, 0x5, {0x2, 0x1}}, {0x7, 0x9, {0x0, 0x2}}, {0x3f, 0x5, {0x1, 0x6}}, {0x9, 0x8, {0x3, 0x6}}, {0x1, 0x1, {0x3, 0x6}}, {0x9, 0x4000, {0x0, 0x6be}}, {0x9, 0x0, {0x0, 0xcf1}}, {0x7fff, 0xae1, {0x1, 0x8f38}}, {0x20, 0x5540, {0x0, 0x10000}}, {0x1ff, 0x3, {0x3}}, {0x8, 0x81}, {0x4c60, 0x5, {0x1, 0x3}}, {0xfff8, 0x1bbb, {0x1, 0x7}}, {0x0, 0x2, {0x2, 0x5}}, {0x8, 0x6, {0x3, 0x81}}, {0x4, 0x9, {0x3, 0xffffffff}}, {0x59e9, 0x20f, {0x2, 0x7fff}}, {0x7, 0x0, {0x0, 0xba}}]}}}, {{0x254, 0x1, {{0x3, 0x3}, 0x5, 0x9, 0x7f, 0xf721, 0xd, 'syz0\x00', "8f2434e75dbf8e18230f51e9700165330e6201d178553d8fe1ac6bccde30c4b3", "890b2b9d38961eb4f39271390a2e0926ec215959817b1104b584a2d3c73e44c0", [{0xdcf3, 0x0, {0x0, 0xff}}, {0x7fff, 0x42, {0x3, 0x8}}, {0x80, 0xff, {0x4}}, {0x9, 0xe9, {0x1, 0x7}}, {0x7, 0x8f8f, {0x2, 0x2}}, {0x90, 0x5, {0x2, 0x6}}, {0x40, 0x0, {0x3, 0x3}}, {0x8, 0x0, {0x0, 0x8}}, {0x1, 0x3, {0x0, 0x80000000}}, {0x1, 0x3, {0x1, 0x10001}}, {0xffff, 0x9, {0x1, 0x5}}, {0x5da, 0x7ff, {0x0, 0x5}}, {0x72b, 0x4cf, {0x2, 0x9}}, {0xfff, 0x1, {0x2, 0xffffff7f}}, {0x2, 0x6, {0x0, 0x4}}, {0x5, 0x2, {0x1, 0xf2a}}, {0x0, 0x0, {0x3, 0xeb2}}, {0x7, 0x3, {0x0, 0x2}}, {0x7, 0x3, {0x3, 0xfffffff7}}, {0x3, 0x8001}, {0x6, 0x1, {0x0, 0x74}}, {0x5, 0x68, {0x0, 0x3}}, {0x8, 0x5, {0x3, 0x5}}, {0x0, 0x1, {0x3, 0x1ff}}, {0xfcc, 0x16e5, {0x2, 0x9}}, {0x7ff, 0x4, {0x2, 0xfffffff9}}, {0x8, 0xfff, {0x2, 0x400}}, {0x3, 0x6, {0x0, 0xffffffff}}, {0x0, 0x1ff, {0x0, 0x9}}, {0x8000, 0x0, {0x2, 0x8001}}, {0x3c1d, 0x3f}, {0xd30, 0x7ff, {0x2, 0x200}}, {0x7, 0x7fff, {0x3, 0x401}}, {0xffff, 0x7b, {0x2, 0x1000}}, {0x6, 0x0, {0x3, 0x4}}, {0xcafe, 0xfffb, {0x1, 0x2}}, {0x3ff, 0x0, {0x1, 0x8f1d}}, {0x1ff, 0x2413, {0x3, 0x10000}}, {0x4, 0x1, {0x1}}, {0x9, 0x0, {0x0, 0x9}}]}}}, {{0x254, 0x1, {{0x1, 0x1f}, 0x1, 0xad, 0xf4, 0x8, 0xa, 'syz1\x00', "f5f59e68038cd1636527f9c9f7b450b4ffffc503cce43dfcdd0251734d022958", "762f54a1a7f027201da98180abecbd7ff2a0c3c66690e2fe62e30069bc5ad3aa", [{0x8, 0x7f, {0x2, 0xffffffff}}, {0x81, 0x7, {0x1, 0x1}}, {0x4, 0x7, {0x3, 0x3}}, {0x0, 0xe257, {0x0, 0x7fffffff}}, {0xfcfd, 0x4, {0x1, 0x1}}, {0x9, 0x400, {0x1, 0x4}}, {0x5, 0x95c3, {0x2, 0x5}}, {0x7fff, 0xffff, {0x2, 0x8}}, {0x8, 0x5, {0x3, 0x2}}, {0xf001, 0x1, {0x2, 0x7ff}}, {0x9, 0xedd7, {0x2, 0x8}}, {0x6, 0x55, {0x0, 0x401}}, {0xe071, 0xe6, {0x0, 0x7ff}}, {0x8, 0x6, {0x2, 0x81}}, {0x1, 0x3, {0x4, 0x6}}, {0x4, 0x1, {0x2, 0xad}}, {0x1, 0x4, {0x1, 0x3}}, {0xff81, 0xfffd, {0x2, 0xe12b}}, {0x99c, 0xaa28, {0x0, 0x7}}, {0x2, 0x0, {0x0, 0x7ff}}, {0x8, 0x8001, {0x2, 0x7}}, {0x100, 0x1f, {0x3, 0x5}}, {0x8, 0x3, {0x2, 0x4811}}, {0x9, 0x1fb4, {0x2, 0x8}}, {0x0, 0x101, {0x1, 0x6}}, {0x5, 0x5, {0x3, 0x1ff}}, {0x2000, 0x1, {0x3, 0x6}}, {0xffff, 0x0, {0x3, 0x2}}, {0x0, 0x3f, {0x3}}, {0x7d5, 0x9, {0x2, 0x1}}, {0x0, 0x800}, {0x81, 0xfff7, {0x1, 0x4}}, {0x0, 0xad5e, {0x0, 0x1}}, {0x400, 0x2, {0x6, 0x1}}, {0x3, 0x3, {0x3, 0x4}}, {0x60, 0x0, {0x1}}, {0x3, 0x7, {0x0, 0x4}}, {0x8, 0x0, {0x2, 0x1f}}, {0x3f, 0x3, {0x3, 0x9b}}, {0x2, 0x2, {0x575d736c084dcac1, 0xfffffffb}}]}}}, {{0x254, 0x1, {{0x1, 0x7f}, 0x14, 0x9, 0x1f, 0x9, 0x11, 'syz0\x00', "9ad342665d29c9515d5b945be42aa8b9ef22d809bb1410425bd00793d6ad282c", "ce82ad25e112a99be1e11b5bfc7e4200c5ef4098ddf71cb375cecf2cb690e469", [{0x0, 0x0, {0x1, 0x80}}, {0x8, 0x400, {0x3, 0x51c}}, {0x2, 0x0, {0x0, 0x200}}, {0xbf, 0xffff, {0x2, 0x4cf}}, {0x974a, 0x3f, {0xb86051c6fdd3a809, 0x5}}, {0x6, 0x1, {0x1, 0x400}}, {0x800, 0x0, {0x0, 0x3}}, {0x3, 0x4, {0x1, 0x2}}, {0x200, 0x1ff, {0x0, 0x3}}, {0x2, 0xe000, {0x3, 0x7f}}, {0x4c2, 0x2, {0x1, 0x401}}, {0xff, 0x7, {0x0, 0x7}}, {0x401, 0x8, {0x2, 0x42d}}, {0x2, 0x4, {0x1, 0x66da}}, {0x0, 0x401, {0x2, 0x1000}}, {0x2, 0x101}, {0x4, 0x6, {0x3, 0x7}}, {0xfffe, 0x2, {0x2, 0x20}}, {0x7, 0x94d2, {0x2, 0x3}}, {0x7fff, 0x8000, {0x1, 0x5}}, {0x3, 0x0, {0x3, 0x7fff}}, {0x73, 0x5, {0x1, 0x8}}, {0x800, 0x8, {0x3, 0x7}}, {0x14, 0x1ff, {0x0, 0x3ff}}, {0x0, 0x401, {0x0, 0xffffffff}}, {0x200, 0x5, {0x0, 0x4b}}, {0xac02, 0x0, {0x3, 0x8}}, {0x2, 0x2, {0x3, 0x80000000}}, {0x8, 0x1f, {0x3, 0x9}}, {0x8, 0x9, {0x0, 0x6}}, {0x5, 0x7ff, {0x1, 0x10000}}, {0x31d0, 0x5, {0x1, 0x1}}, {0x3, 0xdb1, {0x0, 0x80}}, {0xae, 0x7, {0x1, 0x400}}, {0x1112, 0xebc, {0x3, 0xffffff81}}, {0x5, 0x4, {0x2, 0x7}}, {0x1ff, 0x6, {0x3, 0x2}}, {0xea57, 0x7, {0x1, 0x3f}}, {0x6, 0x9, {0x1, 0x4}}, {0x8, 0x6, {0x2, 0x81}}]}}}, {{0x254, 0x1, {{0x3, 0x9}, 0x9, 0x9, 0x7f, 0x5, 0x1e, 'syz1\x00', "318c56b101caa531ec5f9182ceefc9a9d840024d04747cee4951de6bc8decfe4", "f8751c91d4129dfa0c6996ac6df2aaba5ffefae6535fe324023d70369159ecb2", [{0x2, 0x3, {0x0, 0xffffffff}}, {0xe17, 0xb53, {0x1, 0x1}}, {0x1, 0xffe1, {0x1, 0x7}}, {0x800, 0x8d2, {0x0, 0x5}}, {0xdc8, 0x8000, {0x2, 0x1000}}, {0x80, 0x3, {0x2, 0xe2}}, {0x7, 0x7, {0x2, 0xfff}}, {0x9c00, 0x40, {0x1, 0x975}}, {0x800, 0x8001, {0x1, 0x5}}, {0x2, 0x401, {0x1, 0x401}}, {0x5, 0xa6f, {0x3, 0xdf}}, {0x200, 0x3, {0x1, 0xfffff556}}, {0x8000, 0x7, {0x3, 0x5}}, {0x783f, 0x4, {0x0, 0x1}}, {0x81, 0x3, {0x2, 0x1f}}, {0x4b01, 0x6, {0x2, 0x1}}, {0x7fff, 0x7, {0x2, 0xffff}}, {0xeb42, 0x47, {0x2, 0x8}}, {0x0, 0x200, {0x0, 0x74}}, {0x3, 0x40, {0x1, 0x8000000}}, {0x1, 0x9, {0x0, 0x2}}, {0x6, 0x0, {0x2, 0x8}}, {0x0, 0xffff, {0x3, 0x2768}}, {0x7, 0x0, {0x2, 0x9}}, {0x4f72, 0x2, {0x3}}, {0x3ff, 0x94, {0x2, 0x1f}}, {0x3f8, 0x1ff, {0x1, 0x1ff}}, {0x7, 0x5045, {0x0, 0x5d4}}, {0x1000, 0x9, {0x2, 0x5}}, {0x7, 0xfff, {0x3, 0x64}}, {0x7, 0x8000, {0x0, 0x9}}, {0x5, 0x8c7c, {0x2, 0x8}}, {0x9, 0x6f2, {0x3, 0x80000001}}, {0x4, 0xfffb, {0x2, 0x7}}, {0x8, 0x200, {0x3, 0x9}}, {0x1, 0x1f, {0x0, 0x40}}, {0x3ff, 0x8001, {0x1, 0xba6}}, {0x532, 0x4, {0x1, 0x3}}, {0x6, 0x5, {0x2, 0x4}}, {0x200, 0xea, {0x3, 0x81}}]}}}, {{0x254, 0x1, {{0x2, 0x3ff}, 0x5, 0x1, 0x101, 0x621, 0xb, 'syz0\x00', "16c1417c6c448703e67779762b71826a055d0e9bc90a24a580c6641a9d4671d1", "59989c4152765fedfba74e96a5bfed30ad1d2e3f4175822e416992f83145bb43", [{0x800, 0x3, {0x3, 0x3ff}}, {0x1f, 0x6, {0x2, 0xffffffff}}, {0x2, 0x20, {0x2, 0x7}}, {0x6, 0x200, {0x1}}, {0xf6, 0xff, {0x3, 0x7fffffff}}, {0x9, 0xf794, {0x2, 0x3}}, {0x1000, 0x86b, {0x1, 0xc5a}}, {0x3f, 0x0, {0x2, 0x9}}, {0x5, 0x1000, {0x0, 0x2}}, {0x6, 0x9, {0x830955252e260325, 0x100}}, {0x47, 0x3f, {0x2, 0x1}}, {0x9, 0x8, {0x1, 0x7}}, {0x6, 0x0, {0x3, 0xa9}}, {0xd27c, 0x100, {0x0, 0x8001}}, {0xfeff, 0x887, {0x0, 0x9}}, {0xff, 0x800, {0x3, 0x76c60879}}, {0x0, 0x8001, {0x0, 0x1}}, {0x7, 0x0, {0x0, 0x3}}, {0xc000, 0x100, {0x3, 0x7}}, {0x3, 0x7, {0x1}}, {0xafe, 0x6, {0x3, 0x2}}, {0x0, 0x35a5, {0x1, 0x380000}}, {0xee, 0x8000, {0x1}}, {0x9, 0x7ff, {0x2, 0x1}}, {0x2, 0x1, {0x1, 0x391}}, {0xf801, 0x3ff, {0x2, 0x1}}, {0xd78, 0xb8, {0x0, 0xfffff903}}, {0x0, 0x1f, {0x1, 0x6b}}, {0x8001, 0x0, {0x3, 0x7931}}, {0x2, 0x1, {0x3, 0x6}}, {0x81, 0x1000, {0x1, 0x40}}, {0xfffe, 0x0, {0x0, 0x1ff}}, {0x166, 0x0, {0x0, 0x6}}, {0x5, 0xff01, {0x2}}, {0xfff, 0x45, {0x2, 0x9}}, {0x3f, 0x7, {0x1, 0x2}}, {0x2, 0x8, {0x2, 0xffff0000}}, {0xf8, 0x401, {0x0, 0x2}}, {0x6, 0x4, {0x1, 0xf2e}}, {0x6, 0x9, {0x1}}]}}}, {{0x254, 0x1, {{0x3, 0x400}, 0x2, 0xfc, 0x61, 0x9, 0x17, 'syz1\x00', "0df605355136b328b7bbdb8f9ddd5c1f756d73c3432f48892f199f18f69ca211", "80f6105705b43d105f004159989858c7668c77b3737fdf6744a0f7f93645032c", [{0x5759, 0x6, {0x0, 0x2}}, {0xec, 0x7fff, {0x1, 0x7fffffff}}, {0xd7, 0x0, {0x3}}, {0x7fff, 0xbe, {0x1, 0x50000000}}, {0x401, 0x7f, {0x0, 0x1}}, {0x8001, 0x0, {0x1, 0xf41}}, {0x1, 0xff81, {0x2, 0x1f7}}, {0xca6, 0x2, {0x3, 0x180}}, {0x9, 0x77de, {0x2, 0x6}}, {0x2, 0x80, {0x1, 0x4}}, {0x8, 0xff01, {0x2, 0x10001}}, {0x9, 0x5, {0x3, 0xfff}}, {0x7, 0x5, {0x1, 0x9e7}}, {0x6, 0x1ff, {0x1, 0x5}}, {0x5, 0x1000, {0x0, 0x7}}, {0x2, 0x3, {0x1, 0xfffffff8}}, {0x8000, 0x7, {0x3, 0x5}}, {0x8000, 0x100, {0x1}}, {0x3, 0x8, {0x0, 0x100}}, {0x1, 0x2, {0x1, 0x3}}, {0x42, 0x1, {0x0, 0x6}}, {0x9, 0x0, {0x0, 0x6c}}, {0x0, 0x7f, {0x2, 0x80000000}}, {0x6, 0xa418, {0x0, 0x800}}, {0x9, 0x7, {0x0, 0x80000001}}, {0x571, 0x2, {0x3, 0x1}}, {0x1, 0xe5, {0x0, 0x40}}, {0x6a1, 0xff, {0x1, 0x7fffffff}}, {0x1000, 0x8000, {0x0, 0x4}}, {0x1ff, 0x3, {0x2, 0x4}}, {0x4, 0x4, {0x0, 0x4}}, {0x1000, 0x100, {0x1, 0xffff}}, {0x0, 0x1, {0x2, 0x8}}, {0x413, 0x2, {0x0, 0x8b7}}, {0x9, 0x5, {0x1, 0xfffffd4a}}, {0x2, 0x1000, {0x0, 0x3}}, {0x1, 0x7, {0x0, 0x7}}, {0x1ff, 0x4e53, {0x0, 0x4e7a}}, {0x0, 0x9, {0x3, 0x9}}, {0x101, 0x40, {0x1, 0x1}}]}}}, {{0x254, 0x1, {{0x3, 0x9}, 0x7, 0x6d, 0x7, 0x7, 0x18, 'syz0\x00', "148579bd58e499ad4570be3ad22d224fc076cbc3f9935ee88b7e37c958f2945d", "1fb6bf9a04cab7790c4225f666b1521674a5decdb7235db56c1a9efb185a03c9", [{0x2, 0x80, {0x2, 0x1ff}}, {0x7ff, 0x9}, {0x3, 0x4f, {0x1, 0x6}}, {0x6, 0x3, {0x3, 0x3f}}, {0x20, 0xa, {0x0, 0x3}}, {0x9, 0x6, {0x2, 0x8000}}, {0x1f, 0xb1f, {0x0, 0x7f}}, {0x101, 0x4, {0x1, 0x40}}, {0x6, 0x1}, {0x2fb4, 0x4800, {0x2, 0x101}}, {0x4, 0x2, {0x3, 0x5}}, {0x5, 0xffe0, {0x0, 0xf8000000}}, {0xe45, 0x6, {0x5, 0x9}}, {0xf65, 0x9ce, {0x2, 0x47}}, {0x9, 0x2, {0x1, 0x7f}}, {0x3ff, 0x1, {0x3, 0x1f}}, {0x3ff, 0xfffc, {0x2, 0x80000000}}, {0x5, 0x2, {0x0, 0x7}}, {0xfff, 0xa484, {0x2, 0xff}}, {0x6, 0x4, {0x0, 0x5}}, {0x8000, 0xff, {0x2, 0xfff}}, {0x1f, 0x2, {0x0, 0xff}}, {0x9b94, 0x1ff, {0x1, 0x2}}, {0x401, 0x401, {0x0, 0x1}}, {0x2, 0x9, {0x2, 0x3}}, {0x100, 0x7, {0x2, 0xcf}}, {0x7f, 0x1ff, {0x7e59ea5cbc3221ba, 0x5}}, {0x8, 0x74, {0x0, 0x9}}, {0x9, 0x1, {0x3, 0x6}}, {0xfff, 0x1ff, {0x1, 0x2}}, {0x8000, 0x8000, {0x1, 0x9}}, {0x8000, 0xaa, {0x1, 0xfff}}, {0x7ff, 0xc3, {0x2, 0x7}}, {0xfffc, 0x5, {0x3, 0xc80}}, {0x4000}, {0x1, 0xffff, {0x0, 0xffff}}, {0x4, 0xff, {0x3, 0xff}}, {0x3, 0x8, {0x3, 0x35}}, {0xff48, 0x81, {0x3, 0x6}}, {0x20, 0x7, {0x2, 0x8000}}]}}}, {{0x254, 0x1, {{0x0, 0x80}, 0x1, 0x20, 0x3, 0xd1, 0x16, 'syz1\x00', "a90e89cb39703d65cebfb7a38bca513e4c18656694f75f0cc1dc15c876f40163", "c3f12fb2a91af02e64dec82d93cf630ac95639ec80496f2e0cf73f03afca0615", [{0x3}, {0xff7f, 0xff00, {0x2, 0x1}}, {0x80, 0x200, {0x1, 0xc1fb}}, {0xa4c, 0x4, {0x2, 0x7fff}}, {0x3, 0x0, {0x3, 0x7fff}}, {0x7ff, 0x2, {0x3, 0xa6e}}, {0xfffe, 0x2, {0x3, 0xc4}}, {0x3f, 0x8, {0x0, 0x2}}, {0x400, 0x9, {0x0, 0x9}}, {0x1, 0x7baa, {0x2, 0x7f}}, {0x3, 0x8000, {0x1, 0x7f}}, {0x9, 0x5, {0x2, 0x8}}, {0x2160, 0xa1, {0x0, 0x2}}, {0xf945, 0x1, {0x3}}, {0xb8ca, 0x2, {0x2, 0x16e}}, {0x9, 0x1, {0x3, 0x92}}, {0x3f, 0x8000, {0x2, 0x1}}, {0x6, 0x200, {0x0, 0x7ff}}, {0x1ff, 0x7fff, {0x2, 0x1}}, {0x8001, 0x8001, {0x3, 0x401}}, {0x1, 0x9, {0x0, 0x81c}}, {0x5, 0x6, {0x2, 0x7}}, {0x8001, 0x81, {0x2, 0x40}}, {0x0, 0x9a6, {0x0, 0x6}}, {0xf3d, 0x200, {0x3, 0x40}}, {0xff, 0x8, {0x3, 0x3}}, {0x0, 0x9, {0x2, 0xd9}}, {0xe6, 0x0, {0x7, 0x34d}}, {0x391, 0x1f, {0x0, 0x401}}, {0x26, 0x8001, {0x1, 0x101}}, {0x0, 0x2, {0x2, 0x5}}, {0x6, 0x8, {0x1, 0x8}}, {0x9, 0x1f, {0x0, 0x6}}, {0x1, 0x6, {0x1, 0x7}}, {0x8001, 0x4, {0x1, 0x6}}, {0x5, 0x20, {0x1, 0xfff}}, {0x6, 0x4, {0x0, 0x200}}, {0x6, 0x40, {0x3, 0x800}}, {0x5, 0x4, {0x1, 0x10001}}, {0x200, 0x80, {0x2, 0x40}}]}}}]}, 0x1508}, 0x1, 0x0, 0x0, 0x40084}, 0x40000) r5 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r5, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x2b) [ 624.130616][ T26] audit: type=1400 audit(1589677016.110:1082): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=23960 comm="syz-executor.5" [ 624.132033][T23965] bond0: (slave veth325): Enslaving as an active interface with an up link 00:56:56 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_typez']}, 0x6c0) 00:56:56 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x1000000}]) 00:56:56 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:56:56 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000, 0x1000000000000}]) [ 624.437642][ T26] audit: type=1400 audit(1589677016.420:1083): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=23982 comm="syz-executor.5" 00:56:56 executing program 1: r0 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0xc480, 0x0) ioctl$KDSETLED(r0, 0x4b32, 0x8f) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000280)='/proc/thread-self/attr/current\x00', 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup2(r5, r4) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) sendto$phonet(0xffffffffffffffff, &(0x7f0000000180)="627fd55a1f4584f67961b246dff2b673f25d477cf456c61f30cbb662f3b817111f91144cc3c0203c96e53c1b84313d8a3ab84658e1e436ef6d3cfaee3624fa46f94e68c3c568102b5439de360dacf359143ff754a1", 0x55, 0x20000000, &(0x7f0000000240)={0x23, 0x20, 0x6, 0x7f}, 0x10) ioctl$VIDIOC_DQBUF(r6, 0xc0585611, &(0x7f0000000040)={0xebcf, 0x1, 0x4, 0x0, 0xda3, {}, {0x3, 0x2, 0x40, 0x4, 0x0, 0x7f, "f55fdfe5"}, 0x7, 0x2, @offset=0x41, 0xdfba802}) r7 = gettid() ptrace$setopts(0x4206, r7, 0x0, 0x0) tkill(r7, 0x3c) ptrace$setregs(0xd, r7, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r7, 0x0, 0x0) getpgid(r7) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r3, &(0x7f00000000c0)=ANY=[@ANYBLOB="7065726d686174203078303030303030303030303030303030305e6370757365746d696d655f74797065007f11f2e4d98722dbd81a1fd00d5e8a4ee3f403e2ccfe8034edd7564c63e8f6003ef3479c247debaa578ba4c755a1c8c2bdfdf2d982d673159d88a31f94f4d8d8bff1e3579a6b7208b8c8ae7c343ae9dd2d44b5ed56"], 0x2b) 00:56:56 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x7, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:56:56 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:56:56 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:56:56 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000, 0x100000000000000}]) [ 624.767877][ T26] audit: type=1400 audit(1589677016.750:1084): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=23996 comm="syz-executor.5" 00:56:56 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r2, &(0x7f0000000000)=@hat={'permhat ', 0xfffffffffffffffc, 0x5e, ['self[(!trusted^\'\x00', 'permhat ', 'permhat ']}, 0x3c) [ 624.815518][T24001] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:56:56 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) [ 624.859346][ T26] audit: type=1400 audit(1589677016.770:1085): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=23996 comm="syz-executor.5" [ 624.987517][T24012] bond0: (slave veth327): Enslaving as an active interface with an up link [ 625.009142][ T26] audit: type=1400 audit(1589677016.990:1086): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=24011 comm="syz-executor.5" 00:56:57 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:56:57 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) [ 625.098963][ T26] audit: type=1400 audit(1589677016.990:1087): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=24010 comm="syz-executor.1" [ 625.304924][ T26] audit: type=1400 audit(1589677017.280:1088): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=24026 comm="syz-executor.5" 00:56:57 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x2000000}]) 00:56:57 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000, 0x200000000000000}]) 00:56:57 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup2(r3, r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x40082406, &(0x7f0000000000)='/proc/thread-self/attr/current\x00') r5 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r5, &(0x7f0000000080)=ANY=[@ANYBLOB="7065726d685d74203078303030313030303030303030303030305e63707506c194e93d0501007365746d696d655f7479706500"], 0x2b) 00:56:57 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:56:57 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:56:57 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) [ 625.645647][T24041] tproxy_tg6_check: 15 callbacks suppressed [ 625.645654][T24041] xt_TPROXY: Can be used only with -p tcp or -p udp [ 625.651932][ T26] audit: type=1400 audit(1589677017.620:1089): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=24036 comm="syz-executor.5" [ 625.691476][T24046] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:56:57 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) r3 = epoll_create(0x1ff) splice(r3, &(0x7f0000000000)=0xd5, r0, &(0x7f0000000080)=0x6, 0x6, 0x2) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x2b) [ 625.744743][T24053] xt_TPROXY: Can be used only with -p tcp or -p udp 00:56:57 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:56:57 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000, 0x400000000000000}]) 00:56:57 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 625.869322][T24046] bond0: (slave veth329): Enslaving as an active interface with an up link 00:56:58 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) r2 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r2, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r2, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) fsetxattr$trusted_overlay_redirect(r2, &(0x7f0000000100)='trusted.overlay.redirect\x00', &(0x7f0000000140)='./file0\x00', 0x8, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r3 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) r4 = socket$bt_rfcomm(0x1f, 0x0, 0x3) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x2010, r4, 0x435d2000) r5 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r5, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r5, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) writev(r5, &(0x7f0000000000)=[{&(0x7f0000000080)="fae586a27c42ea23dd83eb9eab2846a24245bdee13591117a206d50f336c0ee68a5420ef2652cdef3303e3b8a57f37d390ec071adb6c916c0dd6a3745b53373a41330c7ca308d70f28dfb33ce94ad01283ab46ad7d335c36496653", 0x5b}], 0x1) write$apparmor_current(r3, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x2b) [ 626.106512][T24078] xt_TPROXY: Can be used only with -p tcp or -p udp [ 626.262961][T24078] xt_TPROXY: Can be used only with -p tcp or -p udp 00:56:58 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0xc, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) [ 626.495517][T24083] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 626.603193][T24083] bond0: (slave veth331): Enslaving as an active interface with an up link 00:56:58 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x3000000}]) 00:56:58 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:56:58 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:56:58 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000, 0x600000000000000}]) 00:56:58 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet(0x2, 0x4000000805, 0x0) r3 = socket$inet_sctp(0x2, 0x5, 0x84) dup3(r2, r3, 0x0) r4 = socket$inet(0x2, 0x4000000805, 0x0) r5 = socket$inet_sctp(0x2, 0x5, 0x84) dup3(r4, r5, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000000240)=[@in={0x2, 0x4e20, @loopback}], 0x10) sendto$inet(r5, &(0x7f0000000280)="042239f6e37ccf96ca42252d3fc9925f92a87e6780101735a0113e13fcc301be86bfb25fe27e15a5caedd6014131ab86d70f3860376802abde1e30c312061201438ad9db5b38ac4ea60e22c0397a329f282b6c3c50be91e87dfbe887527d538f72f1", 0x62, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r5, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x25, &(0x7f0000000340)={0x0, 0x5311}, &(0x7f0000000300)=0x8) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f0000000080)={r6, @in={{0x2, 0x4e22, @broadcast}}}, &(0x7f0000000140)=0x84) r7 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) ioctl$VIDIOC_ENUM_FREQ_BANDS(r1, 0xc0405665, &(0x7f0000000000)={0x8, 0x5, 0x5, 0x20, 0x21, 0x4, 0x8}) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r7, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x2b) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$SNDCTL_DSP_GETOPTR(0xffffffffffffffff, 0x800c5012, &(0x7f0000000180)) [ 626.870924][T24108] xt_TPROXY: Can be used only with -p tcp or -p udp [ 626.909599][T24108] xt_TPROXY: Can be used only with -p tcp or -p udp 00:56:58 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0xe, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:56:59 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) ioctl$sock_inet_udp_SIOCOUTQ(r1, 0x5411, &(0x7f0000000000)) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r2, &(0x7f0000000040)=ANY=[@ANYBLOB='permhat 0x0000000001000000^cpusetmime_type\x00'], 0x2b) 00:56:59 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:56:59 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000, 0x4000000000000000}]) 00:56:59 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 627.130732][T24116] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 627.230030][T24128] xt_TPROXY: Can be used only with -p tcp or -p udp [ 627.254102][T24129] bond0: (slave veth333): Enslaving as an active interface with an up link [ 627.355792][T24128] xt_TPROXY: Can be used only with -p tcp or -p udp 00:56:59 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup2(r4, r3) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) r8 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r8, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r8, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r8, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) ioctl$VIDIOC_QBUF(r5, 0xc058560f, &(0x7f0000000080)={0x1, 0x4, 0x4, 0x2000000, 0x9, {r6, r7/1000+10000}, {0x4, 0xc, 0x1, 0x3, 0x1, 0xc3, "5bab5feb"}, 0x3, 0x4, @fd=r1, 0x2, 0x0, r8}) sendto$inet(0xffffffffffffffff, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) ioctl$sock_SIOCSIFVLAN_SET_VLAN_INGRESS_PRIORITY_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000240)={0x2, 'veth1_to_batadv\x00', {0x800}, 0x7}) newfstatat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x7100) ioctl$SIOCAX25DELUID(r9, 0x89e2, &(0x7f00000001c0)={0x3, @null, r10}) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x2b) 00:56:59 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:56:59 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x4000000}]) 00:56:59 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:56:59 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000, 0x8000000000000000}]) 00:56:59 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x10, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:56:59 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:56:59 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup2(r3, r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$MON_IOCX_GETX(r4, 0x4018920a, &(0x7f0000000100)={&(0x7f0000000000), &(0x7f0000000080)=""/91, 0x5b}) r5 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r5, &(0x7f0000000040)=ANY=[@ANYBLOB='permhat 0x0000000000000003^cpusetmime_t}pe\x00'], 0x2b) [ 627.959992][T24154] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 628.015746][T24162] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:00 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000240)=ANY=[@ANYBLOB="70657257686174203078303030303030303230303030303030305e6370757365746d696d655f747970650062c1be5e602a2367d6dea71350c85fc7934c237d839d7cb7bcf0058a416e2c3f87ebce2e85afdf6ba4e4473762a6032f"], 0x2b) r3 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r3, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r3, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f00000002c0)={0x100000001, 0x0, 0x10000, 0x3}) ioctl$DRM_IOCTL_AGP_ALLOC(r1, 0xc0206434, &(0x7f0000000300)={0x3, r4, 0x2, 0x8}) fsetxattr$security_capability(r3, &(0x7f0000000140)='security.capability\x00', &(0x7f0000000180)=@v2={0x2000000, [{0xfff, 0x400}, {0x7, 0x7fffffff}]}, 0x14, 0x0) openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x81, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup2(r6, r5) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) ioctl$EVIOCGUNIQ(r7, 0x80404508, &(0x7f0000000400)=""/152) [ 628.086895][T24154] bond0: (slave veth335): Enslaving as an active interface with an up link [ 628.123290][T24174] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:00 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:57:00 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:00 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000, 0xffffffff00000000}]) 00:57:00 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:57:00 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x60, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) [ 628.647185][T24193] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 628.707354][ T26] kauditd_printk_skb: 17 callbacks suppressed [ 628.707368][ T26] audit: type=1400 audit(1589677020.691:1107): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=24192 comm="syz-executor.5" [ 628.800188][T24202] bond0: (slave veth337): Enslaving as an active interface with an up link 00:57:00 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x5000000}]) 00:57:00 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:00 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000, 0x0, 0x2}]) 00:57:00 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup2(r3, r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) bind$vsock_stream(r4, &(0x7f0000000000)={0x28, 0x0, 0x2711, @hyper}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r5 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="706572cd63433520307830303030305e6385757365741f696d655f7479786500"/43], 0x2b) 00:57:00 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) [ 629.141535][ T26] audit: type=1400 audit(1589677021.121:1108): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=24212 comm="syz-executor.5" [ 629.229960][ T26] audit: type=1400 audit(1589677021.181:1109): apparmor="DENIED" operation="setprocattr" info="current" error=-22 profile="unconfined" pid=24209 comm="syz-executor.1" 00:57:01 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$FIOCLEX(r0, 0x5451) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) r3 = accept4$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @private}, &(0x7f0000000080)=0x10, 0x0) getsockopt$SO_TIMESTAMP(r3, 0x1, 0x23, &(0x7f00000000c0), &(0x7f0000000100)=0x4) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x2b) 00:57:01 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0xf0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:01 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:57:01 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000, 0x0, 0x4}]) 00:57:01 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 629.487276][ T26] audit: type=1400 audit(1589677021.471:1110): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=24226 comm="syz-executor.1" [ 629.539918][T24234] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:57:01 executing program 1 (fault-call:2 fault-nth:0): r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) 00:57:01 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) [ 629.648183][ T26] audit: type=1400 audit(1589677021.521:1111): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=24228 comm="syz-executor.5" [ 629.720010][T24244] bond0: (slave veth339): Enslaving as an active interface with an up link [ 629.764989][ T26] audit: type=1400 audit(1589677021.521:1112): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=24226 comm="syz-executor.1" [ 629.821746][T24253] FAULT_INJECTION: forcing a failure. [ 629.821746][T24253] name failslab, interval 1, probability 0, space 0, times 0 [ 629.865895][ T26] audit: type=1400 audit(1589677021.771:1113): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=24249 comm="syz-executor.5" [ 629.872996][T24253] CPU: 0 PID: 24253 Comm: syz-executor.1 Not tainted 5.7.0-rc1-next-20200415-syzkaller #0 [ 629.903415][T24253] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 629.913484][T24253] Call Trace: [ 629.916810][T24253] dump_stack+0x188/0x20d [ 629.921295][T24253] should_fail.cold+0x5/0x14 [ 629.925939][T24253] ? setup_fault_attr+0x1e0/0x1e0 [ 629.931086][T24253] should_failslab+0x5/0xf [ 629.935521][T24253] __kmalloc_track_caller+0x2d1/0x7a0 [ 629.940910][T24253] ? lock_downgrade+0x840/0x840 [ 629.945863][T24253] ? proc_pid_attr_write+0x1f1/0x680 [ 629.951186][T24253] ? rcu_read_lock_held+0x9c/0xb0 [ 629.957166][T24253] ? rcu_read_lock_held_common+0x130/0x130 [ 629.963132][T24253] memdup_user+0x22/0xd0 [ 629.967398][T24253] proc_pid_attr_write+0x1f1/0x680 [ 629.972710][T24253] ? proc_loginuid_write+0x490/0x490 [ 629.978454][T24253] __vfs_write+0x76/0x100 [ 629.983330][T24253] vfs_write+0x268/0x5d0 [ 629.987785][T24253] ksys_write+0x12d/0x250 [ 629.992228][T24253] ? __ia32_sys_read+0xb0/0xb0 [ 629.997282][T24253] ? __ia32_sys_clock_settime+0x260/0x260 [ 630.003213][T24253] ? trace_hardirqs_off_caller+0x55/0x230 [ 630.008971][T24253] do_syscall_64+0xf6/0x7d0 [ 630.013507][T24253] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 630.019554][T24253] RIP: 0033:0x45ca29 [ 630.023466][T24253] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 630.043783][T24253] RSP: 002b:00007f14b1252c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 630.052399][T24253] RAX: ffffffffffffffda RBX: 000000000050c7c0 RCX: 000000000045ca29 [ 630.060421][T24253] RDX: 000000000000001b RSI: 0000000020000040 RDI: 0000000000000003 [ 630.068807][T24253] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 630.077045][T24253] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 630.085612][T24253] R13: 0000000000000ce6 R14: 00000000004cf31f R15: 00007f14b12536d4 00:57:02 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x7000000}]) 00:57:02 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000, 0x0, 0x6}]) 00:57:02 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:02 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:57:02 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x152, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) [ 630.284459][ T26] audit: type=1400 audit(1589677022.261:1114): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=24260 comm="syz-executor.5" 00:57:02 executing program 1 (fault-call:2 fault-nth:1): r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) 00:57:02 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:02 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000, 0x0, 0x600}]) 00:57:02 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:57:02 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 630.514387][T24275] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 630.543436][T24278] FAULT_INJECTION: forcing a failure. [ 630.543436][T24278] name failslab, interval 1, probability 0, space 0, times 0 [ 630.612541][T24278] CPU: 1 PID: 24278 Comm: syz-executor.1 Not tainted 5.7.0-rc1-next-20200415-syzkaller #0 [ 630.620456][ T26] audit: type=1400 audit(1589677022.601:1115): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=24277 comm="syz-executor.5" [ 630.622543][T24278] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 630.650897][T24278] Call Trace: [ 630.654200][T24278] dump_stack+0x188/0x20d [ 630.658543][T24278] should_fail.cold+0x5/0x14 [ 630.663133][T24278] ? setup_fault_attr+0x1e0/0x1e0 [ 630.667375][T24286] bond0: (slave veth341): Enslaving as an active interface with an up link [ 630.668169][T24278] should_failslab+0x5/0xf [ 630.668185][T24278] __kmalloc+0x2d9/0x7a0 [ 630.668202][T24278] ? apparmor_setprocattr+0x153/0xf40 [ 630.668217][T24278] ? lock_release+0x800/0x800 [ 630.668240][T24278] apparmor_setprocattr+0x153/0xf40 [ 630.700749][T24278] ? apparmor_task_kill+0x1120/0x1120 [ 630.706142][T24278] ? __mutex_lock+0x458/0x13c0 [ 630.711325][T24278] ? find_held_lock+0x2d/0x110 [ 630.716119][T24278] ? proc_pid_attr_write+0x255/0x680 [ 630.721409][T24278] ? mutex_trylock+0x2c0/0x2c0 [ 630.726203][T24278] security_setprocattr+0xae/0x110 [ 630.731326][T24278] proc_pid_attr_write+0x2ea/0x680 [ 630.736451][T24278] ? proc_loginuid_write+0x490/0x490 [ 630.741740][T24278] __vfs_write+0x76/0x100 [ 630.746106][T24278] vfs_write+0x268/0x5d0 [ 630.750379][T24278] ksys_write+0x12d/0x250 [ 630.754716][T24278] ? __ia32_sys_read+0xb0/0xb0 [ 630.759658][T24278] ? __ia32_sys_clock_settime+0x260/0x260 [ 630.765380][T24278] ? trace_hardirqs_off_caller+0x55/0x230 [ 630.771108][T24278] do_syscall_64+0xf6/0x7d0 [ 630.771235][T24294] tproxy_tg6_check: 10 callbacks suppressed [ 630.771242][T24294] xt_TPROXY: Can be used only with -p tcp or -p udp [ 630.775628][T24278] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 630.775643][T24278] RIP: 0033:0x45ca29 [ 630.775659][T24278] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 630.775667][T24278] RSP: 002b:00007f14b1252c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 630.775687][T24278] RAX: ffffffffffffffda RBX: 000000000050c7c0 RCX: 000000000045ca29 [ 630.833872][T24278] RDX: 000000000000001b RSI: 0000000020000040 RDI: 0000000000000003 [ 630.835952][T24296] xt_TPROXY: Can be used only with -p tcp or -p udp [ 630.842192][T24278] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 630.842201][T24278] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 630.842209][T24278] R13: 0000000000000ce6 R14: 00000000004cf31f R15: 00007f14b12536d4 00:57:02 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:57:02 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000, 0x0, 0x4000}]) [ 631.072119][ T26] audit: type=1400 audit(1589677023.051:1116): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=24297 comm="syz-executor.5" 00:57:03 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x8000000}]) 00:57:03 executing program 1 (fault-call:2 fault-nth:2): r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) 00:57:03 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:03 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x300, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:03 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) [ 631.321110][T24309] FAULT_INJECTION: forcing a failure. [ 631.321110][T24309] name failslab, interval 1, probability 0, space 0, times 0 [ 631.340553][T24310] xt_TPROXY: Can be used only with -p tcp or -p udp [ 631.382873][T24312] xt_TPROXY: Can be used only with -p tcp or -p udp [ 631.397671][T24309] CPU: 0 PID: 24309 Comm: syz-executor.1 Not tainted 5.7.0-rc1-next-20200415-syzkaller #0 [ 631.407577][T24309] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 631.417634][T24309] Call Trace: [ 631.420941][T24309] dump_stack+0x188/0x20d [ 631.425288][T24309] should_fail.cold+0x5/0x14 [ 631.429894][T24309] ? setup_fault_attr+0x1e0/0x1e0 [ 631.434941][T24309] ? lock_downgrade+0x840/0x840 [ 631.439812][T24309] should_failslab+0x5/0xf [ 631.444233][T24309] kmem_cache_alloc+0x44/0x740 [ 631.449018][T24309] audit_log_start+0x2a3/0x7b0 [ 631.453797][T24309] ? audit_serial+0x30/0x30 [ 631.458312][T24309] ? lock_acquire+0x1f2/0x8f0 [ 631.463054][T24309] ? process_measurement+0x68a/0x1750 [ 631.468436][T24309] ? mark_held_locks+0xe0/0xe0 [ 631.473258][T24309] ? deref_stack_reg+0xaa/0xe0 [ 631.478032][T24309] ? __read_once_size_nocheck.constprop.0+0x10/0x10 [ 631.484620][T24309] ? find_held_lock+0x2d/0x110 [ 631.489395][T24309] ? audit_file_mask+0x170/0x170 [ 631.494339][T24309] ? aa_write_access.cold+0x1f/0x1f [ 631.499543][T24309] common_lsm_audit+0xd3/0x1e00 [ 631.504407][T24309] ? ipv6_skb_to_auditdata+0xdc0/0xdc0 [ 631.509952][T24309] ? is_bpf_text_address+0xa9/0x160 [ 631.515171][T24309] ? lock_downgrade+0x840/0x840 [ 631.520042][T24309] ? unwind_next_frame+0xdba/0x19d0 [ 631.525256][T24309] aa_audit+0x20f/0x730 [ 631.529416][T24309] ? audit_file_mask+0x170/0x170 [ 631.534373][T24309] aa_audit_file+0x33f/0x660 [ 631.538975][T24309] ? update_file_ctx+0x210/0x210 [ 631.546596][T24309] ? stack_trace_consume_entry+0x160/0x160 [ 631.552422][T24309] aa_change_hat+0xee7/0x1a60 [ 631.557118][T24309] ? _parse_integer+0x12f/0x180 [ 631.561978][T24309] ? apparmor_bprm_set_creds+0x2370/0x2370 [ 631.567797][T24309] ? simple_strtoull+0xbe/0x110 [ 631.572663][T24309] ? mark_lock+0x12b/0xf10 [ 631.577094][T24309] aa_setprocattr_changehat+0x166/0x313 [ 631.582652][T24309] ? aa_getprocattr+0x1090/0x1090 [ 631.587701][T24309] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 631.593260][T24309] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 631.599305][T24309] ? __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 631.605214][T24309] ? __kmalloc+0x62f/0x7a0 [ 631.609638][T24309] ? apparmor_setprocattr+0x153/0xf40 [ 631.615196][T24309] ? lock_release+0x800/0x800 [ 631.619893][T24309] apparmor_setprocattr+0x7dd/0xf40 [ 631.625107][T24309] ? apparmor_task_kill+0x1120/0x1120 [ 631.630488][T24309] ? __mutex_lock+0x458/0x13c0 [ 631.635262][T24309] ? find_held_lock+0x2d/0x110 [ 631.640036][T24309] ? proc_pid_attr_write+0x255/0x680 [ 631.645335][T24309] ? mutex_trylock+0x2c0/0x2c0 [ 631.650128][T24309] security_setprocattr+0xae/0x110 [ 631.655257][T24309] proc_pid_attr_write+0x2ea/0x680 [ 631.660472][T24309] ? proc_loginuid_write+0x490/0x490 [ 631.665768][T24309] __vfs_write+0x76/0x100 [ 631.670125][T24309] vfs_write+0x268/0x5d0 [ 631.674381][T24309] ksys_write+0x12d/0x250 [ 631.678721][T24309] ? __ia32_sys_read+0xb0/0xb0 [ 631.683490][T24309] ? __ia32_sys_clock_settime+0x260/0x260 [ 631.689400][T24309] ? trace_hardirqs_off_caller+0x55/0x230 [ 631.695141][T24309] do_syscall_64+0xf6/0x7d0 [ 631.699662][T24309] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 631.705568][T24309] RIP: 0033:0x45ca29 [ 631.709470][T24309] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00:57:03 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:57:03 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000, 0x0, 0x1000000}]) [ 631.730119][T24309] RSP: 002b:00007f14b1252c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 631.738544][T24309] RAX: ffffffffffffffda RBX: 000000000050c7c0 RCX: 000000000045ca29 [ 631.746524][T24309] RDX: 000000000000001b RSI: 0000000020000040 RDI: 0000000000000003 [ 631.754506][T24309] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 631.762486][T24309] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 631.770463][T24309] R13: 0000000000000ce6 R14: 00000000004cf31f R15: 00007f14b12536d4 00:57:03 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:03 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:57:03 executing program 1 (fault-call:2 fault-nth:3): r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) [ 631.975085][T24323] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:57:04 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000, 0x0, 0x2000000}]) [ 632.075180][T24333] xt_TPROXY: Can be used only with -p tcp or -p udp [ 632.119028][T24334] bond0: (slave veth343): Enslaving as an active interface with an up link [ 632.148712][T24333] xt_TPROXY: Can be used only with -p tcp or -p udp [ 632.165522][T24342] FAULT_INJECTION: forcing a failure. [ 632.165522][T24342] name failslab, interval 1, probability 0, space 0, times 0 [ 632.191009][T24342] CPU: 1 PID: 24342 Comm: syz-executor.1 Not tainted 5.7.0-rc1-next-20200415-syzkaller #0 [ 632.200925][T24342] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 632.211244][T24342] Call Trace: [ 632.214548][T24342] dump_stack+0x188/0x20d [ 632.218889][T24342] should_fail.cold+0x5/0x14 [ 632.223488][T24342] ? setup_fault_attr+0x1e0/0x1e0 [ 632.228520][T24342] ? mark_lock+0x12b/0xf10 [ 632.232953][T24342] should_failslab+0x5/0xf [ 632.237390][T24342] kmem_cache_alloc_node+0x55/0x760 [ 632.242597][T24342] ? audit_log_start+0x2a3/0x7b0 [ 632.247539][T24342] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 632.253114][T24342] __alloc_skb+0xba/0x5a0 [ 632.257912][T24342] ? __kmalloc_reserve.isra.0+0xe0/0xe0 [ 632.263458][T24342] ? kmem_cache_alloc+0x358/0x740 [ 632.268500][T24342] audit_log_start+0x2c8/0x7b0 [ 632.273276][T24342] ? audit_serial+0x30/0x30 [ 632.277790][T24342] ? lock_acquire+0x1f2/0x8f0 [ 632.282742][T24342] ? process_measurement+0x68a/0x1750 [ 632.289003][T24342] ? mark_held_locks+0xe0/0xe0 [ 632.293773][T24342] ? deref_stack_reg+0xaa/0xe0 [ 632.298661][T24342] ? __read_once_size_nocheck.constprop.0+0x10/0x10 [ 632.305252][T24342] ? find_held_lock+0x2d/0x110 [ 632.310025][T24342] ? audit_file_mask+0x170/0x170 [ 632.314965][T24342] ? aa_write_access.cold+0x1f/0x1f [ 632.320258][T24342] common_lsm_audit+0xd3/0x1e00 [ 632.328555][T24342] ? ipv6_skb_to_auditdata+0xdc0/0xdc0 [ 632.334021][T24342] ? is_bpf_text_address+0xa9/0x160 [ 632.339240][T24342] ? lock_downgrade+0x840/0x840 [ 632.344364][T24342] ? unwind_next_frame+0xdba/0x19d0 [ 632.349575][T24342] aa_audit+0x20f/0x730 [ 632.353738][T24342] ? audit_file_mask+0x170/0x170 [ 632.358699][T24342] aa_audit_file+0x33f/0x660 00:57:04 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 632.367818][T24342] ? update_file_ctx+0x210/0x210 [ 632.372787][T24342] ? stack_trace_consume_entry+0x160/0x160 [ 632.378644][T24342] aa_change_hat+0xee7/0x1a60 [ 632.384556][T24342] ? _parse_integer+0x12f/0x180 [ 632.392802][T24342] ? apparmor_bprm_set_creds+0x2370/0x2370 [ 632.398619][T24342] ? simple_strtoull+0xbe/0x110 [ 632.403485][T24342] ? mark_lock+0x12b/0xf10 [ 632.407922][T24342] aa_setprocattr_changehat+0x166/0x313 [ 632.413484][T24342] ? aa_getprocattr+0x1090/0x1090 [ 632.418700][T24342] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 632.424254][T24342] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 632.430265][T24342] ? __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 632.436344][T24342] ? __kmalloc+0x62f/0x7a0 [ 632.440766][T24342] ? apparmor_setprocattr+0x153/0xf40 [ 632.446142][T24342] ? lock_release+0x800/0x800 [ 632.450835][T24342] apparmor_setprocattr+0x7dd/0xf40 [ 632.456052][T24342] ? apparmor_task_kill+0x1120/0x1120 [ 632.461440][T24342] ? __mutex_lock+0x458/0x13c0 [ 632.466209][T24342] ? find_held_lock+0x2d/0x110 [ 632.470981][T24342] ? proc_pid_attr_write+0x255/0x680 [ 632.476285][T24342] ? mutex_trylock+0x2c0/0x2c0 [ 632.481073][T24342] security_setprocattr+0xae/0x110 [ 632.487061][T24342] proc_pid_attr_write+0x2ea/0x680 [ 632.492185][T24342] ? proc_loginuid_write+0x490/0x490 [ 632.497474][T24342] __vfs_write+0x76/0x100 [ 632.501818][T24342] vfs_write+0x268/0x5d0 [ 632.506071][T24342] ksys_write+0x12d/0x250 [ 632.510412][T24342] ? __ia32_sys_read+0xb0/0xb0 [ 632.515181][T24342] ? __ia32_sys_clock_settime+0x260/0x260 [ 632.520911][T24342] ? trace_hardirqs_off_caller+0x55/0x230 [ 632.526648][T24342] do_syscall_64+0xf6/0x7d0 [ 632.531168][T24342] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 632.537182][T24342] RIP: 0033:0x45ca29 [ 632.541080][T24342] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 632.560695][T24342] RSP: 002b:00007f14b1252c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 632.569113][T24342] RAX: ffffffffffffffda RBX: 000000000050c7c0 RCX: 000000000045ca29 [ 632.577092][T24342] RDX: 000000000000001b RSI: 0000000020000040 RDI: 0000000000000003 [ 632.585078][T24342] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 632.593063][T24342] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 632.601303][T24342] R13: 0000000000000ce6 R14: 00000000004cf31f R15: 00007f14b12536d4 00:57:04 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x3f000000}]) 00:57:04 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:57:04 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000, 0x0, 0x4000000}]) [ 632.775944][T24353] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:05 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x500, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) [ 632.987939][T24353] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:05 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:57:05 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:05 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000, 0x0, 0x6000000}]) [ 633.192271][T24367] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 633.287632][T24377] xt_TPROXY: Can be used only with -p tcp or -p udp [ 633.304613][T24380] bond0: (slave veth345): Enslaving as an active interface with an up link [ 633.350502][T24377] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:05 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:57:05 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000, 0x0, 0x40000000}]) 00:57:05 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) 00:57:05 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:05 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x600, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) [ 633.749778][ T26] kauditd_printk_skb: 9 callbacks suppressed [ 633.749792][ T26] audit: type=1400 audit(1589677025.731:1122): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=24393 comm="syz-executor.1" [ 633.867049][T24401] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:57:05 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x40000000}]) 00:57:05 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:57:05 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10009}, 0x1b) 00:57:05 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:05 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000, 0x0, 0x1000000000000}]) [ 633.938978][T24401] bond0: (slave veth347): Enslaving as an active interface with an up link [ 634.046491][ T26] audit: type=1400 audit(1589677026.021:1123): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=24410 comm="syz-executor.5" 00:57:06 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:06 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x1000a}, 0x1b) 00:57:06 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) [ 634.166434][ T26] audit: type=1400 audit(1589677026.041:1124): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=24409 comm="syz-executor.1" 00:57:06 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10010}, 0x1b) [ 634.320679][ T26] audit: type=1400 audit(1589677026.301:1125): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=24430 comm="syz-executor.1" [ 634.374058][ T26] audit: type=1400 audit(1589677026.351:1126): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=24429 comm="syz-executor.5" [ 634.474062][ T26] audit: type=1400 audit(1589677026.451:1127): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=24435 comm="syz-executor.1" 00:57:06 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x700, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:06 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:06 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) [ 634.714016][ T26] audit: type=1400 audit(1589677026.691:1128): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=24441 comm="syz-executor.5" [ 634.722973][T24444] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 634.824301][T24448] bond0: (slave veth349): Enslaving as an active interface with an up link 00:57:07 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0xeffdffff}]) 00:57:07 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x101b7}, 0x1b) 00:57:07 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000, 0x0, 0x100000000000000}]) 00:57:07 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:57:07 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 635.154039][ T26] audit: type=1400 audit(1589677027.131:1129): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=24461 comm="syz-executor.1" 00:57:07 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x776, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:07 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10300}, 0x1b) 00:57:07 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:57:07 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:07 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000, 0x0, 0x200000000000000}]) [ 635.412150][ T26] audit: type=1400 audit(1589677027.391:1130): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=24477 comm="syz-executor.1" [ 635.439705][T24482] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:57:07 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x1069c}, 0x1b) [ 635.490486][ T26] audit: type=1400 audit(1589677027.421:1131): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=24480 comm="syz-executor.5" 00:57:07 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) [ 635.575289][T24498] bond0: (slave veth351): Enslaving as an active interface with an up link [ 635.795670][T24493] tproxy_tg6_check: 11 callbacks suppressed [ 635.795676][T24493] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:08 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0xfcfdffff}]) 00:57:08 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000, 0x0, 0x400000000000000}]) 00:57:08 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:08 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:57:08 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0xa00, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:08 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x106a0}, 0x1b) [ 636.275580][T24521] xt_TPROXY: Can be used only with -p tcp or -p udp [ 636.298301][T24519] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:57:08 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x2000005b) 00:57:08 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000, 0x0, 0x600000000000000}]) [ 636.357544][T24531] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:08 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:57:08 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 636.466915][T24535] bond0: (slave veth353): Enslaving as an active interface with an up link 00:57:08 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r3, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) [ 636.700820][T24555] xt_TPROXY: Can be used only with -p tcp or -p udp [ 636.892167][T24555] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:08 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0xc00, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) [ 637.098179][T24561] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 637.195612][T24561] bond0: (slave veth355): Enslaving as an active interface with an up link 00:57:09 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0xfefdffff}]) 00:57:09 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$LOOP_SET_CAPACITY(r3, 0x4c07) 00:57:09 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:57:09 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000, 0x0, 0x4000000000000000}]) 00:57:09 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 637.457031][T24584] xt_TPROXY: Can be used only with -p tcp or -p udp [ 637.560829][T24584] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:09 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:09 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0xe00, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:09 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:57:09 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = pidfd_getfd(r3, r0, 0x0) write$apparmor_current(r4, &(0x7f0000000000)=@profile={'permprofile ', '\x84.