[info] Using makefile-style concurrent boot in runlevel 2.
[   63.672083][   T27] audit: type=1800 audit(1555007090.406:21): pid=8963 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="bootlogs" dev="sda1" ino=2419 res=0
[   63.692380][   T27] audit: type=1800 audit(1555007090.406:22): pid=8963 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="motd" dev="sda1" ino=2447 res=0
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added '10.128.0.242' (ECDSA) to the list of known hosts.
2019/04/11 18:25:03 fuzzer started
2019/04/11 18:25:05 dialing manager at 10.128.0.26:38715
2019/04/11 18:25:05 syscalls: 2408
2019/04/11 18:25:05 code coverage: enabled
2019/04/11 18:25:05 comparison tracing: enabled
2019/04/11 18:25:05 extra coverage: extra coverage is not supported by the kernel
2019/04/11 18:25:05 setuid sandbox: enabled
2019/04/11 18:25:05 namespace sandbox: enabled
2019/04/11 18:25:05 Android sandbox: /sys/fs/selinux/policy does not exist
2019/04/11 18:25:05 fault injection: enabled
2019/04/11 18:25:05 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled
2019/04/11 18:25:05 net packet injection: enabled
2019/04/11 18:25:05 net device setup: enabled
18:25:52 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bc070")
r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0)
fstat(r1, &(0x7f00000018c0))

syzkaller login: [  125.622106][ T9126] IPVS: ftp: loaded support on port[0] = 21
18:25:52 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000080)="0adc1f123c123f319bc070")
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$LOOP_SET_STATUS64(0xffffffffffffffff, 0x4c04, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "f2786cce0fad21c4ce22cf1aed03b5ee77000000000000000000023ae9bf4041000ae3f4eb7505000000bb02107e7060799f0d8813c9caadc9e163c77b492492", "c3ad24a5ccb7412c2ab68f4429c8d2dd6c39de29daf4692562dce4423008719f30a13fcc8346eb3b962f8a512471d87c1e0bea3523941df7054fdd81130cdc2e", "22481815e3f3c8f7cb5d417c992df1e792cb400c906176bce6107e55707b7802"})
ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc))
r2 = syz_open_pts(r1, 0x20201)
write(r2, &(0x7f0000000140), 0x28d)

[  125.707247][ T9126] chnl_net:caif_netlink_parms(): no params data found
[  125.752450][ T9126] bridge0: port 1(bridge_slave_0) entered blocking state
[  125.761011][ T9126] bridge0: port 1(bridge_slave_0) entered disabled state
[  125.769322][ T9126] device bridge_slave_0 entered promiscuous mode
[  125.777152][ T9126] bridge0: port 2(bridge_slave_1) entered blocking state
[  125.785244][ T9126] bridge0: port 2(bridge_slave_1) entered disabled state
[  125.794121][ T9126] device bridge_slave_1 entered promiscuous mode
[  125.813874][ T9126] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  125.825102][ T9126] bond0: Enslaving bond_slave_1 as an active interface with an up link
[  125.845184][ T9126] team0: Port device team_slave_0 added
[  125.864045][ T9126] team0: Port device team_slave_1 added
[  125.876117][ T9129] IPVS: ftp: loaded support on port[0] = 21
18:25:52 executing program 2:
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
r1 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bc070")
sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x0, @loopback}, 0x10)
connect(r0, &(0x7f00000000c0)=@nfc, 0x80)

[  125.969785][ T9126] device hsr_slave_0 entered promiscuous mode
18:25:52 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl(r0, 0x1000008912, &(0x7f0000000080)="0adc1f123c123f319bc070")
r1 = socket$inet(0x2, 0x2, 0x0)
setsockopt$inet_int(r1, 0x0, 0xb, &(0x7f0000000040), 0x2)

[  126.077817][ T9126] device hsr_slave_1 entered promiscuous mode
18:25:53 executing program 4:
mknod(&(0x7f0000000200)='./file0\x00', 0x1120, 0x0)
r0 = open$dir(&(0x7f0000000040)='./file0\x00', 0x27e, 0x0)
vmsplice(r0, &(0x7f00000088c0), 0x158, 0x0)