-\x00'}, 0x10) 00:57:09 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000, 0x0, 0x8000000000000000}]) [ 637.771664][T24596] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:09 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'changehat ', 0x10001, 0x5e, ['vmnet0vboxnet1cgrouplo\x00', 'changehat ']}, 0x3e) [ 637.815610][T24601] xt_TPROXY: Can be used only with -p tcp or -p udp [ 637.842286][T24602] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:57:09 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) [ 637.980493][T24611] bond0: (slave veth357): Enslaving as an active interface with an up link 00:57:10 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0xfffffdef}]) 00:57:10 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:10 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000, 0x0, 0xffffffff00000000}]) 00:57:10 executing program 1: openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) r0 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r0, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r0, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) r1 = socket$inet(0x2, 0x4000000805, 0x0) r2 = socket$inet_sctp(0x2, 0x5, 0x84) r3 = dup3(r1, r2, 0x0) r4 = socket$inet(0x2, 0x4000000805, 0x0) r5 = socket$inet_sctp(0x2, 0x5, 0x84) dup3(r4, r5, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000000240)=[@in={0x2, 0x4e20, @loopback}], 0x10) sendto$inet(r5, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r5, 0x84, 0x1d, &(0x7f0000000280)=ANY=[@ANYBLOB="eeae6d3543005b658b4dd9300cf9d5255106a1f4e86178dd84542ef137c8fba97ebd2e50ca66127d2b993be42dd8dbb4f4f1d5b971831a84fe2e412600ef0e1c8358c0bf35ed800bbc90abb5c6259e746fd9b2f7b51fbfb16d064f6fb172f19f7a390025935f25ce3b150e29c7b1276ce0019859e91a48e51bfb0441a091c8a398fc88f2b86fce542259471ee58611d56ceb23d6872ae8836a110fc9bb21c80f4a5602f118d06c10d86aa0a6a5fca8928ec798860e4e2650f39c72f712f88e67618f6ec695af75daf2d84f7bcd46a440e16bbc5a8b582cbb0cdb59ee0760ca6227bf89", @ANYRES32=0x0, @ANYRES32=0x0], &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r3, 0x84, 0x25, &(0x7f000059aff8)={r6}, &(0x7f000034f000)=0xfeb5) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000000)={0x61c, 0x30, 0xb, 0x101, 0x1f, 0x7, 0x0, 0x4, r6}, 0x20) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) r7 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r7, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) write$apparmor_current(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYRESDEC=r7], 0x1b) 00:57:10 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:57:10 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x2088, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) [ 638.478804][T24629] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:10 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:10 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) [ 638.608216][T24641] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:57:10 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:57:10 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="7065726d686174203078303030303030303030303031303030315e2f70726f632f7468726561642d73656c662f617474722f63757272656e740057fb5b5a1ca85a8c9bc64a34f613b623f39aebe47ab9c38b0efd769ae4b9ecb6d3d6b3b9b74df1cf8a25a8675ca1d6aae9152a17cc8e7cc4b633c3505db80dcab1756f4187058603d65b900a573edcc01fcfb409a8510eb165b077e5338d34272602a76a7cabc13e07d2b01849db35b83ba72cdbd3a501307dc0af9c4b1c77877c6c59fcde4095db52d5716f880cd3306d76d45ab9844124b556684b8c66c060da4a586b2717f6ae5f4562a13d6fb08825254680f37a6d6e"], 0x3a) [ 638.763881][T24650] bond0: (slave veth359): Enslaving as an active interface with an up link [ 638.825594][ T26] kauditd_printk_skb: 14 callbacks suppressed [ 638.825608][ T26] audit: type=1400 audit(1589677030.801:1146): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=24656 comm="syz-executor.5" 00:57:10 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x3c) ptrace$cont(0x18, r1, 0x0, 0x0) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r1, 0x0, 0x0) ptrace$cont(0x20, r1, 0x1, 0x8) 00:57:10 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 638.984021][ T26] audit: type=1400 audit(1589677030.851:1147): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=24661 comm="syz-executor.1" [ 639.065476][ T26] audit: type=1400 audit(1589677031.011:1148): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=24668 comm="syz-executor.1" 00:57:11 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0xfffffdfc}]) 00:57:11 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000, 0x0, 0x0, 0x2}]) 00:57:11 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=ANY=[@ANYBLOB='permhat 0x00000000000!0001^'], 0x1b) 00:57:11 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:57:11 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x3f00, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:11 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 639.574749][ T26] audit: type=1400 audit(1589677031.552:1149): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=24682 comm="syz-executor.5" [ 639.602948][T24689] AppArmor: change_hat: Invalid input '0x00000000000!0001^' [ 639.604138][T24688] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:57:11 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:11 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="7d3dd8d052d999cc3078303030303030303030303031303030315e"], 0x1b) 00:57:11 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) [ 639.774376][T24698] bond0: (slave veth361): Enslaving as an active interface with an up link 00:57:11 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000, 0x0, 0x0, 0x4}]) 00:57:11 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:11 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$GIO_FONTX(r3, 0x4b6b, &(0x7f0000000180)={0x12d, 0x1c, &(0x7f0000001300)}) r4 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000100)='/proc/capi/capi20ncci\x00', 0x501000, 0x0) flistxattr(r4, &(0x7f0000000140)=""/11, 0xb) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000001700)=@profile={'permprofile ', 'Wrw\xbe\xf9\xbf=\xbc\x1fO\xa6\xea\x7fL\xfb/x\xfe\xb1\n\x82hW\xe8\x8b{\xb2!\xed\x89\xdf\xc1\x9ag\xcdb\x1eb\xe6T\n\x87\xd9/\x1b\b\x1cko\x00\x00\x00\x00\x00\x00\x00\x00\x9f3.\xc8\x05B$)\xb8\x9e\x94\xe2S\x12k\x99\xfe\x81\xeeY$HN\x05ax\x02\x80\xac\xc5\x0eK\xa4.^\xe0\xfb\xe4\xad\x1259j\x84<\x1a>\xe4l`\x8e\x99s\xed\xb2\x8c6\xab8\x81\x91\xa2\x9b\xaf\x9a\x84\xd1k\xa6\xd1\x9an&\xf3\xee\x86\xect\bl\x16\xb0\xadp\xd0ho\x9bY\n\x9b\x1f\xa4`t\xf6\x80q\xbdIn\x94y\xe8\xfc\xceZ\x95\xef\xd7\x9f\b%{\x0e\\=\xe0\xf3\xfe\x93\xa9n vR\xc2\xa8j\xb8\x1e\x14obN\xe2\xe4\xe611\x9e\x8a=\xf9'}, 0xe0) r5 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$EBT_SO_SET_ENTRIES(r5, 0x0, 0x80, &(0x7f0000000080)=@filter={'filter\x00', 0xe, 0x5, 0x10b6, [0x0, 0x20000240, 0x20000270, 0x20000426], 0x0, &(0x7f0000000040), &(0x7f0000000240)=[{0x0, '\x00', 0x0, 0xfffffffffffffffc}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{0x5, 0x34, 0x8906, 'gre0\x00', 'syzkaller0\x00', 'macvlan0\x00', 'veth0_virt_wifi\x00', @local, [0x0, 0x0, 0xff, 0xff, 0xff, 0xff], @random="6a9a43840ef5", [0x0, 0xff], 0xae, 0x14e, 0x186, [@time={{'time\x00', 0x0, 0x18}, {{0x276e, 0x9, 0x4e52, 0xcafe, 0x7ff, 0x0, 0x2}}}], [@common=@LED={'LED\x00', 0x28, {{'syz1\x00', 0x0, 0x32, {0x3}}}}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x8000, 'syz1\x00', {0x5}}}}], @common=@mark={'mark\x00', 0x10, {{0xffffffd0, 0x1}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc, 0x2, [{0x11, 0x0, 0x8847, 'veth1_to_bridge\x00', 'batadv_slave_0\x00', 'vcan0\x00', 'veth1_to_bond\x00', @remote, [0xff, 0x101, 0xff, 0x0, 0xff], @remote, [0xff, 0x0, 0xff, 0xff, 0xff], 0x6e, 0x116, 0x166, [], [@common=@nflog={'nflog\x00', 0x50, {{0x7, 0x3ff, 0x0, 0x0, 0x0, "c00de5d2dfca8e9a5a64f461a53c2cc9ddf4287e0ba2a4e9e23d0a29bee28df293bb15ff5e504784ce466e33987ca1b33fc81d36d1a1eb75f3041804d17d0f38"}}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8, {{0x5}}}], @common=@LED={'LED\x00', 0x28, {{'syz0\x00', 0x0, 0x20, {0x8}}}}}, {0x11, 0x21, 0x22eb, 'macvlan0\x00', 'xfrm0\x00', 'dummy0\x00', 'team0\x00', @empty, [0xff, 0x0, 0xff], @local, [0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0x88e, 0x93e, 0xa6e, [@mac={{'mac\x00', 0x0, 0x10}, {{@remote, 0x1}}}, @u32={{'u32\x00', 0x0, 0x7c0}, {{[{[{0x1, 0x2}, {0x0, 0x3}, {0x3f}, {0x8, 0x2}, {0x7fff, 0x3}, {0x6c}, {0x4}, {0x0, 0x2}, {0x2}, {0x3}, {0xfffffffe}], [{0xfffffffa}, {0x2a2b, 0x1}, {0x8}, {0xad79, 0x2}, {0x6, 0x7ac}, {0x5, 0x5}, {0x0, 0x8}, {0x7, 0x1000}, {0x1, 0xfffffffd}, {0x5, 0x2}, {0x8001, 0x80000001}], 0x1, 0xb}, {[{0x7, 0x2}, {0x4, 0x1}, {0x200, 0x1}, {0x9, 0x3}, {0x3}, {0x61}, {0x2}, {0x1, 0x3}, {0x1, 0x1}, {0x3, 0x3}, {0x30000, 0x3}], [{0x7fff, 0x7}, {0x0, 0x400}, {0x4, 0x3}, {0x9, 0x2}, {0x3, 0x2}, {0xbd07, 0x1f}, {0x5, 0x4}, {0x1f, 0x1}, {0x3, 0xf9}, {0x5, 0xeb86}, {0x10001, 0x3}], 0xb, 0x7}, {[{0x1, 0x2}, {0x8, 0x1}, {0xffff}, {0x2, 0x3}, {0x8, 0x1}, {0x200, 0x1}, {0x1f, 0x3}, {0x7}, {0x8}, {0x778}, {0x2, 0x2}], [{0xe77, 0x8}, {0x1f, 0x7}, {0x6, 0x9}, {0x1, 0x2}, {0x1, 0xfff}, {0x1fe2, 0x455}, {0xbf07, 0x2}, {0x2, 0x3}, {0xf71, 0x2}, {0x40, 0xd63c}, {0x1, 0x7}], 0x3, 0x5}, {[{0x1, 0x2}, {0xfff, 0x2}, {0x1, 0x2}, {0x9, 0x2}, {0x0, 0x1}, {0xfffffff7, 0x1}, {0x7ff}, {0x8001, 0x1}, {0x7, 0x2}, {0x80000001, 0x3}, {0x3f, 0x3}], [{0x1, 0x9}, {0x10000, 0x2}, {}, {0x5, 0x81}, {0xfffffffb, 0x4}, {0xffff, 0x4}, {0x5}, {0x1, 0x5}, {0x0, 0x5}, {0x3, 0x7}, {0x1, 0xca}], 0x9, 0xb}, {[{0x80, 0x3}, {0x2, 0x3}, {0x4}, {0x10000, 0x3}, {0x7}, {0x8}, {0xf1, 0x2}, {0x5, 0x2}, {0x1, 0x1}, {0x7, 0x2}, {0x91, 0x3}], [{0xfff, 0x7}, {0xfff, 0x1ff}, {0x392, 0x20}, {0x3, 0x3}, {0x1, 0x9}, {0xffffff00, 0x6}, {0xfff, 0xfffffffa}, {0x9, 0x555b226b}, {0x5, 0x47b}, {0xc3, 0x3ff}, {0x200}], 0x5, 0x6}, {[{0x8}, {0x8}, {0x10000, 0x3}, {0x80000000, 0x2}, {0x7}, {0x7fff, 0x1}, {0x1f}, {0x0, 0x1}, {0x3aa, 0x3}, {0x7f, 0x1}, {0x6, 0x3}], [{0x9, 0xd21}, {0x9, 0xffffffff}, {0xd9, 0xfffffffa}, {0x2, 0x200}, {0x49, 0x2}, {0x101, 0x9}, {0xfa6c, 0x80000001}, {0x2, 0x1}, {0x5, 0x1}, {0x7, 0x1}, {0x0, 0x8}], 0x0, 0xb}, {[{0x2, 0x3}, {0x7fff, 0x1}, {0x4}, {}, {0x2, 0x1}, {0x6, 0x3}, {0x401}, {0x6f}, {0xff, 0x3}, {0x100, 0x2}, {0x5, 0x2}], [{0x7, 0x7fffffff}, {0x1ff, 0x7fff}, {0x9, 0x13b4}, {0x7fffffff, 0x8}, {0x0, 0xab}, {0x1, 0x7ff}, {0xfffffffd, 0xffffffff}, {0x4, 0xeccb}, {}, {0x81}, {0x288, 0x1}], 0x1, 0x2}, {[{0x9, 0x3}, {0xf22, 0x2}, {0x9, 0x2}, {0x2, 0x3}, {0x2, 0x1}, {0x7fff}, {0x5, 0x3}, {0x3, 0x2}, {0x7}, {0x7, 0x3}, {0x7, 0x3}], [{0x6, 0x20}, {0x1, 0x8}, {0x7fffffff, 0x1}, {0x6, 0x1f}, {0x7, 0x6}, {0x362, 0x200}, {0x0, 0x1f}, {0x5, 0xb75}, {0x4, 0x101}, {0x8001, 0x7}, {0x1, 0x3ff}], 0x2, 0xb}, {[{0x9, 0x1}, {0x3, 0x3}, {0x5, 0x2}, {0x6}, {0x2, 0x3}, {0x4, 0x1}, {0x1b9, 0x1}, {0x87, 0x3}, {0x172, 0x2}, {0x1}, {0xfffffffc, 0x1}], [{0x3, 0x80000000}, {0x1000, 0x1f}, {0x101, 0x2}, {0x400, 0xfffffffa}, {0x7fff, 0x4}, {0x7f, 0xffffffff}, {0x800, 0x7}, {0x7fff, 0x7fffffff}, {0x13a56689, 0x4}, {0x7f, 0x6}, {0xffffffff, 0x5}], 0x2, 0x5}, {[{0x7}, {0x5, 0x3}, {0x3f, 0x2}, {0x3, 0x1}, {0x9, 0x1}, {0x7f, 0x3}, {0x2}, {0x4}, {0x3}, {0x19634e87, 0x3}, {0x1, 0x3}], [{0x3, 0x2}, {0x8, 0x7fff}, {0x1000, 0x1}, {0x5, 0x5}, {0x6decbe38, 0xaeb}, {0x2, 0x3}, {0xb418, 0xe0}, {0x80000000, 0x7}, {0x9, 0x6}, {0x9, 0x4}, {0x3, 0x7}], 0x9, 0x6}, {[{0x5}, {0x8}, {0x100, 0x1}, {0x1, 0x1}, {0x6}, {0x6b8b, 0x1}, {0x1, 0x2}, {0x7, 0x3}, {0x4, 0x2}, {0x200000}, {0x7}], [{0x7, 0x4}, {0x2, 0x7fffffff}, {0x4, 0x4}, {0x40, 0x2}, {0x3, 0x7ff}, {0xa1, 0xfffffffd}, {0x1ff, 0x9}, {0x1, 0x4}, {0xc8000000, 0x6}, {0x1, 0x8}, {0x20, 0x10001}], 0x4, 0xa}], 0x2}}}], [@common=@mark={'mark\x00', 0x10, {{0xfffffff0, 0xfffffffffffffffe}}}, @common=@nflog={'nflog\x00', 0x50, {{0x180000, 0x101, 0x7, 0x0, 0x0, "37c0f800fd5023e8cf0b10a7331b99a7ee6874b091187cc8912ccf3854e591a00d76fb23e2401fd18a950606f93bf4a6218276975bc9388294529919c8a0835d"}}}], @common=@SECMARK={'SECMARK\x00', 0x108, {{0x1, 0xfff, 'system_u:object_r:root_t:s0\x00'}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffc, 0x2, [{0x9, 0x4, 0x0, 'syzkaller0\x00', 'geneve0\x00', 'bridge0\x00', 'veth1_to_batadv\x00', @remote, [0xff, 0xff, 0xff], @broadcast, [0x0, 0xff, 0xff], 0x9e, 0xce, 0x146, [@vlan={{'vlan\x00', 0x0, 0x8}, {{0x2, 0x1, 0x88ca, 0x4, 0x6}}}], [@common=@redirect={'redirect\x00', 0x8, {{0xffffffffffffffff}}}], @common=@nflog={'nflog\x00', 0x50, {{0x80000001, 0xf06a, 0x7, 0x0, 0x0, "6fecedb32d633bd55fe0c55df17449cef06dd47828ed4081c47dd05a77f07081865b0d7e64d46c15c1cfaba9d48387117cff810a3337dc3bca3aa2c0408f9670"}}}}, {0x3, 0x6, 0x10, 'ip6erspan0\x00', 'vlan0\x00', 'veth0_macvtap\x00', 'erspan0\x00', @broadcast, [0x0, 0x8739b47f3a6d683a, 0xff, 0xff, 0xff], @local, [0x0, 0x0, 0x0, 0xff, 0xff], 0xde, 0xde, 0x156, [@stp={{'stp\x00', 0x0, 0x48}, {{0x8, {0x19, 0x3f, 0x9, @random="82f79e3aff6c", [0x0, 0xff, 0xff, 0xff], 0x3, 0x2, 0x5, 0x4, @multicast, [0x0, 0x0, 0x0, 0xd8b304b7d84ab9dd, 0xff], 0x4e24, 0x4e24, 0x1ff, 0xffff, 0x1ff, 0x7, 0x7, 0x2a, 0x2, 0x2}, 0x400, 0x800}}}], [], @common=@nflog={'nflog\x00', 0x50, {{0x9, 0x9, 0x1, 0x0, 0x0, "335febf9cd3c7d88482fcf3db0d2c437628e3188d865f57613a05e292be1fb497e8f2865ffe625c8155bab8565604c38d1dcc8eb0cbd83a07261978c864063dd"}}}}]}]}, 0x112e) [ 639.955133][ T26] audit: type=1400 audit(1589677031.932:1150): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=24711 comm="syz-executor.5" [ 640.103545][ T26] audit: type=1400 audit(1589677032.082:1151): apparmor="DENIED" operation="change_profile" info="label not found" error=-2 profile="unconfined" name=577277BEF9BF3DBC1F4FA6EA7F4CFB2F78FEB10A826857E88B7BB221ED89DFC19A67CD621E62E6540A87D92F1B081C6B6F pid=24717 comm="syz-executor.1" [ 640.217469][ T26] audit: type=1400 audit(1589677032.132:1152): apparmor="DENIED" operation="change_profile" info="label not found" error=-2 profile="unconfined" name=577277BEF9BF3DBC1F4FA6EA7F4CFB2F78FEB10A826857E88B7BB221ED89DFC19A67CD621E62E6540A87D92F1B081C6B6F pid=24717 comm="syz-executor.1" 00:57:12 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0xfffffdfe}]) 00:57:12 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x4000, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:12 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:57:12 executing program 1: mq_open(&(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x40, 0x0, &(0x7f0000000080)={0x6, 0x200, 0x3, 0x39000}) r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x3c) ptrace$cont(0x18, r1, 0x0, 0x0) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r1, 0x0, 0x400ffff) getpgid(r1) 00:57:12 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:12 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000, 0x0, 0x0, 0x6}]) [ 640.690929][ T26] audit: type=1400 audit(1589677032.672:1153): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=24732 comm="syz-executor.1" [ 640.745549][T24742] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 640.763980][ T26] audit: type=1400 audit(1589677032.702:1154): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=24733 comm="syz-executor.5" 00:57:12 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:57:12 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:12 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000, 0x0, 0x0, 0x600}]) 00:57:12 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup2(r3, r1) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = syz_genetlink_get_family_id$batadv(&(0x7f00000003c0)='batadv\x00') sendmsg$BATADV_CMD_GET_MESH(r4, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x24, r5, 0x800, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x1000}, @BATADV_ATTR_MULTICAST_FANOUT={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000001}, 0x24000080) r6 = dup2(r2, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f00000005c0)='nl80211\x00') r9 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000140)={'virt_wifi0\x00', 0x0}) connect$rds(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$NL80211_CMD_SET_WIPHY(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x20, r8, 0x11, 0x0, 0x0, {}, [@NL80211_ATTR_IFINDEX={0x8, 0x3, r10}, @NL80211_ATTR_WIPHY_DYN_ACK={0x4}]}, 0x20}}, 0x0) sendmsg$NL80211_CMD_NEW_INTERFACE(r6, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x38, r8, 0x4, 0x70bd26, 0x25dfdbff, {}, [@NL80211_ATTR_WIPHY={0x8}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}, @NL80211_ATTR_IFTYPE={0x8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x800}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20040000}, 0x44000) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) [ 640.938132][T24747] bond0: (slave veth363): Enslaving as an active interface with an up link [ 640.986274][T24759] tproxy_tg6_check: 12 callbacks suppressed [ 640.986281][T24759] xt_TPROXY: Can be used only with -p tcp or -p udp [ 641.019324][ T26] audit: type=1400 audit(1589677033.002:1155): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=24752 comm="syz-executor.5" [ 641.109733][T24767] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:13 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:13 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) [ 641.559836][T24775] xt_TPROXY: Can be used only with -p tcp or -p udp [ 641.583102][T24778] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:13 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0xfffffe00}]) 00:57:13 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x5201, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:13 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="7065726d68617420307930303030303020303f303031303030315e5793dd9dce4be3be16f79a2055992ef0e7ee6009d5828539db7bb894555b68cb394fe68b422c0cd3db98b61322002809e444abc6f7df4aee6d98ae3e2407cfb90e6950dc910ac7364c87d114fbd3c0e3e66964997f3546703313131324a74db2d31e0653a62fbb02bf6ec38c95d4361eaaf5811b8be181d2fa10dfa77038b6c04517b34fb2e4039c0e6e9cfcf8013c5def8b007b2ec5e6495b"], 0x1b) r1 = dup2(r0, 0xffffffffffffffff) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) setsockopt$inet6_IPV6_PKTINFO(r1, 0x29, 0x32, &(0x7f0000000000)={@loopback, r8}, 0x14) 00:57:13 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:13 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:57:13 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000, 0x0, 0x0, 0x4000}]) [ 641.834523][T24783] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 641.900584][T24793] AppArmor: change_hat: Invalid input '0y000000 0?0010001^' [ 641.940189][T24798] xt_TPROXY: Can be used only with -p tcp or -p udp [ 642.076648][T24810] xt_TPROXY: Can be used only with -p tcp or -p udp [ 642.097709][T24793] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'. 00:57:14 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) [ 642.190553][T24797] bond0: (slave veth365): Enslaving as an active interface with an up link [ 642.229674][T24808] bond0: (slave veth3): Enslaving as an active interface with an up link 00:57:14 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000, 0x0, 0x0, 0x1000000}]) 00:57:14 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 642.386186][T24803] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'. [ 642.520950][T24826] xt_TPROXY: Can be used only with -p tcp or -p udp [ 642.579673][T24826] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:14 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:57:14 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x2, 0x5e, ['/proc/thread-self/attr/current\x00', '\x00', '{ppp0\x00', '/proc/thread-self/attr/current\x00', '\x00']}, 0x61) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$TIOCEXCL(r3, 0x540c) r4 = accept(r3, &(0x7f0000001480)=@l2={0x1f, 0x0, @fixed}, &(0x7f0000001500)=0x80) r5 = socket$inet(0x2, 0x4000000805, 0x0) r6 = socket$inet_sctp(0x2, 0x5, 0x84) r7 = dup3(r5, r6, 0x0) r8 = socket$inet(0x2, 0x4000000805, 0x0) r9 = socket$inet_sctp(0x2, 0x5, 0x84) r10 = dup3(r8, r9, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r9, 0x84, 0x64, &(0x7f0000000240)=[@in={0x2, 0x4e20, @loopback}], 0x10) sendto$inet(r9, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r10, 0x84, 0x1d, &(0x7f0000000000)=ANY=[@ANYBLOB="4c1cda869d46a253b18d7f8701f09c40198bfdbef425397e3b0e03ba", @ANYRES32=0x0, @ANYRES32=0x0], &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r7, 0x84, 0x25, &(0x7f000059aff8)={r11}, &(0x7f000034f000)=0xfeb5) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r4, 0x84, 0x1b, &(0x7f0000001540)={r11, 0x8, "3b1ba00d455df048"}, &(0x7f0000001580)=0x10) 00:57:14 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x5865, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) [ 642.766026][T24832] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:57:14 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x7ffffffff000}]) 00:57:14 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000, 0x0, 0x0, 0x2000000}]) 00:57:14 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:14 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) r1 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000080)={0x0, @rand_addr, @multicast2}, &(0x7f0000000100)=0xc) sendto$inet(r1, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r1, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) r2 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r2, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r2, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) setsockopt$EBT_SO_SET_COUNTERS(r2, 0x0, 0x81, &(0x7f0000000300)={'broute\x00', 0x0, 0x0, 0x0, [], 0x8, &(0x7f0000000240)=[{}, {}, {}, {}, {}, {}, {}, {}, {}], 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, 0xf8) ioctl$sock_SIOCGSKNS(r1, 0x894c, &(0x7f0000000000)=0x6) [ 642.874166][T24837] bond0: (slave veth367): Enslaving as an active interface with an up link 00:57:14 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) [ 643.036688][T24855] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:15 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x101000, 0x0) ioctl$NBD_SET_FLAGS(r1, 0xab0a, 0x5) 00:57:15 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) [ 643.257336][T24855] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:15 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x6000, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:15 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:15 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000, 0x0, 0x0, 0x4000000}]) 00:57:15 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$UI_BEGIN_FF_UPLOAD(r3, 0xc06855c8, &(0x7f0000000080)={0xc, 0x7a, {0x55, 0x1ff, 0x8, {0x9, 0x8000}, {0x4, 0xf7}, @const={0x7f, {0x540, 0x3, 0x6, 0xffc0}}}, {0x54, 0x3, 0x4, {0x81, 0x9}, {0x5, 0x70f}, @ramp={0x48, 0x3, {0x2b7, 0x7, 0x9e, 0x6}}}}) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) [ 643.412221][T24870] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 643.541654][T24883] bond0: (slave veth369): Enslaving as an active interface with an up link 00:57:15 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:57:16 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0xf0ffffff7f0000}]) 00:57:16 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:16 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000, 0x0, 0x0, 0x6000000}]) 00:57:16 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x6558, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:16 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:57:16 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000080)=@hat={'permhat ', 0x10001, 0x5e, ['permhat ', '/proc/thread-self/attr/current\x00', 'permhat ', '/proc/thread-self/attr/current\x00', '\'\'/cpuset\x00'/22, '\x00', 'permhat ', '/proc/thread-self/attr/current\x00', '\x00', 'permhat ']}, 0xb0) 00:57:16 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0xf) [ 644.114924][ T26] kauditd_printk_skb: 10 callbacks suppressed [ 644.114938][ T26] audit: type=1400 audit(1589677036.092:1166): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=24902 comm="syz-executor.5" [ 644.180060][T24913] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:57:16 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 644.214026][ T26] audit: type=1400 audit(1589677036.182:1167): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=24905 comm="syz-executor.1" 00:57:16 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000, 0x0, 0x0, 0x40000000}]) 00:57:16 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="7065726d6861742030783030303030303030303030303028c016c3"], 0x1b) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-control\x00', 0x20800, 0x0) ioctl$UI_BEGIN_FF_UPLOAD(r1, 0xc06855c8, &(0x7f0000000100)={0x5, 0x9, {0xaa5eb95dd5e1e0c0, 0x4, 0xc02, {0xfffd, 0x8000}, {0x3, 0x5}, @rumble={0x32d, 0xfffe}}, {0x52, 0x5, 0x81, {0x7, 0x5}, {0x0, 0x100}, @const={0x5, {0x8001, 0x7f, 0x40, 0x1}}}}) r2 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x0, 0x0) ioctl$TCSETAF(r2, 0x5408, &(0x7f0000000080)={0x1c3, 0x2, 0x9, 0x4, 0x2, "ece8ed40470d7544"}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(0xffffffffffffffff, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) r3 = socket$inet(0x2, 0x4000000805, 0x0) r4 = socket$inet_sctp(0x2, 0x5, 0x84) r5 = dup3(r3, r4, 0x0) r6 = socket$inet(0x2, 0x4000000805, 0x0) r7 = socket$inet_sctp(0x2, 0x5, 0x84) dup3(r6, r7, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r7, 0x84, 0x64, &(0x7f0000000240)=[@in={0x2, 0x4e20, @loopback}], 0x10) sendto$inet(r7, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r7, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r5, 0x84, 0x25, &(0x7f000059aff8)={r8}, &(0x7f000034f000)=0xfeb5) setsockopt$inet_sctp_SCTP_SET_PEER_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x5, &(0x7f0000000240)={r8, @in={{0x2, 0x4e22, @broadcast}}}, 0x84) [ 644.362805][T24922] bond0: (slave veth371): Enslaving as an active interface with an up link 00:57:16 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x10) 00:57:16 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 644.368744][T24930] AppArmor: change_hat: Invalid input '0x00000' [ 644.490117][T24938] AppArmor: change_hat: Invalid input '0x0000000000000(ÀÃ' 00:57:17 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0xfeffffffffffff}]) 00:57:17 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x3c) ptrace$cont(0x18, r2, 0x0, 0x0) ptrace$setregs(0xf, r2, 0xfffffffffffffffd, &(0x7f00000000c0)) ptrace$cont(0x20, r2, 0x0, 0x0) ptrace$setregset(0x4205, r2, 0x3, &(0x7f0000000080)={&(0x7f0000000180)="68007748f0d1efc96a9b19bcd3a9517faebef574ea13d942e7d5b557a8ffbb4f19681aa8bf1ddc322d91dd2b5808a0f258ade6c78868e4c4f7a74608794911ff332c1928bdbb1ed48e03e8bb6b3e1f35e6a86ef67e427a8ce5adf2e4a79600680407acf2563b5ac112f69d060f6b5928c71e508fed4171cf3039ec2323ce8fad133505c5aac23eadef45fe50722f9c967546ba824f98818700ff2bc8f6b33d2e8b8f3f61398df8e56933ae29e396373e2db34a67f6a9b68b207187445ef2eca54f0fe54b48f930c54a105e2d1dff72ba64fc2737ebfe8f215b56f2109ddaed64032aa8f7", 0xe4}) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) 00:57:17 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup2(r5, r4) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$KVM_GET_VCPU_EVENTS(r6, 0x8040ae9f, &(0x7f0000000000)) ioctl$VIDIOC_QUERY_EXT_CTRL(r3, 0xc0e85667, &(0x7f0000000080)={0x0, 0x8, "fb93c1e798991a529330ca58e9f4f33ef06a6b03a710392fac35d1859ed98d9d", 0x2, 0x3, 0x0, 0x7917, 0x9, 0x2, 0xfffffff8, 0x0, [0x7, 0x1f, 0x1, 0x800]}) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) 00:57:17 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x7607, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:17 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x2b) 00:57:17 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:17 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 644.645690][T24943] AppArmor: change_hat: Invalid input '0x000000' [ 645.208632][ T26] audit: type=1400 audit(1589677037.192:1168): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=24955 comm="syz-executor.5" [ 645.228362][T24962] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:57:17 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) syz_genetlink_get_family_id$nbd(&(0x7f0000000080)='nbd\x00') io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) r4 = syz_open_dev$audion(&(0x7f00000000c0)='/dev/audio#\x00', 0xda, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, &(0x7f0000000100)={0xffff8001, 0x6, 0x5, 0x1, 0xc3, "08fd180b03d8c6654c15ab9669010ad94161f8", 0x40, 0x8}) 00:57:17 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x34) [ 645.390660][T24970] bond0: (slave veth373): Enslaving as an active interface with an up link [ 645.418108][ T26] audit: type=1400 audit(1589677037.402:1169): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=24956 comm="syz-executor.1" 00:57:17 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r1) r4 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x7, 0x1) sendmsg$NFNL_MSG_CTHELPER_NEW(r4, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x48, 0x0, 0x9, 0x3, 0x0, 0x0, {0x5, 0x0, 0x4}, [@NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0x296d}, @NFCTH_STATUS={0x8}, @NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_POLICY={0xc, 0x4, 0x0, 0x1, {0x8, 0x1, 0x1, 0x0, 0x7}}, @NFCTH_POLICY={0xc, 0x4, 0x0, 0x1, {0x8, 0x1, 0x1, 0x0, 0x80}}]}, 0x48}, 0x1, 0x0, 0x0, 0x24000004}, 0x44004) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$VT_ACTIVATE(r3, 0x5606, 0x5) 00:57:17 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 645.622345][ T26] audit: type=1400 audit(1589677037.602:1170): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=24986 comm="syz-executor.1" [ 645.650505][ T26] audit: type=1400 audit(1589677037.632:1171): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=24983 comm="syz-executor.5" 00:57:17 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x3c) [ 645.981472][ T26] audit: type=1400 audit(1589677037.962:1172): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=24998 comm="syz-executor.5" 00:57:18 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x100000000000000}]) 00:57:18 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:18 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x8100, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:18 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r2, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r2, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) r3 = dup2(0xffffffffffffffff, r2) ioctl$KVM_GET_SREGS(r3, 0x8138ae83, &(0x7f00000002c0)) r4 = socket$inet_udp(0x2, 0x2, 0x0) r5 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r5, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r5, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) connect$inet(r5, &(0x7f0000000080)={0x2, 0x8001, @multicast2}, 0x10) r6 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) 00:57:18 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000080)=""/114) 00:57:18 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x47) [ 646.315867][ T26] audit: type=1400 audit(1589677038.302:1173): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=25006 comm="syz-executor.1" [ 646.394871][T25018] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 646.398809][T25017] tproxy_tg6_check: 11 callbacks suppressed [ 646.398816][T25017] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:18 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$EVIOCGNAME(r3, 0x80404506, &(0x7f0000000040)=""/233) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000000)=@hat={'changehat ', 0x10001}, 0x55) 00:57:18 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x53) [ 646.434112][ T26] audit: type=1400 audit(1589677038.332:1174): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=25007 comm="syz-executor.5" [ 646.548834][T25024] bond0: (slave veth375): Enslaving as an active interface with an up link [ 646.569764][T25032] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:18 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 646.689924][ T26] audit: type=1400 audit(1589677038.672:1175): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=25033 comm="syz-executor.5" 00:57:18 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) socket$rds(0x15, 0x5, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000240)=[@in={0x2, 0x4e20, @loopback}], 0x10) sendto$inet(0xffffffffffffffff, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000480)=ANY=[@ANYBLOB="02000000a5b2c15f217351f1103436294633627b190dc7a967229caa4c17d0c86e014694f27c7ec226d4aa42a4fbeb3a5e77c0955cadbd6e8bb3020e5b371ccf22801601477200f6ffffffffffffff00de290bfd9346ecfc3ab5ff2079f98b07d61cc173161c69b969348fc6a558b5d8f50a69524be1dd85a2a0d618ab16cd8772d8249b339e25e1f95a7ce8773c82b05fb43447b3c70e2fd1a26ac7b14e2d2cf5c77ce19c819a554286759a9b4af949ee06aa4a58a3835fbbde8e831e2179cb101104daa968c29f4d166f72b00b9011c57d8722ec1271045c38285c3c9dcaf49931404185dbf39b3e93e8190b77c01887fb663a759bc9c479ab5c60f692bc78ef5ba27f176398aae0aa9c363bfd09fa61e7eed053075e560c2a2fdca364e0fb94ae6ec9bbd95e996713e6eb318849f613d09ce105fa39db4cb77df34a83c588d5eb598ca007e72a9e69fc9b0c00b2f5ebdccef4e037c3dc73423b341ae500d72de24d4547ce4b24228ef6b07d8e2feb2939b42105b79957dff6a8cb05514bc08ab12ff698c00e5686d2", @ANYRESHEX, @ANYRES32=0x0], &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x25, &(0x7f000059aff8)={r5}, &(0x7f000034f000)=0xfeb5) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000100)={r5, 0x5}, &(0x7f0000000180)=0x8) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000040)='bond_slave_1\x00', 0x10) sendto$inet(r4, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r4, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) ioctl$SIOCGSTAMPNS(r4, 0x8907, &(0x7f0000000080)) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) [ 646.833142][T25041] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:18 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x59) 00:57:18 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0xf000, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) [ 646.932947][T25041] xt_TPROXY: Can be used only with -p tcp or -p udp [ 647.165790][T25050] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 647.252359][T25050] bond0: (slave veth377): Enslaving as an active interface with an up link 00:57:19 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x200000000000000}]) 00:57:19 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$TIOCMIWAIT(r3, 0x545c, 0x0) write$apparmor_current(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="7065726568617420307830303030303030d8c2bb77948e26621b07"], 0x1b) socketpair(0x1f, 0x4, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0)='nl80211\x00') sendmsg$NL80211_CMD_START_AP(r4, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000240)={0xc0, r5, 0x300, 0x70bd27, 0x25dfdbfc, {}, [@NL80211_ATTR_WIPHY={0x8, 0x1, 0x2}, @NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_AKM_SUITES={0xc, 0x4c, [0xfac08, 0xfac04]}, @NL80211_ATTR_TWT_RESPONDER={0x4}, @NL80211_ATTR_PBSS={0x4}, @NL80211_ATTR_BEACON_INTERVAL={0x8, 0xc, 0x7f}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_TX_RATES={0x7c, 0x5a, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x48, 0x3, [@NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HT={0x3c, 0x2, "19ffc11b1b72ed57489786706c289565890ee71593ee5ba984a0c3da6bc0d3b2bcdfb2a69058b0204380068259a00e6371d8923b647f11af"}]}, @NL80211_BAND_2GHZ={0x4}, @NL80211_BAND_6GHZ={0x2c, 0x3, [@NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_LEGACY={0x1d, 0x1, "209636a87140336c99e3e0a3ea9f35ae3bb72e5b3b5c25a0dc"}]}]}]}, 0xc0}, 0x1, 0x0, 0x0, 0x40000000}, 0x4004810) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = dup2(r7, r6) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) ioctl$SNDRV_TIMER_IOCTL_SELECT(r8, 0x40345410, &(0x7f0000000180)={{0x0, 0x1, 0x1, 0x2, 0xffff8001}}) 00:57:19 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:19 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r1, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r1, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) fcntl$lock(r1, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) write$P9_RLOPEN(r3, &(0x7f0000000180)={0x18, 0xd, 0x2, {{0x80, 0x4, 0x8}, 0xe0}}, 0x18) close(r0) write(r0, &(0x7f00000002c0)="501bb9c3b37b9666f74fc6ff286bbd959ffbed1fbfd6c081100fc1d2447c769cbd65ac1c46a8dfd637466f3f843401441fb7d06bb2f4b7938d59506bb9a62143e2ab00c65263d3957940141dd523d3450e9191e26f728c28d830d71cbc15da709bd072f689d9ad9d2298b6b5edaad94e98271beb3b73bc126a30ea7cfd33647393fafbc7823d16c3bbbd8b61ba20", 0x8e) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) r6 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r6, 0x800442d3, &(0x7f0000000100)={0xfffffffa, 0x3, 0x6, @multicast, 'wg1\x00'}) r7 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) io_submit(r4, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) 00:57:19 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x78) [ 647.583360][T25076] xt_TPROXY: Can be used only with -p tcp or -p udp [ 647.659514][T25076] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:19 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x20677, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:19 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x8a) 00:57:19 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) r1 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ocfs2_control\x00', 0x412500, 0x0) getsockopt$kcm_KCM_RECV_DISABLE(r1, 0x119, 0x1, &(0x7f0000000080), 0x4) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) 00:57:19 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:19 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r1 = socket$inet(0x2, 0x6000000000000003, 0x2) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r1, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r1, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f0000000040)={0x0, 0x3, 0x800000, 0x3}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup2(r6, r5) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) setsockopt$TIPC_GROUP_JOIN(r7, 0x10f, 0x87, &(0x7f0000000080)={0x43, 0x0, 0x1}, 0x10) r8 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) io_submit(r3, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) [ 647.924472][T25087] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:57:19 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x96) [ 648.014096][T25096] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:20 executing program 1: prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(0xffffffffffffffff, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) r0 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r0, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r0, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) r1 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r1, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r1, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) splice(r0, &(0x7f0000000000)=0x4, r1, &(0x7f0000000080)=0x8, 0x0, 0x0) [ 648.076520][T25101] bond0: (slave veth379): Enslaving as an active interface with an up link [ 648.104070][T25107] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:20 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x300000000000000}]) 00:57:20 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:20 executing program 4: r0 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r0, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r0, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f00000000c0)=0xfffffffd, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r2 = eventfd(0x7) fcntl$lock(r2, 0x0, &(0x7f0000000080)={0x263899c84c3ea116, 0x0, 0xec77, 0x1}) close(r1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup2(r4, r3) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) sendmsg$AUDIT_GET_FEATURE(r5, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000200)={&(0x7f00000002c0)={0x10, 0x3fb, 0x400, 0x70bd27, 0x25dfdbfd, "", ["", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x8004000}, 0x20000010) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r7 = socket$inet_udp(0x2, 0x2, 0x0) r8 = dup(r7) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) io_submit(r6, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r1, 0x0, 0x7ffffffff000}]) 00:57:20 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000000)=@hat={'permhat ', 0x0, 0x5e, ['\x00', 'permhat ', 'changeprofile ', 'changeprofile ', 'md5sum\x00', '\x00', 'permhat ', '%.\x00', '{\x00', '}&/systemselinux\x00']}, 0x66) 00:57:20 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x20678, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:20 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0xa6) [ 648.610110][T25124] AppArmor: change_hat: Invalid input, NULL hat and NULL magic [ 648.610141][T25121] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:20 executing program 1: openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$apparmor_current(r2, &(0x7f0000000040)=@profile={'stack ', '$\x00'}, 0x8) [ 648.671898][T25130] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:20 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 648.746258][T25132] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:57:20 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) msgsnd(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="cc"], 0x1, 0x0) msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000540)) msgsnd(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='\f'], 0x1, 0x0) msgrcv(0x0, &(0x7f0000000040), 0x8, 0x0, 0x0) msgctl$IPC_STAT(0x0, 0x2, &(0x7f00000002c0)=""/148) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r3, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r3, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) getsockopt$inet_sctp_SCTP_HMAC_IDENT(r3, 0x84, 0x16, &(0x7f0000000080)=ANY=[@ANYBLOB="03088a48945908000300"], &(0x7f00000000c0)=0xa) r4 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) ioctl$sock_SIOCDELDLCI(r0, 0x8981, &(0x7f0000000100)={'xfrm0\x00', 0x5}) 00:57:20 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0xb6) [ 648.897965][T25141] bond0: (slave veth381): Enslaving as an active interface with an up link 00:57:20 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:21 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) r1 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r1, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r1, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) r2 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r2, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r2, &(0x7f0000000080), 0x0, 0x20000800, &(0x7f00000001c0)={0x2, 0xfffc, @local}, 0x10) r3 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r3, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r3, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) r4 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r4, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r4, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) fsetxattr$trusted_overlay_origin(r0, &(0x7f0000000000)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x2, 0x2) [ 649.153892][ T26] kauditd_printk_skb: 7 callbacks suppressed [ 649.153905][ T26] audit: type=1400 audit(1589677041.132:1183): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=25156 comm="syz-executor.5" 00:57:21 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x400000000000000}]) 00:57:21 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x20679, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:21 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:21 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x20000700) 00:57:21 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) r1 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r1, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r1, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) r2 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r2, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r2, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) r3 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r3, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) r4 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x400c043, &(0x7f00000000c0)={0x2, 0x4e21, @empty}, 0x10) sendto$inet(r4, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) write$apparmor_current(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYRES16=r4, @ANYBLOB="8c1c4edb13fc2f6dec19546bc778bb3c7a03f2e42c9f0555afca3716ab2d1213d6c8840da099b56f5960ed21700d33e4f5a8df1e880739f1503585f388cda0e443fc85ebbb3019c254a87e97365244d63e5afdb017a8dcc0cda5553f13b342b0bedb292d0e398bd0db97fcbca99c351cd77c5375", @ANYBLOB="b08922450ed1af10dceeae2e042418b5404452d5757f752af4c78b85b3c37d4b0ac68a88df71b126007b64e748c90d6f904aaa64629a77102528851b01dd4e2a0d880c76eff979c16e401e1c7775f8860842d4cae5d06dba300cb74a856cc4f08f3907e0972c638bc2948fa5a48a1badf302239c67cb5274e72a"], 0x19) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) [ 649.713524][T25180] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 649.791264][ T26] audit: type=1400 audit(1589677041.772:1184): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=25179 comm="syz-executor.5" [ 649.892591][ T26] audit: type=1400 audit(1589677041.872:1185): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=25178 comm="syz-executor.1" [ 649.922883][T25193] bond0: (slave veth383): Enslaving as an active interface with an up link 00:57:21 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x0, 0x200}]) 00:57:21 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$KVM_GET_VCPU_EVENTS(r3, 0x8040ae9f, &(0x7f0000000000)) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) ioctl$sock_rose_SIOCRSCLRRT(0xffffffffffffffff, 0x89e4) 00:57:22 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$inet_sctp_SCTP_HMAC_IDENT(r1, 0x84, 0x16, &(0x7f0000000000)={0xa, [0x401, 0x603, 0xf35, 0x1, 0x401, 0x7, 0x2, 0x8, 0x9, 0x6]}, &(0x7f0000000080)=0x18) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:57:22 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 650.181006][ T26] audit: type=1400 audit(1589677042.162:1186): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=25206 comm="syz-executor.5" 00:57:22 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x2067a, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:22 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:22 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000000)='./file0\x00', 0x30) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) [ 650.652876][T25228] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 650.677817][ T26] audit: type=1400 audit(1589677042.662:1187): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=25220 comm="syz-executor.5" 00:57:22 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x500000000000000}]) 00:57:22 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet(0x2, 0x6000000000000003, 0x6) getsockopt$netrom_NETROM_T4(0xffffffffffffffff, 0x103, 0x6, &(0x7f0000000080), &(0x7f0000000100)=0x4) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r1, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r1, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) r2 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r2, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r2, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) r3 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r3, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) r4 = dup2(r0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000640)=ANY=[@ANYBLOB="20000000000000000a004e24fffffffffe80000000000000000000000000001affff00000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000a004e22000000e6fc02000000000000000000000000000043000000000000000000000000000000000000000000000000000000b6bd6d43e113912d00707f4205366505c8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c33566f722b1b1fee33f6b3594afe0eb963a983957085fed93b5d6ba6e193b31fcd4e0759ff601811cffba14dd6edfc4b061c1d3a32bc65c932098f0df5707e52a5a85a3f41924f4babab06cd1f2025a9fe208146acb5b2803cf5bfbda161ca6f7f7db35ccd31db3039bdb27f70b0ce81823c66c1d663bf8b066bbc0fd76160d91118d3472edb348a06c5e0bc1ff82e1dad5ecdce9e7a07012e967295ccea8e001168b40e624341d29b2039956a67776f1a03c430e4dc7521609d3351961b941372946d69ff1e50a88f3f29942d6ddcea2f5c1f14e1a141f061c2bb6fac6597e705b95164187215c9b84959ff39f8c32137bd45793a3a5af9317f9310058e5946fe1450af0b4860c603c1b86717f9b8e6beae26699f485f37a60c31c4ea713c603464b8b415cee523b5ad8c3d86bb77f8c6e6ca81ad257c01364b75c4e8fec4d8dd17b00a5f2b17eea3908753c291e388b4de66abf7e008e1b2960000000000c9430a789cde820cad60c3c7c923140a5d27e543aef267537f808c8c4ade88797d230f0a8bc813f7b8b42d31094a4a9e32ac30e697d36867d886707ab532455525ae1cbd1a7aec8c668eb95da24dde4ddfe3348b3cdda1deecfc0a5277c20690b56da7f13861cdb81b3774b64eacd0a8785ad604589a33ed9a98dc07201a9829128ca234fe1c2e81e112468f299cba65e82a0b44b6f8c591259f12f0f2b4bd91180c819aa01f"], 0x110) 00:57:22 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$IP_VS_SO_GET_INFO(r1, 0x0, 0x481, &(0x7f0000000080), &(0x7f00000000c0)=0xc) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) io_submit(r2, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) 00:57:22 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 650.809452][T25232] bond0: (slave veth385): Enslaving as an active interface with an up link 00:57:22 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$PPPIOCGFLAGS1(r2, 0x8004745a, &(0x7f0000000240)) sendmsg$RDMA_NLDEV_CMD_STAT_DEL(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x40, 0x1412, 0x20, 0x70bd2a, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_RES_LQPN={0x8}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x4}, @RDMA_NLDEV_ATTR_STAT_COUNTER_ID={0x8, 0x4f, 0x2}, @RDMA_NLDEV_ATTR_STAT_COUNTER_ID={0x8, 0x4f, 0x1}]}, 0x40}, 0x1, 0x0, 0x0, 0x40}, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) move_mount(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', r2, &(0x7f00000001c0)='./file0\x00', 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ttyS3\x00', 0x800, 0x0) r3 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r4, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) [ 650.892519][ T26] audit: type=1400 audit(1589677042.872:1188): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=25239 comm="syz-executor.1" 00:57:23 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:23 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) r1 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r1, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r1, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) r2 = syz_open_dev$rtc(&(0x7f0000000080)='/dev/rtc#\x00', 0x7, 0x20000) close(r2) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) io_submit(r3, 0x200000000000005e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0xffff, r0, 0x0, 0xfffffffffffffff0, 0x8001}]) 00:57:23 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x531002, 0x0) 00:57:23 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x2067b, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:23 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x100000000) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080)='batadv\x00') socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup2(r6, r5) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) accept4$packet(r7, &(0x7f0000002d40)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000002d80)=0x14, 0x0) sendmsg$BATADV_CMD_GET_HARDIF(r3, &(0x7f0000002e40)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000002e00)={&(0x7f0000002dc0)={0x1c, r4, 0x20, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4044}, 0x84) r9 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r9, 0x8912, 0x400200) r10 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r10, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:57:23 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 651.389652][ T26] audit: type=1400 audit(1589677043.372:1189): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=25264 comm="syz-executor.1" [ 651.414304][T25270] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:57:23 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) sendmsg$AUDIT_MAKE_EQUIV(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x28, 0x3f7, 0x4, 0x70bd2d, 0x25dfdbfd, {0x7, 0x7, './file0', './file0'}, ["", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x44080}, 0x81) r0 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r0, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r0, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) ioctl$sock_SIOCGIFBR(r0, 0x8940, &(0x7f0000000240)=@get={0x1, &(0x7f0000000180)=""/124, 0x5}) r1 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="7065726d686174203078303030303030303030303031303030315e2272240dd36431002b270d7937bdf1a70a0754aac1a9a057d4de210c5ea17241d4b0e4ae4ef903aab410a1b15785e03789b37a75647c4a349260bd70d24a223a81dcefb7c78ab82fb938d0c0373f7ccc6d3b70882b58ece050f6157d684a8fae41b94b3041acc79af3002956fe6fff181e2fbc51d2b6f747eb62a984be4d25b6d540f9556d1e0cb4f331be64d604a65e7b957cdc108faaa895ced32c3c2d193498b2bd501da321f95c719fed8a0704f43b524152aeb951b0f09fa992039bea052cf51ccb33"], 0x1b) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r3], 0x44}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3}, [@IFLA_MASTER={0x8}]}, 0x28}}, 0x0) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x24, 0x0, 0x8, 0x70bd26, 0x25dfdbfd, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x7}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r3}]}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x20000015) [ 651.569191][T25278] bond0: (slave veth387): Enslaving as an active interface with an up link [ 651.586346][T25276] tproxy_tg6_check: 14 callbacks suppressed [ 651.586353][T25276] xt_TPROXY: Can be used only with -p tcp or -p udp [ 651.675810][ T26] audit: type=1400 audit(1589677043.662:1190): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=25286 comm="syz-executor.1" 00:57:23 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x700000000000000}]) 00:57:23 executing program 5: socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/userio\x00', 0x208000, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x4) r1 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r1, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r1, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) r2 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r3, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:57:23 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r4, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) getsockopt$IP_VS_SO_GET_TIMEOUT(r2, 0x0, 0x486, &(0x7f0000000100), &(0x7f0000000180)=0xc) sendto$inet(r4, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) ioctl$sock_TIOCOUTQ(r4, 0x5411, &(0x7f0000000080)) io_submit(r1, 0x1, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x0, 0x9}]) 00:57:23 executing program 1: openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x0, &(0x7f00000000c0)={0x6, &(0x7f0000000080)=[{0x1, 0x7f}, {0x8, 0x3f, 0x1f, 0x800}, {0x4, 0x1, 0x0, 0x4}, {0x11, 0x7, 0x81}, {0x4, 0x8, 0x1, 0x4}, {0x4, 0x7, 0x1f, 0x2}]}) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) r0 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm_plock\x00', 0x600681, 0x0) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100)='/dev/nvram\x00', 0x200200, 0x0) ioctl$SNDRV_PCM_IOCTL_WRITEI_FRAMES(r1, 0x40184150, &(0x7f0000000140)={0x0, &(0x7f0000000240)="52a85477c010fcc783dbbc9f508009fd873080ddfb1bd81363b8a5898778fa774507a31339cade988a890ed36efce218aea7d750700a22a2c6555f99102e252ed6cb55d0322a96db8caecddb192bf9e0c9efd15081617794d57931205001081fd3ecf156ac4b16acc895551514b78c2cca2f8c90c35d7581c6ecd30ad3fe81369ab95cf0ac1cde889dba9170f029de36f64561ba5b7db63e209abcdf74d39996db49734bf90b222fd35d84c0a7cf0cccda75de5e8ac815d28c958e6c3abe2a57ed745ebc3753350a81f1f105fee3152d0eb0b7ffd6888da2850b532af092102cd54ae1524e1b64", 0xe7}) write$apparmor_current(r0, &(0x7f0000000000)=@profile={'changeprofile ', 'cgroup\x00'}, 0x15) 00:57:23 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 652.002136][T25300] xt_TPROXY: Can be used only with -p tcp or -p udp [ 652.034805][ T26] audit: type=1400 audit(1589677044.012:1191): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=25294 comm="syz-executor.5" 00:57:24 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) perf_event_open(&(0x7f00000001c0)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_tables_matches\x00') r2 = fsopen(&(0x7f0000000340)='exfat\x00', 0x0) dup3(r1, r2, 0x0) preadv(r2, &(0x7f0000001640)=[{&(0x7f0000000240)=""/185, 0xb9}], 0x1, 0x1) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) 00:57:24 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x2067c, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) [ 652.075423][T25306] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:24 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:24 executing program 5: r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) setsockopt$TIPC_IMPORTANCE(r0, 0x10f, 0x7f, &(0x7f0000000000)=0x1, 0x4) write$apparmor_current(r1, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:57:24 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup2(r5, r4) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000080)=0xb) [ 652.247075][ T26] audit: type=1400 audit(1589677044.232:1192): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=25311 comm="syz-executor.1" [ 652.270644][T25314] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 652.348251][T25314] bond0: (slave veth389): Enslaving as an active interface with an up link [ 652.377400][T25325] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:24 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="06000000009a03e1fa78000000000000000030303031300000315e"], 0x1b) [ 652.408412][T25330] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:24 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) r3 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r3, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r3, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(r3, 0x8982, &(0x7f0000000000)) r4 = syz_open_dev$media(&(0x7f0000000100)='/dev/media#\x00', 0x10001, 0x111000) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r4, 0x84, 0x8, &(0x7f0000000140), &(0x7f0000000180)=0x4) 00:57:24 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x800000000000000}]) 00:57:24 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:24 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000080)=@hat={'changehat ', 0x0, 0x5e, ['/proc/thread-self/attr/current\x00', '\x00']}, 0x3d) write$apparmor_current(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="7065726d686174303030050000037030303031303030315e000000"], 0x1b) 00:57:24 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x2067d, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:24 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0xfffffffffffffffe, 0x5e, ['cpusetmime_type\x00']}, 0x2b) 00:57:24 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x1, 0x3, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) [ 653.068617][T25355] xt_TPROXY: Can be used only with -p tcp or -p udp [ 653.074028][T25354] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:57:25 executing program 1: prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(0xffffffffffffffff, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) [ 653.148104][T25367] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:25 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:25 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$SCSI_IOCTL_GET_IDLUN(r3, 0x5382, &(0x7f0000000180)) r4 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) r9 = dup2(r8, r7) ioctl$PERF_EVENT_IOC_ENABLE(r9, 0x8912, 0x400200) sendmsg$nl_route(r9, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB="1c0000002200200025bd388cb300771900000000000000010000000000000000000400"], 0x1c}, 0x1, 0x0, 0x0, 0x4004}, 0x2404c8c0) r10 = dup2(r6, r5) ioctl$PERF_EVENT_IOC_ENABLE(r10, 0x8912, 0x400200) sendmsg$IPSET_CMD_RENAME(r10, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x2c, 0x5, 0x6, 0x3, 0x0, 0x0, {0x2, 0x0, 0x1}, [@IPSET_ATTR_SETNAME2={0x9, 0x3, 'syz1\x00'}, @IPSET_ATTR_SETNAME2={0x9, 0x3, 'syz0\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40c0}, 0x4000000) r11 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r11, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x2b) [ 653.208420][T25368] bond0: (slave veth391): Enslaving as an active interface with an up link 00:57:25 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setreuid(0x0, r4) syz_mount_image$ext4(&(0x7f0000000080)='ext3\x00', &(0x7f00000000c0)='./file0\x00', 0xa3, 0x3, &(0x7f0000000340)=[{&(0x7f0000000180)="8460c182216a136b2bed3fc6048a4bdd31ad4071bdb818a2be289e1fbf390abb2883228b2814467e56c876aad6dc74d8d51e9470f13857dc91b3fb4982f47e80d69711828dd44582c14b4b95d1883ed9f13fb4faa484aceb41856900cf57ce94aaaac8413084c0b77612ba041ccdf1d25294484cc7d42e9e2f3d796454cef6cc3cca48b71138afb08790d7f887c1477386926e0b3207b3135842240b1d87f441449e33c2370a0383d691b8c07f1f5c68f122c423417b99df57548d08e105f132a41f0bf7f1f269b0f9ca373410aa94eab6af9463abaf715fdd5130e35d7d93cecf78d0c85a9ca0775046ab8beb7457eb6c9a", 0xf2, 0x6}, {&(0x7f0000000100)="68d583fe76233022dfe94b1e1d", 0xd, 0x5}, {&(0x7f00000002c0)="163382c4586f6bf8ac5a9476cd34421afbc5e2ff614ea235c853eddb6fadf3f5b6f6b8ab392c0c300c0e06b256bd9ff8f676c5635ef82f5716677fde721f5cc4ac04786d5fc720ca5a", 0x49, 0x82}], 0x292004, &(0x7f00000003c0)={[{@jqfmt_vfsv1='jqfmt=vfsv1'}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x40}}, {@inode_readahead_blks={'inode_readahead_blks'}}, {@jqfmt_vfsv0='jqfmt=vfsv0'}], [{@subj_role={'subj_role', 0x3d, '}+'}}, {@pcr={'pcr', 0x3d, 0x1c}}, {@uid_gt={'uid>', r4}}, {@smackfsroot={'smackfsroot', 0x3d, '*selfeth0'}}, {@context={'context', 0x3d, 'system_u'}}]}) r5 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) 00:57:25 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r1, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r1, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f0000000240)={0xa10000, 0x5, 0x1, 0xffffffffffffffff, 0x0, &(0x7f0000000180)={0x6000c, 0x80000000, [], @p_u8=&(0x7f0000000100)=0x3}}) ioctl$SG_GET_SG_TABLESIZE(r2, 0x227f, &(0x7f0000000280)) r3 = dup2(r1, r0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x1ff) ioctl$sock_inet6_tcp_SIOCOUTQ(r4, 0x5411, &(0x7f00000002c0)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) symlinkat(&(0x7f0000000000)='./file0\x00', r3, &(0x7f0000000080)='./file0\x00') r5 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="7065726d6ba9d3527c1be03130303030303030303031303030315e"], 0x1b) [ 653.461916][T25383] xt_TPROXY: Can be used only with -p tcp or -p udp [ 653.610104][T25383] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:25 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x2067e, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) [ 653.803068][T25394] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 653.873482][T25394] bond0: (slave veth393): Enslaving as an active interface with an up link 00:57:26 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x3f00000000000000}]) 00:57:26 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) r3 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r3, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r3, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) r4 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r4, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r4, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) r5 = dup2(r3, r4) ioctl$KVM_SET_PIT2(r5, 0x4070aea0, &(0x7f0000000140)={[{0x0, 0x6, 0x3, 0x7f, 0x67, 0x0, 0x6, 0x7, 0x7f, 0x80, 0x8, 0x8, 0x3}, {0x7, 0x3, 0x6, 0x0, 0x4, 0x1f, 0x1, 0x7, 0x40, 0x80, 0x1, 0x1, 0x8}, {0x8, 0x1ff, 0x80, 0x7, 0x8, 0x1, 0xe7, 0x4, 0x0, 0x3d, 0x81, 0x81, 0x7}], 0x1}) getsockname(r1, &(0x7f0000000000)=@ethernet={0x0, @local}, &(0x7f0000000080)=0x80) write$apparmor_current(r2, &(0x7f00000000c0)=ANY=[@ANYBLOB="7065726d686174000000000000000030963030303030303030305e6370757365746d696d655f7479706500d401916567c273d82fb8574b0ec106c74f57944c6b8f7aedd8f03bcc8b7018dad1cc159f30d77a"], 0x6c0) 00:57:26 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:26 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f00000000c0)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup2(r5, r4) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$VIDIOC_SUBDEV_G_SELECTION(r6, 0xc040563d, &(0x7f0000000080)={0x1, 0x0, 0x100, 0x4, {0x6f, 0x20, 0xff, 0x7ff}}) 00:57:26 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) r1 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r1, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r1, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) ioctl$sock_SIOCGIFVLAN_GET_VLAN_REALDEV_NAME_CMD(r1, 0x8982, &(0x7f0000001340)={0x8, 'lo\x00', {'vlan0\x00'}, 0x7}) clock_gettime(0x0, &(0x7f00000012c0)={0x0, 0x0}) futex$FUTEX_WAIT_MULTIPLE(&(0x7f0000000f00)=[{&(0x7f0000000000), 0x2}, {&(0x7f0000000080), 0x1}, {&(0x7f00000000c0)=0x1, 0x2}, {&(0x7f0000000100)=0x1, 0x2}, {&(0x7f0000000140), 0x2}, {&(0x7f0000000180)=0x2}, {&(0x7f00000001c0)}, {&(0x7f0000000240)=0x2, 0x2}, {&(0x7f0000000280)=0x2, 0x1}, {&(0x7f00000002c0)=0x2, 0x1}, {&(0x7f0000000300)}, {&(0x7f0000000340), 0x1}, {&(0x7f0000000380)=0x1}, {&(0x7f00000003c0), 0x6}, {&(0x7f0000000400)=0x1, 0x2}, {&(0x7f0000000440)=0x1, 0x2}, {&(0x7f0000000480), 0x1}, {&(0x7f00000004c0)=0x1, 0x1}, {&(0x7f0000000500)=0x1, 0x2}, {&(0x7f0000000540)}, {&(0x7f0000000580)=0x2, 0x2}, {&(0x7f00000005c0)}, {&(0x7f0000000600), 0x2}, {&(0x7f0000000640)}, {&(0x7f0000000680)=0x1}, {&(0x7f00000006c0)=0x1, 0x2}, {&(0x7f0000000700)=0x2, 0x2}, {&(0x7f0000000740)=0x1, 0x1}, {&(0x7f0000000780)}, {&(0x7f00000007c0)=0x2, 0x2}, {&(0x7f0000000800)=0x2, 0x2}, {&(0x7f0000000840)=0x2, 0x1}, {&(0x7f0000000880)=0x2, 0x1}, {&(0x7f00000008c0)=0x2, 0x2}, {&(0x7f0000000900)=0x2, 0x2}, {&(0x7f0000000940)=0x1, 0x2}, {&(0x7f0000000980)=0x2, 0x1}, {&(0x7f00000009c0)=0x1, 0x2}, {&(0x7f0000000a00)=0x1, 0x1}, {&(0x7f0000000a40), 0x2}, {&(0x7f0000000a80)=0x2}, {&(0x7f0000000ac0)=0x2}, {&(0x7f0000000b00)=0x2, 0x2}, {&(0x7f0000000b40)}, {&(0x7f0000000b80)=0x1}, {&(0x7f0000000bc0)=0x1}, {&(0x7f0000000c00), 0x2}, {&(0x7f0000000c40)=0x1, 0x2}, {&(0x7f0000000c80)=0x2, 0x2}, {&(0x7f0000000cc0)=0x2, 0x6}, {&(0x7f0000000d00)}, {&(0x7f0000000d40)=0x2}, {&(0x7f0000000d80), 0x2}, {&(0x7f0000000dc0)}, {&(0x7f0000000e00)=0x1}, {&(0x7f0000000e40)=0x1, 0x2}, {&(0x7f0000000e80)=0x2, 0x1}, {&(0x7f0000000ec0)}], 0xd, 0x3a, &(0x7f0000001300)={r2, r3+60000000}, 0x0, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) [ 654.154542][T25417] xt_TPROXY: Can be used only with -p tcp or -p udp [ 654.209095][ T26] kauditd_printk_skb: 4 callbacks suppressed [ 654.209107][ T26] audit: type=1400 audit(1589677046.193:1197): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=25407 comm="syz-executor.1" 00:57:26 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x2067f, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:26 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:26 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) r1 = syz_open_dev$vcsu(&(0x7f0000000100)='/dev/vcsu#\x00', 0x5, 0x19f000) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_MEDIA_SET(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)={0x14, r2, 0x1, 0x0, 0x0, {0x12}}, 0x14}}, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r1, &(0x7f0000000500)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000240)={0x28c, r2, 0x1, 0x70bd2b, 0x25dfdbfe, {}, [@TIPC_NLA_SOCK={0x18, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x5}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x5}]}]}, @TIPC_NLA_MEDIA={0x40, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}]}]}, @TIPC_NLA_BEARER={0xc, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x3f}]}, @TIPC_NLA_SOCK={0x38, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x7fff}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xff}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x2}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x2}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xa437}]}, @TIPC_NLA_SOCK_ADDR={0x8}]}, @TIPC_NLA_MEDIA={0x30, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x401}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10000}]}, @TIPC_NLA_MEDIA_PROP={0x4}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_PUBL={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8}]}, @TIPC_NLA_NODE={0x24, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x280e}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_LINK={0xac, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x40}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x25}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf884}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xd7}]}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2b}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}]}]}, @TIPC_NLA_PUBL={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0xab}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x289}]}, @TIPC_NLA_LINK={0xbc, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x40}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xc2fb}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x800}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}]}]}, 0x28c}, 0x1, 0x0, 0x0, 0x40004}, 0x20008085) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup2(r6, r5) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(r7, 0x80045700, &(0x7f00000000c0)) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x4) dup2(r8, r4) getsockopt$inet6_tcp_int(r8, 0x6, 0x6, &(0x7f0000000000), &(0x7f0000000080)=0x4) 00:57:26 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socket$nl_xfrm(0x10, 0x3, 0x6) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x100000000000c333, &(0x7f0000000180)=0x0) ftruncate(r2, 0x48280) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) io_submit(r3, 0x0, &(0x7f0000000180)) 00:57:26 executing program 5: setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(0xffffffffffffffff, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) r0 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r0, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r0, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup2(r4, r3) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f00000000c0)={@remote, @remote, 0x0}, &(0x7f0000000100)=0xc) sendmsg$NL80211_CMD_SET_MPATH(r5, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x48, r6, 0x300, 0x70bd27, 0x25dfdbfe, {}, [@NL80211_ATTR_MAC={0xa, 0x6, @remote}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r7}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @random="0858cd083e27"}, @NL80211_ATTR_WDEV={0xc, 0x99, {0xffffffc1, 0x2}}]}, 0x48}, 0x1, 0x0, 0x0, 0x51}, 0x20004814) r8 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r8, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) [ 654.512264][T25428] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 654.542440][ T26] audit: type=1400 audit(1589677046.523:1198): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=25427 comm="syz-executor.1" 00:57:26 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = accept4$bt_l2cap(r3, &(0x7f0000000100)={0x1f, 0x0, @fixed}, &(0x7f0000000140)=0xe, 0x800) ioctl$sock_SIOCSIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r4, 0x8983, &(0x7f0000000180)) r5 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000000)=[{0x28, 0x0, 0x0, 0xfffff034}, {0x80000006}]}, 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = fcntl$dupfd(r7, 0x0, r6) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) r9 = socket$kcm(0xa, 0x5, 0x0) sendmsg(r9, &(0x7f0000000400)={&(0x7f0000000140)=@in6={0xa, 0x0, 0x0, @loopback={0x0, 0x7ffff000}}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000000)="be", 0x246c3}], 0x1}, 0x60) select(0x40, &(0x7f00000000c0)={0x5d, 0x100, 0xfff, 0xca6, 0x1, 0x7, 0xfffffffffffffffb, 0x1}, &(0x7f00000001c0)={0x6, 0x3, 0xfffffffffffff001, 0x7, 0xa0, 0x4, 0xffff, 0x5}, &(0x7f0000000240)={0x100, 0x40, 0x7, 0x6, 0x3, 0x6, 0x2, 0xea1d}, &(0x7f0000000280)={0x77359400}) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) 00:57:26 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 654.708577][T25443] bond0: (slave veth395): Enslaving as an active interface with an up link [ 654.781239][ T26] audit: type=1400 audit(1589677046.763:1199): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=25433 comm="syz-executor.5" 00:57:27 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x4000000000000000}]) 00:57:27 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$SG_GET_REQUEST_TABLE(r2, 0x2286, &(0x7f00000002c0)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r3) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r5 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r5, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r5, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) getsockopt$inet_sctp_SCTP_RECVNXTINFO(r5, 0x84, 0x21, &(0x7f0000000080), &(0x7f00000000c0)=0x4) r6 = socket$inet_udp(0x2, 0x2, 0x0) r7 = dup(r6) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) io_submit(r4, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r3, 0x0, 0x7ffffffff000}]) 00:57:27 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:27 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x20680, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:27 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = syz_open_dev$dri(&(0x7f0000000100)='/dev/dri/card#\x00', 0xfffffffffffffff9, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r1, 0x4010640d, &(0x7f0000000040)={0x1}) r2 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) write$apparmor_current(0xffffffffffffffff, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x2b) 00:57:27 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) r4 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r4, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r4, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) close(r4) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) [ 655.356865][T25461] syz-executor.1 (25461) used greatest stack depth: 21888 bytes left 00:57:27 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 655.426209][T25476] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:57:27 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(0xffffffffffffffff, &(0x7f0000000080), 0x0, 0x0, &(0x7f00000001c0), 0x10) r1 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r1, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r1, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup2(r3, r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup2(r6, r5) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) ioctl$ION_IOC_ALLOC(r4, 0xc0184900, &(0x7f00000005c0)={0xfffffffffffff52f, 0x0, 0x1, r7}) io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x6, &(0x7f0000000640)={0xff0, &(0x7f0000000000)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff, r4, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r8]}, 0xa) write$apparmor_current(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="7065728a686174203078303012a816eb303830303031303030315e7579d38c38afb33ccd298d2a7d8fa01461f86be9d2a688f2a725f59ad7dbcd3dad8449ee7607c10f00551f62db3119d843536bd4b4a3d822e14d634e0a33bbed2de6948ade0db1d9fbc6f5c34e1bbfe2a8ce69d02719bd13f76e1c9b5f93dd61bd8ea261c1155a5471a37d437c1e36da1e10f450a23f5deb76388d5b9e2543e49d75619a8cd76829995b882078dee8c729"], 0x1b) 00:57:27 executing program 5: socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x0, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x6) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat '}, 0x1b) [ 655.548328][T25485] bond0: (slave veth397): Enslaving as an active interface with an up link 00:57:27 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:27 executing program 5: socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) r1 = dup(r0) r2 = add_key$user(&(0x7f00000000c0)='user\x00', &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000340)="585ccbe4ed83b836c1a6474914dc55e72206297b6895b66147b3c7218a9169a85ea0bdc9e1587a050000000000000042e33089754c8107c3cd3923dd4a71c2ff06007b6b4816122d2550829eaa9435c99926022b8753a188748c569f435fb3bae96efb74b50ec93c152f5e8e198a29e5c0d0c60000ce0637ce003d661ff5ff70e48884ca000018cea71fcfacf40d32e4b58a8d2725561f6110fd7b06f90b5274cc5c1e298a16324fe27da2a9d5ba9ff3c009d308bd73f4772539", 0x2b2, 0xfffffffffffffffe) r3 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000180)={'syz', 0x2}, &(0x7f0000000500)='\x00', 0x1, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000200)={r3, r2, r2}, &(0x7f0000000400)=""/226, 0xe2, &(0x7f0000000240)={&(0x7f0000000080)={'crc32c-generic\x00'}}) keyctl$describe(0x6, r2, &(0x7f0000000080)=""/141, 0x8d) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = syz_open_dev$mouse(&(0x7f00000001c0)='/dev/input/mouse#\x00', 0x98, 0x2000) perf_event_open(&(0x7f0000000280)={0x3, 0x70, 0x9, 0x3, 0x40, 0x0, 0x0, 0x7, 0x124, 0x4, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x2, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x2, @perf_config_ext={0x3, 0x3}, 0x402, 0xffff, 0x8, 0x9, 0x3, 0x382, 0x41}, 0xffffffffffffffff, 0x1, r6, 0x1) r7 = dup2(r5, r4) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) setsockopt$pppl2tp_PPPOL2TP_SO_LNSMODE(r7, 0x111, 0x4, 0x1, 0x4) r8 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r8, &(0x7f0000000040)=ANY=[@ANYBLOB='changepro\a\x00\x00\x00\x00\x00\x00\x00setmime_type\x00'], 0x1e) [ 655.795896][T25500] AppArmor: change_hat: Invalid input, NULL hat and NULL magic [ 655.868608][ T26] audit: type=1400 audit(1589677047.853:1200): apparmor="DENIED" operation="setprocattr" info="current" error=-22 profile="unconfined" pid=25490 comm="syz-executor.1" 00:57:27 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x20681, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) [ 656.079232][T25510] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:57:28 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0xeffdffffffffffff}]) 00:57:28 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) r1 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) r2 = syz_open_dev$vcsu(&(0x7f0000000080)='/dev/vcsu#\x00', 0x92, 0x8000) ioctl$TCSBRK(r2, 0x5409, 0x2) sendto$inet(r1, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r1, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) setsockopt$llc_int(0xffffffffffffffff, 0x10c, 0x8, &(0x7f0000000000)=0x71, 0x4) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) 00:57:28 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:28 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$AUDIT_GET_FEATURE(r3, &(0x7f0000000f80)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000f40)={&(0x7f00000002c0)={0x10, 0x3fb, 0x300, 0x70bd2d, 0x25dfdbfe, "", ["", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x44}, 0x5) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) socket$inet_udp(0x2, 0x2, 0x0) r6 = dup(0xffffffffffffffff) write$binfmt_elf32(r4, &(0x7f0000000540)={{0x7f, 0x45, 0x4c, 0x46, 0x1, 0xfb, 0x7f, 0x6, 0x69, 0x3, 0x6, 0x4, 0x23c, 0x38, 0x16e, 0x19a6, 0xff, 0x20, 0x1, 0x1, 0xf86}, [{0x3, 0x2, 0xffffffff, 0x4, 0xfff00000, 0x80, 0x9, 0x5}, {0x3, 0x9, 0x7fffffff, 0x3, 0x7, 0x26d2, 0xffffffff, 0x1}], "75856f2aa42d87bac74d6c605d8a044a8ef8017680d86326cca04398513b0a9d6e9ea52400fdead7f739049661b428e4c661b64f2e772289286c7af27866d6c2202dda1b0da099ea0bf252931164b42bd35e2ddf3f2ef3af791ba8972a86504e7402db", [[], [], [], [], [], [], [], [], []]}, 0x9db) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) io_submit(r5, 0x1, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x0, 0x3}]) r7 = add_key$user(&(0x7f00000000c0)='user\x00', &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000340)="585ccbe4ed83b836c1a6474914dc55e72206297b6895b66147b3c7218a9169a85ea0bdc9e1587a050000000000000042e33089754c8107c3cd3923dd4a71c2ff06007b6b4816122d2550829eaa9435c99926022b8753a188748c569f435fb3bae96efb74b50ec93c152f5e8e198a29e5c0d0c60000ce0637ce003d661ff5ff70e48884ca000018cea71fcfacf40d32e4b58a8d2725561f6110fd7b06f90b5274cc5c1e298a16324fe27da2a9d5ba9ff3c009d308bd73f4772539", 0x2b2, 0xfffffffffffffffe) r8 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000180)={'syz', 0x2}, &(0x7f0000000500)='\x00', 0x1, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000200)={r8, r7, r7}, &(0x7f0000000400)=""/226, 0xe2, &(0x7f0000000240)={&(0x7f0000000080)={'crc32c-generic\x00'}}) openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000100)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) keyctl$invalidate(0x15, r8) 00:57:28 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="7065726c686174203078303030303030303030303030303030305e63705f7479706500b471139a878fe77905ae02193008dbcdade7db5f24613bf587bc0d7194d7b9ff92c9243406dd1758556fccebd97a1cdda55505ae6c005b1684f4fd0af749ca2ef9eee43b5a57bc02faf2cc0673940af3d79ca974387c8d6a836913a5f60000000000000000"], 0x6c0) [ 656.251271][T25518] bond0: (slave veth399): Enslaving as an active interface with an up link [ 656.316478][ T26] audit: type=1400 audit(1589677048.303:1201): apparmor="DENIED" operation="setprocattr" info="current" error=-22 profile="unconfined" pid=25524 comm="syz-executor.5" 00:57:28 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) ioctl$SIOCX25SDTEFACILITIES(r1, 0x89eb, &(0x7f0000000000)={0x8, 0x9, 0x80, 0x5, 0x95, 0x23, 0x1e, "e627d28bd780887988af02c6bd608d3920e80e18", "d6b99e4de645b9bd85a95de22656cefcfa532241"}) [ 656.398871][ T26] audit: type=1400 audit(1589677048.343:1202): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=25525 comm="syz-executor.1" 00:57:28 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) nanosleep(&(0x7f0000000000)={r1, r2+10000000}, &(0x7f0000000080)) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) setsockopt$bt_l2cap_L2CAP_CONNINFO(0xffffffffffffffff, 0x6, 0x2, &(0x7f0000000140)={0x9, "6a050b"}, 0x6) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) clock_nanosleep(0x6, 0x1, &(0x7f00000000c0)={0x0, 0x3938700}, &(0x7f0000000100)) r3 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r3, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r3, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) recvfrom$inet(r3, &(0x7f0000000180)=""/76, 0x4c, 0x40, &(0x7f0000000240)={0x2, 0x4e22, @local}, 0x10) 00:57:28 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$inet(0x2, 0x4000000805, 0x0) r5 = socket$inet_sctp(0x2, 0x5, 0x84) r6 = dup3(r4, r5, 0x0) r7 = socket$inet(0x2, 0x4000000805, 0x0) r8 = socket$inet_sctp(0x2, 0x5, 0x84) dup3(r7, r8, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r8, 0x84, 0x64, &(0x7f0000000240)=[@in={0x2, 0x4e20, @loopback}], 0x10) sendto$inet(r8, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r8, 0x84, 0x1d, &(0x7f00000002c0)=ANY=[@ANYBLOB="00000000f89d9d5e73ad57b9059786c54377713f1676288df6ae84b9cd01de9b262f3545132df37d43810dead4194146b75167ed51732c8c0bdc8227ee7fe56b0e56d23c4e24958f4bd8c4bb98d7f587dcc76739d96cdaf1181700202871eb7e61dad7d69b2021117223f397b6294a590d8c20a079d3f1e283289f31b2124c23f0fa017661cb436b0f1057f10a1c7923952c42d4f554000000000000009c806d795f993ad7aa67cbd7c70695451e25774f6d4fac7e67e5afa565b0d5bf93ecda88d6edffdd293ab4598332911fae5915cfc7b40daeab5175b46ee4807134fe29c3fbeb1937a008000000ddd522e9aadc2d8404c1384115348552ddc0bcdd7b968ac8cf02af59945c9e5b0a0d12ceb76b846f00008bf07b2575d8f70852", @ANYRES32=0x0, @ANYRES32=0x0], &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r6, 0x84, 0x25, &(0x7f000059aff8)={r9}, &(0x7f000034f000)=0xfeb5) getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000080)={0x0, 0xffff, 0x5, 0x899, 0x5, 0x7, 0x5, 0x6, {r9, @in6={{0xa, 0x4e21, 0x7, @ipv4={[], [], @multicast2}, 0x9}}, 0x0, 0x40000000, 0xfffffff6, 0x1, 0x3}}, &(0x7f0000000180)=0xb0) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) [ 656.552990][ T26] audit: type=1400 audit(1589677048.533:1203): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=25539 comm="syz-executor.5" 00:57:28 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:28 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x20682, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:28 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x4, &(0x7f00000000c0)={0xffffffffffffffff}, 0x106, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f0000000180)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000080), r3, 0x0, 0x2, 0x4}}, 0x20) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r4) unshare(0x22000080) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) r7 = dup(r6) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) io_submit(r5, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r4, 0x0, 0x7ffffffff000}]) 00:57:28 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) bind$bt_l2cap(r2, &(0x7f0000000100)={0x1f, 0x0, @none}, 0xe) listen(r2, 0x0) setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f0000000000)={0xfff6ffff, 0x401}, 0x8) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000080)=[0x8, 0x753]) close(r2) r3 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r3, &(0x7f0000000380)=ANY=[@ANYBLOB="7065726d68617420307830303030303030f23c7c31daacb13030300830303030305e6370757365746d496d655f747970650099dba8d611a9ae787426451b2ff8cfa7a9bf02abea57075c41937335ed2d000eb91e89df398e446f3e39a0695e227870c3b1884a1544ca57c348daaea774bbf22a3cc94500e180fbc995e871eee48592331e3da21f1efe0cb1254ba9e4cafeed48b3336797c715bb14125d941a6a995c594405363c2b74014d3c8245fed34a45c55bb92a2b75736ace84ff0db6f5cc10a1cc96d185b05a2ce33a603e2457e461a37b6bcd473dd9e725247a48ff625901000000680400e2094f2acfd67593b0cd2ef1f0583ba4e9f831eb12764a6a822dcf8278fb0c1732defb0a2d4981cb78048fce4a175cda42fc1faeef44a12f5f2186e4c4183a5e656ba432123a2c62503d06983780997703afe05188ccd6abdb18c9dd45408bb9d75552797b467c7312f37f613f008e97b0cad2d33a4fe7ba58c9a109588549aebc3665d07c2b951a13440b93ce0a650604ba0eb289fb87419cafe14bbc6952eb88a77acd8da598590ba5ba87e18245e880257a3e686965e657ac61a212b56f4e52edf0b8"], 0x6c0) r4 = shmget$private(0x0, 0x600000, 0x0, &(0x7f0000000000/0x600000)=nil) shmat(r4, &(0x7f0000000000/0x13000)=nil, 0x4000) r5 = shmat(r4, &(0x7f00000a6000/0x3000)=nil, 0x4800) shmdt(r5) r6 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) dup2(r8, r7) [ 656.739862][T25550] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 656.810855][T25556] tproxy_tg6_check: 13 callbacks suppressed [ 656.810862][T25556] xt_TPROXY: Can be used only with -p tcp or -p udp [ 656.912031][T25558] bond0: (slave veth401): Enslaving as an active interface with an up link [ 656.914564][T25564] AppArmor: change_hat: Invalid input '0x0000000ò<|1Ú¬±00000000^cpusetmIme_type' [ 656.934358][T25556] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:29 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0xfcfdffffffffffff}]) 00:57:29 executing program 4: setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(0xffffffffffffffff, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x89e1, &(0x7f0000000000)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = gettid() ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x3c) ptrace$cont(0x18, r4, 0x0, 0x0) ptrace$setregs(0xd, r4, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r4, 0x0, 0x0) ptrace$setopts(0x4206, r4, 0x4, 0x10) io_submit(r1, 0x0, &(0x7f0000000040)) 00:57:29 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:29 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup2(r4, r3) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r5, 0x4000000) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:57:29 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0xf0ffff, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) [ 657.364933][T25580] xt_TPROXY: Can be used only with -p tcp or -p udp [ 657.387667][ T26] audit: type=1400 audit(1589677049.373:1204): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=25576 comm="syz-executor.5" 00:57:29 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) preadv(r3, &(0x7f0000002600)=[{&(0x7f0000000240)=""/244, 0xf4}, {&(0x7f0000000080)=""/12, 0xc}, {&(0x7f00000000c0)=""/100, 0x64}, {&(0x7f0000000340)=""/220, 0xdc}, {&(0x7f0000000440)=""/163, 0xa3}, {&(0x7f0000000500)=""/4096, 0x1000}, {&(0x7f0000000180)=""/83, 0x53}, {&(0x7f0000001500)=""/58, 0x3a}, {&(0x7f0000001540)=""/172, 0xac}, {&(0x7f0000001600)=""/4096, 0x1000}], 0xa, 0x1) r5 = dup2(r4, r2) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$SIOCX25GDTEFACILITIES(r5, 0x89ea, &(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x4001fc) r6 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r6, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) [ 657.431811][T25585] xt_TPROXY: Can be used only with -p tcp or -p udp [ 657.458088][ T26] audit: type=1400 audit(1589677049.413:1205): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=25541 comm="syz-executor.1" [ 657.530706][T25588] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:57:29 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) r1 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r1, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r1, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) r2 = accept4(r1, &(0x7f0000000080)=@ipx, &(0x7f0000000000)=0x80, 0x80800) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r2, 0x84, 0xc, &(0x7f0000000100)=0xdde, 0x4) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@profile={'changeprofile ', '\x00'}, 0xf) 00:57:29 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r9, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r9], 0x44}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r9}, [@IFLA_MASTER={0x8, 0xa, r5}]}, 0x28}}, 0x0) ioctl$sock_SIOCDELRT(r1, 0x890c, &(0x7f00000000c0)={0x0, @ethernet={0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, @ax25={0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x1}, @xdp={0x2c, 0x4, r9, 0x7}, 0x101, 0x0, 0x0, 0x0, 0x9, &(0x7f0000000080)='geneve0\x00', 0xffffffff, 0x5, 0xc739}) setsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000000180)={@mcast1, r10}, 0x14) r11 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r11, 0x8912, 0x400200) io_submit(r3, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) 00:57:29 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 657.663800][T25594] bond0: (slave veth403): Enslaving as an active interface with an up link [ 657.720299][ T26] audit: type=1400 audit(1589677049.703:1206): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=25590 comm="syz-executor.5" [ 657.727837][T25603] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 657.811798][T25611] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:30 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) sendto$inet(0xffffffffffffffff, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$inet(0x2, 0x4000000805, 0x0) r5 = socket$inet_sctp(0x2, 0x5, 0x84) r6 = dup3(r4, r5, 0x0) r7 = socket$inet(0x2, 0x4000000805, 0x0) r8 = socket$inet_sctp(0x2, 0x5, 0x84) dup3(r7, r8, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r8, 0x84, 0x64, &(0x7f0000000240)=[@in={0x2, 0x4e20, @loopback}], 0x10) sendto$inet(r8, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f00000002c0)={0x4, [0x0, 0x0, 0x0, 0x0]}, &(0x7f0000000280)=0x14) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r6, 0x84, 0x25, &(0x7f000059aff8), &(0x7f000034f000)=0xfeb5) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r3, 0x84, 0x6c, &(0x7f0000000080)={0x0, 0x77, "e4bbb9e0218e50dc5c326c406a23b58fa3ed2908b9b5adb376b20de3e1a86e244cbda938bcf996073ec5e32004cfefa1a96f468954ee927723493c634bf6666e858e0818887fabe4f0e5c3d61f2065ac0171ab0d7b8d942222d0f41a36ae71b57a57118a8fa390d8010ece846a164f02602b6a1dd78570"}, &(0x7f0000000000)=0x7f) getsockopt$inet_sctp_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, &(0x7f0000000100)={r9, 0x2}, &(0x7f0000000140)=0x8) [ 657.961517][T25621] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:30 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:30 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) [ 658.199819][T25608] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 658.352500][T25635] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:30 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0xfefdffffffffffff}]) 00:57:30 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x1000000, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:30 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) socketpair(0xb, 0x5, 0x7, &(0x7f0000000080)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) epoll_create1(0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$IPSET_CMD_SAVE(r3, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000000c0)={&(0x7f0000000240)={0x44, 0x8, 0x6, 0x201, 0x0, 0x0, {0xc, 0x0, 0x1}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x2004088d}, 0x48841) write$apparmor_current(r0, &(0x7f0000000040)=@profile={'changeprofile ', 'permhat '}, 0x16) [ 658.404094][T25638] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:30 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup2(r3, r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$PPPIOCGMRU(r4, 0x80047453, &(0x7f0000000080)) r5 = socket$inet_udp(0x2, 0x2, 0x0) r6 = dup(r5) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) r9 = dup2(r8, r7) ioctl$PERF_EVENT_IOC_ENABLE(r9, 0x8912, 0x400200) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, &(0x7f0000000100)={&(0x7f0000000180)="d6588931c77009a3817375ff85e9a8d5afa2293bdd08efd7f3e5d8dd0cbb8068e27d8aa92eb80857b2cdd14558f49888fd03c2e28e1e65787d03af1100a48f0d0f9a1fbf5089", &(0x7f00000002c0)=""/137, &(0x7f0000000200)="ca2b5d5a2934c0f833b2a73511c470d81b1d6c871130224eb3c0bcf6a34f6d64ba68b82c95b9a47965ab70d51640bb2727053703098b35d4aed66f5506ae9d44df07009c9364d4e960fa7696d0d2621732486acf6e", &(0x7f0000000380)="2134cdb0d85b9fe64980c9ca4255474232b845afaf0c4c81a96b9204550e17372b8a80404b2ee93301da85924a0f4ee5f5fdfd2d48e3c62ec4707ce9584726e41f097a52c91578a6691bf8c489dde22524cd7379068f449433c2e2dc07fc170b8ab8b56dd5a8d627c20a2247fe96499409fd518c5127b5518ac0056192ec963c000177780c8b4ce5e1da71163014cc119f4d98ac50b22d26fda708cb84f4b27b", 0x9c9, r4}, 0x38) write$P9_RREADLINK(r9, &(0x7f00000000c0)=ANY=[@ANYBLOB="03275a8f147324070000002f6669"], 0x10) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) 00:57:30 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup2(r3, r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000005c0)='nl80211\x00') r7 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000140)={'virt_wifi0\x00', 0x0}) sendmsg$NL80211_CMD_SET_WIPHY(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x20, r6, 0x11, 0x0, 0x0, {}, [@NL80211_ATTR_IFINDEX={0x8, 0x3, r8}, @NL80211_ATTR_WIPHY_DYN_ACK={0x4}]}, 0x20}}, 0x0) sendmsg$NL80211_CMD_SET_WIPHY(r4, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="2400b8ecde895886e0a261a60b03d54823f429dc780d4d9b890095d0cc", @ANYRES16=r6, @ANYBLOB="00022abd7000fedbdf250200000008006100010000000800610001040000"], 0x24}, 0x1, 0x0, 0x0, 0x48000}, 0x2004) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r9 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r9, &(0x7f0000000180)=ANY=[@ANYBLOB="7065726d060000003078303030303030303030df1d303030303050305b290e5e637075738b23268effba448dce33c332"], 0x6c0) 00:57:30 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 658.532981][T25642] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:57:30 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) r1 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r1, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r1, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) r2 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r2, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) ioctl$SOUND_MIXER_WRITE_RECSRC(0xffffffffffffffff, 0xc0044dff, &(0x7f0000000080)=0x3075e9e1) sendto$inet(r2, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) write$apparmor_current(r0, &(0x7f0000000000)=ANY=[@ANYRESOCT=r2], 0x1b) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000100)={'mangle\x00'}, &(0x7f0000000180)=0x54) [ 658.677162][T25653] bond0: (slave veth405): Enslaving as an active interface with an up link [ 658.706751][T25662] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:30 executing program 5: socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r0, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r0, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$apparmor_current(0xffffffffffffffff, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) [ 658.782708][T25664] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:30 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r4, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r4, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) ioctl$sock_inet_tcp_SIOCINQ(r4, 0x541b, &(0x7f0000000080)) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) 00:57:31 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x2000000, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:31 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:31 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x2000, 0x0) ioctl$SNDRV_PCM_IOCTL_READN_FRAMES(r1, 0x80184153, &(0x7f00000004c0)={0x0, &(0x7f00000001c0)=[&(0x7f0000000080)="04fbd93b3569e7321c34678a1f8317999cb433401e05de4e4b3f9d0bedf34df63ea7e9e53785f2c629c095dfbc556aa803ae72d3ef35fe37e5eacea6b56744d6795e158be0d025776664c4318730854198409967fd2508404c0e418dd2a20e200bd276633f3d28f1f80f8c544cbbf589f0c5fbd780e56b892c5f5b2b690288bb5cb5d24cff1ff8de2e223afde73b8303e7d99554b4d60533191e697e143a21fb3874ec999e3e83809fadc8237fb4838ef1abe2fda9ac15b14a58be6b814036335a7cc0e4bbcb073a97cd79cf61589ea56828d9cfb853dcd0a0e8d9e8bde5b9402e3623af96f48a40901ee0d182", &(0x7f0000000240)="314f35a40c2a1343b0a5400d63bea4255796c0bf142052267ed9934bf80ecc7e587e61e49c11b024950927b455cd518876fbd060a66cbbcbe237f287fe12ee74c5862510ca5d2d0d72f2665f998c1ec0203c379537b1ce5a0345e57cf240d8a95d8e08a6b7972754351f9f3f1cf630e131653fdbf7ae5bd72114039b42d04c41732ec1c2c0af86eb2733539757d0e8f312eb9cf105407c3230f871c4d38e837f", &(0x7f0000000180)="515b48293bad46", &(0x7f0000000300)="f7aa7ef237f75d029b0c2af4226a75d0388f2897b0cc51081b1687d7fea6c7ce898b18f6f4ea82177dc19611a4f65fda63f0f210302b60bf0777e7e0835850fda7898be23b4f96d08d255f4740120f4ba6d2ace1f2473411a2b54ef0378d522c410b91c9ab3404b7a4010c94e87f3f6d5958e38390cf10f3ece377e80143a9656ca07dfa05c478afd7d1c06ff58fb74a3dec8a83082dc4bf23bb103a72e508b9707db543250042bca1a2c4ddd5a43e6eb07ce6d0a5f7418961aabf8a037575485e2edda536c93e109eca44889ca9bfc234", &(0x7f0000000400)="65a55ee1d6fda717be1ff18e8fc78ae95c14f948b375afabbd1310edc179eba185bf8c260477621dfe9f272c1865fddefd1ce82180c08fa07277f1bc563842bf8c9ef5830adb593836b03d18df589afb0e130b8f310c0f966452f282c3127bddf1cc6a688307edf56dcf6061621e4da7e27d2b80b7e6a60a1a813f8b80aa7065788f036dd5c03e7db1bf26496ca10b20cd8ce6739423"]}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup2(r3, r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000540)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_ACCEPT(r4, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x1c, r5, 