[  126.246729][ T9126] bridge0: port 2(bridge_slave_1) entered blocking state
[  126.253903][ T9126] bridge0: port 2(bridge_slave_1) entered forwarding state
[  126.261337][ T9126] bridge0: port 1(bridge_slave_0) entered blocking state
[  126.268540][ T9126] bridge0: port 1(bridge_slave_0) entered forwarding state
[  126.298919][ T9131] IPVS: ftp: loaded support on port[0] = 21
[  126.305615][ T9133] IPVS: ftp: loaded support on port[0] = 21
[  126.421519][ T9126] 8021q: adding VLAN 0 to HW filter on device bond0
[  126.483241][ T9126] 8021q: adding VLAN 0 to HW filter on device team0
18:25:53 executing program 5:
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0xa, &(0x7f0000000680)=0xfff, 0x4)
r1 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bc070")
bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @broadcast}, 0x10)
sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @loopback}, 0x10)
setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000100), 0x921b527a62bfd8af)
write$binfmt_elf64(r0, &(0x7f00000016c0)=ANY=[@ANYPTR=&(0x7f00000005c0)=ANY=[@ANYPTR=&(0x7f00000004c0)=ANY=[@ANYRES16], @ANYRES32, @ANYRES64=0x0, @ANYPTR=&(0x7f0000000580)=ANY=[@ANYPTR64, @ANYRESHEX, @ANYPTR64, @ANYRES32=0x0]], @ANYRESDEC, @ANYRES16], 0x10000017c)
recvmsg(r0, &(0x7f0000000240)={&(0x7f0000000740)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x1ffc}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x400100)
setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000340)='lp\x00', 0x2ad)
pipe(0x0)

[  126.538530][ T2988] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  126.546792][ T2988] bridge0: port 1(bridge_slave_0) entered disabled state
[  126.569929][ T2988] bridge0: port 2(bridge_slave_1) entered disabled state
[  126.578135][ T2988] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
[  126.649322][ T2988] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  126.658374][ T2988] bridge0: port 1(bridge_slave_0) entered blocking state
[  126.665463][ T2988] bridge0: port 1(bridge_slave_0) entered forwarding state
[  126.674305][ T2988] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  126.682985][ T2988] bridge0: port 2(bridge_slave_1) entered blocking state
[  126.690085][ T2988] bridge0: port 2(bridge_slave_1) entered forwarding state
[  126.721982][ T9129] chnl_net:caif_netlink_parms(): no params data found
[  126.733942][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  126.744146][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  126.754125][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  126.766781][ T9136] IPVS: ftp: loaded support on port[0] = 21
[  126.767623][ T9126] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[  126.783680][ T9126] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[  126.812703][ T9140] IPVS: ftp: loaded support on port[0] = 21
[  126.826486][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  126.836453][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  126.844797][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  126.853462][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  126.864066][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  126.903862][ T9131] chnl_net:caif_netlink_parms(): no params data found
[  126.923901][ T9133] chnl_net:caif_netlink_parms(): no params data found
[  126.969967][ T9129] bridge0: port 1(bridge_slave_0) entered blocking state
[  126.977114][ T9129] bridge0: port 1(bridge_slave_0) entered disabled state
[  126.984892][ T9129] device bridge_slave_0 entered promiscuous mode
[  127.012774][ T9129] bridge0: port 2(bridge_slave_1) entered blocking state
[  127.020435][ T9129] bridge0: port 2(bridge_slave_1) entered disabled state
[  127.028300][ T9129] device bridge_slave_1 entered promiscuous mode
[  127.050383][ T9133] bridge0: port 1(bridge_slave_0) entered blocking state
[  127.057925][ T9133] bridge0: port 1(bridge_slave_0) entered disabled state
[  127.065543][ T9133] device bridge_slave_0 entered promiscuous mode
[  127.081729][ T9131] bridge0: port 1(bridge_slave_0) entered blocking state
[  127.088956][ T9131] bridge0: port 1(bridge_slave_0) entered disabled state
[  127.096809][ T9131] device bridge_slave_0 entered promiscuous mode
[  127.111061][ T9129] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  127.120771][ T9133] bridge0: port 2(bridge_slave_1) entered blocking state
[  127.128235][ T9133] bridge0: port 2(bridge_slave_1) entered disabled state
[  127.135977][ T9133] device bridge_slave_1 entered promiscuous mode
[  127.150485][ T9131] bridge0: port 2(bridge_slave_1) entered blocking state
[  127.157829][ T9131] bridge0: port 2(bridge_slave_1) entered disabled state
[  127.165536][ T9131] device bridge_slave_1 entered promiscuous mode
[  127.178932][ T9129] bond0: Enslaving bond_slave_1 as an active interface with an up link
[  127.196482][ T9131] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  127.211118][ T9126] 8021q: adding VLAN 0 to HW filter on device batadv0
[  127.223274][ T9133] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  127.234213][ T9133] bond0: Enslaving bond_slave_1 as an active interface with an up link
[  127.244083][ T9131] bond0: Enslaving bond_slave_1 as an active interface with an up link
[  127.319932][ T9129] team0: Port device team_slave_0 added
[  127.334881][ T9131] team0: Port device team_slave_0 added
[  127.342656][ T9131] team0: Port device team_slave_1 added
[  127.355508][ T9133] team0: Port device team_slave_0 added
18:25:54 executing program 0:
r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x0, 0x0)
sendfile(r0, r0, 0x0, 0x3)
mount(0x0, 0x0, 0x0, 0x0, 0x0)
clone(0x13102001fee, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0x3)
ioctl$VIDIOC_TRY_DECODER_CMD(r0, 0xc0485661, &(0x7f0000000000)={0x6, 0x1})
socket(0x7, 0x4, 0x0)