0x100, 0x70bd28, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @multicast1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x805}, 0x48000) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1000008, 0x10, r0, 0x82bb0000) r6 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) r7 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r7, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) [ 659.211106][T25680] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 659.350990][T25692] bond0: (slave veth407): Enslaving as an active interface with an up link 00:57:31 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) sched_yield() keyctl$join(0x1, &(0x7f0000000080)={'syz', 0x2}) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) 00:57:31 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) r1 = userfaultfd(0x800) ioctl(r1, 0x3, &(0x7f0000000080)="6bb193f1edc400ef0c0b41938a2301c90c20725a9b780f50e004e6f1f94ab39e9f467367bc04ba5c2ac02ceb9952bcab4c10f9d43e4c93d4343c01a8df60a3de203133c4e8f6ba7e2dbab0e53cc1a3b1ffb546ea62a4fcf41baf34eedd759e631c89bc5657f52782215c3152446e0eb04aec99359131af1afc7d") write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) 00:57:31 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0xffffffff00000000}]) 00:57:31 executing program 5: socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r1, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:57:31 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 659.635525][ T26] kauditd_printk_skb: 2 callbacks suppressed [ 659.635538][ T26] audit: type=1400 audit(1589677051.623:1209): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=25697 comm="syz-executor.5" 00:57:31 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x3000000, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:31 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:31 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) r3 = syz_genetlink_get_family_id$fou(&(0x7f00000001c0)='fou\x00') sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="01000000000000000000010000000500040001"], 0x1c}}, 0x0) sendmsg$FOU_CMD_DEL(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=ANY=[@ANYBLOB="140019b8a39eb301cfa63076780000", @ANYRES16=r3, @ANYBLOB="e5fe000000000000000002000000"], 0x14}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) r9 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r10, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r10], 0x44}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r10}, [@IFLA_MASTER={0x8, 0xa, r6}]}, 0x28}}, 0x0) sendmsg$FOU_CMD_GET(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x14, r3, 0x400, 0x70bd2a, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0xc080}, 0x80) 00:57:31 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) write$P9_RREADLINK(r3, &(0x7f0000000000)={0x10, 0x17, 0x2, {0x7, './file0'}}, 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) r4 = socket$netlink(0x10, 0x3, 0x16) r5 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r5, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r5, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) r6 = dup2(r5, r4) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r6, 0x6, 0x16, &(0x7f0000000080)=[@sack_perm], 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) bind$isdn_base(0xffffffffffffffff, &(0x7f0000000100)={0x22, 0xf0, 0xb2, 0x81, 0xb7}, 0x6) [ 659.773493][ T26] audit: type=1400 audit(1589677051.663:1210): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=25698 comm="syz-executor.1" 00:57:31 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x4, 0x800000, 0xfffffffffffffffc}) close(r1) io_setup(0x6, &(0x7f0000000140)=0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) io_submit(r2, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) accept$netrom(r4, 0x0, &(0x7f0000000080)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup2(r6, r5) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) ioctl$sock_x25_SIOCDELRT(r7, 0x890c, &(0x7f0000000180)={@null=' \x00', 0xa, 'netdevsim0\x00'}) [ 659.872758][ T26] audit: type=1400 audit(1589677051.853:1211): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=25713 comm="syz-executor.5" [ 659.901888][T25714] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 660.004869][T25721] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 660.083707][ T26] audit: type=1400 audit(1589677052.063:1212): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=25717 comm="syz-executor.1" [ 660.119265][T25731] bond0: (slave veth17): Enslaving as an active interface with an up link 00:57:32 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:32 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$PPPIOCCONNECT(r3, 0x4004743a, &(0x7f0000000000)) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) [ 660.209005][T25741] bond0: (slave veth409): Enslaving as an active interface with an up link 00:57:32 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup2(r5, r4) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$KVM_GET_MSRS(r6, 0xc008ae88, &(0x7f0000000080)={0x9, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}, {}]}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) r9 = dup2(r8, r7) ioctl$PERF_EVENT_IOC_ENABLE(r9, 0x8912, 0x400200) ioctl$SG_GET_ACCESS_COUNT(r9, 0x2289, &(0x7f0000000180)) 00:57:32 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0xffffffffffffffff, 0x5e, ['cpusetmime_type\x00']}, 0x2b) [ 660.531774][ T26] audit: type=1400 audit(1589677052.513:1213): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=25756 comm="syz-executor.5" 00:57:32 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0xfffffffffffffdef}]) 00:57:32 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_inet_SIOCSIFBRDADDR(r1, 0x891a, &(0x7f00000000c0)={'veth1_to_team\x00', {0x2, 0x4e22, @multicast2}}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$inet(0x2, 0x4000000805, 0x0) r5 = socket$inet_sctp(0x2, 0x5, 0x84) r6 = dup3(r4, r5, 0x0) r7 = socket$inet(0x2, 0x4000000805, 0x0) r8 = socket$inet_sctp(0x2, 0x5, 0x84) dup3(r7, r8, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r8, 0x84, 0x64, &(0x7f0000000240)=[@in={0x2, 0x4e20, @loopback}], 0x10) sendto$inet(r8, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r8, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r6, 0x84, 0x25, &(0x7f000059aff8)={r9}, &(0x7f000034f000)=0xfeb5) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r3, 0x84, 0x76, &(0x7f0000000000)={r9, 0x6}, &(0x7f0000000080)=0x8) r10 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r10, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) 00:57:32 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x4000000, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:32 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup2(r4, r3) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) write$P9_RFLUSH(r5, &(0x7f00000000c0)={0x7, 0x6d, 0x2}, 0x7) r6 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) ioctl$RNDZAPENTCNT(0xffffffffffffffff, 0x5204, &(0x7f0000000080)) 00:57:32 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:32 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000280)=ANY=[@ANYBLOB="7065726d686174203078303030303030303030303030303030305e6370757365746d696d65db5f747970650068eeb71e29d5fcad076871fc7a736300932438aedfb7a758125c6ca38a9f6b28d9b923875991a1766024c11c76c20ba648db04221f37284e09e130012ef1d4039508c6731bd15026a7637d68f43d38263f45174b7529ee92a11f579a77d83901fe7f7713b88b7f97a6f8223a8d6dcf3442c6d666b7a7b911210b80c06e06940e41bb8850a8f5fd13c5d4be0290c849b6a21bfb74b54a26d71d51be"], 0x6c0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup2(r4, r3) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r7 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r8 = dup2(r7, r6) write$RDMA_USER_CM_CMD_CREATE_ID(r7, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x111}}, 0x20) ioctl$DRM_IOCTL_SET_UNIQUE(r8, 0x40106410, &(0x7f0000000040)={0x47, &(0x7f0000000380)="7df1c1b065ff4927ec56e957abf80ebc1dcc7373adde99467a81c910599ad8ea3c96f1c883641e9d1f91963f8c91bbb8646818ea3db2f9de25cab25c2bf8e1c3cdced9d239d337"}) write$RDMA_USER_CM_CMD_RESOLVE_IP(r6, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0x6000000, 0x0, 0x0, @private0}, {0xa, 0x0, 0x0, @dev}, r9}}, 0x48) write$RDMA_USER_CM_CMD_RESOLVE_IP(r5, &(0x7f0000000080)={0x3, 0x40, 0xfa00, {{0xa, 0x4e20, 0x2, @private1, 0xfffffe00}, {0xa, 0x4e21, 0xa7, @remote, 0x7}, r9, 0x3}}, 0x48) 00:57:32 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 660.865995][T25777] __nla_validate_parse: 1 callbacks suppressed [ 660.866007][T25777] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 660.911575][ T26] audit: type=1400 audit(1589677052.893:1214): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=25770 comm="syz-executor.1" 00:57:33 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x202000, 0x0) ioctl$SNDRV_PCM_IOCTL_TTSTAMP(r2, 0x40044103, &(0x7f00000000c0)=0x20) socket$inet6_mptcp(0xa, 0x1, 0x106) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(0x0, 0x3c) ptrace$cont(0x18, 0x0, 0x0, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, 0x0, 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000180)='net/bnep\x00') r4 = syz_open_dev$audion(&(0x7f00000001c0)='/dev/audio#\x00', 0x50, 0x0) r5 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000200)='/dev/audio1\x00', 0x80000, 0x0) kcmp$KCMP_EPOLL_TFD(0x0, 0x0, 0x7, r3, &(0x7f0000000240)={r4, r5, 0x401}) io_setup(0x6, &(0x7f0000000140)=0x0) r7 = socket$inet_udp(0x2, 0x2, 0x0) r8 = dup(r7) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) io_submit(r6, 0x6, &(0x7f00000017c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x7, 0x40, 0xffffffffffffffff, &(0x7f00000002c0)="0342afcddb35ae6956a9c9dd4eba8924c16bf8faf8cf05e7bf26ee1ddcf3b685bbfaad93536c9b21823a3c04d4cd1c990c89e2d853640cff6411dc3ba4a2215e1e6a54baee27f7aa7ffb58c5fb9c6c58022b5d0a94f3bcb11896e3fa51a711bc2ef4651d5993633a986f8f84c0a9cf364aa47757d1f61742ca7437a233949e83f8635cb0ca637fbfc673b1b5e69a27afd3e56e6dd4739bcacab3a6cc88a6063f864d0f50be13de6d3b27157efbecdefa541e0fa6f6201de318628562f7303d76f19bcf586356da88b278affa7bbb1f94d7164793ac856430abfd2f121ad1fc8d902712a6776d511050fa0ed4cedffdee2c1eb5191569d51ddf5db41d2e3570c3d8c537fc04daf72bd57e137ec99b8e44a4c3f862e60d714731b8e24e8040d0cd1c11a259d6c3327044e8d29f98830857b22f4d54c8ed7f5a71e2298f98d1438b3141c6a672f6517f9e793fd86ee4141c51785f26b20f29e48f1c51a4f0c9827ff0752a9142b7baa32a8be60c2ebd9b3faf655c8641388050f435a2246e8ef1f4aa5afccae7295b116f7b9fb540f2c92cca71abb0f5b67664c9cc3db768f47e493c2d49c3f9082f01a180c7f2ac50a5ba723fb80ba9f88dd8ffaef2c16ccf63ad119e9f4b04fe3a7a3c468e945e73d099d0c5bb96fcd4cee7fba3e7d89a87f3ed2b845486627af6627ef14d25873c658a1d19d18f8fd062685540a713ef69ac80a671f4feaa9f0c6755f21edc3e633184f6560acf47580b19b658509a8f6744ec4e34694e26deb8d0e561aac1a6fcb0d7f16cbbfe7c8d80815913da73bcdc5303849e0dc999c73fce345a27ec5c15f4087570a22fe7b74c40407c1016b9e97c175f00453b5b6078808e59f99f5e7aed43eae86f2261489f79c918a8c300e44357395cf9aff3dd5a038b313a76f18a27fe7d8d32502ff328bf224cb643586151e8971f2b9ad7ed61f55f21913853d44c81759a37ddb7b6ba4798857b1999bd0dd4aed85c129e0c3325488f32b26a3b05ae5289f571421b4004ef74e9c228fcf6c8fc2c7586fa7b94955bac59ce73c236c6d29af128f9fd44c01524bdd6cb8e7becd72c6a90a36d3e9d906abfa300ce63009eb617eb1ec78325cadb54160c7cda2320c6ae6d2522e0bd916553cc55affb1b0295c816d38a0e63cd1573c592a28941ff0412336bce9ed07b68e7a853baca7f2139b723326fe41f2be8775521ccd8cccead6da709dee221be54fbdab2472d21da57622c48cda8aa3870a779e02f4709558d4146e594b8e3619cb84146083cf58786b0c19c7237cbe5b4c1d2483516593f4434a5468073c639622425286d7ea261f745dda901d2f111b0c68202d6533cf69f2b7a957159e4d37e91a9d634fdbc390b5e9e4b1f5c285beab3a0415c2fb0084e53dc9a9d2db0808e2a29b4f229c039a8dc6b3d70df5d629964c1c2f20b73f31b5eeb3129fee540dd1669267148ee2b9038138830463d4b832b2b72637b759e3e011ce95842bf6c586fb389dc15aae8dc5dab41f309db60783eed53489c279f571b2a90c9ec8c541b3afb01f82ca75bd194a204cd37f311227bd711ff3a71f1163762c23fd63a114ac4b6b95351cf22d87cb4ff15f7987a0fee8b41f6347c5644a5880b019d8d0be3314e7690073975108bbed3661512f73b10751e9a0cc094944f4a89dc406b260ca11de73c3e8ccae2731b5c92c0b3434a78dd0ea484dda2a732a13e2281604a0b5024fdef1a3e2565c28cc234ea23fc7c41918e1a8b361933ba517ba522e7599561a52b695aac3e3b9e82d0c35d50fc37d2838b05dac0df6543b3599e653f7ff4d2b7950f73810d2bf915a1ec70976abcf6af273445f7c788a2d720bb558ecd7d3596667811cefe94b043382a5d3134551b98b080a512d75e635726d5896588ba46b1af890f6fc290801527d58a02b112f106897de503d3c561370f426bc75dd0c57ca575ffd9270901552a4564a1166660d13294767295d145a1d7dfd288fecedb433a3d1136111e5a79131a646ba27fa8c4f0ffd2063e8844f78d7237907adee36330e8192df94cb782b96efc6c549e62c2eac0090c3937897dfa3fb47f083f252b243cc65f3405d47b6ee6ccbad1f285315445f96fcb67aba8207a184cbfb5bd889aca0f12bccaf457c3b371089c1a67a9da42c29af172e0e503438a97b2205cfaf00aa83bb82543edb52b8f76f04576d48de94c692138a58e86fbd04415fc65cce324f07f022526eef67ce3b178811e77f395291a1c52704be165daddc05f7fcf8ada41dfbbb3caa0c70633ebffec7b09a3bbfc038b217bb13e26bbcadfc77c1877d26c10940cd9e9675580b64a89fb38df21ea9e182925eaae6d05d0fa8619e9ae483f5e4ef27c8795e1bb33013cbc2e8cd765b18e2d48eb4300a7b986dd7aaabd1da62dd7d22a48c4c46549b3f6b6f5626a590b4331af79c190a80db619541b163b902be4b5ec8992f1d82f8ef6cb662158b81ca3da8edf7c0c74d89e0340fbc25b7f6e8056257f0f358d0f87cf2adb22a68aa3a70c147e33041e97153d384fe618ce8c7c658e3d77c3f7cde22bfe6a9f75e74ae3eac6810f378cda82416a74c4a72771cfe3c568c3711ecdc0578df3e66f5b09b2bd77a29319643d46d9264ae04e426855bbd5410e3fb5d61493e20bd5659b2144fe67233e2c46b2dfd1a41118173c092e84361d9eafbd2586d577a34cbdca339937e3f9a5bde44d34801f62b1f1efe932c86c5d150b9f3925151eca6a535a16bdb149a35d1e4643ed48ee6cb89b4628410e4370c0cd0258cb77e30428a2217af338093a8b2f8cc31a79725b6a624481144587dabe2631bf7317ea87af8cad25fd2a57c368657ad6fd6a3a06a4338fca3afe54a2f9e177175747c831fb9461bdf7c44db3f146c607ee6b335ac43cd484f05e8fceec2f7172357700220fef2407c406e2887c2b43ff0d075622a666d51c50b7663568dcf15ecc0772beb9bd17f2d87a8ce6e3dbbede827de028bdf68117d3a7143b5504210057ad83018ca2e833da36a0d88498d668f7708ed3157da0534687ec1c4fcea336f856a631fa65805e42d413bd186ef4d322eca25ac83c3ccd59c025da75896e5cce53f712f7db0c0c3ca3134ec3efe86099a5e5a8a4ab3216c9875111aa900a452f69529127b59ed149bdc082967b98e11f47905bd794b3b587cc2270900be6d74c16b2527c55005caa392f3547c3f62c458d0098cfeeebfc187ab1eca424987c13ba99c7dd0ae41df783e997a2a19bfef4d2f1864ea1c2398f210c1277579079fda46196c51e4717b69fd8505f953d288b8993165da01b09bdb08f757a545ad1f6d86e777b5f8279f7de96e241dcb490620d02341a382c9749fefa9b1c70eb46aead5902cf489a2924e825483f749b373d8ffd6a1a5a2f65986873189c7c66b893f5db2e48fdc8833e0d09fb53dca8257762ca6ad922d65042083cd62f373cb42bb0e089ca2346ef8ad062b8f3dac6b436f59dd8603a4361c811e4228d79c6fcf37bb1ba0e40cc761530ab903df043e917d37a6ba864bfcd5680da5e3254a11fb797ebdc18a1c84dec6ac5c72d74591b586b7863436c3f332517974540e6fd1c4163586bec2a04a8ad621d0f0beb6786c4012651622432262c3bf4aa64a5f96676d8d61928701cb571985b9742041aaaf26fffcbf8099f5b5d3d7997779154b13f761143a20bc518331574f8dbf42b583c31de13aa0b29bd774b8090c4b9f30cd72a3ffec87cf5235b97b1ece2e277d9b1e1071e3fa3cd8a87b3b71278b0e7d1ae3eb10c593f62f36b7bf0ef43df7b73c0e91881941e19183ba44371d8453a752dea218328f114afcbceee20b1ed15bf320bd89d804c3b1a979f0bb7bd15db1e62b9f7297b496d1e9769ea69ba64e1be6d814ec738ae9313fe014cfa5fe1273b40be0575d029c301a1693df3cd2627c40b59f1b419556e210d11443b509cd0286e4f7e703f4f787bd639655a34294796c1260cfc161e40ce2fff73c8a0153197ef16934e0601f67be4ecbd8a26fd8619ae0633aeaedc25a3819309eba329db66c0a4c27c21f9664a958c73c05b6dbd993e400fe1328d07de93e502191c74703e12d5f8bc1d8e29214061e323315fb7e8dec8b08e9f8ab5854467aa2943725c757d1378cd3c86bb8329600416a7b6d9735b42540fad754820a4faf16a449eb1724c2e6093e1169711f7d286844e8cd59c83301e3bbc54885eadc56a0a909c33c46c8b0da8e61a755f03bde84b2c594c19ae5f241184aaae06870a8187e5201c75b348af97c40032d12107fda0d607069f9e0a29df97a6790509de3f6d2a09da5274ebe3bcd86045f9f26fca38151650071e0b28deaa83b1408dbb5bf2d4fb253a1272e11a3ce39555fedb90b1b8e3ff486b69813cb3c5ce4cfcbf4bf0dfc71c3eb09ae24b4f7729120e475b365ffc4434d1380805e8602d8c612dd2b3a75989fefc97abfb0b3735b540b1f40d0484fa354039275ae04fb5555d340b48c82bc62dc1b5e2d9febc3f271da0ffec2d5d1c4ee57dde71d7dce218c1a2f77ba7fb6718e96c85f61b728d7b3519f2cc5f6ff7eda32a410b9f0ad40f5d78624b3e4298acc7c22ee6b8b278e3f65eb24ced0876e5a673aa4d4bb4a4fc12bacf60fc132afb575f6c7d50e79e198278fac5666194dd5eccca44b5de196e756479d5e6117c3489bf8e51d0ac5545d3f8fef15b40c80c5e4d896308137adc98fe27874ef035b3c11535a32718a249a978241556b6b993bc613919c9d0f794574bd5ef92e01f3f0771de516676c76fb53ab21816068b2898a24efba1be9836235382abd33025b2834fa9485561dc04c5c68806dceeef4b250993c21a4c0565b4b3799423351cea4cd3872d5bd6cb99421bbf31454f447433f46391b62360c1bb268ba21509c4ddf3a7f9006a3d2678a5346352e86495a658f94db7842250216137320e40d0ae0ac29be65e9ac82c1570409c94aaf62b77757850ce716e37bc4ba087f5be497df3f81e41e6d40637ce5d17d07717d586863dab6f19f29907431374e33f6417d3e00bbf60ab5b4def1140fce9c861bcae0064a7fb4ba6590a030a3e038f8e8e0434986bf5707d7d737e99804954e19a09e312e527ba4dd61e29532bff0a36732b6ddb6cf9fe1afca1189b54ecacf6987fbd4a305176f8df7bd14ef5a7dc21f15900137b5e265ce6b78ba6ee8c98c2243743beab2e53cc07a26abf20b95c02022902be0623d0a6b0a2044044643278237e8854ce0f3af32923c7588d0b9ef9628df40f1640b308df356f08165deb9f5a3d9616fcace26098ca87a577e80bab7262913d03f559eebad791d2554536933b06ee43e9f6c7ae4f1e894a7c8964bf7024ec2d58524e8bb195545c4a8db553db986270d78f18c3b61ff871549277727eed70f2c2a28a8c80143d5c064142ae5b05760b4dcbffb62f5c4c8aa247280afa6976c2928eb3fd1e3c0061bc8af0970474aba842b94024227a853869e146670b9661437f6277a2ecefa1a14ef1666bca518939a5b0afdc336a177d1529d2be73cc087cd98122224e244fca4ce6021de9feb74d9ddf663ad6c25089ce76da88f7d7f859f44f566b6e504ce3e4361012bc96e563f820eda19d44f94f1633f712976385f9332075b0bb99d8010aa521a5858a25975d12e172a11659c28bc2301bc40dc1e6bf4502443d9c8f4e2d7ec5fa9bbd889bd1c50fa6f31f8c454bea696caf2552c1cb17529e7ae860a409aecfb304e558e091e90872eb72517be8eda2bf17b88c096ad7fa55e92ec4", 0x1000, 0x80000000, 0x0, 0x2}, &(0x7f0000001380)={0x0, 0x0, 0x0, 0x6, 0x20, 0xffffffffffffffff, &(0x7f0000001800)="1b2fe8692ce0cefcf200de725e4cc98b3402708a63a03708a6585f606e40d532d0ea5345d3c0c12cc588811e0fc42d26d65ccd9461360434b198548312c6645ae054379a341664b60930ac7acec5269ed84df86664b0c34bc4be4d16f3b8204db68de08d671aa3d7074abd679ea17bfbcdb3015ce1c9798bbdf7d60123d63d74caefba6a4deadbade305bd988360d502f2f6579461617a0ea5c3ea73cfdcd42487b318df576399b816d4d89e1e2e06d21cb6ea5c4f338079358065d8fe1c3e73fb0c31dd87585b13dd6dba2914b2de1468df06a230c109096ab7c86d7e288504c6a95d0a4ca99ca68550d89fa6400eb83cf605a37a3871064bbffea888af3ebf47e27b185c", 0x105, 0x8, 0x0, 0x2}, &(0x7f0000001440)={0x0, 0x0, 0x0, 0x6, 0x63, r1, &(0x7f00000013c0)="824fc4ddfb3751f119c42d65108440bdd311b1e6bc2b12cffcb07ea1b7d2ace0362b3c08d2fde8a41409f4b6d7436d1daf08fdbed465255df7be8b48cb06d8e30373b55451657999240a40d53f058d2bf7f73e274c839ed8d9675905cbcc81ca577862e5a02ff4bba1dba171ffe7", 0x6e, 0x10001, 0x0, 0x3, r8}, &(0x7f0000001540)={0x0, 0x0, 0x0, 0x8, 0x1, 0xffffffffffffffff, &(0x7f0000001480)="70dcbb92dee97c232fa628cb19cf0845614b3c1411adfa5811d35cf30fb74cebb052a0ce0d3c228ca55ce51d1f5c584b270b17e632e761107a8397027e929f8b995efb73004233d83f63895e3a142c91e5d943d272d6f0658b77c9ead733c6fab2632440b8343e8dd07a6fc309d48e7e47c63684c4f1a779de5864f922ea3ef2ef354294789fb7601871943d9342f44fcca1d6da4689a847ae1873a2485a9e04d44742ea64", 0xa5, 0xdd7, 0x0, 0x1}, &(0x7f0000001600)={0x0, 0x0, 0x0, 0x6, 0x2, 0xffffffffffffffff, &(0x7f0000001580)="5c621b8a62d18e852289da33f6ec95e01b353a7936f822898a025ccecfa3511ffaa51375b1a6d66a1704e1ab0908712ba350b0440c82c6f9639630bfd8f24a6fb21fbdb6a10616fb405bc9e68fd482901468a04ca0f398a6", 0x58, 0x7fff}, &(0x7f0000001780)={0x0, 0x0, 0x0, 0x1, 0x4, 0xffffffffffffffff, &(0x7f0000001640)="e602ca7763abfc224fc1999b9ebd8d8c4085b8bb83b45226ae9917cc4966b041fb1b57e67415f4d7fbdb088911db0fac40d7ef82dbcadb342ecab95f5fd8c0e2426db1a2ec1c2556d8faa9c6aaff87939039bebd2aa033c4d1b1e00e5745a58f498bce5c40a732f28b2b931524802b619c0f851947751d0d2215fee6bb48c557eff648e207cf6cdac11d5e7ab4c0b771cc3de0ef3f449ae1dbdd12bbad7d32a676a946badd5c5755d8", 0xa9, 0x8001, 0x0, 0x1}]) [ 661.028700][ T26] audit: type=1400 audit(1589677053.013:1215): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=25773 comm="syz-executor.5" [ 661.100085][T25787] bond0: (slave veth411): Enslaving as an active interface with an up link 00:57:33 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r1) r4 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r4, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r4, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) ioctl$VIDIOC_PREPARE_BUF(r3, 0xc058565d, &(0x7f0000000180)={0x7fffffff, 0x1, 0x4, 0x22410, 0x7, {0x0, 0x2710}, {0x3, 0x2, 0x8, 0x20, 0x5, 0x20, "d9d17658"}, 0x6, 0x0, @planes=&(0x7f0000000100)={0x8c, 0x995f, @mem_offset=0x2, 0x5}, 0x3, 0x0, r4}) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000240)='/dev/sequencer\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = dup2(r7, r5) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0xec50) accept4$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, &(0x7f0000000080)=0x1c, 0x800) setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f00000000c0)=0x1, 0x2a) write$apparmor_current(r0, &(0x7f0000000040)=ANY=[@ANYRESOCT=r6], 0x1b) 00:57:33 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:33 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup2(r3, r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup2(r6, r5) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) ioctl$UI_SET_RELBIT(r7, 0x40045566, 0x1) r8 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r8, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:57:33 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) syz_open_dev$tty20(0xc, 0x4, 0x0) r3 = dup(r2) r4 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r4, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r4, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) ioctl$VIDIOC_DQBUF(r3, 0xc0585611, &(0x7f00000000c0)={0x7, 0xc, 0x4, 0x2000000, 0x10001, {0x0, 0xea60}, {0x4, 0xc, 0x40, 0x20, 0x0, 0x8, "1b3b7d2a"}, 0x7fffffff, 0x4, @planes=&(0x7f0000000080)={0x4, 0xcb, @mem_offset, 0x8}, 0xf2, 0x0, r4}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) [ 661.473875][ T26] audit: type=1400 audit(1589677053.453:1216): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=25808 comm="syz-executor.5" 00:57:33 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0xfffffffffffffdfc}]) 00:57:33 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x5000000, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:33 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:33 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) gettid() r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x3c) ptrace$cont(0x18, r2, 0x0, 0x0) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) getsockopt$inet6_buf(r3, 0x29, 0x3d, &(0x7f00000000c0), &(0x7f0000000100)) ptrace$cont(0x20, r2, 0x0, 0x0) fcntl$lock(r1, 0x0, &(0x7f0000000080)={0x0, 0x0, 0x800000, 0x4, r2}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) io_submit(r4, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) [ 661.959710][T25829] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 662.027853][T25833] tproxy_tg6_check: 14 callbacks suppressed [ 662.027860][T25833] xt_TPROXY: Can be used only with -p tcp or -p udp [ 662.111668][T25838] bond0: (slave veth413): Enslaving as an active interface with an up link [ 662.152206][T25844] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:34 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 662.468094][T25850] xt_TPROXY: Can be used only with -p tcp or -p udp [ 662.512851][T25850] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:34 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x57b6787, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:34 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) r3 = socket$inet(0x2, 0x4000000805, 0x0) r4 = socket$inet_sctp(0x2, 0x5, 0x84) dup3(r3, r4, 0x0) r5 = socket$inet(0x2, 0x4000000805, 0x0) r6 = socket$inet_sctp(0x2, 0x5, 0x84) dup3(r5, r6, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r6, 0x84, 0x64, &(0x7f0000000240)=[@in={0x2, 0x4e20, @loopback}], 0x10) sendto$inet(r6, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r6, 0x84, 0x1d, &(0x7f0000000280)=ANY=[@ANYBLOB="6a38f017aa120000", @ANYRES32=0x0, @ANYRES32=0x0], &(0x7f0000a8a000)=0xc) r8 = syz_open_dev$vcsu(&(0x7f0000000100)='/dev/vcsu#\x00', 0x4, 0x200000) ioctl$VIDIOC_G_EDID(r8, 0xc0285628, &(0x7f0000000180)={0x0, 0x38, 0x777, [], &(0x7f0000000140)=0x40}) syz_open_procfs(0x0, &(0x7f00000001c0)='wchan\x00') r9 = accept4$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1c, 0x80000) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r9, 0x84, 0x25, &(0x7f000059aff8)={r7}, &(0x7f000034f000)=0x8) setsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000000000)={r7, 0x7, 0x0, 0x3}, 0x10) 00:57:34 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet6_buf(r2, 0x29, 0x1c, &(0x7f0000000180)="e8e17867d0f5c2e5cf2cd168ede9e01086087f68c4ce1d3861f95e6fa49447a1a67d9436f5de8f086f8f35ac19ad8cadc3664eec0dc6687f14c619b60f0b6f7037584d9a508fe59eaed435cef0cc6fbda04351b91404c45e91c6e135757c294a01a495ce2626b62b703cb8edbe4952ec3c1d941b9e99175f8f30c9f8556c7ed3623b85bcd77fd82ffcfb2b7c059ada06e3e0117f72c4404bf0ec2d8fece7bc858f30dd86f7b7249570e9d3ac", 0xac) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup2(r5, r4) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$TIOCGSID(r6, 0x5429, &(0x7f0000000080)) gettid() close(r3) socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$FBIOPAN_DISPLAY(r2, 0x4606, &(0x7f00000002c0)={0x780, 0x320, 0x0, 0x384, 0x2, 0x6, 0x18, 0x1, {0x3f, 0x3}, {0x0, 0x5, 0x1}, {0x7, 0x8, 0x1}, {0x2, 0x1, 0x1}, 0x2, 0x10, 0x1, 0x3f, 0x1, 0x0, 0x5, 0xab5, 0xffffffc0, 0x49, 0x3, 0xb99, 0x1, 0x1, 0x0, 0xc}) io_setup(0x6, &(0x7f0000000140)=0x0) socket$inet_udp(0x2, 0x2, 0x0) r8 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) io_submit(r7, 0x1, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r3, 0x0, 0x0, 0x598}]) 00:57:34 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 662.664968][ T26] audit: type=1400 audit(1589677054.653:1217): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=25852 comm="syz-executor.5" [ 662.675213][T25854] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:57:34 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) dup2(r4, r3) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r3, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0x6000000, 0x0, 0x0, @private0}, {0xa, 0x0, 0x0, @dev}, r5}}, 0x48) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r2, &(0x7f0000000080)={0x15, 0x110, 0xfa00, {r5, 0x0, 0x0, 0x0, 0x0, @in6={0xa, 0x4e21, 0x10000, @local, 0x4}, @in={0x2, 0x4e22, @loopback}}}, 0x118) r6 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r6, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) [ 662.841977][T25867] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:34 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0xfffffffffffffdfe}]) [ 662.886259][T25862] bond0: (slave veth415): Enslaving as an active interface with an up link [ 662.942907][T25878] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:35 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup2(r3, r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) write$apparmor_current(r4, &(0x7f0000000240)=ANY=[@ANYBLOB="7065726d634b46fbfed167c4ac1a3c3909cdffb9686174203078303030303030303030303030303030305e6370757365746d696d655f7479706500c9b72d9e2f4e6f00856900e0bd91bc058b85868cadd45c4f07e727b032ff632383bea3d15c113b44c137231fa6120edabfc18f51542860386cce76ad1037fd636aa8"], 0x79) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x3, 0x2) r7 = dup2(r6, r5) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) sendmsg$NFULNL_MSG_CONFIG(r7, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="70000000010401080000000000000000010000060600064000000000080004400000007f0800044000000007080003407805651408000540000000000a0002000000000400000000050001000300002beb9a442fbbc2d380d4102adb7530070006000640000500000a00020000000101"], 0x70}}, 0x20000015) 00:57:35 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcsu\x00', 0x10000, 0x0) 00:57:35 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) setns(r3, 0x20000) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) io_submit(r4, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) 00:57:35 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 663.225142][ T26] audit: type=1400 audit(1589677055.213:1218): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=25884 comm="syz-executor.1" 00:57:35 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x6000000, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:35 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r4, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) r5 = socket(0x11, 0x800000003, 0x0) bind(r5, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000011039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c65400"}, 0x80) getsockname$packet(r5, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) sendmmsg(r4, &(0x7f0000000800)=[{{&(0x7f00000000c0)=@ll={0x11, 0x0, r6, 0x1, 0x0, 0x6, @link_local}, 0x80, 0x0}}, {{0x0, 0x0, 0x0}}], 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:57:35 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$KDSETLED(r3, 0x4b32, 0x7) write$apparmor_current(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="6368616e676570726f66696c65202f70726f632f7468726561642d73116c662f617474722f63757272656e7400"], 0x2d) [ 663.379583][T25894] xt_TPROXY: Can be used only with -p tcp or -p udp [ 663.439672][T25897] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:35 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) syncfs(0xffffffffffffffff) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup2(r5, r4) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) setsockopt$XDP_UMEM_FILL_RING(r6, 0x11b, 0x5, &(0x7f0000000080)=0x20000, 0x4) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) r7 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r7, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r7, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r7, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) write$binfmt_misc(r7, &(0x7f0000000180)={'syz1', "b79d9b9413df894df0bb67f7faa54785cef97683b14258538ac5965e1d02737bebeba563987a7bbc61d7deb0a49a474428532b7ae1e632ecf60e988609241edca45f376a15de006e8c913f584cd215cad4c078d87587a6bfa3abcc2a3dcd966f71e195a441f035d0c7b2e1bbaaa384b9ddd3691f932010b78ed874fffc8fda9dfa519350ea45af4d6ce6e1a85c1910629b7f97880cae870cd6edca45f3d5ffefdc0337d4cec3f4a0bd7529605aff5f207c095cb91ae822be23a04466e3e2195064509c8270779a44493e548737d7969521409e236c5714aa699c1c1eafd2a6fb5647d9ffc682706b420749c132831c5bb5878bd650d462be64ee7e"}, 0xff) [ 663.516937][T25900] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:57:35 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 663.683744][T25909] bond0: (slave veth417): Enslaving as an active interface with an up link [ 663.740934][T25920] xt_TPROXY: Can be used only with -p tcp or -p udp [ 663.775055][T25922] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:35 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000080)={0x0}, &(0x7f00000000c0)=0xc) r6 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vcs\x00', 0x400, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) r9 = dup2(r8, r7) ioctl$PERF_EVENT_IOC_ENABLE(r9, 0x8912, 0x400200) ioctl$VIDIOC_QUERYSTD(r9, 0x8008563f, &(0x7f00000001c0)) ptrace(0x4207, r5) ioctl$PPPIOCGIDLE(r6, 0x8010743f, &(0x7f0000000180)) ioctl$SOUND_PCM_READ_RATE(r3, 0x80045002, &(0x7f0000000000)) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="7065726d6861b438ef293d54e4ad79f9018cafa963930eec7238d77ccf5176908600000000000000005afd29825bf5aa59d00827980000000000000000000000000002c98fe7208235fa8e531a7f2c18edcee17de995838073958d3526b20552273810f7bd71d035d297794113d0caff0e0efe3694a475acb6c9e3be887c9837b33c33d669a6a07732c3171e0e091d6824d1fe10ff8610c4ee77b5cd9fb4da0819c6b6f5f867c1515c41394e322654c38cf97c821bc162678db4c9dead8fbddc1ca9fd87127288cbe43be9066f45839ac8125695835a0515e549f7d4700ef16f14700d769f13d14ffe54db1d379c093e40e2740cc94f71ef9beb824bae0dc04d71d59da38f0a415b6edd9f2ea24dc128a2cc8e980ac3d876509ed0b73ec559f3a71616f4"], 0x1b) 00:57:35 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$RDMA_NLDEV_CMD_STAT_DEL(r3, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x50, 0x1412, 0x4, 0x0, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x4f, 0x1, 0x2}, @RDMA_NLDEV_ATTR_STAT_RES={0x8}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8}, @RDMA_NLDEV_ATTR_STAT_COUNTER_ID={0x8, 0x4f, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x1}, @RDMA_NLDEV_ATTR_STAT_RES={0x8}, @RDMA_NLDEV_ATTR_STAT_RES={0x8}]}, 0x50}, 0x1, 0x0, 0x0, 0x4010}, 0x20000000) sendmsg$IPCTNL_MSG_CT_GET_DYING(r3, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x14, 0x6, 0x1, 0x205, 0x0, 0x0, {0x2, 0x0, 0x3}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4044064}, 0x40005) r4 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TCSETSF2(r4, 0x402c542d, &(0x7f0000000000)={0x9, 0x1, 0x4, 0x2, 0x80, "e357b981a9b5f4fce9c9da343c36a547aafd6c", 0x8, 0x72}) r5 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r5, &(0x7f0000000040)=ANY=[@ANYRESOCT=r4], 0x6c0) 00:57:36 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0xfffffffffffffe00}]) 00:57:36 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:36 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000000)=@hat={'changehat ', 0x800, 0x5e, ['cpusetmime_type\x00']}, 0x2d) 00:57:36 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x7000000, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:36 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:36 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(0xffffffffffffffff, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) write$binfmt_elf32(0xffffffffffffffff, &(0x7f00000001c0)={{0x7f, 0x45, 0x4c, 0x46, 0xff, 0x6, 0x9, 0x1, 0x10001, 0x2, 0x3, 0x8000, 0x298, 0x38, 0x254, 0x2, 0x101, 0x20, 0x2, 0x8, 0x7, 0x4}, [{0x3, 0x3, 0x8, 0xe, 0xa3a, 0x0, 0x9, 0x3f}], "19b3bbefd3a0ddc605acccfa5358ea1daffe703e87fb923aa86ac14b867e45"}, 0x77) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x100000000000c333, &(0x7f0000000180)=0x0) ftruncate(r3, 0x48280) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = fcntl$dupfd(r5, 0x0, r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) clock_gettime(0xfffffffffffffffd, &(0x7f0000000300)) io_submit(r4, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r3, &(0x7f0000000000), 0x377140be6b5ef4c7}]) io_submit(r4, 0x1, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0}]) 00:57:36 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000300)='/proc/thread-self/attr/current\x00', 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) keyctl$update(0x2, r3, 0x0, 0x0) r4 = add_key$user(&(0x7f0000000180)='user\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000240)="bdfaf7613e673a440920e839c0d483c0ccae6568697b688fbd525561a79b6a72e0e6dc16eedaf69644b0983b1ddfdb67f3d612235f7560e83e3fd702ed59546d55d38ddc3f8fdd0e156b3e448da4236be904b97e80749155ff395eb5348a36298bcb1cee2a454d2e8ed3781d9c1c43533616852c5ff25967a796bf0298e7064390a5f495441a4e", 0x87, r3) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r6, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r6], 0x44}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x20, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r6}}, 0x20}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'batadv_slave_1\x00', r6}) keyctl$setperm(0x5, r4, 0x4000004) r7 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) mmap$snddsp(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x3000002, 0x4010, r7, 0xa000) ioctl$MON_IOCX_GET(r7, 0x40189206, &(0x7f0000000140)={&(0x7f0000000000), &(0x7f0000000080)=""/161, 0xa1}) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) 00:57:36 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 664.307652][T25949] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:57:36 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000140)={'virt_wifi0\x00', 0x0}) sendmsg$NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x20, 0x0, 0x11, 0x0, 0x0, {}, [@NL80211_ATTR_IFINDEX={0x8, 0x3, r3}, @NL80211_ATTR_WIPHY_DYN_ACK={0x4}]}, 0x20}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) r9 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r10, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r10], 0x44}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r10}, [@IFLA_MASTER={0x8, 0xa, r6}]}, 0x28}}, 0x0) sendmsg$NL80211_CMD_GET_MESH_CONFIG(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x58, 0x0, 0x302, 0x70bd2d, 0x25dfdbfc, {}, [@NL80211_ATTR_IFINDEX={0x8}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r10}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x3}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x3, 0x2}}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x1}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x3}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x1, 0x2}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40000}, 0x10) r11 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r11, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) [ 664.460709][T25961] bond0: (slave veth419): Enslaving as an active interface with an up link 00:57:36 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:36 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000080)=@profile={'changeprofile ', '\x00'}, 0xf) r1 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r1, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r1, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) setsockopt$IP_VS_SO_SET_STOPDAEMON(r1, 0x0, 0x48c, &(0x7f0000000000)={0x0, 'nr0\x00', 0x2}, 0x18) [ 664.552600][T25972] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 00:57:36 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup2(r5, r4) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) waitid$P_PIDFD(0x3, r6, &(0x7f0000000080), 0x2, &(0x7f0000000180)) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r7, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r7], 0x44}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x100, 0x0, {0x0, 0x0, 0x0, r7, 0x0, 0x9194}, [@IFLA_MASTER={0x8}]}, 0x28}}, 0x0) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f0000000100)={@mcast2, 0x40, r7}) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) [ 664.696454][ T26] kauditd_printk_skb: 3 callbacks suppressed [ 664.696468][ T26] audit: type=1400 audit(1589677056.683:1222): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=25971 comm="syz-executor.5" [ 664.981527][T25972] bond0: (slave veth19): Enslaving as an active interface with an up link 00:57:37 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x2}]) 00:57:37 executing program 1: openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0) r0 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r0, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r0, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) r1 = socket$inet(0x2, 0x6000000000000003, 0x6) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) accept4$nfc_llcp(r3, 0x0, &(0x7f0000000080), 0x800) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r1, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r1, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup2(r6, r4) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) write$apparmor_current(r7, &(0x7f0000000100)=ANY=[@ANYRESHEX=r5, @ANYRES16=r1, @ANYBLOB="10bac27670f1d4e7f95b474c77275b9c67105a16c4ce455536260cc4d3708c4878730ba0eab8edb9a0d7c6c9"], 0x1b) 00:57:37 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0xa000000, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) [ 665.057775][T25974] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 00:57:37 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 665.269942][T26001] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:57:37 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000001700)='/dev/dlm_plock\x00', 0x50500, 0x0) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r1, &(0x7f0000001800)={&(0x7f0000001740)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000017c0)={&(0x7f0000001780)={0x3c, 0x140f, 0x200, 0x70bd2a, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_CHARDEV_TYPE={0x9, 0x45, 'issm\x00'}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x4}, @RDMA_NLDEV_ATTR_CHARDEV_TYPE={0x7, 0x45, 'cm\x00'}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40448d4}, 0xc814) r2 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syz_mount_image$nfs4(&(0x7f0000000000)='nfs4\x00', &(0x7f0000000080)='./file0\x00', 0x3ff, 0x9, &(0x7f00000015c0)=[{&(0x7f00000000c0)="2c1b045b4a4196596406f53d90f39f280e243e32b2b97f41280f45ee041c5677ada9a742be215f79c4485e5f492d2fd5f4766988d00f6cbad61b3e7351ceeeda03f0a8f10866b0840b528f518d8c3e1d9df6a93722fbf2cbe6806c39c6cb6e712802c941cdf078a9edb0a8adecac92ef2b385ad1ec5302c22f3983afef77dec1e47b8bf9b0aabb72a97bb30fc43b4d4a26a9d571ea23a9ca0faab75865951eba83bfe887c026bc507755456f5416bec4691022f817d72e4c2a3a797628e5e05a", 0xc0}, {&(0x7f0000000180)="9e70887bd0acc0b6e97397637576159cb79f9bddd73d193a28d1b0fbfebac85a368e60984c388e8287588d55a2f0d9a41bc4b96b066eb4107d2987d21912c2e546c02cfac4e7d1eff6a5ceda2ac75eb428e9c8069968782dac4a40fc", 0x5c, 0x100}, {&(0x7f0000000240)="93a87976b332003fc92c830969b65c7e16e5b9eef711941a6e83b79b2cf230d383b7e284b93c806c3a33e8b77f8687ce1b3722acf0e59f60742a8d5e593b6ccbf7415d15027bb074b0bd734c8a45a3cef7056f8a19f6cca68a1b40a3916dc37b68d5a7ede3fccb5f2f682e12963a219d9aa65633a59c7ca7eceeaa412c2d76083dcbc0ba2beaaa529ff443e3fcbdf9b753531be46b65191f0483c4bb77f90b4b61ac5dcc51b8e22b2d15a1bfbae1121514fcd75d9dbafba9473cb475a68f4550910478eaf368ede693a76a37fb0947b356e42b259ff6e5125b7a9015c1a73cc951cf726282984793af52d0765bbb60ace3490cda63c4d64eb229bf40245c1c173b95d694c2e947ff0b0d4805bfe9c3caf33ea0475b785136d8af27ea518b9cf3b7ab14b0d92925eab9b8bec2fcd8fd8a96ec770fa0be97cbaed08d4dbe74c317c1bb6031d02f185219f46bb66d9f2a70e84db80abfa9bd6e950f373894e8a4edfb26db6401827f9cb6f7d516bfcfe1154957afaadd8cedd4c6dfed3965268bae2ad8c3f32a4fd49ea3dfba90c298663cd3ac3de8bcf52b7743189e3194a46be664e642461dc63705730645f3f4faa8fbc33f6e4148dcb192d5e9874a3a6ef1d7506246fd07722be6cdf106c31f5de8abe6afbefca9dcf0ad0c4ff7e18c40789cca14a89535c1eefce989c6bb503a1d65ae3229696f451de0c70cf141ffd78b0c6c99328071c73a4c644fe15fdb0133593175bea745bee702c76644d7665835fb5976c5f8d5b01b420f7ccbeba3bc910ba7c7283d37ac4337ac9eff7feef79de55c85e31cde7be85e2a62f97615c50e2b90ee68ab71cdf52b621a89af5018e4bd1861c36c3cc0e9879a1919a0eef067bbd2b415d376959ded206d920209efa365cc2cdc69e65ef82808af976dc0ecf4a7e64c85b4d9c9af48c8313e14cc2e645e7e31c23f646c69db34b7642877377262ecd3705c3de96cc220b3aad661b87511d06a2c513d143ce1fb04fc1e845b0b8b7da695ec99831a18d4773332f195662677a66aeae6532e90a25033f39f86f8ccefe5f914fa4ee1f27fae443db45b857e110bfe7b2251704bf668cbac2311eda00943f7cf3a6d71828818c487ee2151c45eaa5fb11032a47ba9319d3fe0ae0c8bdf859b64efbac376bc9f928c93e085e2da1a2aabd67f40f28a7d155a3a4fa3802e696047e1b4ca9b88e9a21dd231dd49c166832b94b9cc0139aa20499813e3d7fbb9a81fe58ef6c137c2036a2b8be31e67e665effd9b7f56a5de308fda077a3a51443b7c277d29a6f895fc55e18303b663467e56e4f11cc93c34e7acb3f69f4dab373b82e922dbfeeb6bf0f8111b256e88c83772dfbc8623b9f6c969a643cebf6880150add2be803c1e93e6144100a3664419abf3b6e21bef88f07f5cb58d23ad3b48f27df12ca72a84081c7980a6d5cb2322c16da325454f9c5a139375d5748be804d4758d4e446347db2061a14e83d025041fe4266533e738fdce3e5d7cc37741da6088d01dfb1caa1132a80594ad6a0881ad126ddb7ac00825ae2c7b1463315048499f0f36007ff7bbe1432c65b0f1a61ead10e1b012eea69497e1e068a0fbf800ec8e97cbb94677d8287a2ce0e3c4dc1b17ed001d0063e02ada626bd968be58f249c9b40d32cf5a45e1f8678ecd7c0356119f810dc5409f10c111af0ae93a5cbf1f023d91c7ee4c6e437c597b3b7ae6fa37843d2a97617040cdfe978d7f7239e9bad087ca9a6914cf9d25949a89bec45e9fc68d653f0b25856fe4d38b7f083eaf67489ebb6eaef36a3d42430b6506b96f4f49449edff2a0c69f8ff0a6d5a30238e69ff47f47408a39b03f2ad6e28b3ead18a5b95b5e04a319c376226a066e4983cda825d7f27b5a7c1ce794bfd43dede078d5cbc918201fe94b3b1782539bc999c152008d0375a45c00e3e4c30583f1480a6eb613f566fca28e2261f6665531130243f7f9e8a46aff137a070cae8b91f311ffb8ef765c604bd6235ae5aeec1e925a03993778da5d18f4087aca071a60f3bfb1cdb335da90bff986e29f81b41207c43cec2ac643eab0ede43f83a70fa28f785a9efda552905107d4aa86fae71578e89063994e1381b6f386acd973ede888d984988d24f84c1dbd3d9d483fadf27c1117a927c4c86aeae388151ef1a370140da65a6b4f31fd7e356cac37d6288a618de166f48d96a1a057a142478f62268956d25856aae6bd10c4146c16dd7a8c9f4aeb6449876ca8892e0476c5c05a77f577849a41c77b6bd9c8d274c86d1f86e05e79f262f3ac283c62cbe1ed5d76be8af7647745dc9fcfc7ef76b9695eed88c5bd87ad0a774d422d042f70f5d69b59410738b92bd11192393d70f6ca83e056027bf21db40c206d92e3dbc7f84fa76dbba4c7ef040780f00b356f2cedfb5762aa92bef7ce332d9681f315eca39127c2bf28b5fcff096ce872a2de5cd07f9f008f1e002648342d3ab8cb24c59e5bc6f22d55e8ad740d2e3e5c296f501597cce032529d91cb4c8f3e2e1614cc6ac442f4141ba2156e6853d92c0c92830e594e629f163b3822498b9030fa8ee7d7a2bd12c1f5bb0c0e560dd76faeff3ec1c9b94be169ee9ce2cfbfb64a4668bee5c591c92c55d840a344ace2087e019fe5ddfef9ef3e163ff8f0bae5991c1bdde9df167ed629a318d2559472b7cc5372b7805fbf951afbd3ce9656c98ff71a5dabe49d8aa17b76d30b0f1a57059336997754201f26f92d00aba73b9dbf20d230db0861d0dee837cb35d41c09b8ddfb6e1b8419312f1da554f289bbdd00ef2a322261fc9f6d0948d2ed252fd014a4551c52f8c24ac50310afd593746c0bfca9dafb6c0182228ec6ff9c94a46910ec160a647a7a595c30ef20264e5a3722649429673ff8c09fe41050c795ed3f37b508b44e1ed64ac840f7ccdbb24314c7103c163a0dfbcddaf9b538ed84e9dc9815a515d2cec8360b5259545a11e7b4caf65bc8a2afb2422565f26bc1db1bdd7387e3a0fe93c81dea340ef0156bbf97c590831081994e12f78598718f2aee391b05b843b40259880cb7909796690744da690eab0219a6d9167763528eb543779da463312b16612cd58cefb05a67b7a3750a09fc69d1dc1596bb836ec82713156691959a9dea9f523f58eaaabed20c586c84cfe8bb924294389384eb31825983cc87a883810ffab25ce4b6534a2a675ce444154ae2fe5213420dcc3c80f735bda97ce3745eebc2140e149c7afbbcf2475cfca41e5a0bd835fe242ff327a74e557c91818224be9293635eebde93f53c6f324da1ac4575d185737e3de6c648aab5c7956d1c85c91e8aebeb1ffd7d0abf92a7bcdb337199c0e59bf3ffdd51785033de2a4671507f8ff494c307bda8511939e388445e653187ec298c596d687934db9468239169cffbed3932cdbabb1acb2f2399ed9ff661151b7dc7c39efd944076e3c997c074cb658842f51456123e6b9dbdf65348f6bcef9d72addd83050759c02176a9ffda68dbbb53aceb8c5f830cbc21726f7f69b469657bd261bd005354c414cff787790b41d7af24774381885bd97ad6d544681e9a9c3dc3c7b16264716ce01add9caf030d790c6f0e67e3cc84e4de7badbe8cc0bca0fc45efc25f17c6bb15585acfa2634d0743a389128ce3744f44a6c3a3f4115e0facbc21c8f3b3c54113975a04a507b0a698841e138a4ab4a6b261606888975b3109a2daac921163d08ecdc73fbdebf32d268b14261bbbbf72a87253ada149402fe8a523cf53859040feec3c926d3b8c402d1149352fbb9e0bfbd07e5daf659dd6d6ee6bab3f94e75334c8bfc05ebea7106dd71c1db0d5591b6d4f923a70370d9afe3550e6312e1bdf15a19741dccecac9c171adf2eeb49f2f50b4972b89187bd340ec1e7aa74dbc17b1e9b61381c33c662d1c79f82607982f2d237b09911fe4585f1286f608c4ffe98dde08006ad93b60291d8412191a17e676ea07377e7b2894249fddd69ef6d1eb7674063ba91c12fbf9e6f09e945b60233fd5411651e4f775aac89eba94d66730c6fd2a44b3eed3aae4530f7be36b10a99538e24cf2f72af2a454c0af0abff85e1395e5cf444aab6955a62dc6699458c0cd32dc114b8611f141567e4bcd6a112c1439f4786c43eca38ec483b7b49ff4c29ea09882183ec0ffbe6b081f8dca71559158ecf426bde079b1e6ebd8a5ff379f100ffc215a2f9433046da47d9601193745b3b0e2aa002ba25df5f2f9375a67ff6769f00c8364aaf4562aef067c23802387844600fb8505b5060ea6d985726cefb1af89ac84a6deba2df0ab779c767e8be8c4f3efc506a8274d637899346462bdefd1270ebd4a76be0e0690891972da396d10d9d1904a367c41101c2d699ba3035de5f37fe012819ece5ba3f0f1e91f74f3375cba2193cca6aa121c1032f0bfe217ac4192634e8b017ebc0461d064c7f0b462d5814ff0703761b2cca47b8fa4d6c9b154628000eba7bf45688cde204f6e2927f27e74989d6594ca68fb2f31a965d2d7edf899ca53895fb08d776b79e11859f8a53d89c8e55973dc7e926a327123c701b1659b81fefa2c8c938dea19cfc65ce74faa0d5d4ccace2883c0394573c1a99951623bea30145771c5568ec7ab66eba3fc5d380fb4d8159f501ec20a2f7bf3f5e1e566895bdc9371a9d67e7cd591a8616fd85b3bb74c914a0e5c5ce581dbdb7aff6416d291a66c9e49b9c74043786f772303dd8814483fac098f3da8923aee043c62fa1c1d77585f9ac36b25a354fd040975332c78beab4853c9f89a184c986e30fdda05fc1bc9211824e532ea3db02facbc7baeaeb42ef2ce2d7be85b3eeacbaa440c6894a4c73f995b9b4d6b2b4adffd0d8ea2fce59eafe40cd83e538f436a3e54637c0e383e33850dd186727062fd2c91e76d7537dc5f2c70d28c2376413c359824b4cb89ae448b8952529084c9acd105b046fb54905a530d1232ea9d0928f88b302f5e9e113c64512a4a7197fbae11cdb6189dbed8db2989e6839a4a077426149c08ff73432dbeede9436fc0d4e0fa18a357030dc38f4a5fd5b60bf5a1a482ca07ff7ecbba35c7a45d661cd79f8c6da9643274ffac6f9781142f4fbae25f73b678888c6a631eb275a2cddc19bf340537e7ffc12385ff391035d80564f476b09e1c11d6a6af46bfe040771601018c4e0604823d398f31ca4c9947f0ca1ee73e6a06e26caccabf8be7905621c85fc4ad4a9e42e4d5b4e36cf2e73e50c9113e4fed101031bb3132a0d5f5f7b346b6a0145ff82012b85a5a43b7fe81688a2ca49f8fe0627ee3e3e0c10ce5aa7cd7e916cd859894ec3d3c6ae8f708f7395a461e1f6106abfeba9a08d7312d61a103b50ba77d13dd94f3588a379392d3b0446fd996ab880991ed7f66529503c79be442acb1bfdd8152735fc1b029105a6726d29646859a92412f9a670d3479a58c58dce15e901744ba3cf43e05f0f9d137c670e0fea993a446cc6171b62658bf862b6eeebcbbb62d509209c33d748fd249d01fa1197bb143dc64953fd5a78d0b69bdc6544f0bc9d35e67f0bda30cd5d252f17c00e064d8a628a9d7d8fb819cdcc0504141fb0bf21b2a9c58c44eb99032810fcc9c27a756abba4d354fb6d8289a934ddd1ab3830988cedd0384fc99600e444bb4e7adee65e44bebe9627f38fad8cf28a9d9510b3e8f269de6b21e4ce530e95793836ad9fe2d39a37cd5c684447422843a331bae0403818d5a7e05af7f80e0f46de3500ae92215c326ed88191a055413418c7b7e18fd417e4c9be73511274ddd207834d664a90", 0x1000, 0x1}, {&(0x7f0000001240)="0ef20d3a39bf6cc95e6e189fd641f7754328581d57c9ecf65d2db79588f204b7b69237482bea4b231532fa79afbaca9e2f98daf84f358b4b590a3bfc8a116b7efa32eb109b9bcc2c441afe3ef8fab6d98f11b62591e46fb38af08adb8520072f2a9e27de9ba54a75d95d5097f5a0fb0dc97a2bfc4f863847e858dbb0b49f1876c4c4043c1c41fa727df404c6e6feca03dff97b48db8cf94e03f7e23b3754d10860f55d7f2edb260a32dcb1da3bf0870fba2de1fd83367fd9b3be", 0xba}, {&(0x7f0000001300)="9392c40cdf91cd2f2fe96d9c8adc2a54d33b27a202bce35cec2b00b440ba732c797a47243483b0bea601d7a95869a829f70b7d10c5be087e1355f0da8ccdf9dff26f3fe0dcd7b40d6477ba0d24409b50b354ef304a292bb4080ea513e91812867e7813942906c54593b65b0fc1203f", 0x6f, 0x1}, {&(0x7f0000001380)="e541ed295fa2fff7445c74c3a5144d0da1728e0657fe1c1712f0675b5078f545f13e3ec16e1140950e9e1de0cb0e9359bb5759346b3a94be1aac91ad37c835df8ee1a0746bf95a2cf3707f6817c80be90e5008f50e87fc9c3d14c5be15d4d7553738c64701215ecf819e", 0x6a, 0x2}, {&(0x7f0000001400)="358202bd6b04b1f63778b66c857c658994d059419254be5314be4100ae43573182784a59c2c39e12426b5c553e81", 0x2e, 0x2}, {&(0x7f0000001440)="1f14855e31a5e660d29b49d02c257bc94b409fb7e8c8f4260a93c76e7c3c29ca3906f59bb394a18ec4aeb1715c7e77d4a8dfdb8f592aa5ec7fbfab4f4531d322526c82c3935786aa108a62438aafef000ae12621cc5dae1343bc282178018edca0627680f015588894733ffc26b7e7d2f4116b212f7c47f37b979e527e0cba0726d72505fea1950fe5bea46057de97b009b6d837f73a3895fa8ab6e90eefbd5e3f4b75ade3d9d8211458f5c1db192326c4f85c8c4a78b74d535642188c047f1ff37a966fffd55ab1a0049a5237043ffcd7385f9354e1f0a5a84cb3", 0xdb, 0x2737}, {&(0x7f0000001540)="5112cff13ee6e4674fe18d6188cd40bb9186e78a408a5d28fef8db3a62d746a8789638f3c74175c96ae3a522f37eda79807359219f40b3675ccf9a53a1941567f7d04c14c5a42056771a5148c0237cb118d70d9d616f87", 0x57, 0x3ff}], 0x1120850, &(0x7f00000016c0)='\x00') r3 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup2(r5, r4) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$TIOCL_PASTESEL(r6, 0x541c, &(0x7f0000001840)) write$apparmor_current(r3, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:57:37 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_bt_cmtp_CMTPGETCONNLIST(0xffffffffffffffff, 0x800443d2, &(0x7f00000001c0)={0x5, &(0x7f00000002c0)=[{@fixed}, {}, {@fixed}, {}, {}]}) r4 = socket$inet_udp(0x2, 0x2, 0x0) r5 = socket$inet_sctp(0x2, 0x5, 0x84) dup3(0xffffffffffffffff, r5, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000000240)=[@in={0x2, 0x4e20, @loopback}], 0x10) sendto$inet(r5, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r5, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x25, &(0x7f000059aff8)={r6}, &(0x7f000034f000)=0xfeb5) getsockopt$inet_sctp_SCTP_MAXSEG(r3, 0x84, 0xd, &(0x7f0000000100)=@assoc_id=r6, &(0x7f0000000180)=0x4) r7 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) 00:57:37 executing program 1: ioctl$FS_IOC_FIEMAP(0xffffffffffffffff, 0xc020660b, &(0x7f0000000080)={0x6, 0x1, 0x0, 0x4, 0x3, [{0x5, 0x9, 0x9e9c}, {0x0, 0xf5, 0x8, [], 0x100}, {0x7fffffff, 0x3, 0x7fff, [], 0x288a}]}) r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) ioctl$VIDIOC_G_OUTPUT(0xffffffffffffffff, 0x8004562e, &(0x7f0000000000)) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0)='TIPC\x00') sendmsg$TIPC_CMD_SET_NODE_ADDR(r3, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000810}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x24, r4, 0x100, 0x70bd26, 0x25dfdbfb, {{}, {}, {0x8, 0x11, 0x8}}, [""]}, 0x24}, 0x1, 0x0, 0x0, 0x40001}, 0x0) [ 665.440415][T26010] bond0: (slave veth421): Enslaving as an active interface with an up link 00:57:37 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 665.501765][ T26] audit: type=1400 audit(1589677057.483:1223): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=26023 comm="syz-executor.1" 00:57:37 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) r1 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r1, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r1, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) r2 = socket$inet(0x2, 0x6000000000000003, 0x6) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup2(r4, r3) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(0xffffffffffffffff, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) ioctl$VIDIOC_DQBUF(0xffffffffffffffff, 0xc0585611, &(0x7f0000000240)={0x80000001, 0x4, 0x4, 0x2000000, 0x9, {}, {0x4, 0x8, 0x3, 0x7a, 0x20, 0x40, "a27c9b6b"}, 0x0, 0x4, @userptr=0x4, 0x6, 0x0, 0xffffffffffffffff}) ioctl$sock_SIOCOUTQNSD(r6, 0x894b, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$KVM_PPC_GET_SMMU_INFO(r5, 0x8250aea6, &(0x7f0000000080)) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r2, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r2, &(0x7f0000000080), 0x0, 0x0, &(0x7f00000001c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x3c}}, 0x10) write$apparmor_current(r0, &(0x7f0000000000)=ANY=[@ANYRES16=r2, @ANYRES16=r1], 0x1b) 00:57:37 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0xc000000, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) [ 665.887759][ T26] audit: type=1400 audit(1589677057.873:1224): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=26014 comm="syz-executor.5" 00:57:37 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:38 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup2(r5, r4) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) r9 = dup2(r8, r7) ioctl$PERF_EVENT_IOC_ENABLE(r9, 0x8912, 0x400200) ioctl$sock_bt_hci(r9, 0x400448e7, &(0x7f0000000180)="cb18f9564a1ef84efb1a43c0c3041f31741b192b3192c9a34f930389e3e7f83791497f5466c6967a68ad43977a06b34ac2e765b139a4f719f37f0f11ec062949e33d1431d06f0d9960486a304f3b3523be79d3362de01641c2ae214bac5739529baafb78041a1658548a6ebcbed42362e3ed80d3b3a14f4fe1e1414c78f478a63329a251a7a48bc5f21324cf320f7cef4b829f7e8b75c85daf6bfb0b877e42b0d8c283ddbf58cc9799b8c9514199cab5805f9db1281e4c7eb2cc094c0793e6743929f121e786cad0a0fedf0be979df054f49507dffd2c0c3b95c35bf5b61b806d28af9c45f4bedc1161a0b5c") ioctl$ASHMEM_SET_SIZE(r6, 0x40087703, 0x0) syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x5, 0x713280) [ 666.129027][T26050] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:57:38 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x3}]) 00:57:38 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/hwrng\x00', 0x1, 0x0) r2 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r2, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r2, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000340)={0x0}, &(0x7f0000000380)=0xc) r4 = gettid() ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(0xffffffffffffffff, 0xc08c5336, &(0x7f0000000840)={0xffffffff, 0x400, 0x1, 'queue0\x00', 0x2}) ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x3c) ptrace$cont(0x18, r4, 0x0, 0x0) ptrace$setregs(0xd, r4, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r4, 0x0, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000740)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000700)={&(0x7f00000003c0)={0x308, 0x3a, 0x4, 0x70bd25, 0x25dfdbfb, {}, [@nested={0xbb, 0x43, 0x0, 0x1, [@generic="cc8d2f2914a95a8b7dceeb64ef2410786b8a75b3a2af9df46e7c108c70a1626acb2a93d99fe906b8d57d9e1e26850c5faf65f0baf218bd59b56a34c755ff139e9fd2889aac1104e208cc65e2138635e0ac8e5b710ec058c4fddd3d4d6b20535405d775858351914c04862707d8c9babfa6a322696c2a64dcc1fa30807ea786ef3133f41377624a1bfc0dc76eb635f536ab6825613387d04feab0d9ac9a4f18d62a9bae7060f76862d4a9cce3590221", @typed={0x8, 0x5b, 0x0, 0x0, @u32=0x2}]}, @typed={0xbf, 0x28, 0x0, 0x0, @binary="2ed2481600122713c9383ffd9d8e7fd2ead6048a316ececf764b5bd4e3d4ef8889310315fe967abff26d11f131d1426f5a2d69819b2d0a5372f7d3f001ecf95dc377b15bb8afbe09737d0bea5a9432e6bef0a8203a1f01d9d9ae388b714b389b41cfe4f13e53c0116fe19703d5ce4754604aefa5ec6ed44dc9ff00c067e7b479df9870be3815e72c1ed9fefbdcd81116c7412d1b8c68edf2c3dca1bac6239c1bb701892ecab55e64b60a7a479c44433d3280053b015ca1134e99a7"}, @nested={0x53, 0x4b, 0x0, 0x1, [@generic="c8fbd9938837d6a4d7d7ac2d800f51fa634814f47e05376c00bbc142cafdff0dfaa81afe16762d59df20f0", @typed={0x14, 0x73, 0x0, 0x0, @ipv6=@mcast2}, @typed={0x5, 0x86, 0x0, 0x0, @str='\x00'}, @typed={0x8, 0x53, 0x0, 0x0, @u32=0x2}]}, @generic="8f1c84d15f80fe12889dd2dc8db37e4cc36d75a6a78c6c75ea06a4a11d5bce01b4a953278a479f4117a5630684085c24724d4c67d2e2f96feab4276343a9e8ce14e529f25bac4702911fa00f779bfa80ff72772eef4d1a5b6b802a4616a27c5f39cb2d8e53d408c2d80346cc208bc5451141c8338a78abc47505ec51a58616de", @typed={0xc, 0x8c, 0x0, 0x0, @u64=0x81}, @typed={0x8, 0x85, 0x0, 0x0, @pid=r3}, @generic="e15a7f8d5b8c6a6b3f5ecdf99c8dc2bd2dad738fe57d43f3291dc910306ac537969fe7168cd7fc9dbfb041df5ace5501787449559eec1479d539baed67ba5770c45d592121d2858d8aa858c3eb9fd9142c349fd7f7a23332cc19f134f8c1ca85be43356da7b9a5c1751bd0ca1e93930ae7c1a208360018a07919725482", @typed={0x8, 0x65, 0x0, 0x0, @pid=r4}, @typed={0x8, 0x13, 0x0, 0x0, @u32=0x101}]}, 0x308}, 0x1, 0x0, 0x0, 0x14}, 0x40) r5 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r6 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r6, &(0x7f00000000c0)=ANY=[@ANYBLOB="7065726d686174203078303030303030304a30303030303030305e6370757365746d696d655f74797065000f0e5ae8bdd157c6317714209440c698593254c2ce29158cd2643c93892bfdde2823b83606134ea4b0cea289892162a4281a79d45059a3f85ff03d1ff4bca52623efd4"], 0x6c0) sendto$inet(r5, &(0x7f0000000780)="bae7fc3ea015a33d90fee3a8b308082d2d48d90427892772d85b7608c25d66626d22a22fb4693283331993035d5e3b1ccb92349be40a5562098202cbae2ecc5e2d7f7cbff773215de29bb57938a583cb86c320b70b47153a1e7cd68e0b84bc2273e4e9ee2b5d2fc59c12efe6d86ac87f87df8784750fb405821de79d8e60a9a7925944a9c604ed7609dd44bf9e8e45f7790ea68d970c126867eb2d45ad9fd8f44618d9e4", 0xa4, 0x0, &(0x7f0000000000)={0x2, 0x4e22, @loopback}, 0x10) 00:57:38 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000000)=@hat={'permhat ', 0x10001, 0x5e, ['bdevem0%locpuset.proc*\'usercpuset\x00']}, 0x3d) [ 666.218095][T26050] bond0: (slave veth423): Enslaving as an active interface with an up link 00:57:38 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:38 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$inet(0x2, 0x6000000000000003, 0x200) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r2, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r2, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) r3 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r3, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r3, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) r4 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) r5 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$SIOCX25SCUDMATCHLEN(r5, 0x89e7, &(0x7f0000000080)={0x5e}) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) [ 666.292505][ T26] audit: type=1400 audit(1589677058.273:1225): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=26064 comm="syz-executor.1" 00:57:38 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) r1 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) r2 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r2, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r2, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) sendto$inet(r2, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x400, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r1, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000140)={&(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000080)="f45f3b8de534aac1aa942010a10dceaa2761807c1f631de00311f3dd5190a2be38c2db726466d0b4331353f250057f8d03b9645d2bdcc4416b4067c381c8ab3e97c04badfd09c2affea23aa0bad65b1a3e313510468867afc525f4270637f439b85647e8b28f77e0e408b3375da8c7b3032c4dd385d0310c44a6d1ffb114ba499fd68c00d49959c21962ea34268a915b84", 0x91, r1}, 0x68) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) 00:57:38 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x141783, 0x0) setsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f0000000080)=0x1, 0x4) r2 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r3, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) [ 666.613184][ T26] audit: type=1400 audit(1589677058.593:1226): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=26079 comm="syz-executor.1" 00:57:38 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0xe000000, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:38 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_buf(r2, 0x0, 0x3, &(0x7f0000000080)=""/191, &(0x7f0000000180)=0xbf) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) 00:57:38 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:38 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x58, 0x3, 0x1, 0x902, 0x0, 0x0, {0x3, 0x0, 0x4}, [@CTA_SEQ_ADJ_REPLY={0x14, 0x10, 0x0, 0x1, [@CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x1}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0xffffff5e}]}, @CTA_PROTOINFO={0x30, 0x4, 0x0, 0x1, @CTA_PROTOINFO_SCTP={0x2c, 0x3, 0x0, 0x1, [@CTA_PROTOINFO_SCTP_STATE={0x5, 0x1, 0x2}, @CTA_PROTOINFO_SCTP_VTAG_REPLY={0x8, 0x3, 0x1, 0x0, 0x54ce4dc1}, @CTA_PROTOINFO_SCTP_STATE={0x5, 0x1, 0x5}, @CTA_PROTOINFO_SCTP_STATE={0x5, 0x1, 0x6}, @CTA_PROTOINFO_SCTP_STATE={0x5, 0x1, 0x3}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40001}, 0x20044041) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) [ 666.716582][ T26] audit: type=1400 audit(1589677058.623:1227): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=26080 comm="syz-executor.5" 00:57:38 executing program 1: ioctl$SG_GET_LOW_DMA(0xffffffffffffffff, 0x227a, &(0x7f0000000000)) r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) [ 666.882417][ T26] audit: type=1400 audit(1589677058.863:1228): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=26093 comm="syz-executor.5" [ 666.927296][T26099] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 666.978837][ T26] audit: type=1400 audit(1589677058.953:1229): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=26102 comm="syz-executor.1" [ 667.060380][T26109] bond0: (slave veth425): Enslaving as an active interface with an up link 00:57:39 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x4}]) 00:57:39 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x2], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:39 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) socket$tipc(0x1e, 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:57:39 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup2(r5, r4) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)={0x44, r8, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x1}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_LNS_MODE={0x5}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @remote}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @multicast1}]}, 0x44}, 0x1, 0x0, 0x0, 0x4020010}, 0x0) sendmsg$L2TP_CMD_NOOP(r6, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x3c, r8, 0x8, 0x70bd2c, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e20}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e24}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0xde}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x14}, 0x4000) 00:57:39 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r0, &(0x7f0000000040)=ANY=[@ANYRES64], 0x1b) 00:57:39 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) [ 667.433053][ T26] audit: type=1400 audit(1589677059.413:1230): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=26119 comm="syz-executor.5" [ 667.461485][T26130] tproxy_tg6_check: 17 callbacks suppressed [ 667.461491][T26130] xt_TPROXY: Can be used only with -p tcp or -p udp [ 667.502356][T26130] xt_TPROXY: Can be used only with -p tcp or -p udp [ 667.515417][ T26] audit: type=1400 audit(1589677059.503:1231): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=26129 comm="syz-executor.1" 00:57:39 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x10000000, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:39 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x3], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:39 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="5665726d6861000000803030303030303030307365746d696d655f74797065000000000002000000000000"], 0x6c0) 00:57:39 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000200)=0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) fcntl$setflags(r0, 0x2, 0x1) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup2(r3, r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TIOCL_SETVESABLANK(r4, 0x541c, &(0x7f0000000080)) timer_settime(r1, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0x40000, 0x0) timer_getoverrun(r1) 00:57:39 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x8, &(0x7f00000000c0)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) [ 667.719409][T26139] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 667.730549][T26140] xt_TPROXY: Can be used only with -p tcp or -p udp [ 667.812807][T26152] xt_TPROXY: Can be used only with -p tcp or -p udp [ 667.845960][T26155] bond0: (slave veth427): Enslaving as an active interface with an up link 00:57:39 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup2(r3, r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_MAX_THREADS(r4, 0x40046205, &(0x7f0000000000)=0x7ad4) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r5 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r5, &(0x7f0000000080)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_\x00\x05pe\x00\xd7a0\x1cY\xef\x9fW\xa2\xc9B\x9cH\xc22\x91\xf6\x92\xebGq\x13\x9d\xc8\xe0\x11\x98\x95\xa2_9^\xd7\xf9\xe2\xa3\xe5\xf3A\xbf\v\x13$\xd3\x98\xcb\x7f\x93y\xde?:\xcc\xc1\xddO\xa7N\xa3\xfc\\o\x9b\xc4\xd7\x89y\xfa\x82\xad\xa6\xcc1:\xce\xbff\xe4\xd8\xc7\x05\x9el\x84\xfa7\xd9`\x02p\xa3\x1d\xaa\x92p\x13\xca\xbdt\x19\x81\x04D\xe9\xcc\r\x95Kwa\xf5\x1d\x8e\xb3CY\x94s3\xd9\x8a\xbe;\xab\x9e`\x86z\n\xc7\x1f\x9b\xceY\xf6\xc7\x1b\x1b\xb9\xd0v\xb3\x12r5Z]7\xba\xf9V\x8az\xae$,\xbc5 \xa5\x06\x1b[Q\xe9\'\n\xf4a\xd8\x94\xa8\xff\xcf\xe3\x8dp\xca\x1a cg\xaa_B\xb9Pe\x95\a\xcb;H>SR\xcdj\x98\x90.\xdfy\xcd\xa1\xe8\x1b\xc9']}, 0xfb) 00:57:40 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x5}]) 00:57:40 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x4], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:40 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) dup2(r3, 0xffffffffffffffff) accept$inet6(r3, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote}, &(0x7f00000001c0)=0x1c) r4 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) setsockopt$inet6_tcp_TLS_RX(r4, 0x6, 0x2, &(0x7f0000000100)=@gcm_128={{0x304}, "5280d492d34b11df", "b602ffb5ba9467332abb75f02b5f6d84", "70eeae8b", "5de3f3c182af18a8"}, 0x28) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)) r5 = socket$inet_udp(0x2, 0x2, 0x0) dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x3) r6 = syz_open_dev$vcsn(&(0x7f0000000080)='/dev/vcs#\x00', 0x1, 0x40840) ioctl$DRM_IOCTL_SG_ALLOC(r6, 0xc0106438, &(0x7f00000000c0)={0x3}) io_submit(0x0, 0x1, &(0x7f0000000300)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x1515, r6, &(0x7f0000000240)="b24740bb5d95f58c0d7ef8247a97c97988fe6e36d2c8e28bb8d97ed238cd59548cd87a3cda60b9e0e115d575d3ed2c78ad6e4a58076816a4bacdb869ae8bd51f21f1139264520a237da3dd2de5c4835731960373baa63f700fd668f61b9e7690939202e26bd240450c87d39ba0f8db8c393375331aaa10463e5c3253639fde4683", 0x81, 0x7, 0x0, 0x3}]) fallocate(r5, 0x4a, 0x130d5ef2, 0x8001) 00:57:40 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x3f000000, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:40 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup2(r4, r3) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$TIOCGISO7816(r5, 0x80285442, &(0x7f0000000000)) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) r9 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r10, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r10], 0x44}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r10}, [@IFLA_MASTER={0x8, 0xa, r6}]}, 0x28}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'batadv0\x00', r10}) 00:57:40 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) getsockopt$packet_int(r3, 0x107, 0x14, &(0x7f0000000180), &(0x7f0000000100)=0x4) r4 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) [ 668.461004][T26176] xt_TPROXY: Can be used only with -p tcp or -p udp [ 668.476186][T26174] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 668.549583][T26185] xt_TPROXY: Can be used only with -p tcp or -p udp [ 668.591811][T26175] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 00:57:40 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x5], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 668.687515][T26186] bond0: (slave veth429): Enslaving as an active interface with an up link [ 668.744071][T26181] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 00:57:40 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=ANY=[@ANYBLOB='\x00'/13], 0x12) r3 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x4441, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup2(r5, r4) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) fanotify_mark(r3, 0x40, 0x8000008, r6, &(0x7f0000000080)='./file0\x00') [ 668.895007][T26207] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:40 executing program 4: r0 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r0, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r0, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) getsockopt$inet_sctp_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000080), &(0x7f00000000c0)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r1) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) io_submit(r2, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r1, 0x0, 0x7ffffffff000}]) [ 669.086319][T26207] xt_TPROXY: Can be used only with -p tcp or -p udp [ 670.278458][ T0] NOHZ: local_softirq_pending 08 [ 670.283501][ T0] NOHZ: local_softirq_pending 08 00:57:42 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = gettid() ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x3c) ptrace$cont(0x18, r4, 0x0, 0x0) ptrace$setregs(0xd, r4, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r4, 0x0, 0x0) timer_create(0x7, &(0x7f0000000040)={0x0, 0x9, 0x5, @tid=r4}, &(0x7f0000000080)=0x0) timer_settime(r5, 0x0, &(0x7f00000000c0)={{}, {0x0, 0x989680}}, &(0x7f0000000100)) setsockopt$SO_J1939_ERRQUEUE(r3, 0x6b, 0x4, &(0x7f0000000000)=0x1, 0x4) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="7065726d686174203078303030303030303030303031303030315e1dfc37dd40916e33ef9e581c03c2e7dca97d0fd906263bc988d4a579e47aa05b7c6ef92072f95497dd143bdc0d8883b40dc6c03123fad43e461c5aae2f62f7a7e1dc385a503b40eeae6e6ca3a8ac171c2cd0886562bb4a25a229d7de49e2b0e2255160ca1f022b366f9bcc54f4f0e59b1753ac843e24d1276746816efcec6a493a741ed65235bdf2cb6722fcba769191f835e9a53f1a61dfe84b46be89e8022b2429224b14595e09c0f9fd2ceefeee"], 0x1b) 00:57:42 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x40000000, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:42 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$VIDIOC_S_JPEGCOMP(0xffffffffffffffff, 0x408c563e, &(0x7f0000000080)={0x8, 0xd, 0xc, "49c647d74af8563b298e0f0dad461df287c376c09eb0eba3f15c8cd33db2ed8b5e7c500d87d9467155e74f7f501290b6f5b172f5f9aa7614d43c3ce0", 0xc, "1b3608c8443f747a252936bb9b29f4b68b06bba2f20c79ecc3a9796c1face6cd2af95d292163f89b88476e00497fde86dc7f95a385e1f95a8dd08fbe", 0x28}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) mmap$IORING_OFF_SQES(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1000006, 0x50, r1, 0x10000000) 00:57:42 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x1, 0x0, 0x2}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0xb, &(0x7f0000000080)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) 00:57:42 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x6], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:42 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x7}]) [ 670.784290][T26228] xt_TPROXY: Can be used only with -p tcp or -p udp [ 670.807299][T26231] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:42 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x7], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 670.848914][ T26] kauditd_printk_skb: 4 callbacks suppressed [ 670.848929][ T26] audit: type=1400 audit(1589677062.834:1236): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=26226 comm="syz-executor.5" [ 670.855611][T26235] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 670.922791][ T26] audit: type=1400 audit(1589677062.874:1237): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=26226 comm="syz-executor.5" 00:57:43 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x7e54c0, 0x0) write$P9_RMKNOD(r2, &(0x7f0000000100)={0x14, 0x13, 0x2, {0x80, 0x2, 0x4}}, 0x14) ioctl$SNDCTL_DSP_GETIPTR(r2, 0x800c5011, &(0x7f00000000c0)) r3 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="4800000010000507010000f70000000000000000", @ANYRES64, @ANYRES64=r3], 0x48}, 0x1, 0x0, 0x0, 0x20000094}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c001280090040000000616e000000000c000280060001000000000008000500d9e3fedd4073dba6be8984bdb307000000004f0b00f9d549a006dedfb1e7f820c29f14da494ee043806ee17b08e644fcba67237c41d116b58f551f9b5a46dc849721fcab2b9155621218cd71be00d907d106d8238818a7de41c26f54f6506552682ef415fa8f46db50c7a44774b3fcba5afc9424fc96fd09a2c6ddbe7797a3ffbbbf3c3fc0305ca89f3814bb06108e2e4bd2aa55155b035166af8a10c288e8366e", @ANYRES32], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="202000000000000008000a00dc7a13601d82378b30edacd79fb20116be1b01a0da78b3e7ea81cd98a017b4927ea80f0415495d3d3000434851c422a75757b139139975d5a8310c9d6b49da0d091514209104c352594bd7105b4ceff0d4aa9ac1866027f8578e421c6ca0dfd042e7b34e2ce0b03b80a7c70255ebfd45188761df394361b5ea5f49873c4a9329e9a8a56d951133fac6b3d1ab5c84a7f498c9", @ANYRES32=0x0, @ANYBLOB], 0x28}}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup2(r5, r4) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) bpf$MAP_CREATE(0x0, &(0x7f0000000180)={0xa, 0x5, 0x7b800, 0x1e988682, 0x52, 0xffffffffffffffff, 0x7, [], 0x0, r6, 0x2, 0x4, 0x5}, 0x40) r7 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) 00:57:43 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nvme-fabrics\x00', 0x40280, 0x0) write$apparmor_current(r2, &(0x7f0000000080)=@hat={'changehat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x2d) [ 671.049097][T26241] bond0: (slave veth431): Enslaving as an active interface with an up link 00:57:43 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, 0x0, 0x800, 0x70bd2d, 0x25dfdbfc, {}, [@FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e24}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_AF={0x5, 0x2, 0x2}, @FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e22}]}, 0x34}, 0x1, 0x0, 0x0, 0xc0048c0}, 0x80) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) [ 671.234000][ T26] audit: type=1400 audit(1589677063.224:1238): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=26257 comm="syz-executor.1" 00:57:43 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x52010000, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:43 executing program 1: syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x5, 0x8000) openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="706572233e6a8f0f593ea03f8be9d774203478303030000000"], 0x1b) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000200)='IPVS\x00') sendmsg$IPVS_CMD_DEL_SERVICE(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={0x28, r5, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_SERVICE={0x14, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}]}]}, 0x28}}, 0x0) sendmsg$IPVS_CMD_GET_DEST(r3, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000380)=ANY=[@ANYBLOB="24000000cf3cde02c00baf32fca374da88adc6c0150e0b144e856766b88275e4c9ac4c3775767fc9953da64d1f5e2974b0fbd04270c0d82da73adee4432d705297eb1ce7831c179714a50e164b4cf9e390004da77b73b8e2db", @ANYRES16=r5, @ANYBLOB="0001bd37101d3edf25080000000800060086d50000080005004364d00b0f0600000000"], 0x24}}, 0x20000800) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000240)=[@in={0x2, 0x4e20, @loopback}], 0x10) sendto$inet(0xffffffffffffffff, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x25, &(0x7f000059aff8)={r6}, &(0x7f000034f000)=0xfeb5) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000280)={r6, @in6={{0xa, 0x4e21, 0x80, @private2, 0x9}}, 0x9, 0x1}, &(0x7f0000000100)=0x90) setsockopt$inet_sctp6_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000340)=@assoc_value={r7, 0x7fff}, 0x8) 00:57:43 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x11], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:43 executing program 5: socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r0, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r0, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) r1 = dup(r0) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x3c) ptrace$cont(0x18, r2, 0x0, 0x0) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r2, 0x0, 0x0) ptrace$setopts(0x4200, r2, 0x62b, 0x2) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r3 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r3, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) [ 671.613448][ T26] audit: type=1400 audit(1589677063.594:1239): apparmor="DENIED" operation="setprocattr" info="current" error=-22 profile="unconfined" pid=26267 comm="syz-executor.1" [ 671.674048][T26273] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:57:43 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x8}]) 00:57:43 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x48], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:43 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) r1 = semget(0x2, 0x1, 0x80) semctl$GETNCNT(r1, 0x0, 0xe, &(0x7f0000000080)=""/213) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) syz_open_dev$binderN(&(0x7f0000000280)='/dev/binder#\x00', 0x0, 0xbb8b8e9288f408d8) r2 = openat$full(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/full\x00', 0x103000, 0x0) read$usbmon(r2, &(0x7f00000003c0)=""/196, 0xc4) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) r4 = socket$kcm(0x10, 0x2, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000001240)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x68, r5, 0x8b8e0eb13081c495, 0x0, 0x0, {{0x1, 0x0, 0x5901}, {}, {0x4c, 0x18, {0x0, @media='ib\x00'}}}}, 0x68}}, 0x0) sendmsg$TIPC_CMD_SET_LINK_PRI(r2, &(0x7f00000004c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x30, r5, 0x100, 0x70bd2c, 0x25dfdbfd, {{}, {}, {0x14, 0x18, {0xfff, @bearer=@udp='udp:syz0\x00'}}}, [""]}, 0x30}, 0x1, 0x0, 0x0, 0x4004000}, 0x20004055) r6 = fcntl$dupfd(r3, 0x406, r3) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f0000000240)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000000), 0x106, 0x5}}, 0x20) setsockopt$inet6_MRT6_DEL_MFC(r3, 0x29, 0xcd, &(0x7f0000000180)={{0xa, 0x4e23, 0x38, @empty, 0x200}, {0xa, 0x4e22, 0x8000, @remote, 0x4}, 0x1, [0x5, 0x3, 0x7ff, 0x1f, 0x7, 0x7, 0xfffffe01, 0x2]}, 0x5c) [ 671.849025][T26282] bond0: (slave veth433): Enslaving as an active interface with an up link 00:57:43 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$FS_IOC_SETVERSION(r1, 0x40087602, &(0x7f0000000000)=0x7) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) r3 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000080)='dummy0\x00', 0x10) sendto$inet(r3, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r3, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) write$apparmor_current(r2, &(0x7f0000000100)=ANY=[@ANYRES32=r3, @ANYBLOB="8a3b2e23a27978533df4efae4c82ba7f7e93f9f016d560cb1f7665e46c1983118b5285c2d1df236a37f8db7c287ef909d154d7b7d3418da6af64fc2e8bb1107bad074dc3d52e3c3e18dbfbde9307f46322643cc09937f436c98d9ed4d4132c9a52338caf46151544422d29d75fa3d7407c9f15a4d251cd1b9729a63ffb485a806ac3a1daeb3a0c1d743beae87bc49daef3e710"], 0x6c0) [ 671.970708][ T26] audit: type=1400 audit(1589677063.954:1240): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=26290 comm="syz-executor.1" 00:57:44 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x60000000, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:44 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x4c], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:44 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) r1 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r1, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x4e26, @dev={0xac, 0x14, 0x14, 0x26}}, 0x10) sendto$inet(r1, &(0x7f0000000240)="df9b224906076a33a0044e3ce6591adf29724000db0cef6077f68a", 0x1b, 0x0, &(0x7f00000001c0), 0x10) getsockopt$inet_sctp_SCTP_NODELAY(r1, 0x84, 0x3, &(0x7f0000000000), &(0x7f0000000080)=0x4) write$apparmor_current(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="706a726d686174203078303030303030303030303031303030b15e6ec873781c429b5b0200010000007cb130223f3a6436ac29f0007d65a7fa8274fd6306b6698bfb51587f0572564a8628fab0bacf0c47605cf5a1dddb4e66b21d9456d3b6eb2d97b7d6804dfe31ba84678812b2eb1d6ded308af319c7fb40a98be19f5e882e94bfda5bc2ae56f3b6fdf30983fab3"], 0x1b) 00:57:44 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) sendmsg$nl_netfilter(r1, &(0x7f00000001c0)={&(0x7f0000000000), 0xc, &(0x7f0000000180)={&(0x7f0000000080)={0xd8, 0x13, 0xa, 0x201, 0x70bd2a, 0x25dfdbfd, {0xa, 0x0, 0x7}, [@generic="42c9d8b588755244db083aedb93b2a09bda591baa9c08c964949efbb379e47111d74770c0693856342d0f88412c36cd1469b4fd6f90eb99ebd89418154d06de549ee96e8a5205779ec91196b712006272a3b9636e607b801cd1b573401ffd8dc7a134d766ca61dd232b6f34b9d21cc6f055058d9ce20b182e2e69e7b290316a1d621e6a2ca2f74648bfda18aec313ebde6d0d6a0da20c7cdc57ae71ef189f032ac58425ebec2fce5f2c58740b6a6c7578427c2780088b35f92469448c78e30f4c214b0ee"]}, 0xd8}, 0x1, 0x0, 0x0, 0x4040}, 0x10) [ 672.407168][T26309] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 672.464429][ T26] audit: type=1400 audit(1589677064.454:1241): apparmor="DENIED" operation="setprocattr" info="current" error=-22 profile="unconfined" pid=26308 comm="syz-executor.1" [ 672.487057][T26320] tproxy_tg6_check: 7 callbacks suppressed [ 672.487064][T26320] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:44 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="70742030da8a6cb444ee7830308124ff24ac30303030"], 0x1b) [ 672.532520][T26321] bond0: (slave veth435): Enslaving as an active interface with an up link 00:57:44 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x387840, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup2(r3, r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x3) socket$inet_sctp(0x2, 0x1, 0x84) r5 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r5, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:57:44 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x60], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 672.727704][ T26] audit: type=1400 audit(1589677064.714:1242): apparmor="DENIED" operation="setprocattr" info="current" error=-22 profile="unconfined" pid=26328 comm="syz-executor.1" 00:57:44 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'changehat ', 0x10001, 0x5e, ['cgroupmd5sum\x00', '/proc/thread-self/attr/current\x00']}, 0x49) [ 672.819118][ T26] audit: type=1400 audit(1589677064.804:1243): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=26329 comm="syz-executor.5" [ 672.834270][T26333] xt_TPROXY: Can be used only with -p tcp or -p udp [ 672.880907][T26341] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:44 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0xfe}]) 00:57:45 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x65580000, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) [ 672.970308][ T26] audit: type=1400 audit(1589677064.954:1244): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=26342 comm="syz-executor.1" 00:57:45 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x68], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:45 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) arch_prctl$ARCH_GET_CPUID(0x1011) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) [ 673.141816][T26349] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 673.202344][T26355] xt_TPROXY: Can be used only with -p tcp or -p udp [ 673.271441][ T26] audit: type=1400 audit(1589677065.254:1245): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=26353 comm="syz-executor.1" [ 673.311875][T26358] bond0: (slave veth437): Enslaving as an active interface with an up link [ 673.352059][T26365] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:45 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x6c], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 673.632657][T26370] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:45 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r4, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r4, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) ioctl$VIDIOC_QBUF(r3, 0xc058560f, &(0x7f0000000080)={0x8, 0x6, 0x4, 0x4000000, 0x2, {}, {0x3, 0x2, 0x4, 0x1, 0xa1, 0x69, "205c8223"}, 0x5, 0x2, @userptr=0x30, 0xb0a, 0x0, r4}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = dup2(r7, r6) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) r9 = openat(r8, &(0x7f0000000100)='./file0\x00', 0x111000, 0x40) ioctl$ION_IOC_ALLOC(r5, 0xc0184900, &(0x7f0000000140)={0x0, 0x22, 0x0, r9}) write$apparmor_current(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="70657269686174203078303030303030303030303031303030315ea73106b27a81af280a6359e7f810b191b6f19d22b8ce5100a71b8c565bd0e62f5feecb083d1fd7bf1b656b10fdbe53a5f049806fded669900ed275ff4f4673571adef8ec60359fcdeabf1dba63c5e1900c95bd4962b1725d10e8d901aee7febb1353b53d810bf99227d894774a21c3ee43b446b3538330d9ea54819ae05237d4e12cb8986d6aaaa3cab59ff847ccb6409f33dd891acf119e03ae4ba42e7872831907ee45aba2f77f315f6b742e0575620bb024486e9b06e4e5fa91d9ad45d6f287a81d3250cbaf8d8a70172bfe8c17e148ef6e39521e587857d9828ce698d5bfb063da5015bbb5a455054dfb6300c834a00f6f0fd19bb4a0b2af9e67db888fa26e7230990dc4f0e5ba00478ddabd09b4d853a68a67993d042cabfe678b60fd508a89"], 0x1b) 00:57:45 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x76070000, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) [ 673.745552][T26370] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:45 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x74], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 673.949824][T26378] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 674.058334][T26386] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:46 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x300}]) 00:57:46 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) r1 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r1, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r1, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000000000)) [ 674.108961][T26383] bond0: (slave veth439): Enslaving as an active interface with an up link [ 674.138746][T26386] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:46 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:46 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) sendto(r1, &(0x7f0000000240)="2d7ca4534c18c23c05f28fecff59b7041f7d25e21589e172c934fa0f5d55d5dc7a5443e28da47518b5901a7146d54a79736a06b7ac65f72adcca0889ea4ddf4456abc3323c3e7d9ca0ededa328ee4401c6b6e74039dca226401349fca5bb8d7765ad19d3e68768b4298b09e5cb2449b3d0cbf9be071d284cfea6e9ccfae1a5c90c5f13bce7edf036b3f267007edcfeb066577bbbd46abe278e737ad18dfb55c1aaeb7bdaed1c81633988feab172aead7e60077803c094d766c61579919417f49f9d5fdc54fb46f19ee8937592c4436df0b7aa31db6d78adb334ff1cb0221fc3eebe127b2471ca993fb3a4915e50104063f802738d9fcee1568378fa8425313ac7b8a23e04799f40998a5ed88aa965624ae4f218dabeb8fe3b7255f4b0c5934999c3166085690995714139b25a8b2caf7d194fe7bf8e39f5761fc6d56ec1ed2df3498a21e651d519fb9f6f1edf3ab8c9d924f7d44b19e3c151b6d9d6fed514cc299c01fbd76c9976d91f4787cee3cb0ce065de55d242d7f49cf1fa940e7d254b9d6ea0965efbfa617e2dc2f43fd57c73876782ae3f1f6dc310b03a88a4117a9e0dbe395ec2401bb21e2123cb8b9b7f428c97e8742afad92b3b8cecf33f527b00776d8670786f2203f167b92cc8afe81c808f6dbbd7996f997e480b8a3c76c450a239ca7e8c38c7e6c56121babd82180e4d93c969d0e690369f6f32798b7566132afaeffab7de8e165773a605802d88bf2e3ff3ca2a681700e186a0fb6223abbb30332d1cbe8c481a1cdc78ffd5dc8b20192a1500b2bd7762b5a0f538928e180a53c48508060d727384e18319a0f4033d6d30fe99f85ac9e4191f56b26ec7301ba1a37a2c95d74db4107ab5a9dc8a4566c40bea33547583b60a18b03d5d1c4182a234a407201994534d9ea90ef16324bc724dca1b5cae6e982e2eb651991dc9b1ee33aab66216f937d1ff9a6d17886187097c223cec9c628fc342b0ee174472f59d5e3516eca1862bc3ec1b49b583fda81d370976f24ae3e1ee600478cad30c78d271cb2c2ab69cdad8a4b803680c51dac629e577b5381b40de0d0e3a8a62ee22bd0551684b990cd3df2f59f3fc3a22d4832262f3cb4cb5f4dc6ced37a99812284c7e1c48c56159b5e9850c33cfb5919c72da75088a272a0b4f0bf93921f59079ee3b9539727d46b7265a325388b2de8c0256380297d4eec8f6fdec074ee22ecae60f7f0303979b636e77f7e16bc4298b00a3bc44eb5ec57926667f767f6fd3df29ea6c7f9c5e1af50743db0ac889cbbeabf22c53956a1f1a73147407d0de811805fc7fb07d31c86a379d4d859c51e7a2e6e617e5c055d84aeeabc689422c548b131b6809a976034b9f1ada7fd1e241535b7ba40769c4a6131dbe8029c6eacf9b16bddd5872ecac621fb154445e475683e0651ffa4b8889bd9b033d5c24e29a5f88ff78a7c7c0ea3971f1d899d5f9a56acaa5898c6314c43850cc129946673aaa4219a2db52ed50a76c9599b5e781a4a2b7aa29f3e2350ad7fdf50f48ba941633c63d58f131521dff7c70b6a6cb3a03ee1da7a5662012a3d62658d3cdd8eed5f976e240efe125eb364c9d036c34d7914d0ad9c9996b2a988cea1f735a05077f69be2dc07ac13378e255af665542fa9fed093eeb1f2d13c0c0960c7c7d98d0841f7320fa226117dd93fc062e250bd41bfe58f496781b3725e1898e4fac4ccc7d89465112bdcd1e09f8c5a4459313878328870d4ebc8f2d3c0d544f58379c1364f3980f82d4210e17f3a1b6cd718ceba741e8d0d93a06d174da90d612fd6227f944c78b1b820134c05bad257044e4867993dbbb3c55343a40bd8c22efefde58ef42c8ffbc663de93088247c15d81d341f57d15b80952646df4f17711e5498e40a871472d654aa8f0fd37cb60867450c6eec5dbbb50e395c92ec0c8abb3119a95cb0e37f0ff10f3ce682f5705cdff7fbb3591be9d61c3c971ac7a329c4ad0456ffedcb27229f0ab4d08201f653331f96a3f24433264aa1fb3eb7ee5ee8884ae3747e28ae785d8c63dae72ad85ff520776c8665bb3381f74fd0d491e80d6d073a9ef1fdc7f7aa0fb6aa9459716fab6076477e3cf2a5fe0c9287305f451ab4f2e766bd02f37ceb1a9a2233413f5a10b167d210e5b463183e30189b0825ce9e501df3ad3e5891466bdf4bbc67de5baf5f49cae02adf70ebe7e98fbef763beb26139119caf33b4e5db4775efc856a2b1c22fac4abe7d07262ae3fc5e46a4a5dcb2eccf3605beb3f381c2a8fef06bb57c9bef77eafc346d11dd243c9ad6ba123d49df6be7dbd6638ccf138604edd514812acf1427566cfb7305c365475f1809934732a60562cec538f98d4e875d3cefbc3eb8f9b797f51b14c4059cde87013f0dd725da7a3f9d24579ccffaab38a4f5a3b25ec19215ce14a8603049f1400e9628d3f660d378b6ab14b7d2861d71a5444244988799dbc75162d4a83384a3ccdb74b2efd0059bfd7d77317574ecefb59a6dbf82d46ffbee0299fedb6ac83fcdacf2f145775531dfd6c4201bd41491364ada726c0c4c91d4c0bc8d81b0d53ab77aa86bccd301414d8d3df9e1d245534d06c249f4519899fde044131754da2f209e4ec53713444a3141382442d7ae15141632b85a2eb816eee8cad5069d49c50369179495343f7607c67e56ad7fd9c056fef6b3b3734793183ba7b71fd11237cdc4f2da1a01dd2712d3395c465b99c364f026d7668a8760f353eb8fd8cc55f86b91789039401e2a6e49c593c3d919849f78741a36023825e49b5da43fac0725e3d61f5d1f0fa50125cf13e556c33f719cde9e24974f8ccd5ed2e7abc2aa394736425899348642c10e566c17b53a358af70feb0b56d21438b2382f72603d633bd84de54133f10d1e644b9f0dd9b295909fb2dd6a5ddbed007561de0400e065fcaea35205016dfa04997ed06328161a569a52db1eb33b0003e74b99d08122319a7df209b9a0a1548c16d8fade354aa60989314fa6a747f8f8ad598f783ceddfc3d3b26640bc075d00a835549a20b3051810a2b8616f855f0ee6f3ae57d65c774d8f09602fc550227b580e16ef2cffa968ea7f97128654c05a3e38fe1d58a4923e6931a303a69c903614f6d5ae38c7ccc1add83d6818143c42978026e9c06ebfc396ccc253862dee0e89615a713a3499ec4a7500de613666120c98d4e74a9e12578b3025c0ca9cb24b8297cc64ea59f77636f2810192ec1e47dc231a61a483b146ba04d710e5c101b16d19d4ef7d1b7608317bf03402c616db231cabdf47cb029426c886c3db3144a3bb8a19b08a2e520b40e0e7fa8cab49c165fc437896bcc9d7221f15cafeb8d70d815e7d0f456e01f734dbb18c9e109d429eb0d7d648fd8a63b67c32952dfc89d8df61899b4c417f161ebe24d25cf8a931d154b2d65b05edbc82c91e854470c69c9c24fd803a2bafb444415354816dea206b9c112e33f72ec9f73944de25da9f01ab665d40e4f6b9b6449bfa0d225ea37f2edfcbdc4b728cc02ac57cd29c478a441905d6c4699a3f06b29d8085c6cdb1064a21187a524c7c57a13d5f1ae04e6d78e535f51b42d4617747a2078c5b41fda5af6e17a53140426307af92ba41a1167c8191b6ee4abe1840cf2e2f0d231df6f64ccace049b744159de40c90f43b7c73c9a36f202a2874caf72c4ed1e1367fea3769335ec5ac375985d998a2c70df6c5817c21408a2dc47c0e71d1a7c9d12e19935a0d0dd4cb8a9da352a1ce58d9b2f018e3dcea198de9e2a1683e680610b0cff4abd758a8ba24e2db960b33640570d32a0b1c7eafc755c881f6de7c1b05484ade825f57eb26bb62db64e0b0405e5fa00f9667a5678da00a80b46dfec162ed34c6b2ade9a2ec4ca9d68baeca6048f6f5ba47379fc8f408aad72e336ec57fb567137b76dad10e0e7be1012bd45d5f939190451004569fbb566c7385fe56fa0989ba1e3534dcfe512cab8faa5be28eb8812ac850c406cfe01f04b4507aade8df3ae0cb88b875d0a81bf0d9171a52b012c7067a73c084925508bdeef1f3a45a9d9c3c56f2e4ca0b4eec7df9885b7bac5b3713b430820365239ac8adeab1d188f17487b3233c88c6412f1c5be3e003daec44ea31a804df8b2b0db56256e2faba466522e3a0d067c9b72c4e29d57b1b1b5bec889646e0fa8edbd8f1e915b4fd18a18733ef42a5ea7b64c8e972528d68a8752060c55354aecb452eaf967da9924932888c1d13cc353f33db7243dec0dd8a007b2bde4c61aebaddad94b9d9d49aeadb130b06759d4f27cfd1d6681688b5d1e97f2963547a7c8c0a52c0f63674eb3c019a4b5257f443c88c5bc900c0685b00eb234020f343844799b6766a2f7c80ccc6aa6e2686157b2e9be2cc5c81793e268c20cb3d37cf5218c11344c8e174862ec0766a180119e44c57cf1c93df9ff78b312cf09ca8a6121023c2669e724e109b87b52df42e8396088c5414c1d98fcce2f0ba8da32107e86a4b4e22fe4cb511e34950109711f1bb23a1c9f2c2f34a1e762d0f089103cbf9db93ae589dfbb6b29b059255bbf50c8c32e761b2898bdcc1f4dd23035430cdd2aef7733abb191c5e96c2097b6dd3281f3969e9815164d683443a4b6b68082d5a1e22d544b0abe4d08e5af4260236f51cd29cb844a0ec3dda0abe061e27852464a4ef50c7b4e4328dfe1cc70189ba3fa038eee5b7a1a777d34add1130b3f7be82e4d30c1037ff82cb4935b1d6ed0a9530d1f16f4225358fc477c280f1a6c64f0983d87211ffca47f8f38ea09b421809dd6094a214709d3fd31ac051bc7b1c58b9a0a2c443a191369a0114ec4a25d184a4633dcf5210f954dcc81cb17e7eb9345376279008643b8777ab1dd085165b96d790853c273a199f6624ab4fca84579584112c5eb7e4b598a4bc136a65fb76cdd647c811a8e1f877630dd21946853ef971afccb00e9d3b5c65b36865d62791b99414dd14cf1d9b1df64bdbac3a2472b2b34b461e4cd7345f90c9aa5c2e0c3970f6114a70ff192cc7002c7ae28b6ce33183f8ab8da25a54e9567b92f1f661cc6fa0c96cd9c319424cdb031f7d8c55de690be6679e7c354b39c005d3692e447f2dfeb6c04550eef7dd0dcbc4608f234fb8500e7f85291bf9cf7aa08acd8766431576d955afdb28878019e172b803efbc9495e7b355994be5897cd4b40ba3136f602045fb6cc5040aed378624550d3d6955cc3e19b43a818d7a21a2728bd804933463ef59f3ed8ade7aad04cbe90dbce5adaf98a3ca0509ae9fce269b1567cc9e3ce1dbe048f19784ad23d6e804060ea288defa0a2faf1b2f0912eac2000e7509d401fd03e172e82c083f556df608f72e7923df6200131bd2ad01409bec444b152dd5551439e03f2153d5bed8b2ed32d7324c8ac0a30dfacfde6205bed09e80796f636b595d172d3716de349f9646262f9f1d973ca694dd36a1e39d0c9aea5f7efea274d0e8f0e00cce7efa513ed13771d94b208b04f5fcd3c86b67c0ea63c6186c8becc7c3261559d3da38a6a9f50c8ba7ba662a1c63c05a157f35a87441be2f5dcc84cc6af640c2b8d359e5e5bf9ad2f244f3520ca3c487d5366d37fb4318d39a26bdae5bd96f1152f1e32364329e539db83c626bf3b7d1d66e3ba4672b25c5c20d443bb83ba34982ba8f775791842457dc839f24ea83ce1eae38c3322ad79246ec1bca5c40a86f0cd12f9c417ec7aa5c4b288e0c45ae6fa4b35c25f30c638e0609a91b8a3a2cbb38d1ac8f66719ce19a3e01b3cc1d96d8c60fe9283eae6400ae79149b6884067232eb351f05", 0x1000, 0x0, &(0x7f0000000080)=@can, 0x80) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f0000000000)='tls\x00', 0x4) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) [ 674.433998][T26401] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:46 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x77060200, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:46 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0xa4], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:46 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x810001}, 0x1b) [ 674.709142][T26408] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:57:46 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 674.835519][T26408] bond0: (slave veth441): Enslaving as an active interface with an up link 00:57:46 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) open_by_handle_at(r0, &(0x7f0000000080)={0x4c, 0x2, "342248a0417a83bda7c2142a3ec7d1a80439a2fa9ba194a0facdc71e93d023a8a643d777d23f8bf27cb1aaca75b4c9770dec3d937b38ebb8e1f3a757e8ba5baac099d503"}, 0x109000) write$apparmor_current(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="7065726ddd807420307830303030b0303030308e918a1e21c3b1f4"], 0x1b) 00:57:47 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x3c) tkill(0x0, 0x19) ptrace$cont(0x18, r2, 0x0, 0x0) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r2, 0x0, 0x0) r3 = signalfd(r0, &(0x7f0000000300), 0x8) fcntl$setflags(r3, 0x2, 0x1) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000000200)=ANY=[@ANYBLOB="bf16000000000000b7070000010000004870000000008ce4225cfa6716e5300000bc700000000000009500faff000000008aa1210b29017b83c8e96e6405f7e93dba4d64b5030b3388b0409a814343f1ae341b74efa745a12f5c0685e5261482e31e0cacc902c97e6145201b062261ef48004d26342c94f56a39359ba56724e4535d80ffbd6848d53382c262869ba15d8f0c2211a2b975eb2b9d08501c56ab5aa0d110c5d197e50ff28b4a3b05489d1d1245cb774879b0871dd61703eefe87d7919c5ea2a361b18c"], &(0x7f0000000140)='GPL\x00', 0xd76, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x78) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000040)={r4, 