[  127.366261][ T9133] team0: Port device team_slave_1 added
[  127.376911][ T9129] team0: Port device team_slave_1 added
[  127.400344][ T9136] chnl_net:caif_netlink_parms(): no params data found
18:25:54 executing program 0:
r0 = socket(0x10, 0x3, 0x0)
ioctl$sock_ifreq(r0, 0x89f0, &(0x7f0000000080)={'ip_vti0\x00', @ifru_data=0x0})

[  127.500178][ T9133] device hsr_slave_0 entered promiscuous mode
[  127.557958][ T9133] device hsr_slave_1 entered promiscuous mode
[  127.639892][ T9129] device hsr_slave_0 entered promiscuous mode
[  127.697778][ T9129] device hsr_slave_1 entered promiscuous mode
18:25:54 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bc070")
syz_open_dev$binder(&(0x7f00000008c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000000240)=[@acquire_done], 0x0, 0x500000000000000, 0x0})

[  127.770310][ T9140] chnl_net:caif_netlink_parms(): no params data found
[  127.839226][ T9131] device hsr_slave_0 entered promiscuous mode
[  127.849850][ T9162] binder: 9160:9162 BC_ACQUIRE_DONE node 1 has no pending acquire request
[  127.877867][ T9131] device hsr_slave_1 entered promiscuous mode
[  127.954982][ T9136] bridge0: port 1(bridge_slave_0) entered blocking state
[  127.962276][ T9136] bridge0: port 1(bridge_slave_0) entered disabled state
[  127.973511][ T9136] device bridge_slave_0 entered promiscuous mode
[  127.981251][ T9136] bridge0: port 2(bridge_slave_1) entered blocking state
[  127.988417][ T9136] bridge0: port 2(bridge_slave_1) entered disabled state
[  127.996266][ T9136] device bridge_slave_1 entered promiscuous mode
18:25:54 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bc070")
r1 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r1, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4)
connect$inet(r1, &(0x7f0000006100)={0x2, 0x0, @broadcast}, 0x10)
sendmmsg(r1, &(0x7f0000007880)=[{{0x0, 0x0, 0x0}}], 0x1, 0x900)

[  128.095099][ T9136] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  128.120768][ T9129] 8021q: adding VLAN 0 to HW filter on device bond0
[  128.130054][ T9136] bond0: Enslaving bond_slave_1 as an active interface with an up link
18:25:54 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bc070")
r1 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r1, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4)
connect$inet(r1, &(0x7f0000006100)={0x2, 0x0, @broadcast}, 0x10)
sendmmsg(r1, &(0x7f0000007880)=[{{0x0, 0x0, 0x0}}], 0x1, 0x900)

[  128.144613][ T9140] bridge0: port 1(bridge_slave_0) entered blocking state
[  128.155588][ T9140] bridge0: port 1(bridge_slave_0) entered disabled state
[  128.164327][ T9140] device bridge_slave_0 entered promiscuous mode
18:25:54 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bc070")
r1 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r1, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4)
connect$inet(r1, &(0x7f0000006100)={0x2, 0x0, @broadcast}, 0x10)
sendmmsg(r1, &(0x7f0000007880)=[{{0x0, 0x0, 0x0}}], 0x1, 0x900)

[  128.192920][ T9129] 8021q: adding VLAN 0 to HW filter on device team0
[  128.207158][ T9140] bridge0: port 2(bridge_slave_1) entered blocking state
[  128.216918][ T9140] bridge0: port 2(bridge_slave_1) entered disabled state
[  128.225999][ T9140] device bridge_slave_1 entered promiscuous mode
[  128.245916][ T9133] 8021q: adding VLAN 0 to HW filter on device bond0
[  128.254440][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  128.262921][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  128.272112][ T9136] team0: Port device team_slave_0 added
[  128.280348][ T9136] team0: Port device team_slave_1 added
[  128.291392][ T9140] bond0: Enslaving bond_slave_0 as an active interface with an up link
18:25:55 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bc070")
r1 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r1, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4)
connect$inet(r1, &(0x7f0000006100)={0x2, 0x0, @broadcast}, 0x10)
sendmmsg(r1, &(0x7f0000007880)=[{{0x0, 0x0, 0x0}}], 0x1, 0x900)

[  128.318308][ T9140] bond0: Enslaving bond_slave_1 as an active interface with an up link
[  128.335793][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  128.344446][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  128.352302][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  128.361273][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  128.369686][   T22] bridge0: port 1(bridge_slave_0) entered blocking state
[  128.376739][   T22] bridge0: port 1(bridge_slave_0) entered forwarding state
[  128.384530][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  128.393604][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  128.402050][   T22] bridge0: port 2(bridge_slave_1) entered blocking state
[  128.409127][   T22] bridge0: port 2(bridge_slave_1) entered forwarding state
[  128.416696][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  128.425430][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  128.433893][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  128.442481][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  128.450815][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  128.460235][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  128.470064][ T9133] 8021q: adding VLAN 0 to HW filter on device team0
[  128.494805][ T9129] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[  128.506368][ T9129] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[  128.525988][ T9140] team0: Port device team_slave_0 added
[  128.533666][ T9140] team0: Port device team_slave_1 added
[  128.542058][ T9141] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  128.550476][ T9141] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  128.560694][ T9141] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  128.570087][ T9141] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  128.579179][ T9141] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  128.588015][ T9141] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  128.596865][ T9141] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  128.650011][ T9136] device hsr_slave_0 entered promiscuous mode
[  128.688067][ T9136] device hsr_slave_1 entered promiscuous mode
[  128.740117][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  128.749035][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  128.757405][   T12] bridge0: port 1(bridge_slave_0) entered blocking state
[  128.764541][   T12] bridge0: port 1(bridge_slave_0) entered forwarding state
[  128.772402][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  128.788993][ T9129] 8021q: adding VLAN 0 to HW filter on device batadv0
[  128.802453][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  128.812222][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  128.820984][   T22] bridge0: port 2(bridge_slave_1) entered blocking state
[  128.828095][   T22] bridge0: port 2(bridge_slave_1) entered forwarding state
[  128.836267][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  128.844891][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  128.857559][    T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  128.866249][    T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  128.875307][    T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  128.884005][    T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  128.893526][    T5] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  128.939510][ T9140] device hsr_slave_0 entered promiscuous mode
[  128.977994][ T9140] device hsr_slave_1 entered promiscuous mode
[  129.024476][ T9133] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[  129.035311][ T9133] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[  129.058589][ T2988] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  129.069130][ T2988] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  129.077304][ T2988] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  129.086960][ T2988] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  129.095730][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  129.110349][ T9131] 8021q: adding VLAN 0 to HW filter on device bond0
18:25:55 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bc070")
syz_open_dev$binder(&(0x7f00000008c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000000240)=[@acquire_done={0x40086310}], 0x0, 0x500000000000000, 0x0})

[  129.126571][ T9131] 8021q: adding VLAN 0 to HW filter on device team0
[  129.148383][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  129.156106][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  129.180531][ T9188] binder: 9187:9188 BC_DEAD_BINDER_DONE 0000000000000000 not found
[  129.188725][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  129.193598][ T9188] binder: 9187:9188 unknown command 0
[  129.197785][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  129.205427][ T9188] binder: 9187:9188 ioctl c0306201 20000100 returned -22
[  129.211191][ T3484] bridge0: port 1(bridge_slave_0) entered blocking state
[  129.223307][ T9190] binder: 9187:9190 BC_DEAD_BINDER_DONE 0000000000000000 not found
[  129.224445][ T3484] bridge0: port 1(bridge_slave_0) entered forwarding state
[  129.235140][ T9190] binder: 9187:9190 unknown command 0
[  129.240959][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  129.245229][ T9190] binder: 9187:9190 ioctl c0306201 20000100 returned -22
[  129.254106][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  129.269136][ T3484] bridge0: port 2(bridge_slave_1) entered blocking state
[  129.276224][ T3484] bridge0: port 2(bridge_slave_1) entered forwarding state
[  129.283886][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  129.292474][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  129.302163][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  129.315883][ T9133] 8021q: adding VLAN 0 to HW filter on device batadv0
[  129.333533][ T9131] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[  129.351806][ T9131] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[  129.368054][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  129.376701][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  129.385510][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  129.394667][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  129.403255][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  129.411928][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  129.420316][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  129.428673][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  129.437218][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  129.445011][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  129.472688][ T9136] 8021q: adding VLAN 0 to HW filter on device bond0
[  129.489847][ T2988] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  129.498325][ T2988] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  129.509350][ T9136] 8021q: adding VLAN 0 to HW filter on device team0
[  129.519674][ T9131] 8021q: adding VLAN 0 to HW filter on device batadv0
[  129.543147][ T9140] 8021q: adding VLAN 0 to HW filter on device bond0
[  129.577586][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  129.588410][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  129.597264][ T3484] bridge0: port 1(bridge_slave_0) entered blocking state
[  129.604420][ T3484] bridge0: port 1(bridge_slave_0) entered forwarding state
[  129.613485][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  129.622238][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  129.630672][ T3484] bridge0: port 2(bridge_slave_1) entered blocking state
[  129.637780][ T3484] bridge0: port 2(bridge_slave_1) entered forwarding state
[  129.640532][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  129.654634][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  129.663945][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
18:25:56 executing program 2:
socket$inet_udplite(0x2, 0x2, 0x88)
syz_open_dev$binder(&(0x7f00000008c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000000240)=[@acquire_done={0x40046307}], 0x0, 0x500000000000000, 0x0})