0xc0, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000)={r5}, 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={r2, r1, 0x0, 0x1f, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', r5}, 0x30) r7 = eventfd2(0x9, 0x81000) fchmodat(r7, &(0x7f00000001c0)='./file0\x00', 0x121) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400203) r8 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r8, &(0x7f0000000100)=ANY=[@ANYBLOB="7064723030303030303030305e6370757365746d696d655f74797065006a69f1ed60f74bb2d457a2ef3b7e6e87895fafef405670b3d6ff5dff6180a1ecbe91e235c5dea1b9d59b562e7bb5ce28ecbacf939b143137285e9db7ec33a95ff27784faca239a2f1541b1f4abbcefa444800b181270b633f7cd048d8f187863f58891495b0832bf86bb738352dd729f7b7176d2138e25d8a01008556cda99f9eeec0c3db2e43b0ba65a8c621b9204"], 0x6c0) 00:57:47 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) kexec_load(0x10000, 0x1, &(0x7f0000000400)=[{&(0x7f0000000340)="b497646b12836c87ee86d435972669502763596e9e7195901126ff216a73854ec661163dacae8e17574b9350ce853b32292f76e685c9ca4f2b5536b636ac9a305e51f948db95969132443af706465ff6d749a2664c1bcf2d731fb7db2cfc3e917ab534329c70267be0dbae1c0fe3190670f8ace9e0afab30f7615a4f08a5c1d99a34e06bca62ab585caecd8c43b16360a9208468", 0x94, 0x33, 0x1ff}], 0x160000) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) lookup_dcookie(0x0, &(0x7f00000004c0)=""/154, 0x9a) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup2(r4, r3) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) getsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r5, 0x84, 0x1e, &(0x7f0000000440), &(0x7f0000000480)=0x4) r6 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) setsockopt$TIPC_CONN_TIMEOUT(r6, 0x10f, 0x82, &(0x7f0000000000)=0x5, 0x4) sendmsg(r6, &(0x7f00000001c0)={&(0x7f0000000080)=@pppoe={0x18, 0x0, {0x0, @dev={[], 0x30}, 'veth1_macvtap\x00'}}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="971a2c6fb09d416486f9cb2c825f2648559cc5d303d5858296c626bf25daabdeb3d85e50600b50ba6f82b623d105c2", 0x2f}, {&(0x7f0000000240)="a629494d7e832dede37f0bec5596c436dcf064a81ae44d79e93577605aee13789192111dd3173e795f3b8e12f081b5f2275489e4f204bfbdab6df10aa0b8bffb45cacd9d66016221edb1fc13d7601aac4fdf6f1cb65c1522bde3ee5a8e0b7ed579138c1db1d3e2746a7ba1ca7cf8e90589547e40284086ad5bbfe7e0978ee59be05879512c253f1e16077bc80807f6b4a13c54e36b199e17ccc81f939a64e7d510df3c5375184e6a308b9d5b5c30025fae15efbb0721f020445f1ab641735bf53bf00bdc0a", 0xc5}], 0x2}, 0x20000001) write$apparmor_current(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="040061636b206065722d6d686174"], 0xe) 00:57:47 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x500}]) 00:57:47 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup2(r4, r3) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$sock_kcm_SIOCKCMCLONE(r5, 0x89e2, &(0x7f0000000000)={0xffffffffffffffff}) getsockopt$TIPC_CONN_TIMEOUT(r6, 0x10f, 0x82, &(0x7f0000000080), &(0x7f00000000c0)=0x4) 00:57:47 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x2], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:47 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x78060200, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:47 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@profile={'changeprofile ', 'permhat '}, 0x16) [ 675.498129][T26445] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:57:47 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x3], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:47 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setreuid(0x0, r3) syz_mount_image$jfs(&(0x7f0000000000)='jfs\x00', &(0x7f0000000080)='./file0\x00', 0x548d81c0, 0xa, &(0x7f00000016c0)=[{&(0x7f00000000c0)="dde11092122cb52e4af569a53ce1956d7cba6766c4e46b6c7a54e3dfb96ead61886781d25693e4a8bff1ea7df87f6aed9df23d78", 0x34, 0x8}, {&(0x7f0000000100)="49c80fa5ae0b7b11b070d24cb1127be39c4521e421e9e971c5c8b291684c7f18d65ff9aeeb50ef2c66efd6187e70c9e7495c218cb79508ab8f5844e85c0352a7f6b7f12ff043d0e6ed884ea0a0d7abb2664e81aec25dc45b801a314c8c387a1b9310e708166fe67f94005e7b365769af1d2a9afa45904ad8b2c9ac6a62dafc5b3893b92b9e379ceac73e5402151f3acda6d7d96892634780bbf9e3f6d14fe33677c64e124dca956b99d8cf999112b3bb27248af48912463c519005534bea9180c240b124a8531deecbc4f590b7412da954655d0077048275946feba5789029e1eb35b09f380822c7a76933cd55f51629dcdef36d13", 0xf5, 0x100000000}, {&(0x7f0000000240)="be8c547116922e0d347f6f3dd049eab8d15f448da951fe78e1b807c317b0663145af45bee780018f16e5ce461627a6225c558b334917c83bfd1ff1f2fabec8f94ab985412ad4f043ebdebe7968893fccb70e1827321ad717d522ae2d035a7d312108cb11c6764b459eb79fa05cd46a0492d890c5afd4375f794429e3e26f2cec16bd9533958bf023d99c838f705ad45d03662f34d191", 0x96, 0x9}, {&(0x7f0000000300)="cad7b2767da994640a9eef2bb46f38e7ba8c70ed65f1bd68550f36d7e4350df5c4572d50587e", 0x26, 0x401}, {&(0x7f0000000340)="73a954f9731ee9f317fd2af292aaae71163d32fd97f3512321c572ca9b85f9d0ebe3fc52b6ebbf1e66a7bd325133b0d3b1352b32d244c4579258aa3f59380645532ee517eaff6a806e4718fd96dbd3d551dc15f9c7179f7255de2fdf8874ca337846fa5b9aebeb265454fdbbf67daab3b282a1fa063c0ff9e1aaa02fbccf7584d6a27db9e4c8b104ac1872e380637b41509aa2fcc201d728cde02552298592807ab46df914be4decf6e76034b664805131c521e91d693789739b25278be034fffb61dff6d36019b7c04d21f9ce68f5c878cd5d2604f91d2163c2d5bef0a5265214c6a28365ddcb2b422767634aaccfa18473f2068b8176d8c67fc5f5b56be493882c1bc0dd6d83183a2b7dfa0728be69efd6835155acb2a31eb634c7dd59e902742b5d6dca3ecb2b8bb428ba4a577fdcc6bc33df882db10d31b372539eeb0c806c4247deeefa684f4b1b6af07caac80b989f197698ad401ca5169a36ec61a0c966091d43a21b7cfd73cce2b2551ce4b6d9f0d6233c86219cc58d5c1f829ee7dd810778b823e21a0267f596bfb82c34fdb791393b463839c896da25a662f0a04c8b3b52745b068e8079cb58070b3049a930e0e5b2a8597d346df776771a84aa9679d8e77d3fa89c80a03bd622467cd22ebec35b2aaf58a2448bb1900dd78de25e51b79915351c214f3c3bd9aae09ed32aac92f7c38b30ee92a18d6d051bea4c2b75ef7885de1c4625adfede3e3ade4ec703b518327d72a118a42b4e56978ab72ec4c33386b785e183340dc0ec65e1cc0fcd4cded4ea73d230352aa3546fba8f6697522c21457aeb196340ea4937d3f90144c47097366c3a4e3bfb4ae0e539303cb4ed988d9581a05719cf092ce19ad3b7079906b436f43e9ec2e6967e374feccf9ad5438d0efba4874483bfae5333729813ac3a4afce839ad5b1235eff8be71882c9ca9233bb0b9a70fafd7bb8236c6f228a1351a8cfa79e35ea9abe17bd664c2f02b3b809e9380d2896ab36df4c4385d181bd3edba4ea27e2b406b93f1bc00a9d13b7d3ff2615d4e5cfd94117153ce32f8f4b35b160c44ee30618e0230721f4dde1a8b0b81d91de57a02c223699b3c7ef096d995ee15a5bac1d225691e6ede4928e2abec9297296165c6241dbf8d532ffc22ea3780d5a6444609ccb1928b33e1d670d043b1b69e14579c8eee003e5b14da8a58b8a2bc53b1982836a0b51c67822e60844d05ba85757ab8f65109a3a32013383fee394724bf0d4e97e685ca9d48e36406d1f3021fca53eba1e1d5b72cb38ccdb5cbbbc009d53ab6d65d995fb3dfdb5b8a2844653785c8c503b19ac0ca0a27451241d07ccc5ebeaae5c31d23ff2cfc45e4d73509f7ecb0405b00fd5f8c3db3c74f7806bf30465fe68a360cdba2b96490d3f7cfd4510a74c20024c026bab73b0a77c3782b2af32982a4f701129f5a6e4b680e62a48dbeba88689933791c502dc4cc3365fe0d8bddf07adda81432b557d714183e8b9646f698f46ce5f19d9c0d830c5b4535dbb513f6d3fcaaa1eba4e696372054a225e28020b3ac5065b6e073cd335b74a04840a2c4a2a9d84d69d103520f37d4e8e200af7666707e03e36a37479202c0a6d32aa1c90f8ddcc0d167e346bef6731acb59cccd3afcc852d96a94c139f045c63254f5f73f109b651dc305b8eefb46a6da6c1625ff0d319261f8a34bf3c1957eb3728013a6e8ebcbfd7ff8c0d3a7c371d3e52ec8d7c65ef0da06c503fa1bcc74a8bad346be934fea2f2613f6545e74ab4674c91e94dd697e74b5659fdad0df0981ac1da9b1f8e232aee654e42eb37331d33aa2003d262ec705c8fba365f509db87eb676569e470983c0c7c69446bc7e6d097f5905e6ea1e0714ad12ac4ce66e109c287612ce629e69a6fd88bc3febca28338b3a707454f79d4e3999af24d2d999055440e23e31f6fb295fafed9b5359185c24365e80b4415cc5968dde8fd4d7aa2a3d2d5e085df5d4d0b4de3332599ea0839f0c6e6ce1a2fefce89ce7e3fcc195f1162987ecc88fb34afda6405eaa7e4db8af183e53f4ef77af74e5e7190b7995872944dc5b42a99158f582899f87b1bf42e2b7764b08b8eeb11b737ae0ceee730e133c5af5d91fb38bd6bcbd4ee1dec3efba57428944a7b9ebbf4c8c20f1e7e81812a9f7c2d3c1d5e5011efc81f35178e4a72205a4cb9ad3cd52c6626ff2f409091e488c45a4a2ef3010edf7b9afe01c8372cc2666744fdd6efd3cbe24b2af72c307d80c76a4a4399d6daa52294a2b8ec7d848885ec0ce39ed57a504e3b29e696acba579f0857efd3422e02a954f1ba574bdeada8565d3cbfe059c7313fb4431c62b3bd42902076ca23307cf52689e3c1983cc742c5777dfa5b8f593e795a759f1b2fc4c2917006d4d665c1efd2e1f2fcdf311645cf323edca77d0ec0798aef257d4f932cbe8cb7c87e4a5d9645799a9908e9fbbe44b80d044cd6ea2a599e4f4595f73a0540705df5cf57762e2227ba40fcaf6ec177af6b66cd7fa4bc1ab4504134f2e484c4fa683fa374e2c408b6f8eb97a62aadadc09e16019b04b05d9ee88a0f5d19084517b72d3496ff0ee9700325be5abb4f234b2434b90408fa470ea6bb9b7eeb55b5527323e9e6282957f6716bf54f115e31e9bef9fe76b575029e246409263681681ebbcaf2baa803c26cfc2139adf87ecdd05cb7cee693f7b33079a6bfb0489119ef99493c4a9e32f82584da12f3122ce37092c19c4ef54a5c0892a548fa68ad6bac11ecd2e65357fa1cddae52c33609110a45e96d71570e1c6c724740ee54fa653ee4d3d7a556c3f50b10b268e3379f71d35911305b325be3bf1b3d6bddc9819da10619512f0910c443a788355bdd091f70602b7f9dd5b5fa3c86cba3952e3b4a73e31b4131848f63fe8fda32b7d824d3bc74608d02e5737ca10e6b80e46bdfd747d52d6e2935fc2c799216b586c1c994d402c8e46b440cfcd1a1e559840918e01e84e2a085d9f718344da16110a7809f31f02e18b2a83748d577f29595cb3f9b4e470e0aed3ed5aa192c6ed62981823b165b91f759e1a83302fc8e05c17252c8fbc45ec5ae612ef6b4f8b1d38117afd516c6891d072cea5df051b55793ba7d772709699c42708aed14f4102ad17f55ba4e4be76722358e81e1b28a68aa623f6000dd8817701aac00d7c3bd26ed97ab57a1fec52d9ed79678382872662626c7bfe89e7c41ad5059e4c780b37a32208ff81b9b61a8aa6d836a39e3c2b7fa1d6e7a25443791408ca896ec3866fdb9dafd6d884f8b984ff2fe1953230d29c5e496b08b85f2aaea982aec163b16547ba3af97e54b220359548e9b7bbe270ef08b0239f1cad1205b996733b6129d94c74681c84b8451614541f3ab6875819445956b7a087094a2fb77b0ed41c00f99bf437900396549aa0e9e9c7393a33bcbef32c79af2438f27f767ca193628bbe8c111959eed307d62cea8a83c9c70932fbed7cc02483ab06f453183e0ce5b470469f1eb66362108df52b772281178fd376052e87475183ea21025f8fb7e02eb376128300fbdb8ab6eab67cddc797d826e6e7fb09bf1ea3a0fcbd1d0bbfc133a6678530a3852aa3bca37f8ad61776dc9ade2e08b3b0a086d48fb02689f48e83585ee032f79bf0fb2a8e84fa9140934795551b43f3c515c2731ef13e7092a068cf16165566a0a9cb64ddd467cea0853a6f41efd40519dfe9c520d6918d24204f483ecf9ab72991d496ff61194a3ba82b532c30290f5ac66c582e6d4a5f23b42a7396c696827ef68fd97876ff352fcac40f4049e1bc0d667d372e00bcb1505aa59c28db8c69b9cbb28fb6c03649cba1b813ff2daf2b322d0d0023cc5c1dc8a3ed1a3d73e77fef2765262177c795858c1f0dcd0a88d3aae452bf51e27628c55804f27b9e38dfecf06109783b859fbf80c08ada9b4f12bd41b7d59cfd95d82d42b5004851d54c6617a07423bb52fc00cb26bce20f5ca3142bb467d3bc2e6c25588979b2d389ad987f26f907e8a844a51d350e0e82d643056472722c2954f80d8c65a67edfd0be13a1789c609858b20319c6cb31728253f0886de639e362b436bbcced914adf65cedffa747bf91d452b505bceea05b73d1b7d1ae8afc9ea881db207f6f0dc06f184537ff1575e4eef916486c6d1e021af3ace112e830b25b098d1201bc97b436000cf86a2cc76ea647d42db8494e90f2b7656edb8395d3371bae58b0488574a33d3773321644307029520cd2173842b87f6e87194ddac86abb19685ab01f49a9c69ff7f03a94ba9af62f914c3e59817d80425f2e07ff4ed29023b3f5c9bf3f52de5c517e4b027816faf2685b0fdb52209d0111e94d73be96fd1c53b6d4c00c5c00524a9b9834aeeaf83b53bff7ee16ac10f2c5947fb67685024d3d0ab208183d21e802b6d38a9071c9fe5b34c8e69e98fccb75265597d94088346c03e406216177e94351165c4c98a3b0356ab1b9a0e900645a47a34a28301d3aeb8baaf1d0d433e06a7996daa6b3b1b65576d1234cfcc1746c69ef285dee18ffa339cdd2756c2490632ff02fac9d645d340720b9d806d3fea94a7896df41e84bc8b0a543f9038cd4afded1952a76f19e648a734b16694fa4fdf618eaea22ab6cfa453f80a16aa7e76c1ea0bccd1b66685a5c5f4e3a0a7f2d736ad0455fd09fa08853daf71f1d1a3b6a5b9a0a64ea8caca4f3e8a4b1f275af2d54ba10c354a039c40b324d53501314537401caed17efbe0d2f867d4d460a457e40b9c0973a3f788a7a79db7c147c17025c17380f717d0e55ebb466fa44113d655b85ace81246f44f60bae63b65f977d3b7610bc69a4d3a9f3b23dad053a43330c08dd8420eed2b47d098e9547a70f2d3ebc62dce7282f08bcb73d856002a7b088d3c2b29278c7710bc63ce2f2d37d8fe327274b47e20b56c5651f6f7b475ab6ec6ce265bef08202b0e1ccdb034f3d3a5f00a096b31f7ed07b65100b6cbba5d823adb703dab52121dd49734bb2eaf87a4126cfdd9e438f4d86764419b951789fa554e5318d6a9796916f413843b167798a0313feba7a4cd59d2a16ae9d7838817eef06d417f99e45ced795c47ef2ae8e14399ea81eda6ad0bdb447506d2bf9a2da14eca34a8315718bd4fd02614e60235b8d5735a8d6ad0c5c9d3fa58fc56dc45095c660a9f9531041faaf3b8d9a063bbb15efdc3e205ae4f5e3c0c07d8660a61212a20a1c4b6a0f173fb3036d1a5eecec9f53bc23a4941eb3fbfae96656c358753a13cb2d1c0bffb3dd48c1677e82c31db17cd9df325e7acd9a201662bf9acff53ca4bb53db28db8505c72576f9eb9fc84221bbffe9f3e8bdcc7bcb7b0984e1a493b3339886ce278b2a821d4eaab25d619148124ee61a788eff7e4307ca31bf0933bc9ecf1e3db2ea63ad9aec0257ab9ea84fbf07d34de818ad0cc1a5839bfc211361180d4f26c7dfe159b6d75ab3267e9831ae3331efd6fd0388fc6979428dff92d840d2c5aa0f34a5ce6e0aeba2bb9ce5e1be69b118bb4770c8adaa5425a6c05fe3544fa2ef2249fc0f3177238c137df14c050974b3924ecc45ce62d88cdb875c22252641cc9b981ac8f5d1aecb97e62eb18389182c3d077f049774116242f87898c7602b3d3bb641a3bc2137c6f929f8cb0ae30df15abb0a3ced128b44e88b68800dfe3e7754866c0dd675fa3cd63605e91e6027751c8dc2b2dc5fca2cf798a5c6429ad2ae70f23c61c3627a36c39e17609a6bc79f7aeec8bfe21ff65b4b213453ea8b0667264ecbd26126855a14d6308f0470ca650327f9c328e246b93418811", 0x1000}, {&(0x7f0000001340)="5880010d2bdfb0cc1aa14277c2fa23ceffcc6628d32e6d4259c0c636453cd10704f3be751f383b4bf7076845213308578cf87bf838b480072177f28f157ba1a88b91c5f11ddbfa9e45eadce8c787c5c50aaaca9afb50af284c5640ea7ca8269e490b4b1016691052604310f91127a5fef7b2611cb41a5bcd2d20c169e89b812047175d5d434cdd04fbe419e0d2789d8e5e733819efc179ee0597504361", 0x9d, 0x1}, {&(0x7f0000001400)="8c70ffe6b34be3e59137d48473c7b6cd6a04ee8e8100559da368c4c30c61ff6bea70986fc61f9f73ee1527ced15c81a35d2bc0da1e29da667c74348379a1760a2b968fc9e0e331ce98124c07ee24520c1454f418aebe2df9995ea18ff1f4a22ddd681864a3d0de8a37293bb45a0f319a5b", 0x71, 0x7}, {&(0x7f0000001480)="5a3badcbefd3b6124daa4881c37dae28dece2bc9ec3570619110cc7714e3f84c214fd943313bb8a072f19f050312f4266d96057275a5eaffb1dfec30afc5bece554486da61782076cd6239324330895ee7ec785f2d10a3e038f6633ed66d706a9a047201e4d7611c476ee8b9e813bcd2f49d138daa22bda0b7af52dc393fde47d3f6175e8176e671da27a18eaf552e9c7d86d1f9b28a8a303f44e5c20906b0ffaf4bb98013d0e2a387e967daa7b991", 0xaf, 0x7}, {&(0x7f0000001540)="a2168f1af821fb3c215246a97a4209946ffd13f0ca4c8bcc59ba7b2725d8524aca2a58b44c17c9c0c61943e0790de55584f6d978b553a995c1a54a623accbdb6f044fc57f275c9cc7d0872464c02d09037d50794279ff5a510a3a6092738ca11d21bc6ffbd8ebf6b2e159b42bae8f0fe9dc603df73d5675cf09f9c53ce7676c05f2434", 0x83, 0x7}, {&(0x7f0000001600)="865a335df276b215df61ac07d2f23d81c9781385a6c7a0f3a53aa593f20967ce9ab9f37c53eb85c21873415a453eb3919da25cfff960cf99d0c8760a30dba2d14d96469f1e7013da7bb24e97c61528a5cf98bc21094c10e2c1894feee4ef3fab44a4241b05fe9ba0995096460519ffc226544ab03375ec97bde2b694fa68237a74e29427cd6ae1e5626d1ef306151cf4cae4", 0x92, 0x2}], 0x1000040, &(0x7f00000017c0)={[{@integrity='integrity'}, {@iocharset={'iocharset', 0x3d, 'cp864'}}, {@nodiscard='nodiscard'}, {@nodiscard='nodiscard'}], [{@dont_hash='dont_hash'}, {@euid_lt={'euid<', r3}}, {@audit='audit'}]}) r4 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r4, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) [ 675.650095][T26455] bond0: (slave veth443): Enslaving as an active interface with an up link 00:57:47 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="7065726d686174203078303030303030315e00faff040000006eb1bd88ff4c0248eaf9b2178aee3bfcd9885c9ac9cad61be5da01fa"], 0x1b) 00:57:47 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x4], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 675.865353][ T26] kauditd_printk_skb: 7 callbacks suppressed [ 675.865368][ T26] audit: type=1400 audit(1589677067.854:1253): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=26466 comm="syz-executor.1" 00:57:47 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="7065726d686174203078303030303030303030303031303030315e7871477cb471bba57bde70e4226f25cf1f7f450d64f5714a8aa6ca3a8cac9b83820c03b926713aad989f82c3d6eeb2481470a2e3359e00d6e0dbe6bfda1707937b9d419f179b0f610df206d2af118c11ca4214c604d2310a328bd89a67d8678d7dffc6c1e429a2de3931e23146287e77799f8df92eebcd9e031689dc7cedcbd2fd0b2c3b36e1302adc078fae86f4aa"], 0x1b) socket$xdp(0x2c, 0x3, 0x0) [ 675.962561][ T26] audit: type=1400 audit(1589677067.894:1254): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=26464 comm="syz-executor.5" [ 676.064672][ T26] audit: type=1400 audit(1589677068.044:1255): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=26473 comm="syz-executor.1" 00:57:48 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x79060200, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:48 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x5], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:48 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x700}]) 00:57:48 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = add_key$user(&(0x7f00000000c0)='user\x00', &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000340)="585ccbe4ed83b836c1a6474914dc55e72206297b6895b66147b3c7218a9169a85ea0bdc9e1587a050000000000000042e33089754c8107c3cd3923dd4a71c2ff06007b6b4816122d2550829eaa9435c99926022b8753a188748c569f435fb3bae96efb74b50ec93c152f5e8e198a29e5c0d0c60000ce0637ce003d661ff5ff70e48884ca000018cea71fcfacf40d32e4b58a8d2725561f6110fd7b06f90b5274cc5c1e298a16324fe27da2a9d5ba9ff3c009d308bd73f4772539", 0x2b2, 0xfffffffffffffffe) r3 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000180)={'syz', 0x2}, &(0x7f0000000500)='\x00', 0x1, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000200)={r3, r2, r2}, &(0x7f0000000400)=""/226, 0xe2, &(0x7f0000000240)={&(0x7f0000000080)={'crc32c-generic\x00'}}) keyctl$setperm(0x5, r3, 0x812) openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) r4 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x400, 0x0) write$apparmor_current(r4, &(0x7f00000000c0)=@profile={'permprofile ', '\x00'}, 0xd) time(&(0x7f0000000040)) 00:57:48 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'changehat ', 0x4, 0x5e, ['#R\xbe\xd9^:$:_\x14\x00']}, 0x28) 00:57:48 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x6], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 676.383909][T26487] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 676.428732][ T26] audit: type=1400 audit(1589677068.414:1256): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=26486 comm="syz-executor.1" 00:57:48 executing program 1: r0 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r0, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @broadcast}, 0x10) sendto$inet(r0, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) fadvise64(r0, 0x1, 0x2, 0x2) r1 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup2(r3, r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) getsockopt$bt_BT_SECURITY(r4, 0x112, 0x4, &(0x7f0000000000), 0x2) write$apparmor_current(r1, &(0x7f0000000040)=ANY=[@ANYBLOB='permhat 0V00000000010001^'], 0x1b) [ 676.510173][T26501] bond0: (slave veth445): Enslaving as an active interface with an up link 00:57:48 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x7], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:48 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup2(r3, r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) write$apparmor_current(r4, &(0x7f0000000240)=@hat={'permhat ', 0x4, 0x5e, ['\xe3pusetmime_type\x00', 'cpusetmime_type\x00', 'selfpRoc[d\x01\x00\x00\x00\x00', 'cpusetmime_type\x00\xb32\xfd/+\xfc\x1f\xcb\xb5\xcc\xd5:\x8f\x1d\xc13u\xae\xea\x9b\xbd\x8cn\xc6M\x02\x95\xfd q\xe3=H\xac\xcf\xee\xed-\xbfd\xe38V\xfb\xbe9\x04Zy\xe4,l\x92\x0fO\xf1\xa6\xa0\xb2\x1a\xce\v\r\xdf|UT\x1b\x87\xebk\xe2p\xcbB\xf0I\xb5\xc8t)\x95\xd1\x81\xd9\xaa\xc6zf\x03tF\x90\xfd\xd3 \xe7-\x1ad6_i\x1c\xb4\x9a\x1f\xa7\x13\xf0\xbc\xcdh-\x19\xd1PL\xf9H\x0f$+?p\xb5\xc8\xbc\xa5~\xb4\xb6\xff;\x02\x03S\x19\xdb\xb1\xa3\xa0(', '/proc/thread-self/attr/current\x00']}, 0x133) 00:57:48 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x7a060200, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:49 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r1) r4 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r4, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r4, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) ioctl$EXT4_IOC_MIGRATE(r4, 0x6609) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x204001fe) fcntl$setlease(0xffffffffffffffff, 0x400, 0x1) r5 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) r6 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r6, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r6, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) ioctl$FS_IOC_ENABLE_VERITY(r6, 0x40806685, &(0x7f0000000300)={0x1, 0x0, 0x1000, 0x10, &(0x7f0000000000)="9d8567e2b55e0fe631be27a0fb1e586a", 0xa9, 0x0, &(0x7f0000000240)="a4a1059637ff005af08aa2c8850172e65dcfba439461d3aac8d83be4671c3e80468d0fc37df58b6f985ac5095335c4b04b89a48ab253d5c0d6ef1aacac60c0f23c2e0547e7013bdba595529f1d1ee5dc12c9a29400ddcfefd12c8bc5cb6b9019754823033c27784da45c2887c9e85709400de737d7ed8d1948e54502f05834308fc6899579bbd08af17c759b01bdfe70a3a4afba5f78598f00fa87ce99888d0b3eb621fb4b8c4e387e"}) write$apparmor_current(r5, &(0x7f00000005c0)=ANY=[@ANYBLOB="7065726d686174203078303030303030303030303030303030305e6370757365746d696d655f74797065007ef496ae0385db175fd917a7f64136d2f45102dc731b62a2242868d1015bee568bf547d51ec9bd3ff42efd200ac9dedf5400f5359db567e18a00003c09f1d9fa1d57d8ed9f7077a21e8700000080000000000000fd18fabb0d9e802a758765b97ca2a6d9dcbf48009426eda159eba2f2fff5677e738b202cca097d5898458c55fda93e050222ffffff7f41ca03a2b289a17d3eacfba35f7c30af7565cecbc450660b720d00000071550bc5d98edd1cec16cb7654aa255bfef0c02eaf58b3502146c7324280e70d30f901aa470d4988edf7b6aabc932c6f536eb424ed042823721b0c7d9872d6b5ad5370e318d69a59329125b7ef3d6e33346babc21ce703260c65ee11ade9a5fbc4dbfc3eb80a5f472803fdae9377d04dd05f82d7c1674b33bd8ab6daf18c3f9d8806f028c3e69cfffc95516a1a3fc91e324c702b018f3176386d1459bb431187c5a730d01c4935eef864dbfe09c89f522d53cd8f4999e842c1575e227aaec56a5ad86c55931d77acb2d778b250dd5b55ff9e3c82d560f8ce3e4d9e8da7f6b6ee245535607066e1898d40a59ce954ed70815cc5c6dfd5ecfeb93f10d6276ae1952a41ed5a281934487e66bc5a45d249"], 0x6c0) 00:57:49 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) r1 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r1, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup2(r3, r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(r4, 0xc058534b, &(0x7f0000000100)={0x6, 0x401, 0x7, 0x1, 0x80000001, 0x1}) sendto$inet(r1, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) accept(r1, &(0x7f0000000080)=@nl=@unspec, &(0x7f0000000000)=0x80) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) 00:57:49 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x11], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 677.169343][T26526] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 677.328430][T26538] bond0: (slave veth447): Enslaving as an active interface with an up link 00:57:49 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x7d, &(0x7f00000000c0)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup2(r4, r3) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r6 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000000c0)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICREMOVE(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="0100e0ef69aa779932392f74bd52c40001a69fa57cc1b1f73b78b721ba22a3c775221eb4cd1571c72167bd23befe43f69575ae000000000000000000000000000000000000170000000000", @ANYRES16=r6, @ANYBLOB="90002cbd7000fbdbdf250400000005000100010000001400020000000000000000000000fc0040000001080005000000000008000601800000000000000005000100000000467c555700000000000000000000000000005264ab1400"/102], 0x3}, 0x1, 0x0, 0x0, 0x4004080}, 0x20000054) sendmsg$NLBL_UNLABEL_C_STATICLIST(r5, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x78, r6, 0x4, 0x70bd29, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth0_to_bond\x00'}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth0_virt_wifi\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private1={0xfc, 0x1, [], 0x1}}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @mcast2}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'bridge_slave_1\x00'}]}, 0x78}, 0x1, 0x0, 0x0, 0x24040810}, 0x80) r7 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) 00:57:49 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x3f00}]) 00:57:49 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x48], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:49 executing program 1: r0 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0xc1, 0x0) ioctl$NBD_SET_TIMEOUT(r0, 0xab09, 0x2) r1 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r1, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) [ 677.672774][T26559] tproxy_tg6_check: 18 callbacks suppressed [ 677.672782][T26559] xt_TPROXY: Can be used only with -p tcp or -p udp [ 677.721808][ T26] audit: type=1400 audit(1589677069.704:1257): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=26556 comm="syz-executor.1" [ 677.765270][T26559] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:49 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x7b060200, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:49 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000080)) write$apparmor_current(r2, &(0x7f0000000240)=ANY=[@ANYBLOB="7065726d686174203078303030303030303030303030303030305e6370757365746d696d655f7479706500192de390e27e4f42725049092c8e215876f73f99a3364fdfa9d3f4b669fdfe45708f382866d4234346f4efaafd465b4c5fc1950e5b6bb207f217ae5a709b4a4b35f0ee9ee9575ec2f39e68f476d1be73092625cbdb6717de8387ae1aa2c3f50922a518d5830db05ec07e07fd16f66204f23a7bd905879d5d"], 0x6c0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup2(r4, r3) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) setsockopt$inet_sctp6_SCTP_HMAC_IDENT(r5, 0x84, 0x16, &(0x7f0000000000)={0x8, [0xfffd, 0x6, 0x2, 0x100, 0x7ff, 0x7ff, 0x100, 0x9]}, 0x14) [ 677.819641][ T26] audit: type=1400 audit(1589677069.764:1258): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=26556 comm="syz-executor.1" 00:57:49 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000000)=@hat={'permhat ', 0x3, 0x5e, ['-vboxnet1em1\\{#}:GPLselinux[\x00']}, 0x38) pipe2(&(0x7f0000000040)={0xffffffffffffffff}, 0x800) ioctl$SNDCTL_DSP_GETISPACE(r1, 0x8010500d, &(0x7f0000000080)) 00:57:49 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) ioctl$SNDRV_PCM_IOCTL_REWIND(r3, 0x40084146, &(0x7f0000000080)=0x80) 00:57:49 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x4c], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 677.999566][T26564] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 678.064922][ T26] audit: type=1400 audit(1589677070.054:1259): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=26565 comm="syz-executor.1" [ 678.140123][ T26] audit: type=1400 audit(1589677070.094:1260): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=26563 comm="syz-executor.5" [ 678.152299][T26574] bond0: (slave veth449): Enslaving as an active interface with an up link [ 678.174590][T26583] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:50 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) ioctl$VIDIOC_PREPARE_BUF(r3, 0xc058565d, &(0x7f0000000080)={0x8, 0x7, 0x4, 0x20, 0x5, {r4, r5/1000+60000}, {0x1, 0xc, 0x1, 0x4, 0x2a, 0x80, "5b3fa1c2"}, 0x8, 0x1, @offset, 0x5, 0x0, r0}) getsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r6, 0x84, 0x12, &(0x7f0000000100), &(0x7f0000000140)=0x4) write$apparmor_current(r0, &(0x7f0000000180)=ANY=[@ANYBLOB="706572be050000000000003030c1db71ca315e"], 0x1b) 00:57:50 executing program 5: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x799880, 0x0) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000100)={&(0x7f0000000240)={0x154, r1, 0x200, 0x70bd27, 0x25dfdbfd, {}, [@TIPC_NLA_NODE={0x10, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_NODE={0x10, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}]}, @TIPC_NLA_PUBL={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x7}]}, @TIPC_NLA_MON={0x3c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xd1}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x8001}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1000}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_PUBL={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x1}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x8000}]}, @TIPC_NLA_MEDIA={0x3c, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xe5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffc}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x200}]}]}, @TIPC_NLA_SOCK={0x88, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x5}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x8001}]}, @TIPC_NLA_SOCK_CON={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x6}]}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xfffeffff}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0x3c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x3}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xe6c5}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x687}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x4}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x3ed}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x3ff}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x6042}]}, @TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0xffffffff}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x5}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x8869}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x40}, 0x20048000) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r4, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) [ 678.291657][ T26] audit: type=1400 audit(1589677070.234:1261): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=26563 comm="syz-executor.5" 00:57:50 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x60], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:50 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) r4 = openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x1, 0x0) ioctl$TUNSETVNETLE(r4, 0x400454dc, &(0x7f00000000c0)=0x1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) [ 678.499740][ T26] audit: type=1400 audit(1589677070.484:1262): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=26586 comm="syz-executor.5" 00:57:50 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x4000}]) [ 678.560561][T26596] xt_TPROXY: Can be used only with -p tcp or -p udp [ 678.618633][T26596] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:50 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x7c060200, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:50 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) prctl$PR_SET_MM(0x23, 0x5, &(0x7f0000ffb000/0x4000)=nil) r1 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r1, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r1, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) sendfile(r0, r1, &(0x7f0000000000)=0x3, 0x2) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) 00:57:50 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x68], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:50 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f00000001c0)={'batadv0\x00', 0x0}) write$FUSE_WRITE(r1, &(0x7f00000002c0)={0x18, 0x0, 0x3, {0x6}}, 0x18) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_MESH(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000080)={0x24, r3, 0xf, 0x0, 0x0, {0xf}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r4}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8}]}, 0x24}}, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(r1, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x48, r3, 0xaeef8f22ccd2d613, 0x70bd25, 0x25dfdbfd, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x6}, @BATADV_ATTR_MULTICAST_FANOUT={0x8}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xc14}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x80000000}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @random="8adbe40241b2"}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x9d}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000090}, 0x20000040) clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) ioctl$VIDIOC_QUERYBUF(r1, 0xc0585609, &(0x7f0000000080)={0x2, 0x7, 0x4, 0x0, 0x4000, {r6, r7/1000+10000}, {0x1, 0x0, 0xff, 0x7, 0x3, 0xbf, "48ad663f"}, 0x0, 0x3, @userptr=0x6, 0x87, 0x0, 0xffffffffffffffff}) write$P9_RSTATFS(r8, &(0x7f0000000100)={0x43, 0x9, 0x2, {0x2, 0x1f, 0x100000000, 0x5, 0x4, 0x9, 0xff, 0x400, 0x3}}, 0x43) write$apparmor_current(0xffffffffffffffff, &(0x7f0000000180)=ANY=[@ANYBLOB="7065726d686c742000800000000000007d49a03030303030303030303030305e6370757365746d696d655f7479706500"], 0x6c0) 00:57:50 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup2(r5, r4) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) io_submit(r1, 0x1, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x9, r0, 0x0, 0x0, 0x10000000000, 0x0, 0x2, r6}]) [ 678.881158][T26607] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 679.026500][T26619] bond0: (slave veth451): Enslaving as an active interface with an up link [ 679.088798][T26627] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:51 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="70e5726d686174203078413030303030303030303030303030305e6370757365746d696d655f7479706500"], 0x6c0) 00:57:51 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) ioctl$VIDIOC_QBUF(r3, 0xc058560f, &(0x7f0000000180)={0x1, 0x7, 0x4, 0x2000000, 0x81, {r4, r5/1000+60000}, {0x5, 0x8, 0xe0, 0xc6, 0x6, 0x6, "94cb03cf"}, 0x2, 0x1, @fd, 0x40, 0x0, 0xffffffffffffffff}) fcntl$lock(r6, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x2}) close(r0) r7 = socket(0x2c, 0x6, 0x203) getsockopt$inet_mreq(r7, 0x0, 0x20, &(0x7f0000000080)={@private, @empty}, &(0x7f00000000c0)=0x8) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r9 = socket$inet_udp(0x2, 0x2, 0x0) r10 = dup(r9) ioctl$PERF_EVENT_IOC_ENABLE(r10, 0x8912, 0x400200) io_submit(r8, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) 00:57:51 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup2(r1, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup2(r4, r3) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) sendmsg$IPCTNL_MSG_CT_GET_STATS_CPU(r5, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, 0x4, 0x1, 0x5, 0x0, 0x0, {0xa, 0x0, 0x7}, ["", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$apparmor_current(r0, &(0x7f0000000040)=ANY=[@ANYBLOB='permhat 0x000000001^'], 0x1b) 00:57:51 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x6c], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:51 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x7d060200, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:51 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup2(r4, r3) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r5, 0x4b1) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) [ 679.446340][T26638] xt_TPROXY: Can be used only with -p tcp or -p udp [ 679.469604][T26643] xt_TPROXY: Can be used only with -p tcp or -p udp [ 679.635570][T26648] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:57:51 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0xeffd}]) 00:57:51 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="3f00720000000000000bb93030303030303030203031303030315e"], 0x1b) 00:57:51 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) clone(0xd190080, &(0x7f0000000080)="9e6314c852b84efb4e7161b55786501d56cde962a1", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000180)="9cec892194de547c30461ee3de471df2ac37e6b60e5f7650a41d9c779a0fa2f75a2be6e4e37816aeb6cdb6a769382d4f7f7703d3a0c6207c82e35bedacd3c137e31b659711511d419402a446c5fe96138542841259f4af39e67cc90f7b264e28f5") 00:57:51 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x74], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 679.737679][T26654] bond0: (slave veth453): Enslaving as an active interface with an up link 00:57:51 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup2(r3, r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r5, 0x8933, &(0x7f00000001c0)={'batadv0\x00', 0x0}) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_MESH(r8, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000080)={0x24, r6, 0xf, 0x0, 0x0, {0xf}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r7}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8}]}, 0x24}}, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x48, r6, 0x200, 0x70bd2d, 0x25dfdbfc, {}, [@BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x79}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0xdd}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000885}, 0x8ef7661d78a21400) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r9 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r9, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:57:51 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="7065726d010000003078303030303030303030303031303030315e"], 0x1b) [ 679.906587][T26671] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:52 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x7e060200, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) [ 680.068585][T26671] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:52 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:52 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="7065726d6861742030303030303030314c022a5530"], 0x1b) 00:57:52 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/autofs\x00', 0x0, 0x0) ioctl$DRM_IOCTL_AUTH_MAGIC(r1, 0x40046411, &(0x7f00000000c0)=0x401) getsockopt$TIPC_CONN_TIMEOUT(r1, 0x10f, 0x82, &(0x7f0000000100), &(0x7f0000000180)=0x4) io_setup(0x6, &(0x7f0000000140)=0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) io_submit(r2, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) openat$ipvs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/sys/net/ipv4/vs/backup_only\x00', 0x2, 0x0) 00:57:52 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r2, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r2, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) write(r2, &(0x7f00000000c0)="2eb41397cc7200b3a394e965f54f467c4fca26cbd1f166f8c21e4cf3ef9e18b3d656c274987e0577bbc3a6ab40f49ccc11cfb3ecc866d397b82116dd564b0f4f06ebf78335094e4b5eff8d54718ea251137fc93fe332e1e4c29bd4ba3881285daee597b4d4a251353d6497ec5a54f02d4cf0b566b5483fc68b66ebbfcdece0fd80f776d536bcc53f5f83b04aba25cae0ff779e6223703f0297bd13903b0f4bec7b91cc037a8dbd110dea35a5ef36677c96d6b13b3c38eb3bbdf1c070b6cdf48de540545d588953f4d1552f5b693f9e6517be715f434d8e4e8bc848b8c3eed04cea249be690a3d2c298fdcd7eefba", 0xee) r3 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r3, &(0x7f0000000040)=ANY=[@ANYBLOB="7065726d686174203078303030303030303030303030303030305e637075738c746d696d655f7479706500"], 0x6c0) [ 680.271417][T26685] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:57:52 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="7065428b5bd83b659171303030303030303030303033303030315e870375b023cf6e1dc3b5f2227f7aa587cfe3d4b2c900010000a6263d5ac39b9a6b4dc96bf6453ef9e4513c00951b9ee3d7d386c575986c0f6bea0854639a5f6047f1233679be0771758f6e457ef9736720b8e2b5647fc63819234f4039b1b55b1b07c1815d8dbbfd586f70cc777bd36445251b44fd058cab3a3ab77e2eed827f317b905b713909320351a79e31f2627912bae485291fcfd674d8cb58527d8b2f89415ba27a9f16364d741e4b3c87a8942b3a30595119d2fa63740557b49fb49fb939153596bfb0fc5d01f3db4c99e5675778076d97371067d5158beaab48e5c6589089a9b8e0ad"], 0x1b) [ 680.304542][T26688] AppArmor: change_hat: Invalid input '00000001L*U0' [ 680.435808][T26698] bond0: (slave veth455): Enslaving as an active interface with an up link 00:57:52 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0xfcfd}]) 00:57:52 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0xa4], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:52 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup2(r3, r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$KVM_SET_FPU(r4, 0x41a0ae8d, &(0x7f0000000240)={[], 0xcb44, 0x0, 0x50, 0x0, 0x40, 0x2000, 0x5000, [], 0x5d5}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r5 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r5, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:57:52 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$P9_RLOCK(r2, &(0x7f0000000080)={0x8, 0x35, 0x1, 0x2}, 0x8) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r3) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) io_submit(r4, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r3, 0x0, 0x7ffffffff000}]) 00:57:52 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000080)=@hat={'permhat ', 0x1, 0x5e, ['@\\eth0#\x00', 'stack ', '/proc/thread-self/attr/current\x00', 'md5sum\x00', '/proc/thread-self/attr/current\x00', 'ppp1-keyring^posix_acl_access*\x00', '\x00', ',selflo\'/\x00', '+:\x00', 'em0em1-vmnet0.(\x00']}, 0xab) 00:57:52 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x7f060200, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) [ 681.011713][ T26] kauditd_printk_skb: 4 callbacks suppressed [ 681.011727][ T26] audit: type=1400 audit(1589677072.994:1267): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=26716 comm="syz-executor.5" [ 681.049517][T26725] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:57:53 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) r1 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r1, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) r2 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r2, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r2, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) sendto$inet(r2, &(0x7f0000000080), 0x0, 0x0, &(0x7f00000001c0), 0x10) signalfd4(r1, &(0x7f0000000080)={[0x400]}, 0x8, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) io_submit(r3, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) 00:57:53 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:53 executing program 1: ioctl$SG_GET_LOW_DMA(0xffffffffffffffff, 0x227a, &(0x7f0000000000)) r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) [ 681.137521][ T26] audit: type=1400 audit(1589677072.994:1268): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=26715 comm="syz-executor.1" 00:57:53 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000100)=ANY=[@ANYBLOB="7065726d686174203078303030303030303030303030303030305e6370757365746d696d655f7479706500601be60fbd34dea9167b04e5ceb951dbb1f50b591e377836273d276659586a9619e49ad4a32f50411f67c177ee530f7473a6e59702a17dcf8128d84d4e0c96925b5e89fecdf5f51d9fa88509d292feb53cbaa8698fa966be294b942cb203830f31891e5782f526aab986f5972673ecbe3116e20227efbdbdd07eb3b66ba066b3053ecfcd"], 0x6c0) [ 681.214396][T26735] bond0: (slave veth457): Enslaving as an active interface with an up link 00:57:53 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x2], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 681.322124][ T26] audit: type=1400 audit(1589677073.304:1269): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=26743 comm="syz-executor.1" 00:57:53 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup2(r5, r4) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$KVM_GET_VCPU_EVENTS(r6, 0x8040ae9f, &(0x7f0000000000)) ioctl$VIDIOC_QUERY_EXT_CTRL(r3, 0xc0e85667, &(0x7f0000000080)={0x0, 0x8, "fb93c1e798991a529330ca58e9f4f33ef06a6b03a710392fac35d1859ed98d9d", 0x2, 0x3, 0x0, 0x7917, 0x9, 0x2, 0xfffffff8, 0x0, [0x7, 0x1f, 0x1, 0x800]}) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) [ 681.420718][ T26] audit: type=1400 audit(1589677073.344:1270): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=26745 comm="syz-executor.5" 00:57:54 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0xfdef}]) 00:57:54 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x80060200, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:54 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r1, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r1, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_1\x00'}) r2 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r3, &(0x7f0000000040)=@hat={'permhat ', 0x2}, 0x1b) 00:57:54 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup2(r3, r1) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = syz_genetlink_get_family_id$batadv(&(0x7f00000003c0)='batadv\x00') sendmsg$BATADV_CMD_GET_MESH(r4, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x24, r5, 0x800, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x1000}, @BATADV_ATTR_MULTICAST_FANOUT={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000001}, 0x24000080) r6 = dup2(r2, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f00000005c0)='nl80211\x00') r9 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000140)={'virt_wifi0\x00', 0x0}) connect$rds(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e20, @multicast1}, 0x10) sendmsg$NL80211_CMD_SET_WIPHY(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x20, r8, 0x11, 0x0, 0x0, {}, [@NL80211_ATTR_IFINDEX={0x8, 0x3, r10}, @NL80211_ATTR_WIPHY_DYN_ACK={0x4}]}, 0x20}}, 0x0) sendmsg$NL80211_CMD_NEW_INTERFACE(r6, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x38, r8, 0x4, 0x70bd26, 0x25dfdbff, {}, [@NL80211_ATTR_WIPHY={0x8}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}, @NL80211_ATTR_IFTYPE={0x8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x800}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20040000}, 0x44000) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000040)=@hat={'permhat ', 0x10001}, 0x1b) 00:57:54 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x3], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 682.151918][T26771] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:57:54 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x4], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 682.262389][ T26] audit: type=1400 audit(1589677074.244:1271): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=26766 comm="syz-executor.5" 00:57:54 executing program 1 (fault-call:2 fault-nth:0): r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x0000000000000000^/'], 0x104) [ 682.312039][T26782] bond0: (slave veth459): Enslaving as an active interface with an up link 00:57:54 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="7065726d686174203078196ed7813030303030303030303030305c6370757365746d690200000079706500a1edbda6eb37f75c6d7b27e404778d0c7d10"], 0x6c0) [ 682.483430][T26794] FAULT_INJECTION: forcing a failure. [ 682.483430][T26794] name failslab, interval 1, probability 0, space 0, times 0 [ 682.500827][T26794] CPU: 1 PID: 26794 Comm: syz-executor.1 Not tainted 5.7.0-rc1-next-20200415-syzkaller #0 [ 682.510737][T26794] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 682.520795][T26794] Call Trace: [ 682.524099][T26794] dump_stack+0x188/0x20d [ 682.528446][T26794] should_fail.cold+0x5/0x14 [ 682.533137][T26794] ? setup_fault_attr+0x1e0/0x1e0 [ 682.538182][T26794] should_failslab+0x5/0xf [ 682.542603][T26794] __kmalloc_track_caller+0x2d1/0x7a0 [ 682.547990][T26794] ? lock_downgrade+0x840/0x840 [ 682.552847][T26794] ? proc_pid_attr_write+0x1f1/0x680 [ 682.558137][T26794] ? rcu_read_lock_held+0x9c/0xb0 [ 682.563345][T26794] ? rcu_read_lock_held_common+0x130/0x130 [ 682.569256][T26794] memdup_user+0x22/0xd0 [ 682.573516][T26794] proc_pid_attr_write+0x1f1/0x680 [ 682.578639][T26794] ? proc_loginuid_write+0x490/0x490 [ 682.583929][T26794] __vfs_write+0x76/0x100 [ 682.588277][T26794] vfs_write+0x268/0x5d0 [ 682.592535][T26794] ksys_write+0x12d/0x250 [ 682.596885][T26794] ? __ia32_sys_read+0xb0/0xb0 [ 682.601656][T26794] ? __ia32_sys_clock_settime+0x260/0x260 [ 682.607386][T26794] ? trace_hardirqs_off_caller+0x55/0x230 [ 682.613120][T26794] do_syscall_64+0xf6/0x7d0 [ 682.618763][T26794] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 682.624657][T26794] RIP: 0033:0x45ca29 [ 682.628557][T26794] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 682.648274][T26794] RSP: 002b:00007f14b1252c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 682.656697][T26794] RAX: ffffffffffffffda RBX: 000000000050c7c0 RCX: 000000000045ca29 [ 682.664675][T26794] RDX: 0000000000000104 RSI: 0000000020000240 RDI: 0000000000000003 [ 682.672653][T26794] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 682.680633][T26794] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 682.688610][T26794] R13: 0000000000000ce6 R14: 00000000004cf31f R15: 00007f14b12536d4 00:57:54 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x81000000, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) [ 682.732062][T26797] AppArmor: change_hat: Invalid input '0xn×000000000000\cpusetmi' [ 682.883505][T26795] tproxy_tg6_check: 11 callbacks suppressed [ 682.883512][T26795] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:54 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup2(r4, r3) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$FBIOBLANK(r5, 0x4611, 0x4) 00:57:55 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x5], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 683.034985][ T26] audit: type=1400 audit(1589677075.025:1272): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=26800 comm="syz-executor.5" [ 683.057841][T26803] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:57:55 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0xfdfc}]) [ 683.159579][T26813] xt_TPROXY: Can be used only with -p tcp or -p udp [ 683.214208][T26812] bond0: (slave veth461): Enslaving as an active interface with an up link [ 683.246023][T26819] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:55 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) r2 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r2, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r2, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) write$binfmt_misc(r2, &(0x7f0000000000)={'syz1', "e7e3858834f204dbeece428e6e4a3236a692992ba9d4cbaaa2903cfd84fafacba4c09c0e23c95a5e28156caa70e6f9d89633f49d261e126b83"}, 