18:25:56 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070")
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
socket$pppoe(0x18, 0x1, 0x0)
openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20\x00', 0x40400, 0x0)
getsockopt$bt_rfcomm_RFCOMM_LM(0xffffffffffffffff, 0x12, 0x3, 0x0, &(0x7f0000000100))
setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, 0x0, 0x0)
setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0)
setsockopt$inet_sctp6_SCTP_ADD_STREAMS(0xffffffffffffffff, 0x84, 0x79, 0x0, 0x545ab53f)
ioctl$CAPI_NCCI_OPENCOUNT(0xffffffffffffffff, 0x80044326, 0x0)
ioctl$KVM_XEN_HVM_CONFIG(r1, 0x4038ae7a, 0x0)
write$P9_RSTATu(0xffffffffffffffff, 0x0, 0x0)
ioctl$DRM_IOCTL_MODE_SETCRTC(0xffffffffffffffff, 0xc06864a2, 0x0)
socket$kcm(0xa, 0x2, 0x73)

[  129.684057][ T9136] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[  129.713275][ T9136] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[  129.718389][ T9206] binder: 9205:9206 DecRefs 0 refcount change on invalid ref 0 ret -22
[  129.734447][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  129.738280][ T9206] binder: 9205:9206 unknown command 0
[  129.745453][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  129.750722][ T9206] binder: 9205:9206 ioctl c0306201 20000100 returned -22
[  129.760865][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  129.772186][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  129.781381][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  129.793066][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  129.801913][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  129.810508][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  129.819118][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  129.827052][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  129.837790][ T9140] 8021q: adding VLAN 0 to HW filter on device team0
[  129.858338][ T2988] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  129.866216][ T2988] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  129.884704][ T2988] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  129.893511][ T2988] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  129.902168][ T2988] bridge0: port 1(bridge_slave_0) entered blocking state
[  129.909323][ T2988] bridge0: port 1(bridge_slave_0) entered forwarding state
[  129.917837][ T2988] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  129.930533][ T9136] 8021q: adding VLAN 0 to HW filter on device batadv0
[  129.944818][ T2988] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  129.955119][ T2988] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  129.963843][ T2988] bridge0: port 2(bridge_slave_1) entered blocking state
[  129.970978][ T2988] bridge0: port 2(bridge_slave_1) entered forwarding state
[  130.010588][ T2988] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  130.055373][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  130.065235][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  130.074799][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  130.085874][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  130.096832][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  130.107638][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  130.140336][    T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  130.159152][    T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  130.214846][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  130.225227][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  130.241847][ T9140] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
18:25:57 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070")
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
socket$pppoe(0x18, 0x1, 0x0)
openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20\x00', 0x40400, 0x0)
getsockopt$bt_rfcomm_RFCOMM_LM(0xffffffffffffffff, 0x12, 0x3, 0x0, &(0x7f0000000100))
setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, 0x0, 0x0)
setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0)
setsockopt$inet_sctp6_SCTP_ADD_STREAMS(0xffffffffffffffff, 0x84, 0x79, 0x0, 0x545ab53f)
ioctl$CAPI_NCCI_OPENCOUNT(0xffffffffffffffff, 0x80044326, 0x0)
ioctl$KVM_XEN_HVM_CONFIG(r1, 0x4038ae7a, 0x0)
write$P9_RSTATu(0xffffffffffffffff, 0x0, 0x0)
ioctl$DRM_IOCTL_MODE_SETCRTC(0xffffffffffffffff, 0xc06864a2, 0x0)
socket$kcm(0xa, 0x2, 0x73)