0x3d) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r3 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r3, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x2b) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup2(r5, r4) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(r6, 0x114, 0xa, &(0x7f0000000240)=ANY=[@ANYBLOB="0126730885b7461eb17eb07a42acec6c9d575ec7f02846e8dd1d2c638423cc80e9bb408775021b5023c92877858634323a58a8c16bf9b32ad79b8707f87d9266225b6260e0dea6ed7c95fe43595ac39585bf6c960bc990ec575662d41033bdc0a0cd221f3bb3f7a24c18935befc9a600b097690f44f09d223a15db20b8db782592501403a3012ab2c3afac837e6dab152fc45415c5c9b16d357a0b87b22598"], 0x2) 00:57:55 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x6], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:55 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x0000000000000000^/'], 0x104) [ 683.495935][ T26] audit: type=1400 audit(1589677075.485:1273): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=26828 comm="syz-executor.1" [ 683.523774][T26831] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:55 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='%ermhat 0x0000000000000000^/'], 0x104) [ 683.559061][ T26] audit: type=1400 audit(1589677075.515:1274): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=26822 comm="syz-executor.5" [ 683.587123][T26831] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:55 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x81060200, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:55 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x7], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:55 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) bind$bt_l2cap(r1, &(0x7f0000000000)={0x1f, 0x9, @any, 0x8}, 0xe) [ 683.756451][ T26] audit: type=1400 audit(1589677075.745:1275): apparmor="DENIED" operation="setprocattr" info="current" error=-22 profile="unconfined" pid=26833 comm="syz-executor.1" [ 683.806816][T26837] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 683.820230][T26838] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:55 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='p\"rmhat 0x0000000000000000^/'], 0x104) [ 683.924758][T26848] xt_TPROXY: Can be used only with -p tcp or -p udp [ 683.951098][ T26] audit: type=1400 audit(1589677075.935:1276): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=26841 comm="syz-executor.5" [ 683.998467][T26845] bond0: (slave veth463): Enslaving as an active interface with an up link 00:57:56 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x11], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:56 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/debug/bluetooth/6lowpan_control\x00', 0x2, 0x0) write$6lowpan_control(r1, &(0x7f0000000300)='connect aa:aa:aa:aa:aa:11 1', 0x1b) r2 = dup(r0) r3 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r3, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r3, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) getsockopt$inet_dccp_int(r3, 0x21, 0x6, &(0x7f0000000000), &(0x7f0000000080)=0x4) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r4 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r4, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:57:56 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='p%rmhat 0x0000000000000000^/'], 0x104) 00:57:56 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0xfdfe}]) [ 684.323723][T26866] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:56 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='pe\"mhat 0x0000000000000000^/'], 0x104) [ 684.416949][T26872] xt_TPROXY: Can be used only with -p tcp or -p udp 00:57:56 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x82060200, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:56 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x48], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 684.664291][T26878] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:57:56 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='pe%mhat 0x0000000000000000^/'], 0x104) [ 684.744362][T26884] xt_TPROXY: Can be used only with -p tcp or -p udp [ 684.799886][T26887] bond0: (slave veth465): Enslaving as an active interface with an up link 00:57:56 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='per%hat 0x0000000000000000^/'], 0x104) 00:57:56 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x4c], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:57 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permh%t 0x0000000000000000^/'], 0x104) 00:57:57 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x87677b05, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:57 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x60], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:57 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup2(r3, r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$CAPI_CLR_FLAGS(r4, 0x80044325, &(0x7f0000000000)=0x1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r5 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) r6 = socket$inet_sctp(0x2, 0x5, 0x84) r7 = dup3(0xffffffffffffffff, r6, 0x0) r8 = socket$inet(0x2, 0x4000000805, 0x0) r9 = socket$inet_sctp(0x2, 0x5, 0x84) dup3(r8, r9, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r9, 0x84, 0x64, &(0x7f0000000240)=[@in={0x2, 0x4e20, @loopback}], 0x10) sendto$inet(r9, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r9, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r7, 0x84, 0x25, &(0x7f000059aff8)={r10}, &(0x7f000034f000)=0xfeb5) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f0000000040)={0x20, 0x8200, 0x0, 0x4, r10}, 0x10) write$apparmor_current(r5, &(0x7f0000000240)=ANY=[@ANYBLOB="7065726d686174203078303030303030303030303030303030305e4470757365746d696d655f74797065009fc93f8925771f1b232df3d014332438b51f63208a78faf1bae119eabcfb66c5d1c271732bd53f5925433826ad32b4f0574704ef30d24d84e5adf2402ffb6d8708daed4147fb3c28f3883931618feb38db6cd0f5a10a820da7035eacbfe12586e62cfa3ff9ae353462cfc55b6a647081e47c09c21416e37b68499bb6649f770cccfd49574241d51f81cad351e338951dd3dfc8b7e537e4a27b4a81497f0192d78092a9d6718b2d29ee6f70259e0d7a885f8d1c127597fda0f2fd9d6274a47e7a65f595b41816e181aee554bb5cb9ccefdeb1528c55acbf419c2d44"], 0x6c0) 00:57:57 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permha\" 0x0000000000000000^/'], 0x104) [ 685.403884][T26913] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:57:57 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0xfe00}]) 00:57:57 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r0) r1 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) uselib(&(0x7f0000000000)='./file0\x00') write$apparmor_current(r1, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:57:57 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x68], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 685.549184][T26925] bond0: (slave veth467): Enslaving as an active interface with an up link 00:57:57 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permha% 0x0000000000000000^/'], 0x104) 00:57:57 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup2(r3, r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup2(r6, r5) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) write$apparmor_current(r7, &(0x7f0000000040)=@hat={'permhat ', 0x800, 0x5e, ['cpusetmime_type\x00']}, 0x2b) 00:57:57 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat%0x0000000000000000^/'], 0x104) 00:57:58 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x88200000, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:58 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x6c], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:58 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat/0x0000000000000000^/'], 0x104) 00:57:58 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000180)=ANY=[@ANYBLOB="7065726d6861742030f80400303030303030303030303030303080637065746d696d655f7479706500537ab03ee47d837962ca8d3a494b120fd34b9c11e35dae7c4ffe36fd7c2b305dc76138a0145d3b5f6a70235965e10403037b2bb0676b563bc467d75558a0b1e3b9620c11fb"], 0x6c0) r3 = socket$inet(0x2, 0x4000000805, 0x0) r4 = socket$inet_sctp(0x2, 0x5, 0x84) r5 = dup3(r3, r4, 0x0) r6 = socket$inet(0x2, 0x4000000805, 0x0) r7 = socket$inet_sctp(0x2, 0x5, 0x84) dup3(r6, r7, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r7, 0x84, 0x64, &(0x7f0000000240)=[@in={0x2, 0x4e20, @loopback}], 0x10) sendto$inet(r7, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r7, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r5, 0x84, 0x25, &(0x7f000059aff8)={r8}, &(0x7f000034f000)=0xfeb5) socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r1, 0x84, 0x6c, &(0x7f00000000c0)={r8, 0x81, "7f4d44858b9c1cff3f9320748cf38e55a39e5575cb310955686634b2f423e686162f729de5313d2630a55b444b8d8c2a7087da283d91fe1b2aa2167c59d7af17c025fc9a37105b300b9fe3e96f02fb69d3e063e1c7fe855478177de0e1486c6b4bc02a87b9680ddf4251066d3877d891addda227975e1ac79744b13e7402612d84"}, &(0x7f0000000000)=0x89) 00:57:58 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x74], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 686.189337][T26955] AppArmor: change_hat: Invalid input '0ø' [ 686.225582][T26957] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:57:58 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat #x0000000000000000^/'], 0x104) [ 686.378460][T26965] bond0: (slave veth469): Enslaving as an active interface with an up link 00:57:58 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0xfefd}]) 00:57:58 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000100)=ANY=[@ANYBLOB="7065726d686174203078303030303030302e30303030303030305e6370757365746d696d655f74797065006d035bbf8d97712151245f4b075ba23001886f2bf3f2a420913ce75f1ab8f4e531dbe3493b45f008dcc48029b65b7657aa26feda670c37ce94a7804c44b30c9d6ed7eec99aa5a5e40ece139af88f495d4e793c698e14aa7a34da7261e1bf0b7240755228782ac6a2448dabe3ec3835ed4ea093"], 0x6c0) 00:57:58 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:58 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat +x0000000000000000^/'], 0x104) 00:57:58 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup2(r4, r3) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r6 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000000c0)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICREMOVE(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="0100e0ef69aa779932392f74bd52c40001a69fa57cc1b1f73b78b721ba22a3c775221eb4cd1571c72167bd23befe43f69575ae000000000000000000000000000000000000170000000000", @ANYRES16=r6, @ANYBLOB="90002cbd7000fbdbdf250400000005000100010000001400020000000000000000000000fc0040000001080005000000000008000601800000000000000005000100000000467c555700000000000000000000000000005264ab1400"/102], 0x3}, 0x1, 0x0, 0x0, 0x4004080}, 0x20000054) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(r5, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x64, r6, 0x100, 0x70bd2d, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_ACPTFLG={0x5, 0x1, 0x1}, @NLBL_UNLABEL_A_ACPTFLG={0x5, 0x1, 0x1}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'netdevsim0\x00'}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'netdevsim0\x00'}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @multicast2}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, 0x64}, 0x1, 0x0, 0x0, 0x1}, 0x800) r7 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) [ 686.469484][T26978] AppArmor: change_hat: Invalid input '#x0000000000000000^/' [ 686.686986][T26989] AppArmor: change_hat: Invalid input '+x0000000000000000^/' 00:57:58 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat -x0000000000000000^/'], 0x104) 00:57:58 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x88a8ffff, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:57:58 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0xa4], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:57:58 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) r2 = socket$inet(0x2, 0x4000000805, 0x0) r3 = socket$inet_sctp(0x2, 0x5, 0x84) r4 = dup3(r2, r3, 0x0) r5 = socket$inet(0x2, 0x4000000805, 0x0) r6 = socket$inet_sctp(0x2, 0x5, 0x84) dup3(r5, r6, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r6, 0x84, 0x64, &(0x7f0000000240)=[@in={0x2, 0x4e20, @loopback}], 0x10) sendto$inet(r6, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r6, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) openat$vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vsock\x00', 0x80a41, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r4, 0x84, 0x25, &(0x7f000059aff8)={r7}, &(0x7f000034f000)=0xfeb5) setsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000000)={r7, 0x1}, 0x8) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r8 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r8, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:57:58 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0xf, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) setsockopt$inet6_MRT6_ADD_MIF(r3, 0x29, 0xca, &(0x7f0000000000)={0x401, 0x1, 0x81, 0x54, 0x40}, 0xc) io_submit(r1, 0x0, &(0x7f0000000040)) [ 686.695577][T26990] AppArmor: change_hat: Invalid input '0x0000000.00000000^cpusetmime_type' [ 686.943074][T26997] AppArmor: change_hat: Invalid input '-x0000000000000000^/' [ 686.997956][T27003] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:57:59 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0\"0000000000000000^/'], 0x104) [ 687.115679][ T26] kauditd_printk_skb: 11 callbacks suppressed [ 687.115692][ T26] audit: type=1400 audit(1589677079.105:1288): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=27000 comm="syz-executor.5" 00:57:59 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 687.191020][T27011] bond0: (slave veth471): Enslaving as an active interface with an up link 00:57:59 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0xfeffff}]) 00:57:59 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r1, 0x84, 0xc, &(0x7f0000000000)=0x1, 0x4) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:57:59 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x#000000000000000^/'], 0x104) 00:57:59 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r2, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r2, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) close(r2) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) 00:57:59 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x9effffff, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) [ 687.270204][T27022] AppArmor: change_hat: Invalid input '0"0000000000000000^/' [ 687.711842][T27036] AppArmor: change_hat: Invalid input '0x#000000000000000^/' 00:57:59 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x2], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 687.745520][ T26] audit: type=1400 audit(1589677079.735:1289): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=27031 comm="syz-executor.5" 00:57:59 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x+000000000000000^/'], 0x104) 00:57:59 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) r3 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x80000, 0x0) mq_getsetattr(r3, &(0x7f0000000080)={0x3, 0x100, 0xc00, 0x1}, &(0x7f00000000c0)) 00:57:59 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x1c082, 0x0) io_submit(r1, 0x0, &(0x7f0000000000)) [ 687.926647][T27050] tproxy_tg6_check: 17 callbacks suppressed [ 687.926660][T27050] xt_TPROXY: Can be used only with -p tcp or -p udp [ 687.950236][T27051] AppArmor: change_hat: Invalid input '0x+000000000000000^/' [ 687.952037][T27049] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:58:00 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x-000000000000000^/'], 0x104) [ 688.026969][T27058] xt_TPROXY: Can be used only with -p tcp or -p udp [ 688.050199][ T26] audit: type=1400 audit(1589677080.035:1290): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=27052 comm="syz-executor.5" [ 688.110610][T27060] bond0: (slave veth473): Enslaving as an active interface with an up link 00:58:00 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x3], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:58:00 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup2(r3, r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) write$apparmor_current(r4, &(0x7f0000000040)=@profile={'stack ', 'permhat '}, 0xe) r5 = socket$inet(0x2, 0x4000000805, 0x0) r6 = socket$inet_sctp(0x2, 0x5, 0x84) r7 = dup3(r5, r6, 0x0) r8 = socket$inet(0x2, 0x4000000805, 0x0) r9 = socket$inet_sctp(0x2, 0x5, 0x84) dup3(r8, r9, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r9, 0x84, 0x64, &(0x7f0000000240)=[@in={0x2, 0x4e20, @loopback}], 0x10) sendto$inet(r9, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r9, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r7, 0x84, 0x25, &(0x7f000059aff8)={r10}, &(0x7f000034f000)=0xfeb5) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000080)={r10, @in={{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x8001, 0x2, 0xe5, 0x7f, 0x20, 0x4, 0x9}, 0x9c) [ 688.223843][T27071] AppArmor: change_hat: Invalid input '0x-000000000000000^/' [ 688.381435][T27079] xt_TPROXY: Can be used only with -p tcp or -p udp [ 688.524349][T27079] xt_TPROXY: Can be used only with -p tcp or -p udp 00:58:00 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x1000000}]) 00:58:00 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) pselect6(0x40, &(0x7f0000000080)={0x1, 0x6, 0x4, 0x762, 0x100000001, 0x6, 0x2, 0x80000000}, &(0x7f00000000c0)={0x10001, 0x4, 0x10001, 0x1ff, 0x100, 0x9, 0x9, 0x8}, &(0x7f0000000100)={0x1, 0x0, 0x7fff, 0xba60, 0x7, 0xff, 0x7ff, 0x9}, &(0x7f0000000180)={0x0, 0x989680}, &(0x7f0000000200)={&(0x7f00000001c0)={[0x101]}, 0x8}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) 00:58:00 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x0#00000000000000^/'], 0x104) 00:58:00 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0xc3ffffff, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:58:00 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup2(r3, r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r4, 0x810c5701, &(0x7f0000000340)) r5 = syz_open_dev$media(&(0x7f00000001c0)='/dev/media#\x00', 0x8, 0x48002) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_MEDIA_SET(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)={0x14, r6, 0x1, 0x0, 0x0, {0x12}}, 0x14}}, 0x0) sendmsg$TIPC_NL_BEARER_SET(r5, &(0x7f0000001440)={&(0x7f0000001340)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000001400)={&(0x7f0000001380)={0x80, r6, 0x608, 0x70bd29, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x30, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x20}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x1000}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x2}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x48cec43e}]}, @TIPC_NLA_NET={0x3c, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x3}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x6}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x91}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x3ff}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x7}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x4000040}, 0x8088) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) 00:58:00 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x4], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:58:00 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:58:00 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x0+00000000000000^/'], 0x104) [ 688.794600][T27093] AppArmor: change_hat: Invalid input '0x0#00000000000000^/' [ 688.835314][T27096] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:58:00 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x480000, 0x0) ioctl$IMCTRLREQ(r4, 0x80044945, &(0x7f0000000100)={0x4000, 0x6, 0x3, 0x7}) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) [ 688.997013][T27100] bond0: (slave veth475): Enslaving as an active interface with an up link [ 689.106665][T27091] xt_TPROXY: Can be used only with -p tcp or -p udp [ 689.182058][T27113] xt_TPROXY: Can be used only with -p tcp or -p udp 00:58:01 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x0-00000000000000^/'], 0x104) [ 689.230050][ T26] audit: type=1400 audit(1589677081.215:1291): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=27106 comm="syz-executor.5" 00:58:01 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x00#0000000000000^/'], 0x104) 00:58:01 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x5], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 689.510992][T27129] xt_TPROXY: Can be used only with -p tcp or -p udp [ 689.562746][T27130] xt_TPROXY: Can be used only with -p tcp or -p udp 00:58:02 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x2000000}]) 00:58:02 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) socket$pptp(0x18, 0x1, 0x2) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:58:02 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0xe4ffffff, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:58:02 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x00+0000000000000^/'], 0x104) 00:58:02 executing program 4: r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TUNGETFEATURES(0xffffffffffffffff, 0x800454cf, 0x0) r1 = perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0x615, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000000c40)=ANY=[@ANYBLOB="850000000800000027000000000000009500000000000000a579753dec29fe276240f076750753bc7b952ab5ad939c40c5f89f8b5c13a24800a26b3c68cea54994e702d609331ab3c70aa6b030ed69efddccea3e793e8287051d4f5fef499e2a4ce758601229b94574e7825441222e81748b4ee09cc6d847ef6943a143669ef5fc545ab7ffef72fd2ca305f386142d7835f213e7ff0b00001731859eba975d4a1809acbc7b716441ef6b2b3c690a88728fe3c766be4825548e085c7866d7ac33165a2178a5c647457a8713e7b70a85bbdb078320eafa48d43c96aebc3da20d188f590ec28e549e8e3d4fe60c9fea00000000000100019efc0060c9e1263ca5507f633b5b0402ffa95acb51428785ae09fdae241f51f7ff22745696f1ffe2ca9ed226213275a566ae3f64fb2dfe777d16832bbb703ea39868fcf0fe11894d2c876e4809a16ce03ba31d2e344151341d1008ae03265f8f99ae15d9b711f4b6746dce6ec1ce34d2e2d5241435b5ddc91e9e99ad6b9cbe55e294f5b1e5dc8f1c7bdd3cf375c0b30ccaba07ce35f90f0c589bc98d678d7e258d5d74a133278866780ddac5fe771e6ae67da6e2df4a560436fa3cb7598f923c7316bb7c31f8e867734a5a66f0465d7183fc05c0d804ac719fa87f64cd4f7deb88254e9ded8cb00c1276b1aaffb3cf86fb92efc51802cdd76a73fd639edea01662abbc567a9db53997aa9abd409b5cb990ea1bc76127057ad3ae000000000000000000000000000000000000000000448495daae181b1c6f442f2f739ce0b3e4377f359887cdf898a4463717a1cf4c5d83e93d581b815950e21279f8bcb5167247a398754a1493639f275c5d6c6ea752b63551125eda435b0100008000000000a77508c2cd9fb2636db3abed6453179e3ca03bd3a3dbc4b61dbbfce11ce2d9dbeb6844a88348197292379d22fb6ea97a4f734953d3697cad93d588172c99700fc4f2983edf5d8bb2ec6dc0cc319881b43b7a8a1d1f872d0000000000ddad9444a6f712c20fd0d908c376316a7b26cbaad28bc703c9492f01de1f5d2093213aa1354e783b15f627834d840c6738f8b16b80cc0b0582a3aa02553979e47bdf3716228c4ff4676997286042b43c6cb7e2a01a16ae5757072574afadf6962a40ed57025b5a3897db7f94e8d5ba14fd018c5b302942916cf7314e3c9a00a378771ee3c704a3947879f4ea1f031cd8432a27bc2cb985d55dc9dda125e9f2e5e0d9f2e69559e4c477915d454a6cdd5e49cb212a15f8583f60a72635b022f784682f6e959dae47e9cca8f6474d843ba5014fbc87dffbabee0c2c9e2c08c007b2e2dee76eceee7d848d4b750bb101d89152c0e5f1cddb632ac598fb8ba5a1"], &(0x7f0000000000)='GPL\x00', 0x5, 0xfd39, &(0x7f000000cf3d)=""/195}, 0x48) r3 = dup3(r0, 0xffffffffffffffff, 0x80000) write$P9_RATTACH(r3, &(0x7f0000000180)={0x14, 0x69, 0x1, {0x10, 0x2, 0x3}}, 0x14) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r4) socket$inet6_mptcp(0xa, 0x1, 0x106) r5 = openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x500, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) io_setup(0x6, &(0x7f0000000140)=0x0) r7 = socket$inet_udp(0x2, 0x2, 0x0) r8 = dup(r7) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) io_submit(r6, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r4, 0x0, 0x7ffffffff000}]) rt_sigtimedwait(&(0x7f00000001c0)={[0x5]}, &(0x7f0000000200), &(0x7f00000002c0), 0x8) 00:58:02 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x6], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 690.241068][T27145] xt_TPROXY: Can be used only with -p tcp or -p udp [ 690.250358][ T26] audit: type=1400 audit(1589677082.245:1292): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=27140 comm="syz-executor.5" [ 690.275992][T27143] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:58:02 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x00-0000000000000^/'], 0x104) [ 690.337163][ T26] audit: type=1400 audit(1589677082.325:1293): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=27140 comm="syz-executor.5" [ 690.357295][T27154] xt_TPROXY: Can be used only with -p tcp or -p udp 00:58:02 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000240)=ANY=[@ANYBLOB="7065726d686174203078303030303030303030303030303030305e6370757365746d696d655f7479706500fd7072eb59c9281a8a309b6e0c659a02d7fd4c6f15632f64fa9efb0430352b0000000000ca531b667dfcf3edc4b4f300e73c7116ea62fc5fde23690cb3f1b235c0536716556493dfcaea037cea7f4d9ebea4747ed7099b1163c29a22542b398e7c859111b2e25ee4bed538cf81bf4b8cc01187f72e037a789e06a5368d88ce7afb9bd98e0031621d16141800"/193], 0x6c0) [ 690.454910][T27156] bond0: (slave veth477): Enslaving as an active interface with an up link 00:58:02 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x7], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:58:02 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x000#000000000000^/'], 0x104) [ 690.686716][ T26] audit: type=1400 audit(1589677082.675:1294): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=27168 comm="syz-executor.5" 00:58:02 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x000+000000000000^/'], 0x104) 00:58:02 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0xf0ffffff, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) [ 691.074784][T27184] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 691.150461][T27184] bond0: (slave veth479): Enslaving as an active interface with an up link 00:58:03 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x3000000}]) 00:58:03 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x11], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:58:03 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="7065726d686174203078303030303030303030303030303030305e63707517120000000000107479706500"], 0x6c0) 00:58:03 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$VIDIOC_G_ENC_INDEX(r3, 0x8818564c, &(0x7f00000002c0)) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) 00:58:03 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x000-000000000000^/'], 0x104) [ 691.363011][T27204] split_token_from_name: 7 callbacks suppressed [ 691.363020][T27204] AppArmor: change_hat: Invalid input '0x000-000000000000^/' 00:58:03 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x0000#00000000000^/'], 0x104) [ 691.406811][ T26] audit: type=1400 audit(1589677083.395:1295): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=27200 comm="syz-executor.5" 00:58:03 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0xfeffffff, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:58:03 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x48], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:58:03 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet(0x2, 0x4000000805, 0x0) r3 = socket$inet_sctp(0x2, 0x5, 0x84) r4 = dup3(r2, r3, 0x0) r5 = socket$inet(0x2, 0x4000000805, 0x0) r6 = socket$inet_sctp(0x2, 0x5, 0x84) dup3(r5, r6, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r6, 0x84, 0x64, &(0x7f0000000240)=[@in={0x2, 0x4e20, @loopback}], 0x10) sendto$inet(r6, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r6, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r4, 0x84, 0x25, &(0x7f000059aff8)={r7}, &(0x7f000034f000)=0xfeb5) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r1, 0x84, 0x6d, &(0x7f0000000080)={r7, 0x5b, "ded0779195f79030f4d79a06227b9de99b312004363e283753bbf2c30640310ea516fd8ae337f46d103ae8a26b7ec1cdf0599b09c97830a7b8eef925ff19adfd92bf3794738c0b5b4e4096520c23f5461201c4efeab55f42addf63"}, &(0x7f0000000100)=0x63) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000140)={r8, 0x4}, 0x8) r9 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r10 = dup(r9) ioctl$PERF_EVENT_IOC_ENABLE(r10, 0x8912, 0x400200) r11 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r11, &(0x7f0000000040)=ANY=[@ANYBLOB='permhat 0x^cpusetmime_type\x00'], 0x6c0) 00:58:03 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x0000+00000000000^/'], 0x104) 00:58:03 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) io_setup(0xad6b, &(0x7f0000000080)=0x0) io_submit(r3, 0x1, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x0, 0x0, 0x0, 0x0, r2}]) [ 691.625999][T27216] AppArmor: change_hat: Invalid input '0x0000#00000000000^/' [ 691.781498][ T26] audit: type=1400 audit(1589677083.765:1296): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=27219 comm="syz-executor.5" [ 691.829440][T27223] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:58:03 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x0000-00000000000^/'], 0x104) [ 691.838486][T27229] AppArmor: change_hat: Invalid input '0x0000+00000000000^/' [ 691.969235][T27236] bond0: (slave veth481): Enslaving as an active interface with an up link 00:58:04 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x4000000}]) 00:58:04 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x4c], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:58:04 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x10) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000002c00)={0x0, 0x2, &(0x7f0000003d00)=[{&(0x7f0000000100)="250000003b000535a4abd32b8018007a0224fc60100002400a000200053594c137153e3709", 0x25}], 0x1}, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r3, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:58:04 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x00000#0000000000^/'], 0x104) 00:58:04 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x3c) sendmsg$TIPC_NL_BEARER_SET(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000680)=ANY=[@ANYBLOB="04030000", @ANYRES16=0x0, @ANYBLOB="000125bd7000fedbdf25050000000c000980080001000700000050000180140002800800030005000000080002000004000008000300010000000d0001007564703a73797a30000000000f00010069623a69705f76746930000008000300810000000800030000000000140007800800020022ffffff0800010001000000c40005803400028008000100120000000800010006000000080002000100000008000200010000000800010005000000080004000300000007000100696200000800010075647000070001006962000008000100657468003c000280080002008000000008000200040000000800030008000000080002000400000008000200fdffffff08000200018000000800010008000000070001006962000014000280080003000100000008000300ffffff7f1400028008000300b63dffff080002007f000000a80004802c000780080004004000000008000400000100000800030004000000080004000600000008000300000000000900010073797a300200000024000780080001000d0000000800030038f79d4c080004000900000008000200250000001300010062726f6164636173742d6c696e6b00000900010073797a31000000001300010062726f6164636173742d6c616e6b00001300010062726f6164636173742d6c696e6b000098000180080003000300000008000300120000004c000280080001000a0000000800010019000000080002000700000008000400060000000800040008000000080003000900000008000200000070000800010005000000080004000002000038000400200001000a004e2200000100fe800000000000000000000000000015010000001400020002004e21ac1414bb0000000000000000280006800800010005000000040002000400020004000200080001000500000008000100040000005400098008000200ca000017abe1855f02efd626b61c37667b54000800020008000000080001000001000008000200d30000000800010008000000080001007f000000080001001f000000080002000000008008"], 0x304}, 0x1, 0x0, 0x0, 0xd89ad2032db25466}, 0x0) ptrace$cont(0x9, 0x0, 0x7ffffffd, 0x100) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r1, 0x0, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x1, 0x4, 0x800000, 0xfffffffffffffffd}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$SIOCAX25OPTRT(r4, 0x89e7, &(0x7f0000000080)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x2, 0x44}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x2000, 0x0) openat$cgroup_subtree(r5, &(0x7f0000000100)='cgroup.subtree_control\x00', 0x2, 0x0) io_submit(r2, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) 00:58:04 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0xffffa888, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:58:04 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcs\x00', 0x901, 0x0) fsync(r4) [ 692.497011][T27256] netlink: 'syz-executor.5': attribute type 2 has an invalid length. [ 692.517325][T27257] AppArmor: change_hat: Invalid input '0x00000#0000000000^/' [ 692.556182][T27256] netlink: 1 bytes leftover after parsing attributes in process `syz-executor.5'. 00:58:04 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x60], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 692.589025][ T26] audit: type=1400 audit(1589677084.575:1297): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=27253 comm="syz-executor.5" 00:58:04 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x00000+0000000000^/'], 0x104) [ 692.634338][T27265] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 692.693406][T27263] netlink: 'syz-executor.5': attribute type 2 has an invalid length. [ 692.714526][T27263] netlink: 1 bytes leftover after parsing attributes in process `syz-executor.5'. [ 692.754507][T27277] bond0: (slave veth483): Enslaving as an active interface with an up link [ 692.784638][ T26] audit: type=1400 audit(1589677084.775:1298): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=27253 comm="syz-executor.5" 00:58:04 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x68], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:58:04 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup2(r1, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r9, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r9], 0x44}}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r9}, [@IFLA_MASTER={0x8, 0xa, r5}]}, 0x28}}, 0x0) sendmsg$xdp(r2, &(0x7f00000000c0)={&(0x7f0000000000)={0x2c, 0xd, r9, 0x3f}, 0x10, &(0x7f0000000080), 0x0, 0x0, 0x0, 0x4000}, 0x100) r10 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r10, 0x8912, 0x400200) r11 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r11, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:58:04 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x00000-0000000000^/'], 0x104) [ 692.831099][T27282] AppArmor: change_hat: Invalid input '0x00000+0000000000^/' [ 692.999515][T27288] tproxy_tg6_check: 10 callbacks suppressed [ 692.999521][T27288] xt_TPROXY: Can be used only with -p tcp or -p udp [ 693.044024][T27290] AppArmor: change_hat: Invalid input '0x00000-0000000000^/' [ 693.220271][T27291] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 693.258642][ T26] audit: type=1400 audit(1589677085.245:1299): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=27289 comm="syz-executor.5" [ 693.284022][T27299] xt_TPROXY: Can be used only with -p tcp or -p udp [ 693.316673][T27296] bond0: (slave veth23): Enslaving as an active interface with an up link [ 693.365096][T27295] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 00:58:05 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x5000000}]) 00:58:05 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x7, &(0x7f00000000c0)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) 00:58:05 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x000000#000000000^/'], 0x104) 00:58:05 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0xfffff000, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:58:05 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x6c], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:58:05 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) r3 = socket$rxrpc(0x21, 0x2, 0x2) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) r9 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r10, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r10], 0x44}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r10}, [@IFLA_MASTER={0x8, 0xa, r6}]}, 0x28}}, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'syzkaller0\x00', r10}) write$apparmor_current(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="7065726d686174203078303030303030303030303030303030305e6370757365746d696d655f7479706992"], 0x6c0) [ 693.583718][T27314] xt_TPROXY: Can be used only with -p tcp or -p udp [ 693.593024][T27317] AppArmor: change_hat: Invalid input '0x000000#000000000^/' [ 693.599756][T27315] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:58:05 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x000000+000000000^/'], 0x104) [ 693.673110][T27326] xt_TPROXY: Can be used only with -p tcp or -p udp 00:58:05 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x74], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 693.770657][T27327] bond0: (slave veth485): Enslaving as an active interface with an up link 00:58:05 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$EXT4_IOC_MIGRATE(r0, 0x6609) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) 00:58:05 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x000000-000000000^/'], 0x104) [ 693.845980][T27340] AppArmor: change_hat: Invalid input '0x000000+000000000^/' [ 693.980432][T27350] xt_TPROXY: Can be used only with -p tcp or -p udp [ 694.017713][T27339] bond0: (slave veth25): Enslaving as an active interface with an up link 00:58:06 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x0000000#00000000^/'], 0x104) 00:58:06 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0xffffff7f, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) [ 694.109805][T27355] AppArmor: change_hat: Invalid input '0x000000-000000000^/' [ 694.259261][T27360] xt_TPROXY: Can be used only with -p tcp or -p udp [ 694.294513][T27361] AppArmor: change_hat: Invalid input '0x0000000#00000000^/' [ 694.524123][T27366] __nla_validate_parse: 1 callbacks suppressed [ 694.524135][T27366] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:58:06 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x7000000}]) 00:58:06 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x0000000+00000000^/'], 0x104) 00:58:06 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 694.639492][T27365] bond0: (slave veth487): Enslaving as an active interface with an up link 00:58:06 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$isdn_base(0x22, 0x3, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) r4 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r4, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r4, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) setsockopt$inet_sctp_SCTP_AUTH_CHUNK(r4, 0x84, 0x15, &(0x7f0000000080)={0x2d}, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) 00:58:06 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r1, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup2(r3, r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) sendmsg$NFT_MSG_GETFLOWTABLE(r4, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x2c, 0x17, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80080}, 0x40000) sendto$inet(r1, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) setsockopt$IP_VS_SO_SET_EDIT(r1, 0x0, 0x483, &(0x7f0000000000)={0x20, @multicast2, 0x4e22, 0x1, 'none\x00', 0x6, 0x1, 0x5}, 0x2c) r5 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r6 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r6, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000240)=[@in={0x2, 0x4e20, @loopback}], 0x10) sendto$inet(0xffffffffffffffff, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x25, &(0x7f000059aff8)={r7}, &(0x7f000034f000)=0xfeb5) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1b, &(0x7f0000000240)={r7, 0x4c, "04b7196d9bfa97988787d89b59a451ec2c8083d775ea3c4a7a488f6748c04639a69fc1ac0a74a8c0fb92aeb9e8cfec9a7a80179319afaac3211aa7bdf60561886a8cd677091c15bf97a7a2b8"}, &(0x7f00000002c0)=0x54) 00:58:06 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x0000000-00000000^/'], 0x104) [ 694.817406][T27387] xt_TPROXY: Can be used only with -p tcp or -p udp 00:58:07 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x00000000#0000000^/'], 0x104) 00:58:07 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) [ 695.045126][T27387] xt_TPROXY: Can be used only with -p tcp or -p udp 00:58:07 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0xffffff9e, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:58:07 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0xa4], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:58:07 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/zoneinfo\x00', 0x0, 0x0) ioctl$sock_ax25_SIOCADDRT(r2, 0x890b, &(0x7f00000000c0)={@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, 0x5, [@null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null, @bcast]}) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup2(r6, r5) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) io_submit(r1, 0x1, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x0, 0x0, 0x0, r7}]) [ 695.236486][ T26] audit: type=1400 audit(1589677087.225:1300): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=27401 comm="syz-executor.5" 00:58:07 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x00000000+0000000^/'], 0x104) [ 695.306520][T27406] xt_TPROXY: Can be used only with -p tcp or -p udp [ 695.337798][T27409] xt_TPROXY: Can be used only with -p tcp or -p udp [ 695.360335][T27408] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 695.488208][T27408] bond0: (slave veth489): Enslaving as an active interface with an up link 00:58:07 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x8000000}]) 00:58:07 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socket$inet_udplite(0x2, 0x2, 0x88) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup2(r4, r3) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r5, 0xc0a85352, &(0x7f0000000080)={{0x3f, 0x8}, 'port0\x00', 0x98, 0x8, 0x1, 0x6, 0xbdb, 0x3f, 0x1f, 0x0, 0x7, 0x81}) 00:58:07 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:58:07 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x00000000-0000000^/'], 0x104) 00:58:07 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) 00:58:07 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0xffffffc3, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:58:08 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x000000000#000000^/'], 0x104) [ 695.959008][ T26] audit: type=1400 audit(1589677087.945:1301): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=27428 comm="syz-executor.5" 00:58:08 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x2], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:58:08 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) r1 = syz_open_dev$video4linux(&(0x7f0000000080)='/dev/v4l-subdev#\x00', 0x1, 0x400c0) ioctl$VIDIOC_QUERYCTRL(r1, 0xc0445624, &(0x7f00000000c0)={0x20, 0x5, "8b47cbb02eef925ca414c74af9487ba6b0d97ab29fe670a8b7f9d0d09e1e4a85", 0xffff488f, 0xb1bf, 0x1, 0x4, 0x9}) socket$inet6_mptcp(0xa, 0x1, 0x106) syz_open_dev$media(&(0x7f0000000180)='/dev/media#\x00', 0x400, 0x86042) io_setup(0x6, &(0x7f0000000140)=0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x7fffffff) io_submit(r2, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) 00:58:08 executing program 5: socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r0, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r0, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) r1 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r1, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r1, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r3, &(0x7f0000000040)=ANY=[@ANYBLOB='permhat 0x00000000\x00\x00000000^cpusetmime_type\x00'], 0x6c0) ioctl$PPPIOCGMRU(r2, 0x80047453, &(0x7f0000000000)) [ 696.107211][T27443] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:58:08 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x000000000+000000^/'], 0x104) [ 696.256517][T27456] bond0: (slave veth491): Enslaving as an active interface with an up link 00:58:08 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x0, 0x0, 0x0, 0x3}]) [ 696.435593][T27468] split_token_from_name: 8 callbacks suppressed 00:58:08 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x3f000000}]) 00:58:08 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x3], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:58:08 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x000000000-000000^/'], 0x104) 00:58:08 executing program 5: socket$inet_icmp_raw(0x2, 0x3, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f0000000000)={0x7, 0x7, 0x0, 0x4000, 0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r5, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) 00:58:08 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0xffffffe4, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:58:08 executing program 4: setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(0xffffffffffffffff, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) ioctl$VIDIOC_QUERYBUF(0xffffffffffffffff, 0xc0585609, &(0x7f00000001c0)={0xd049, 0x9, 0x4, 0x20000, 0x2, {}, {0x2, 0x8, 0x7, 0x9, 0x1f, 0x40, "41908bf6"}, 0x0, 0x1, @planes=&(0x7f0000000180)={0x20, 0x2, @userptr=0x2, 0x4}, 0x5, 0x0, 0xffffffffffffffff}) ioctl$USBDEVFS_RELEASE_PORT(r0, 0x80045519, &(0x7f0000000240)=0x5) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r1) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) socket$inet_udp(0x2, 0x2, 0x0) r3 = syz_open_dev$swradio(&(0x7f0000000080)='/dev/swradio#\x00', 0x0, 0x2) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup2(r6, r5) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) recvfrom$l2tp6(r7, &(0x7f00000000c0)=""/28, 0x1c, 0x2000, &(0x7f0000000100)={0xa, 0x0, 0x0, @private0}, 0x20) io_submit(r2, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r1, 0x0, 0x7ffffffff000}]) [ 696.435603][T27468] AppArmor: change_hat: Invalid input '0x000000000+000000^/' [ 696.966215][T27484] AppArmor: change_hat: Invalid input '0x000000000-000000^/' [ 696.969164][T27486] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 697.002082][ T26] audit: type=1400 audit(1589677088.985:1302): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=27479 comm="syz-executor.5" 00:58:09 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x0000000000#00000^/'], 0x104) 00:58:09 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x4], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 697.137562][T27496] bond0: (slave veth493): Enslaving as an active interface with an up link 00:58:09 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) r3 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup2(r5, r4) r7 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/vmstat\x00', 0x0, 0x0) waitid$P_PIDFD(0x3, r7, &(0x7f0000000240), 0x80000000, &(0x7f00000002c0)) r8 = syz_open_dev$audion(&(0x7f0000000180)='/dev/audio#\x00', 0x100, 0x400000) ioctl$UI_ABS_SETUP(r8, 0x401c5504, &(0x7f0000000380)={0x4bb1, {0x80, 0x8, 0x80000001, 0xfffff801, 0x6}}) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) r9 = pidfd_getfd(r6, r2, 0x0) ioctl$TUNGETFILTER(r9, 0x801054db, &(0x7f0000000080)=""/1) sendto$inet(r3, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x4e22, @remote}, 0x10) sendto$inet(r3, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) write$apparmor_current(r2, &(0x7f0000000000)=ANY=[@ANYRES16=r3], 0x6c0) 00:58:09 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r4, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r4, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) ioctl$FIONCLEX(r4, 0x5450) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(0x0, 0x3c) ptrace$cont(0x18, 0x0, 0x0, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, 0x0, 0x0, 0x0) ioctl$TIOCSPGRP(r3, 0x5410, &(0x7f0000000080)) 00:58:09 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x0000000000+00000^/'], 0x104) 00:58:09 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x0000000000-00000^/'], 0x104) [ 697.218844][T27507] AppArmor: change_hat: Invalid input '0x0000000000#00000^/' [ 697.441490][T27521] AppArmor: change_hat: Invalid input '0x0000000000+00000^/' 00:58:10 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x40000000}]) 00:58:10 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x5], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:58:10 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0xfffffff0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:58:10 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x00000000000#0000^/'], 0x104) 00:58:10 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000080)={0x0, 0x0, 0x3}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) 00:58:10 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) r2 = socket$inet(0x2, 0x6000000000000003, 0x6) r3 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r3, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r3, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) ioctl$sock_SIOCSIFVLAN_GET_VLAN_REALDEV_NAME_CMD(r3, 0x8983, &(0x7f0000000080)={0x8, 'syzkaller1\x00', {'veth1_macvtap\x00'}, 0x1}) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r2, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r2, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) ioctl$FIGETBSZ(r2, 