[  130.320956][ T9140] 8021q: adding VLAN 0 to HW filter on device batadv0
[  130.517378][    C0] hrtimer: interrupt took 58424 ns
18:25:57 executing program 5:
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0xa, &(0x7f0000000680)=0xfff, 0x4)
r1 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bc070")
bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @broadcast}, 0x10)
sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @loopback}, 0x10)
setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000100), 0x921b527a62bfd8af)
write$binfmt_elf64(r0, &(0x7f00000016c0)=ANY=[@ANYPTR=&(0x7f00000005c0)=ANY=[@ANYPTR=&(0x7f00000004c0)=ANY=[@ANYRES16], @ANYRES32, @ANYRES64=0x0, @ANYPTR=&(0x7f0000000580)=ANY=[@ANYPTR64, @ANYRESHEX, @ANYPTR64, @ANYRES32=0x0]], @ANYRESDEC, @ANYRES16], 0x10000017c)
recvmsg(r0, &(0x7f0000000240)={&(0x7f0000000740)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x1ffc}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x400100)
setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000340)='lp\x00', 0x2ad)
pipe(0x0)

18:25:57 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bc070")
syz_open_dev$binder(&(0x7f00000008c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000000240)=[@acquire_done={0x40086310}], 0x0, 0x500000000000000, 0x0})

18:25:57 executing program 2:
socket$inet_udplite(0x2, 0x2, 0x88)
syz_open_dev$binder(&(0x7f00000008c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000000240)=[@acquire_done={0x40046307}], 0x0, 0x500000000000000, 0x0})

18:25:57 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000080)="0adc1f123c123f319bc070")
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x1, 0x0)

18:25:57 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070")
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
socket$pppoe(0x18, 0x1, 0x0)
openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20\x00', 0x40400, 0x0)
getsockopt$bt_rfcomm_RFCOMM_LM(0xffffffffffffffff, 0x12, 0x3, 0x0, &(0x7f0000000100))
setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, 0x0, 0x0)
setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0)
setsockopt$inet_sctp6_SCTP_ADD_STREAMS(0xffffffffffffffff, 0x84, 0x79, 0x0, 0x545ab53f)
ioctl$CAPI_NCCI_OPENCOUNT(0xffffffffffffffff, 0x80044326, 0x0)
ioctl$KVM_XEN_HVM_CONFIG(r1, 0x4038ae7a, 0x0)
write$P9_RSTATu(0xffffffffffffffff, 0x0, 0x0)
ioctl$DRM_IOCTL_MODE_SETCRTC(0xffffffffffffffff, 0xc06864a2, 0x0)
socket$kcm(0xa, 0x2, 0x73)

18:25:57 executing program 4:
r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0)
write$apparmor_current(r0, &(0x7f0000000140)=@profile={'changeprofile ', 'changehat '}, 0x18)

18:25:58 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070")
r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
dup3(r0, r1, 0x0)

[  131.272184][ T9233] binder: 9231:9233 DecRefs 0 refcount change on invalid ref 0 ret -22
[  131.283856][   T27] kauditd_printk_skb: 8 callbacks suppressed
[  131.283873][   T27] audit: type=1400 audit(1555007158.016:31): apparmor="DENIED" operation="change_profile" info="label not found" error=-2 profile="unconfined" name="changehat" pid=9230 comm="syz-executor.4"
[  131.322279][ T9235] binder: 9234:9235 BC_DEAD_BINDER_DONE 0000000000000000 not found
[  131.324008][ T9233] binder: 9231:9233 unknown command 0
[  131.340314][ T9233] binder: 9231:9233 ioctl c0306201 20000100 returned -22
18:25:58 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070")
r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
dup3(r0, r1, 0x0)

18:25:58 executing program 4:
r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0)
write$apparmor_current(r0, &(0x7f0000000140)=@profile={'changeprofile ', 'changehat '}, 0x18)

18:25:58 executing program 5:
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0xa, &(0x7f0000000680)=0xfff, 0x4)
r1 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bc070")
bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @broadcast}, 0x10)
sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @loopback}, 0x10)
setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000100), 0x921b527a62bfd8af)
write$binfmt_elf64(r0, &(0x7f00000016c0)=ANY=[@ANYPTR=&(0x7f00000005c0)=ANY=[@ANYPTR=&(0x7f00000004c0)=ANY=[@ANYRES16], @ANYRES32, @ANYRES64=0x0, @ANYPTR=&(0x7f0000000580)=ANY=[@ANYPTR64, @ANYRESHEX, @ANYPTR64, @ANYRES32=0x0]], @ANYRESDEC, @ANYRES16], 0x10000017c)
recvmsg(r0, &(0x7f0000000240)={&(0x7f0000000740)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x1ffc}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x400100)
setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000340)='lp\x00', 0x2ad)
pipe(0x0)