0x2, &(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup2(r5, r4) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$SOUND_MIXER_WRITE_RECSRC(r6, 0xc0044dff, &(0x7f0000000100)=0x4) openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(0xffffffffffffffff, &(0x7f0000000380)=ANY=[@ANYBLOB="6368616e6765686174203078303030303030303030303030303030325e6d696d9ea73c68a647189c011e8993b256655faa61b81e00d33ff53a051847d18cac149cefbe0bc907fbda309cad0039a01576dbcf2f8c469a5b22bfded82f70726f632f7468726561642d73656c662f617474722f63757272656e74006c6f6d643573756d0023006e6f646576626465766367726f7570256d643573756d73656c66766d6e6574306d643573756d2576626f786e657430707070300073797a6b616c6c657231007070703000"], 0xbd) [ 697.626032][T27528] AppArmor: change_hat: Invalid input '0x0000000000-00000^/' [ 698.112626][T27540] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:58:10 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x00000000000+0000^/'], 0x104) [ 698.133513][T27542] AppArmor: change_hat: Invalid input '0x00000000000#0000^/' [ 698.190717][T27551] tproxy_tg6_check: 8 callbacks suppressed [ 698.190724][T27551] xt_TPROXY: Can be used only with -p tcp or -p udp [ 698.214528][T27556] bond0: (slave veth495): Enslaving as an active interface with an up link 00:58:10 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x3) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) [ 698.305977][T27551] xt_TPROXY: Can be used only with -p tcp or -p udp 00:58:10 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x00000000000-0000^/'], 0x104) 00:58:10 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x6], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 698.375218][T27562] AppArmor: change_hat: Invalid input '0x00000000000+0000^/' 00:58:10 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x000000000000#000^/'], 0x104) 00:58:10 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0xfffffffe, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) [ 698.477092][T27569] AppArmor: change_hat: Invalid input '0x00000000000-0000^/' [ 698.602272][T27575] xt_TPROXY: Can be used only with -p tcp or -p udp [ 698.687988][T27577] xt_TPROXY: Can be used only with -p tcp or -p udp [ 698.748578][T27580] AppArmor: change_hat: Invalid input '0x000000000000#000^/' [ 698.789358][T27582] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 698.935363][T27586] bond0: (slave veth497): Enslaving as an active interface with an up link 00:58:11 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0xeffdffff}]) 00:58:11 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) setsockopt$SO_J1939_FILTER(r3, 0x6b, 0x1, &(0x7f00000002c0)=[{0x3, 0x2, {0x3, 0xf0, 0x4}, {0x0, 0x0, 0x1}, 0x0, 0x1}, {0x2, 0x3, {0x1, 0xff}, {0x0, 0x0, 0x3}, 0xfd, 0xff}, {0x1, 0x4, {0x2, 0x0, 0x3}, {0x0, 0x1}, 0x0, 0xfe}, {0x1, 0x2, {0x0, 0xf0}, {0x0, 0xf0}, 0xfd, 0x2}, {0x0, 0x3, {0x1, 0xff, 0x3}, {0x0, 0x1}, 0xfd}, {0x2, 0x3, {0x2}, {0x0, 0xff, 0x4}, 0x2, 0x1}, {0x2, 0x0, {0x3, 0xf0, 0x2}, {0x0, 0x0, 0x1}, 0x2, 0xff}, {0x2, 0x3, {0x2, 0x1, 0xa1ec7cbbcc8ebded}, {0x0, 0xf0, 0x3}, 0x1, 0xfe}, {0x1, 0x2, {0x0, 0xf0, 0x1}, {0x0, 0xff, 0x4}, 0xfc, 0x1}, {0x0, 0x1, {0x0, 0x0, 0x1}, {0x1, 0xff, 0x4}, 0x1, 0x2}], 0x140) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) 00:58:11 executing program 5: socket$inet_icmp_raw(0x2, 0x3, 0x1) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x102, 0x0) r0 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r0, 0x0, 0x0, 0x2404c8c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) r1 = socket$inet(0x2, 0x4000000805, 0x0) r2 = socket$inet_sctp(0x2, 0x5, 0x84) dup3(r1, r2, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000240)=[@in={0x2, 0x4e20, @loopback}], 0x10) sendto$inet(r2, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x25, &(0x7f000059aff8)={r3}, &(0x7f000034f000)=0xfeb5) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000080)={r3, 0x9, 0x1000}, &(0x7f0000000100)=0x8) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f0000000240)={r4, @in6={{0xa, 0x4e23, 0x4, @private2, 0x3d}}, [0x200, 0x10001, 0x2441400000000000, 0xfffffffffffffffe, 0xffffffffffffffa8, 0x100000000, 0x3f, 0x800, 0x3f, 0x1, 0x100, 0x6, 0x1, 0x7, 0x1]}, &(0x7f0000000180)=0x100) sendto$inet(r0, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) r5 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r6 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) ioctl$NBD_CLEAR_SOCK(r5, 0xab04) write$apparmor_current(r6, &(0x7f0000000040)=@profile={'stack ', 'keyring\x00'}, 0xe) 00:58:11 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x000000000000+000^/'], 0x104) 00:58:11 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x7], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:58:11 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0xffffffff, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) [ 699.243511][T27604] AppArmor: change_hat: Invalid input '0x000000000000+000^/' [ 699.279977][T27607] xt_TPROXY: Can be used only with -p tcp or -p udp [ 699.309076][ T26] audit: type=1400 audit(1589677091.296:1303): apparmor="DENIED" operation="stack" info="label not found" error=-2 profile="unconfined" name="keyring" pid=27597 comm="syz-executor.5" 00:58:11 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x000000000000-000^/'], 0x104) [ 699.389477][T27607] xt_TPROXY: Can be used only with -p tcp or -p udp 00:58:11 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x301200, 0x0) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/qat_adf_ctl\x00', 0x101400, 0x0) sendmsg$nl_route(r2, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=@ipv6_getanyicast={0x14, 0x3e, 0x4, 0x70bd27, 0x25dfdbfb, {}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x20000800}, 0x0) io_setup(0x6, &(0x7f0000000140)=0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) io_submit(r3, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) 00:58:11 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$KDGKBTYPE(0xffffffffffffffff, 0x4b33, &(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0xaf) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000240)=ANY=[@ANYBLOB="70650002000076203078303030303030b03030303034841cc49850544830302a30305e6300757365746d696d655f7479706500e76c36fb00800080e95c723e95a9b6f8fce408ab"], 0x6c0) r3 = gettid() getsockopt$inet_sctp6_SCTP_HMAC_IDENT(0xffffffffffffffff, 0x84, 0x16, &(0x7f0000000100)={0x6, [0xffff, 0x7f, 0x1, 0x0, 0xa1, 0x0]}, &(0x7f0000000140)=0x10) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x9) ptrace$cont(0x18, r3, 0x0, 0x0) ptrace$setregs(0xd, r3, 0x0, &(0x7f0000000080)) setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f0000000040)=0x6, 0x4) ptrace$cont(0x20, r3, 0x0, 0x0) rt_sigqueueinfo(r3, 0x4, &(0x7f0000000080)={0x40, 0x3ff, 0x3ff}) 00:58:11 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x11], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 699.495646][T27615] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:58:11 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x0000000000000#00^/'], 0x104) [ 699.650825][T27623] bond0: (slave veth499): Enslaving as an active interface with an up link [ 699.722605][T27633] xt_TPROXY: Can be used only with -p tcp or -p udp 00:58:11 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_sctp(0x2, 0x5, 0x84) r3 = dup3(0xffffffffffffffff, r2, 0x0) r4 = socket$inet(0x2, 0x4000000805, 0x0) r5 = socket$inet_sctp(0x2, 0x5, 0x84) dup3(r4, r5, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0x4e20, @loopback}, @in={0x2, 0x4e22, @multicast1}, @in={0x2, 0x4e22, @loopback}], 0x30) sendto$inet(r5, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r5, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r3, 0x84, 0x25, &(0x7f000059aff8)={r6}, &(0x7f000034f000)=0xfeb5) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f00000000c0)={0x8, 0x205, 0x4, 0x0, r6}, &(0x7f0000000100)=0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) r9 = dup2(r8, r7) ioctl$PERF_EVENT_IOC_ENABLE(r9, 0x8912, 0x400200) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r9, 0x6, 0x23, &(0x7f0000000000)={&(0x7f0000ffc000/0x1000)=nil, 0x1000}, &(0x7f0000000080)=0x10) r10 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r10, &(0x7f0000000300)=ANY=[@ANYBLOB="706530303e30303030be6f3030305e63707073654655d124c90e1839706500000000000000000000000000036b14e0c3b0b0c73467f9ffffff4199990375ee30e98b2edfab606cf0849314725d8b9b5fdbb67355dae7fcbdb7c8529744a73c6b585fe108dd347053ac7f84c8e97fb2deece1a3ea4f9db3f8fd0e95bb8a512a602381e6"], 0x6c0) [ 699.799081][T27636] xt_TPROXY: Can be used only with -p tcp or -p udp 00:58:12 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0xfcfdffff}]) 00:58:12 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x3c) ptrace$cont(0x18, r1, 0x0, 0x0) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r1, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x7, 0x0, r1}) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(0xffffffffffffffff, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) getsockopt$inet_dccp_int(0xffffffffffffffff, 0x21, 0x1, &(0x7f00000000c0), &(0x7f0000000100)=0x4) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) finit_module(r0, &(0x7f0000000080)='ppp0security[system\x00', 0x1) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) io_submit(r2, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) 00:58:12 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x0000000000000+00^/'], 0x104) 00:58:12 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x48], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:58:12 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0xf, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:58:12 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=@hat={'permhat ', 0x0, 0x5e, ['cpusetmime_type\x00']}, 0x6c0) open_by_handle_at(r0, &(0x7f0000000080)={0xa1, 0x10001, "39ca47a2fff43caa50853d150a64c1183d7381bcba84105b7f81fe65a85570f1ed784fd8696dfbd02616b9c5c8f45f7839e28fbd7caa359de18bfb9327abf380594c8a4d1e48632a135b54f9238483af1cf8820f0dc81273e2a2ba940860abf4c70e640c497fe777a660e7ae33346437250710bf999b0188b2d2e589e61f3db88619c9dca525c90fc69beb48d01c936db2b9fd7a36af103d57"}, 0x513082) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$CAPI_GET_ERRCODE(r3, 0x80024321, &(0x7f0000000140)) [ 700.339931][ T26] audit: type=1400 audit(1589677092.326:1304): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=27650 comm="syz-executor.5" [ 700.365244][T27653] xt_TPROXY: Can be used only with -p tcp or -p udp [ 700.399593][T27657] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:58:12 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000000)={0x0, 0x0, 0x1ff}) close(r0) r2 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r2, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r2, &(0x7f0000000100), 0x0, 0x4000, &(0x7f00000001c0), 0x10) fcntl$getownex(r2, 0x10, &(0x7f00000000c0)) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000100)) r3 = socket$inet_udp(0x2, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup2(r5, r4) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER(r6, 0xc0605345, &(0x7f0000000040)={0x7, 0x0, {0x2, 0x1, 0x4, 0x0, 0xc52}, 0x9}) dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x7ffffffc) 00:58:12 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) openat$vim2m(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video35\x00', 0x2, 0x0) ioctl$FIBMAP(r1, 0x1, &(0x7f0000000080)=0x401) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="7065726d68617420307830303030309a003030303030303030305e9970757365746d696d655f7479706500"], 0x6c0) 00:58:12 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x0000000000000-00^/'], 0x104) [ 700.452490][T27663] xt_TPROXY: Can be used only with -p tcp or -p udp 00:58:12 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x4c], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:58:12 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x00000000000000#0^/'], 0x104) 00:58:12 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x10, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) [ 701.029557][T27693] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:58:13 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0xfefdffff}]) 00:58:13 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f0000000000)=0x2) r3 = openat$procfs(0xffffff9c, &(0x7f0000000040)='/proc/slabinfo\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x0, 0x11, r3, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 00:58:13 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x00000000000000+0^/'], 0x104) 00:58:13 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x60], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:58:13 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0xb72, &(0x7f0000000080)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) 00:58:13 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0xc0, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) [ 701.486045][T27716] split_token_from_name: 6 callbacks suppressed 00:58:13 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x68], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:58:13 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x00000000000000-0^/'], 0x104) 00:58:13 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r5, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r5], 0x44}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r1}]}, 0x28}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wg2\x00', r5}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000001c0)={&(0x7f0000000440)=@newtclass={0x4c, 0x28, 0x100, 0x70bd2c, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0xa, 0x7ffb}, {0xa, 0xfff3}, {0x2, 0x6}}, [@tclass_kind_options=@c_netem={0xa, 0x1, 'netem\x00'}, @TCA_RATE={0x6, 0x5, {0xff}}, @tclass_kind_options=@c_prio={0x9, 0x1, 'prio\x00'}, @tclass_kind_options=@c_cbs={0x8, 0x1, 'cbs\x00'}]}, 0x4c}, 0x1, 0x0, 0x0, 0x1}, 0x24000000) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r7 = socket$inet_udp(0x2, 0x2, 0x0) r8 = dup(r7) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) io_submit(r6, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) [ 701.486054][T27716] AppArmor: change_hat: Invalid input '0x00000000000000+0^/' [ 701.641362][T27726] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:58:13 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f0000000000)=0x2) r3 = openat$procfs(0xffffff9c, &(0x7f0000000040)='/proc/slabinfo\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x0, 0x11, r3, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 00:58:13 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x000000000000000#^/'], 0x104) [ 701.721987][T27730] AppArmor: change_hat: Invalid input '0x00000000000000-0^/' [ 701.839151][T27739] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 00:58:14 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x6c], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:58:14 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0xfffffdef}]) 00:58:14 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x000000000000000+^/'], 0x104) 00:58:14 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f0000000000)=0x2) r3 = openat$procfs(0xffffff9c, &(0x7f0000000040)='/proc/slabinfo\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x0, 0x11, r3, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 00:58:14 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0xec0, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:58:14 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x74], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 701.926861][T27753] AppArmor: change_hat: Invalid input '0x000000000000000#^/' [ 702.549366][T27777] AppArmor: change_hat: Invalid input '0x000000000000000+^/' [ 702.634838][T27784] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:58:14 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x000000000000000-^/'], 0x104) 00:58:14 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f0000000000)=0x2) r3 = openat$procfs(0xffffff9c, &(0x7f0000000040)='/proc/slabinfo\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x0, 0x11, r3, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 00:58:14 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r3, 0xc008551a, &(0x7f0000000080)={0x10000, 0x10, [0xffff, 0xffffff7f, 0x6, 0x8000]}) close(r0) sendto$inet(0xffffffffffffffff, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) r4 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r4, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r4, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) sendfile(0xffffffffffffffff, r4, &(0x7f00000000c0)=0x80, 0x80000001) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) r7 = dup(r6) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) io_submit(r5, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) 00:58:14 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:58:14 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x0000000000000000^/'], 0x103) 00:58:15 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f0000000000)=0x2) openat$procfs(0xffffff9c, &(0x7f0000000040)='/proc/slabinfo\x00', 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 702.830557][T27798] AppArmor: change_hat: Invalid input '0x000000000000000-^/' [ 703.077461][ T26] audit: type=1400 audit(1589677095.066:1305): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=27810 comm="syz-executor.1" 00:58:15 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x2000, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) [ 703.360536][T27825] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:58:15 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0xfffffdfc}]) 00:58:15 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x0, 0xa4], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:58:15 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x0000000000000000^/'], 0x105) 00:58:15 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup2(r4, r3) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) write$char_usb(r5, &(0x7f00000000c0)="32c8b8b88b9d42363c8f92930c15696388793a741d99496c324de5f0ab56e46c6167f4e83296ca7cace65ed8f06e9dbdcd97865c737f8b58fceb043e5700e8980b194414cd9a1f42600c61fb", 0x4c) r6 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff, 0x15}, 0x10) ftruncate(r6, 0x6) r7 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) ioctl$VIDIOC_S_PRIORITY(r7, 0x40045644, 0x1) io_submit(r1, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) 00:58:15 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f0000000000)=0x2) openat$procfs(0xffffff9c, &(0x7f0000000040)='/proc/slabinfo\x00', 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 703.700910][ T26] audit: type=1400 audit(1589677095.686:1306): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=27837 comm="syz-executor.1" [ 703.748207][T27852] tproxy_tg6_check: 12 callbacks suppressed [ 703.748214][T27852] xt_TPROXY: Can be used only with -p tcp or -p udp 00:58:15 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x0000000000000000^/'], 0x109) 00:58:15 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f0000000000)=0x2) openat$procfs(0xffffff9c, &(0x7f0000000040)='/proc/slabinfo\x00', 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 00:58:15 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x33fe0, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) [ 703.855541][T27852] xt_TPROXY: Can be used only with -p tcp or -p udp 00:58:15 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x3c) ptrace$cont(0x18, r1, 0x0, 0x0) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r1, 0x0, 0x0) clone3(&(0x7f0000000340)={0x20002000, &(0x7f0000000180), &(0x7f00000001c0)=0x0, &(0x7f0000000200), {0x16}, &(0x7f0000000240)=""/26, 0x1a, &(0x7f0000000400)=""/125, 0xffffffffffffffff}, 0x50) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$SIOCPNADDRESOURCE(0xffffffffffffffff, 0x89e0, &(0x7f00000003c0)=0x1ff) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000100)={0x0, 0x4, 0x800, 0x200000000000000, r2}) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r6 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm_plock\x00', 0x10000, 0x0) r7 = syz_open_dev$video(&(0x7f00000000c0)='/dev/video#\x00', 0x56, 0x20001) io_submit(r3, 0x1, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x7, 0x0, r7, 0x0, 0x0, 0x0, 0x0, 0x0, r6}]) 00:58:15 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 703.982719][ T26] audit: type=1400 audit(1589677095.976:1307): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=27855 comm="syz-executor.1" 00:58:16 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x0000000000000000^/'], 0x110) 00:58:16 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f0000000000)=0x2) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x0, 0x11, 0xffffffffffffffff, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 704.097281][T27867] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 704.166633][T27871] xt_TPROXY: Can be used only with -p tcp or -p udp [ 704.233136][T27871] xt_TPROXY: Can be used only with -p tcp or -p udp [ 704.268558][ T26] audit: type=1400 audit(1589677096.256:1308): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=27872 comm="syz-executor.1" 00:58:16 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0xfffffdfe}]) 00:58:16 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x800000}) close(r0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(r3, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x28, 0x140c, 0x20, 0x70bd27, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x1}, @RDMA_NLDEV_ATTR_RES_CQN={0x8, 0x3d, 0x3}, @RDMA_NLDEV_ATTR_RES_CQN={0x8, 0x3d, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_setup(0x6, &(0x7f0000000140)=0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) r6 = dup(r5) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) r9 = dup2(r8, r7) ioctl$PERF_EVENT_IOC_ENABLE(r9, 0x8912, 0x400200) write$FUSE_DIRENT(r9, &(0x7f0000000080)={0x68, 0x0, 0x6, [{0x6, 0x401, 0x0, 0x5}, {0x5, 0x8, 0x22, 0x8, '#cgroupem1mime_type^vboxnet0:bdev]'}]}, 0x68) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) io_submit(r4, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x7ffffffff000}]) 00:58:16 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:58:16 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x0000000000000000^/'], 0x112) 00:58:16 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f0000000000)=0x2) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x0, 0x11, 0xffffffffffffffff, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 00:58:16 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x20000028, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) [ 704.801830][ T26] audit: type=1400 audit(1589677096.786:1309): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=27897 comm="syz-executor.1" [ 704.823426][T27902] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 704.832431][T27903] xt_TPROXY: Can be used only with -p tcp or -p udp [ 704.896193][T27913] xt_TPROXY: Can be used only with -p tcp or -p udp 00:58:16 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x0000000000000000^/'], 0x163) 00:58:16 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f0000000000)=0x2) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x0, 0x11, 0xffffffffffffffff, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 00:58:16 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 705.119699][ T26] audit: type=1400 audit(1589677097.106:1310): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=27923 comm="syz-executor.1" 00:58:17 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x0000000000000000^/'], 0x20000344) [ 705.169157][T27929] xt_TPROXY: Can be used only with -p tcp or -p udp 00:58:17 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r3 = openat$procfs(0xffffff9c, &(0x7f0000000040)='/proc/slabinfo\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x0, 0x11, r3, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 705.309046][ T26] audit: type=1400 audit(1589677097.296:1311): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=27932 comm="syz-executor.1" [ 705.330259][T27929] xt_TPROXY: Can be used only with -p tcp or -p udp 00:58:17 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x7ffff000, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) [ 705.620265][T27943] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 00:58:17 executing program 3: getpid() io_setup(0x3, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000000080)=[{}, {}], 0x0) r1 = memfd_create(&(0x7f0000000140)='s\xe5c]`it\x8fnodev:ppr1bdev\x00', 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0xfffffe00}]) 00:58:17 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) 00:58:17 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000000)=ANY=[@ANYBLOB='permhat 0x0000000000000000^/', @ANYBLOB="47bdd24d9b07639d7a7d870248f01216c2ef039f1e25091db780f2c89731f965b95865f297d5659c6b3ac024df2751b79a48fb0465cf9d4e32b0a02e3b5b2fa6e74ee2169cc456e62465ad8b0dae86aed6640e2e496772672c"], 0x104) r1 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) sendto$inet(r1, 0x0, 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) sendto$inet(r1, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0), 0x10) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000080)={0x0, 0x1, 0x401, 0x1}, &(0x7f00000000c0)=0x10) 00:58:17 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r3 = openat$procfs(0xffffff9c, &(0x7f0000000040)='/proc/slabinfo\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x0, 0x11, r3, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 705.873222][ T26] audit: type=1400 audit(1589677097.866:1312): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=27955 comm="syz-executor.1" [ 705.935433][T27963] xt_TPROXY: Can be used only with -p tcp or -p udp 00:58:18 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r3 = openat$procfs(0xffffff9c, &(0x7f0000000040)='/proc/slabinfo\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x0, 0x11, r3, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 706.083962][T27963] xt_TPROXY: Can be used only with -p tcp or -p udp 00:58:18 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$VHOST_SET_VRING_NUM(r3, 0x4008af10, &(0x7f0000000000)={0x1, 0x80000000}) write$apparmor_current(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="7065726d686174203078303030303030303030303030303030305e2f2d963d858154252a4726a31b9a0344b4d827b7a6850ab6b4edd5941aa94970df7997c7ec8d1a1f65fb1fa64b0b6a40d7cc3387d73b5c71af9a48165769c6ecb87f434b71b6ffef33703ce492e14751f583b79c9c5691d05314d01b1e2cef07232af1a68a69231f37062c182b078ead353910f5747745f132128eecd1b07a81371b3ba648835f"], 0x104) syz_mount_image$ext4(&(0x7f0000000100)='ext3\x00', &(0x7f0000000180)='./file0\x00', 0xfda8, 0x7, &(0x7f0000001640)=[{&(0x7f0000000240)="66d39aaca3a88fb4647a5048c5ade0d3953f8ff3f4af853a0379824f3c1d5f3f7023f148c93b6c3b6f26a7e760178175c41765f1dc10bc5145e2026523dfa6105c22faeab36b6a5268430bdeb9f7de3bbbdf082fdedb1a38eeb0f7ca08864a30831958625f9c52b7f87c6b65b593d597e9cabdd426edd0e3d771de263b86e31f6ecd9ea44ac776ed267e23ab055f58cb5e95563c3cf0cf4911e734e5fef8222b5a437fc938a1e293cad3698cf62f800ce42490aa4e757bb64e7e5894f4bbf27d89b6f33baff9a4ae9cd80ada72b31c36d2cde746b42d13a598ed48013da832896026c373368ee9239dda01b78a876a8818ba9ff2d98a77", 0xf7, 0xc6}, {&(0x7f00000001c0)="53cd305ec758", 0x6}, {&(0x7f0000000340)="78e26a1170f8813e76ca659227a40e23e05d223d0b30e5718e04037422179c4e3d5999bc47f562d61c43d6af2bf7272978638b4a588cef007f7e6a57bdead06c79c2e936bc154432fe8f7de63cdf8640bc7537af9621e4f8e4bf34c12230b5e8983b5111acfa59e38f0f9a74debffc87576e556a3e2bb83966981c3d8d319e216151684728b5a85be1bbd87ccada8edbbbabb56709879c702745caf46761e5627a7fc7c8e5e47f1f9f3255d1f86aa7127783a6372b4b33c6e979c06b27a510557ac5a832768c88555943148d", 0xcc, 0x100}, {&(0x7f0000000440)="ec8d92bf98537d6520cfd87805a338fa6fdacaa055d5db1c1e4c2840875abb88f68385bbd1c9c6fdeb4001efbb4859689e4c7df4476efadbb38a0c369b01a2189d11ac4604779bcb389a839b254f554f991cb72109863a905dbde5d29cf504c7f88da10c15612815f0f00513f4c00a4a8a6327805689895c3582d9067029bdd169b8ecc1b2f4f73684a533208f0a763e8a15947e1ec2ae44716dd348d7ab7502f5c3944fca7fc01bc5201409cd326cd03008c9f6b7deff3ff3557dc772ad8b42136814c634231b87a99385baf66794703866778a5f347bec31696cadaa03e02048441b72562ad13d5d1f3be80e6c70f5ff712196cc5131494ee097389a3475d01ad74fcb466993b0c075321fcc2cd1f20a297e6109a93bb14a1ec7fba360e7b8c4a77cac341fa844a9147ba94d6b7e4b3344f9007120471e91e0fbf36c44fe4da34d4522a2e44604b5253d286d6ecf895e513fbfec9d64e3cc7542b524857619c3d0aba044a6613c47e8454f5ab4b0a4bad21819dc8e95cb7a89197e19488e3aa852bc8e57064b6dde01fabb718299b552a72eb727441c9c44a8859143cc16a624fca4998192e5c5e1c0aa2ce194f36a65cbe0d7267aaab842ef987894178bf9c0318847610f9cea105fce40b0a969a0874666a4431a60fb0dea4ffaf1a5feb554314a37bf2056aca11a02a8febbb0db792bd32a0dca08913ae576a93d79ab9cae39d7bab20ade63e76f42e8a1e15d2b7976b80aa4c2346d3f9c30ddd53335588e7a50c32bfe119c97ad9947c36b45cc38e446ae02061712ecbc8cfe4f8596c97ffa2e73c0dc48ed2fe65ac19c9fba8ad5f9a788362ff9b6d77d260b64093cbc17f011d713690284b3a5ee47585d80e6f38d70007620c37f896f28ccaa153da6273f8deae2a28c800c7c78d5c673b02d86264603fc52e2fef7ea3796bd149a37c7ffed332fc2105437c743aae0981cb0c3dc1dad1fbc224382c6924622e65cebf706d7f5384e909ba848028d389e62155de8b2dfd1ea6cd16ce9663f696d7ad259740819983b50e5a0410adf0568e488cbe9af69fa6e65c8197562d95374bea59f0d7b9ea9cee5ceb14eee43dcaa4adba5772f8f98b149d2b86537b5962c2471948d3ced2ebf4ade01c45726446aa36ebf0605aff8a7ea4206045a444aa38c8d1053579dd9d443753227a49b6bc07a963ba190fac4f22696cdc61ff4f6126fd56124c5edf2c9e0ba2b0a9df23736fb47e595521b814f1a4da37ba191a73f16458d6f3aa41f1f656d9404187637286071eb2140ff0b2ac11d610770e519c5c0547bcc48e9e7435797243513a5048c9ef98906bfd9d193a6ddc9797d683057b2df806e7c625480f86a2bc716ecfbd38a16bd1020b484ce1a0b25c2c61cd5c7d90b6819760ae61c574ad366a4d8c10223cd7a882b305db4d8958d25d24dac1c0f0985708231fcdf334688c3a2436e46de23717fe5a118548628bd49c6835b67a40a0d2ebf909f349c5a3187a5e85e00ccabb7fb3280078fbb58c951bf48cc431ff8a00a3dc5d04f538b5d08ac5900fb7f06b9e47e6467e2657d5aa9d0e215165c28cf135b4304a3550d0610afc0d6543ee84b1a2f69b027371f575be872256d8f89c235597e1992ecb2fa3dc264fded0c4e29d41e3caa37325129210368fbcef2e06b199401dc5317f003bbc90c85d450964d22557f19e1f92e154a4078ae4148b5ea9bddd343d3185a82b7c1d6c6b13da56df16ff282170081d95494c0013979b2564bfa0357104e26879e978d8f85f46031af1d735cc81a4f350bfc62ec5c39eacc68bc5af36e080f5dd1d0b3e6c8cdd3e5a21da1ed1f22b60d1a0ac52aca32d62a48741eefa8f02f70c0d6ff21bd7d01f3bf0d907b0b06084398c60e56d9d3261fc014cabc58755b99d430c5b1b0cbebe25073383336176d01bfe200cdbea01e14348227324db016cc49edac8d5ff102a0ffa2f3f54e750e723ec546ecfac6d27688075e29fa0638e4ae822ddcc9dc4e8fc8e5512504d5f3b654810d088a7a1ca28171f711edac6478cebc6e2876642d81fc1459f302eae5b722b0c01ff4a9b2bb130f4848fa9c2439b23c78aea9892d4a3cb65f225d21bcd524496916dcf6cb15a8968f11e7849486f2cacbe962ab64d3964a052d182daf2ef784b15350da702c7a9804b7b35f3e8449b001ee8a56c3f08c428dee994bd288da3a010a99a84e4161057222e5894e7e23070698b4e0f0e64afdf8ec0ab315f137dcacc7fbc8e61a69caf3acd356d96fe870881079a74dae4bf0727f94ee03816b22dde2c0b9505b64816f17677da030a3035147ace1119df9d59b7cb9756e6092cc4814316aff305f8f412891a8a79617262446b9a67dcea9090feee552d089a4f74e70fcc27c58cd8db5a0789032fc63ae81088790330020e6d9da766b070d48b0d184859f3440dd4018fd490ff1f567e286155dddf4cdeb7dbf70801af380212562e63d324b63a4bad0f20e101bf998884756222b20a034e540c64438adb6895bc69adb43177e689726584509316bf8040985a4e6289282f9b2e6b0e27589c5c15e433740415ece5f856106f4ce894ab100b2483f163fb1548889226762a212e4083f1266363be04d54093b303bb389c56b32bc5bfa9537dd26bbc7228ce56b4a5ce54a6473b56aa5e3e088a34bd4521f08a6af939ff379066f8f3a1d8abb3b692d1b79820b5a1118c5436ce8e62e3792ee0692325dbf3df00b4d2f99ec3f5d257cfe19dfc53de273c5686340eba4ba69a8ff3be8a4cccc05c1ecb8e591f2de637b3fa9a5a468834819268b8d3751faf53e3176873f33e3d035677358822fbbadcf81db30547dd44aa6ba77b8fea2024e022cc28bc21348f5e0d4c702c7707aa690d1d13ecda1112cf62e73a8b17c72f8833cfe09c41392c28b29432ac1541bb824fd2e56a23ba2ca42ac82d51b27c53d6f08cc658b7d142e81e382c2c9f2d3b4c7dca81355bed54066700db7ed556ddecd6bea763acd86e57a6d36eb5e33383a18bc0c2c87742d3c94da1b06a7d5956d39e73b0d5500f7f7937d2c5a2c260e5329a24efdd500f9eb295518899caec24101e1fc6a6956580a05cff782d91e0ae35aeacf784dc789309ddea30908d4afe636f6a5678e112e55f3595666c257c6974b69b88c44094e3c1d2869581635f52fab2721bb429e3e1ec4d29cf9edca1e430a6f9b76b89fc325f9c6101aee9a55dff3882859fefd86e4388b0c4741a29a51befeee3ee48fa1fe965865fafe2a1efbaf1762053fed87ea066c9a7ab5f92c447d09dc3349a153abc0d539341f2937a2ce81db23248db8613bc2c676553c4c2823ad3a17c92f38e52090f39ebc627b1a0ae908c9b389a31606aaa9bb6d77b03379a9ae01f5a265ad3ec0776857563741bfbca334bf0a6de02345bc908f6c97f4b071277c6b245f7d599a71fbe476d70e0572e1653d865582754bbc7b2baf93ca81134833a64aa3ac134000333662e376161645ca0d85a4b0ec650130ee741f0ccb815b191df8b611357bfda13b1476cf3dfafd5780be10bdcb5746f413529e234b25aa2d1654b6036231ba8227245d0d499ca2f835f58fce722860fd5a4cc0d2dd0d68ee97e1714c4c9cccf8ebfc0c4350fae7920bb09562eb4e3ef6ecdd8e9a3b58bc066dc236a01191f9d1ccafef6b75f4911b662d728912332dbb64dbd60624a9b230a0f9d75f1bb27ac418588a4e54e639fd2b112519bae892ba0f36080becdc28d56ac5b599457a525a37e06f347078b273158765f0d681ea39bc730f5c3fed13457061d4af8ca51bd7b855aa06fc7dd7b2fa8053e160db5d3beeb72b9eebae86362312c7bcf28202a9d0998e60366b8a82002c2f1e1a4a2c5e666e9cfb322243cd3e3bc2398a086ba80583e159f3068fb01915f04a8e62d629c84968a0718bf8d2587aaa3912e3e1e2a3d5939f04478f14836e5ebbd35ab394a13208b7f71914efc0be262dac163169d10a32f6c88374f6ffc53664a5a2028f50b19357ac09862b9c5aecb28a54a6552be20d39c25c14fea5abe0fa73ad8ae79beaf2f9da106a49bb29526c50234e1c55b9baca8f4d03b02d27dd10eb28fabc67b2a9484d42251d8dcc10bb711fe391e52e32b7224ee167c3f2b0bb06dff508546424ed3d4cabfc14693225c60fb60a62f315dddd1a1037d329c31072521c7114047dceb43795a0e133667372537a199d69d23588f47739bfc729cd679b3e702081cd070ae46d7f2466d96ede92b383b59eaf5cb8d65702d7ac1be57f4698fb159c7792cb1a83fad5799249e4005dbaa09f586d1252f03559aefc1f84ce5e0c9136a014b34c7b355e261b72fcd48de9f784a91ece3ce32175656e1292ad461fdef116fd77239d92eeb6d76ce0a2443da4c681d052a96007eaac18b70ad048baa7ca05585f6d892a525baf432c2e30b20cf9f83c957d099f3e4bf7c595b020a868168b98d8f73b9a919e7329acb821e5b873f5f94335d530ce222efb09b016d06e73c86d10df554f2afa93c14d00b0c1b844cf99e1cf68112987f24558f3ca1ae539fa3a878f4ab130ab89dec2ec1735c99e53d1b4ed34c0b2064c215c040e894fa574be11b0cae1ff75606e48baf6765090b53e7fbc5783068957aff0c9cb6ff6c4faee49cb1cc864ac5ca88b9a1e5051c0a3730fa2cc7d7b285af225413b4b72cb3e441b98891448206beea287782fa61f97d6803ece7c628e4536bd2832f4579480dc41110a225d379ef81afe564ca3c04b090406d4b6a7df0066ceb6cc0d870c67f25c4b7cb98194e52a9bebb3eb8f3b6a0aa0ee810c99b117839ddfc3d1e514b0ef56aa6cc95d6578a4dbc71af2b29b0c541c4ded3a60c70319ccaf4871974bcba202ca60718bbbd4b950b00542b27bad8bc924defafa0bf4076ed8e74cacab3daaaa4b18233b7cf44368a61020d4a00389878a4078d90ebb7407bca97fe773e7a114d90bc18dc2c1be413f96f3b7825c970df3188ed4af30674d3dc24bda757ef38a2ab96ced39af1dbea7d32e630ca1d8095a03eff227bccefba70b3255cf8e58aaa442aeb0e29bcc469f5bd8b44401c73893d248db71eed28ae0f899b07326a1bbeebdf3e23cfc24c870abe89207f038b29914e1cf781d1e3fb3fa6ce91b5216238701a92f3929e5662c716cade07a7a444c80d6687db36af9f9f84422304f1d571b24df33b52413572ac9bb568e327e2c3acbe22ecc780b5222e7f8e4c9998478b9dfdcf03733e4bc11edec38181c1d4c63d14b1ea373de89986aad0cb8d40cf8534f3156aa4e20359f8bf345a4e7d327b4eb576f324189f4894f79366038db80c324d1174d38672d28a262f2dd6d2ad6e90adae3bcbecb6e570f046680ef6d766242438868717e67fefe7b8faa0f5fc2f33ce3f4e07e071089c1b9675d462968540c349a7b057fbb12dcd5d1a9a14345df65f4b4fd03f8d15429ab7d290212780275d1bd3ce0368c8157482a65b1a65e1371c47d3aebeded94e0a2ac8cf53a04ce61788d2b21a8b95d044c2c8c8e62b8f0057dd18a2c4f27a178e338eb259612ce61c9f6d36c56f272299e64b906d05c2697876d79ebe23c8a1f214fd66a7490365c2919cdc59309a86e8ab92fd29e8b4c7087bbf19d029b891e74f99f0b7868c81d53df04cd0ec93d84fae876c374fb7960e9e36e2eeb00f8707008f6943e7d947d49bde8d71d500e7b021443b455296dfe84991b67051775993aaebd8070f4375b9595b8750e7c749ac280130bb991545d3d4e7d6fdf564f4aab26cc54b9abdb17775f", 0x1000, 0x43}, {&(0x7f0000001440)="e7ceb3a8cde54255f00d3b6591c448b94ab51d51a1f2b776bb45386747e12ddac0100691914981eea32e734fcc31bda8593cd0177f5ffd2c57aa94c0c244ae4e65ff9507bd539f4afa1c50c5905a1bbbe43906fb9eb5606d5672ef82792c2739b35d29e5163c3be5a5f737", 0x6b, 0x207bf3d5}, {&(0x7f00000014c0)="c36a9db453e772b128400e1d0da5172ba237ec0446041457a50b46f6258df69fc0e5d6032e0cf5cb55741950c5e99e85d1936ec708c282a62a38941a902058949e07818616cab4c6ff3b75c0784976ac1535f3293f38075fcbaec72d0e084aeebccdff24160462d153cadbccd3c68279380997ffa7e721a67b54", 0x7a, 0x7}, {&(0x7f0000001540)="9c9da57ee143904f0ea07b6e973386aaa0721770fe99e1f692476792d87ae4337bbd1d35dec784a2b6e4219f272b85ae75422a9c476cae611c48377348d419b2f26c0b2c72ca5bdbcd081c2f0cfa743f7c346834567929a1f577cd54a13b58cfa5c9b52e2d9b6204bcfe2a196cef53b3646628c6182df7562a4c2b609eb7d4791b1b32788e33363fc331b9d530de97b4af578a4833891f3e1e7b13eb6f1da557c3dfa5624b5041e4346effe72a0ac72aed34fda4a6ef2eb77a0a2c1e26b395593de961393160e6603108f04028a7c60d8ae9bd1035eb049d6aaf05f6d472907adbc8fdd2adc2c0", 0xe7, 0xffff}], 0x40000, &(0x7f0000001700)={[{@acl='acl'}, {@sb={'sb', 0x3d, 0x5}}, {@grpid='grpid'}, {@nolazytime='nolazytime'}], [{@obj_user={'obj_user', 0x3d, '*vboxnet1/vboxnet1ppp1&selinux.'}}, {@subj_role={'subj_role'}}, {@smackfsdef={'smackfsdef', 0x3d, '#ppp0keyringvmnet1\xc1security'}}, {@hash='hash'}, {@appraise='appraise'}, {@smackfsdef={'smackfsdef', 0x3d, 'cgroupmd5sumwlan1'}}, {@dont_hash='dont_hash'}]}) 00:58:18 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507800000f70000000000000000", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001000810500000000000000000000000d", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r8], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x28, 0x2, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_MASTER={0x8, 0xa, r4}]}, 0x28}}, 0x0) 00:58:18 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 706.296949][ T26] audit: type=1400 audit(1589677098.286:1313): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=27972 comm="syz-executor.1" 00:58:18 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f0000000000)=0x2) r3 = openat$procfs(0xffffff9c, &(0x7f0000000040)='/proc/slabinfo\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x0, 0x11, r3, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 706.391589][T27982] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 706.615368][T27997] ================================================================== [ 706.624019][T27997] BUG: KASAN: slab-out-of-bounds in __kvm_gfn_to_hva_cache_init+0x5fb/0x670 [ 706.632886][T27997] Read of size 8 at addr ffff8880a2604468 by task syz-executor.5/27997 [ 706.641119][T27997] [ 706.644331][T27997] CPU: 1 PID: 27997 Comm: syz-executor.5 Not tainted 5.7.0-rc1-next-20200415-syzkaller #0 [ 706.654224][T27997] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 00:58:18 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/attr/current\x00', 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$NBD_DISCONNECT(r3, 0xab08) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup2(r5, r4) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$VHOST_GET_VRING_BASE(r6, 0xc008af12, &(0x7f0000000000)) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_current(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='permhat 0x0000000000000000^/'], 0x104) [ 706.664283][T27997] Call Trace: [ 706.667587][T27997] dump_stack+0x188/0x20d [ 706.671941][T27997] print_address_description.constprop.0.cold+0xd3/0x315 [ 706.678974][T27997] ? __kvm_gfn_to_hva_cache_init+0x5fb/0x670 [ 706.684961][T27997] __kasan_report.cold+0x35/0x4d [ 706.689907][T27997] ? __kvm_gfn_to_hva_cache_init+0x5fb/0x670 [ 706.695921][T27997] ? __kvm_gfn_to_hva_cache_init+0x5fb/0x670 [ 706.701905][T27997] kasan_report+0x33/0x50 [ 706.706243][T27997] __kvm_gfn_to_hva_cache_init+0x5fb/0x670 [ 706.712072][T27997] ? __kvm_write_guest_page+0x170/0x170 [ 706.717692][T27997] kvm_lapic_set_vapic_addr+0x88/0x180 [ 706.723239][T27997] kvm_arch_vcpu_ioctl+0xf0d/0x2c00 [ 706.728459][T27997] ? kvm_arch_vcpu_put+0x530/0x530 [ 706.733580][T27997] ? lock_acquire+0x1f2/0x8f0 [ 706.738269][T27997] ? kvm_vcpu_ioctl+0x175/0xe60 [ 706.743133][T27997] ? lock_release+0x800/0x800 [ 706.747871][T27997] ? find_held_lock+0x2d/0x110 [ 706.752655][T27997] ? __mutex_lock+0x458/0x13c0 [ 706.757421][T27997] ? kfree+0x1eb/0x2b0 [ 706.761500][T27997] ? kvm_vcpu_ioctl+0x175/0xe60 [ 706.766362][T27997] ? mutex_trylock+0x2c0/0x2c0 [ 706.771135][T27997] ? tomoyo_execute_permission+0x470/0x470 [ 706.776960][T27997] ? __fget_files+0x30d/0x500 [ 706.781651][T27997] kvm_vcpu_ioctl+0x866/0xe60 [ 706.786340][T27997] ? kvm_get_dirty_log_protect.isra.0+0x670/0x670 [ 706.792762][T27997] ? ioctl_file_clone+0x180/0x180 [ 706.797801][T27997] ? __fget_files+0x32f/0x500 [ 706.802493][T27997] ? do_dup2+0x520/0x520 [ 706.806803][T27997] ? __x64_sys_futex+0x380/0x4f0 [ 706.811761][T27997] ? kvm_get_dirty_log_protect.isra.0+0x670/0x670 [ 706.818187][T27997] ksys_ioctl+0x11a/0x180 [ 706.822532][T27997] __x64_sys_ioctl+0x6f/0xb0 [ 706.827131][T27997] ? lockdep_hardirqs_on+0x463/0x620 [ 706.832428][T27997] do_syscall_64+0xf6/0x7d0 [ 706.836939][T27997] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 706.842831][T27997] RIP: 0033:0x45ca29 [ 706.846735][T27997] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 706.866365][T27997] RSP: 002b:00007fe1c22b6c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 706.874783][T27997] RAX: ffffffffffffffda RBX: 00000000004e8740 RCX: 000000000045ca29 [ 706.882760][T27997] RDX: 0000000020000000 RSI: 000000004008ae93 RDI: 0000000000000005 [ 706.890740][T27997] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 706.898718][T27997] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 706.906695][T27997] R13: 00000000000003e4 R14: 00000000004c697c R15: 00007fe1c22b76d4 [ 706.915294][T27997] [ 706.917631][T27997] Allocated by task 28004: [ 706.922325][T27997] save_stack+0x1b/0x40 [ 706.926505][T27997] __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 706.932147][T27997] kvmalloc_node+0x61/0xf0 [ 706.936573][T27997] kvm_set_memslot+0x115/0x1530 [ 706.941430][T27997] __kvm_set_memory_region+0xcf7/0x1320 [ 706.946977][T27997] __x86_set_memory_region+0x2a3/0x5a0 [ 706.952503][T27997] vmx_create_vcpu+0x2107/0x2b40 [ 706.957451][T27997] kvm_arch_vcpu_create+0x6ef/0xb80 [ 706.962657][T27997] kvm_vm_ioctl+0x1614/0x2400 [ 706.967862][T27997] ksys_ioctl+0x11a/0x180 [ 706.972204][T27997] __x64_sys_ioctl+0x6f/0xb0 [ 706.976804][T27997] do_syscall_64+0xf6/0x7d0 [ 706.981316][T27997] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 706.987403][T27997] [ 706.989735][T27997] Freed by task 27518: [ 706.993830][T27997] save_stack+0x1b/0x40 [ 706.997993][T27997] __kasan_slab_free+0xf7/0x140 [ 707.002850][T27997] kfree+0x109/0x2b0 [ 707.006753][T27997] skb_free_head+0x8b/0xa0 [ 707.011179][T27997] skb_release_data+0x617/0x8a0 [ 707.016041][T27997] skb_release_all+0x46/0x60 [ 707.020639][T27997] consume_skb+0xf3/0x400 [ 707.025048][T27997] ip_do_fragment+0x115f/0x1c80 [ 707.029914][T27997] ip_fragment.constprop.0+0x171/0x240 [ 707.035376][T27997] __ip_finish_output+0x4b5/0xbd0 [ 707.040409][T27997] ip_finish_output+0x34/0x1f0 [ 707.045183][T27997] ip_output+0x1fe/0x620 [ 707.049430][T27997] ip_local_out+0xaf/0x1a0 [ 707.053881][T27997] iptunnel_xmit+0x619/0x9d0 [ 707.058523][T27997] ip_tunnel_xmit+0xf80/0x2a65 [ 707.063368][T27997] sit_tunnel_xmit__+0xe6/0x160 [ 707.068222][T27997] sit_tunnel_xmit+0x374/0x27c0 [ 707.073123][T27997] dev_hard_start_xmit+0x1a4/0x9b0 [ 707.078259][T27997] __dev_queue_xmit+0x259c/0x3070 [ 707.083290][T27997] ip_finish_output2+0x909/0x2610 [ 707.088317][T27997] ip_do_fragment+0x17a7/0x1c80 [ 707.093175][T27997] ip_fragment.constprop.0+0x171/0x240 [ 707.098643][T27997] __ip_finish_output+0x4b5/0xbd0 [ 707.103677][T27997] ip_finish_output+0x34/0x1f0 [ 707.108453][T27997] ip_output+0x1fe/0x620 [ 707.112700][T27997] ip_local_out+0xaf/0x1a0 00:58:19 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x570, 0x288, 0x0, 0x288, 0x0, 0x380, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6], 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00'}}, {{@ipv6={@dev, @local, [], [], 'veth1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ipv6={@rand_addr=' \x01\x00', @ipv4={[], [], @broadcast}, [], [], 'macsec0\x00', 'veth1_macvtap\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @inet=@TOS={0x28, 'TOS\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) [ 707.117210][T27997] ip_send_skb+0x3e/0xe0 [ 707.122242][T27997] ip_push_pending_frames+0x5f/0x80 [ 707.127503][T27997] raw_sendmsg+0x13c4/0x2f30 [ 707.132115][T27997] inet_sendmsg+0x99/0xe0 [ 707.136449][T27997] sock_sendmsg+0xcf/0x120 [ 707.140876][T27997] __sys_sendto+0x220/0x330 [ 707.145392][T27997] __x64_sys_sendto+0xdd/0x1b0 [ 707.150163][T27997] do_syscall_64+0xf6/0x7d0 [ 707.154669][T27997] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 707.160552][T27997] [ 707.162882][T27997] The buggy address belongs to the object at ffff8880a2604000 [ 707.162882][T27997] which belongs to the cache kmalloc-2k of size 2048 [ 707.176939][T27997] The buggy address is located 1128 bytes inside of [ 707.176939][T27997] 2048-byte region [ffff8880a2604000, ffff8880a2604800) [ 707.190380][T27997] The buggy address belongs to the page: [ 707.196032][T27997] page:ffffea0002898100 refcount:1 mapcount:0 mapping:000000004261182d index:0x0 [ 707.205140][T27997] flags: 0xfffe0000000200(slab) [ 707.210004][T27997] raw: 00fffe0000000200 ffffea0000560008 ffffea0001392808 ffff8880aa000e00 [ 707.218595][T27997] raw: 0000000000000000 ffff8880a2604000 0000000100000001 0000000000000000 [ 707.227179][T27997] page dumped because: kasan: bad access detected [ 707.233585][T27997] [ 707.235910][T27997] Memory state around the buggy address: [ 707.241717][T27997] ffff8880a2604300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 707.249783][T27997] ffff8880a2604380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 707.257856][T27997] >ffff8880a2604400: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc [ 707.265914][T27997] ^ [ 707.273375][T27997] ffff8880a2604480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 707.281443][T27997] ffff8880a2604500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 707.289513][T27997] ================================================================== [ 707.297572][T27997] Disabling lock debugging due to kernel taint [ 707.358507][T27997] Kernel panic - not syncing: panic_on_warn set ... [ 707.365125][T27997] CPU: 1 PID: 27997 Comm: syz-executor.5 Tainted: G B 5.7.0-rc1-next-20200415-syzkaller #0 [ 707.376400][T27997] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 707.386453][T27997] Call Trace: [ 707.389760][T27997] dump_stack+0x188/0x20d [ 707.394169][T27997] panic+0x2e3/0x75c [ 707.398096][T27997] ? add_taint.cold+0x16/0x16 [ 707.402799][T27997] ? preempt_schedule_common+0x5e/0xc0 [ 707.408256][T27997] ? __kvm_gfn_to_hva_cache_init+0x5fb/0x670 [ 707.414249][T27997] ? preempt_schedule_thunk+0x16/0x18 [ 707.419620][T27997] ? trace_hardirqs_on+0x55/0x220 [ 707.424649][T27997] ? __kvm_gfn_to_hva_cache_init+0x5fb/0x670 [ 707.430629][T27997] end_report+0x4d/0x53 [ 707.434800][T27997] __kasan_report.cold+0xd/0x4d [ 707.439652][T27997] ? __kvm_gfn_to_hva_cache_init+0x5fb/0x670 [ 707.445637][T27997] ? __kvm_gfn_to_hva_cache_init+0x5fb/0x670 [ 707.451615][T27997] kasan_report+0x33/0x50 [ 707.455947][T27997] __kvm_gfn_to_hva_cache_init+0x5fb/0x670 [ 707.461763][T27997] ? __kvm_write_guest_page+0x170/0x170 [ 707.467314][T27997] kvm_lapic_set_vapic_addr+0x88/0x180 [ 707.472775][T27997] kvm_arch_vcpu_ioctl+0xf0d/0x2c00 [ 707.478665][T27997] ? kvm_arch_vcpu_put+0x530/0x530 [ 707.483770][T27997] ? lock_acquire+0x1f2/0x8f0 [ 707.488531][T27997] ? kvm_vcpu_ioctl+0x175/0xe60 [ 707.493731][T27997] ? lock_release+0x800/0x800 [ 707.498404][T27997] ? find_held_lock+0x2d/0x110 [ 707.503174][T27997] ? __mutex_lock+0x458/0x13c0 [ 707.507931][T27997] ? kfree+0x1eb/0x2b0 [ 707.512002][T27997] ? kvm_vcpu_ioctl+0x175/0xe60 [ 707.516858][T27997] ? mutex_trylock+0x2c0/0x2c0 [ 707.521624][T27997] ? tomoyo_execute_permission+0x470/0x470 [ 707.527442][T27997] ? __fget_files+0x30d/0x500 [ 707.532127][T27997] kvm_vcpu_ioctl+0x866/0xe60 [ 707.538110][T27997] ? kvm_get_dirty_log_protect.isra.0+0x670/0x670 [ 707.544526][T27997] ? ioctl_file_clone+0x180/0x180 [ 707.549548][T27997] ? __fget_files+0x32f/0x500 [ 707.554326][T27997] ? do_dup2+0x520/0x520 [ 707.558573][T27997] ? __x64_sys_futex+0x380/0x4f0 [ 707.563518][T27997] ? kvm_get_dirty_log_protect.isra.0+0x670/0x670 [ 707.570469][T27997] ksys_ioctl+0x11a/0x180 [ 707.574804][T27997] __x64_sys_ioctl+0x6f/0xb0 [ 707.579401][T27997] ? lockdep_hardirqs_on+0x463/0x620 [ 707.584686][T27997] do_syscall_64+0xf6/0x7d0 [ 707.589192][T27997] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 707.595082][T27997] RIP: 0033:0x45ca29 [ 707.598971][T27997] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 707.618595][T27997] RSP: 002b:00007fe1c22b6c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 707.627015][T27997] RAX: ffffffffffffffda RBX: 00000000004e8740 RCX: 000000000045ca29 [ 707.634985][T27997] RDX: 0000000020000000 RSI: 000000004008ae93 RDI: 0000000000000005 [ 707.643650][T27997] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 707.651620][T27997] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 707.659589][T27997] R13: 00000000000003e4 R14: 00000000004c697c R15: 00007fe1c22b76d4 [ 707.668943][T27997] Kernel Offset: disabled [ 707.673279][T27997] Rebooting in 86400 seconds..