18:25:58 executing program 2:
socket$inet_udplite(0x2, 0x2, 0x88)
syz_open_dev$binder(&(0x7f00000008c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000000240)=[@acquire_done={0x40046307}], 0x0, 0x500000000000000, 0x0})

[  131.372061][ T9235] binder: 9234:9235 unknown command 0
[  131.395264][ T9235] binder: 9234:9235 ioctl c0306201 20000100 returned -22
18:25:58 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070")
r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
dup3(r0, r1, 0x0)

[  131.461240][   T27] audit: type=1400 audit(1555007158.196:32): apparmor="DENIED" operation="change_profile" info="label not found" error=-2 profile="unconfined" name="changehat" pid=9247 comm="syz-executor.4"
18:25:58 executing program 4:
r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0)
write$apparmor_current(r0, &(0x7f0000000140)=@profile={'changeprofile ', 'changehat '}, 0x18)

18:25:58 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bc070")
syz_open_dev$binder(&(0x7f00000008c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000000240)=[@acquire_done={0x40086310}], 0x0, 0x500000000000000, 0x0})

18:25:58 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070")
r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
dup3(r0, r1, 0x0)

[  131.520219][ T9256] binder: 9255:9256 DecRefs 0 refcount change on invalid ref 0 ret -22
[  131.554881][ T9256] binder: 9255:9256 unknown command 0
[  131.575452][ T9262] binder: 9261:9262 BC_DEAD_BINDER_DONE 0000000000000000 not found
[  131.584448][ T9262] binder: 9261:9262 unknown command 0
[  131.590154][   T27] audit: type=1400 audit(1555007158.316:33): apparmor="DENIED" operation="change_profile" info="label not found" error=-2 profile="unconfined" name="changehat" pid=9260 comm="syz-executor.4"
[  131.609351][ T9256] binder: 9255:9256 ioctl c0306201 20000100 returned -22
[  131.621489][ T9262] binder: 9261:9262 ioctl c0306201 20000100 returned -22
[  286.807818][ T1043] INFO: task syz-executor.3:9225 blocked for more than 143 seconds.
[  286.816064][ T1043]       Not tainted 5.1.0-rc4-next-20190411 #23
[  286.822729][ T1043] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  286.831832][ T1043] syz-executor.3  D28520  9225   9133 0x00000004
[  286.838357][ T1043] Call Trace:
[  286.841813][ T1043]  __schedule+0x817/0x1cc0
[  286.846251][ T1043]  ? __sched_text_start+0x8/0x8
[  286.851432][ T1043]  ? __mutex_lock+0x527/0x1310
[  286.856340][ T1043]  schedule+0x92/0x180
[  286.860578][ T1043]  schedule_preempt_disabled+0x13/0x20
[  286.866227][ T1043]  __mutex_lock+0x726/0x1310
[  286.871193][ T1043]  ? snd_seq_kernel_client_ctl+0xe5/0x170
[  286.877026][ T1043]  ? mutex_trylock+0x1e0/0x1e0
[  286.881905][ T1043]  ? odev_release+0x54/0x80
[  286.886750][ T1043]  ? __fput+0x2e5/0x8d0
[  286.891075][ T1043]  ? ____fput+0x16/0x20
[  286.895559][ T1043]  ? exit_to_usermode_loop+0x273/0x2c0
[  286.901310][ T1043]  ? do_syscall_64+0x52d/0x610
[  286.906085][ T1043]  ? entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  286.912320][ T1043]  ? lock_acquire+0x16f/0x3f0
[  286.917025][ T1043]  ? kasan_check_write+0x14/0x20
[  286.922447][ T1043]  ? do_raw_spin_lock+0x12a/0x2e0
[  286.927541][ T1043]  mutex_lock_nested+0x16/0x20
[  286.932406][ T1043]  ? mutex_lock_nested+0x16/0x20
[  286.937528][ T1043]  snd_seq_kernel_client_ctl+0xe5/0x170
[  286.943260][ T1043]  snd_seq_oss_writeq_clear+0xe0/0x140
[  286.949335][ T1043]  ? snd_seq_oss_writeq_wakeup+0xc0/0xc0
[  286.955026][ T1043]  ? snd_seq_oss_timer_delete+0x5a/0x80
[  286.960687][ T1043]  ? create_port+0x250/0x250
[  286.965405][ T1043]  snd_seq_oss_writeq_delete+0x20/0x40
[  286.971163][ T1043]  free_devinfo+0x66/0xc0
[  286.976993][ T1043]  port_delete+0xe8/0x1c0
[  286.981767][ T1043]  snd_seq_delete_port+0x266/0x330
[  286.988460][ T1043]  snd_seq_ioctl_delete_port+0xba/0x190
[  286.999839][ T1043]  snd_seq_kernel_client_ctl+0x112/0x170
[  287.006218][ T1043]  ? snd_seq_info_done+0x30/0x30
[  287.011711][ T1043]  snd_seq_event_port_detach+0xba/0x100
[  287.017533][ T1043]  ? snd_seq_event_port_attach+0x220/0x220
[  287.025498][ T1043]  ? kasan_check_write+0x14/0x20
[  287.032631][ T1043]  ? kfree+0x1bf/0x230
[  287.037275][ T1043]  ? __sanitizer_cov_trace_cmp4+0x16/0x20
[  287.044230][ T1043]  delete_port+0x87/0xd0
[  287.050586][ T1043]  snd_seq_oss_release+0xf5/0x150
[  287.056769][ T1043]  odev_release+0x54/0x80
[  287.061857][ T1043]  __fput+0x2e5/0x8d0
[  287.065996][ T1043]  ____fput+0x16/0x20
[  287.070559][ T1043]  task_work_run+0x14a/0x1c0
[  287.075713][ T1043]  exit_to_usermode_loop+0x273/0x2c0
[  287.081723][ T1043]  do_syscall_64+0x52d/0x610
[  287.088002][ T1043]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  287.094085][ T1043] RIP: 0033:0x4129e1
[  287.098337][ T1043] Code: e8 34 99 01 00 e9 45 fe ff ff 4c 8b 86 80 00 00 00 4c 39 c3 72 08 48 85 f6 e9 32 fd ff ff 44 0f b6 46 64 41 80 f8 01 74 08 48 <85> f6 e9 1f fd ff ff 0f b7 56 5e 66 85 d2 74 6a 48 29 fb 0f b7 d2
[  287.118910][ T1043] RSP: 002b:00007ffff106c940 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
[  287.127750][ T1043] RAX: 0000000000000000 RBX: 0000000000000005 RCX: 00000000004129e1
[  287.135979][ T1043] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
[  287.144043][ T1043] RBP: 00000000007401b8 R08: 00000000f5aa1ed7 R09: 00000000000200a2
[  287.152433][ T1043] R10: 00007ffff106ca10 R11: 0000000000000293 R12: 0000000000000001
[  287.161012][ T1043] R13: 00000000000200ba R14: 00000000000200e7 R15: 000000000073bf0c
[  287.169078][ T1043] INFO: lockdep is turned off.
[  287.174034][ T1043] NMI backtrace for cpu 1
[  287.178582][ T1043] CPU: 1 PID: 1043 Comm: khungtaskd Not tainted 5.1.0-rc4-next-20190411 #23
[  287.187810][ T1043] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  287.198747][ T1043] Call Trace:
[  287.202693][ T1043]  dump_stack+0x172/0x1f0
[  287.207052][ T1043]  nmi_cpu_backtrace.cold+0x63/0xa4
[  287.212431][ T1043]  ? lapic_can_unplug_cpu.cold+0x38/0x38
[  287.218066][ T1043]  nmi_trigger_cpumask_backtrace+0x1be/0x236
[  287.224477][ T1043]  arch_trigger_cpumask_backtrace+0x14/0x20
[  287.230838][ T1043]  watchdog+0x9b7/0xec0
[  287.236282][ T1043]  kthread+0x357/0x430
[  287.240515][ T1043]  ? reset_hung_task_detector+0x30/0x30
[  287.246104][ T1043]  ? kthread_cancel_delayed_work_sync+0x20/0x20
[  287.252616][ T1043]  ret_from_fork+0x3a/0x50
[  287.257454][ T1043] Sending NMI from CPU 1 to CPUs 0:
[  287.262858][    C0] NMI backtrace for cpu 0 skipped: idling at native_safe_halt+0x2/0x10
[  287.264084][ T1043] Kernel panic - not syncing: hung_task: blocked tasks
[  287.278356][ T1043] CPU: 1 PID: 1043 Comm: khungtaskd Not tainted 5.1.0-rc4-next-20190411 #23
[  287.287481][ T1043] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  287.297789][ T1043] Call Trace:
[  287.301164][ T1043]  dump_stack+0x172/0x1f0
[  287.305601][ T1043]  panic+0x2cb/0x72b
[  287.310494][ T1043]  ? __warn_printk+0xf3/0xf3
[  287.315467][ T1043]  ? lapic_can_unplug_cpu.cold+0x38/0x38
[  287.321225][ T1043]  ? ___preempt_schedule+0x16/0x18
[  287.326657][ T1043]  ? nmi_trigger_cpumask_backtrace+0x19e/0x236
[  287.332862][ T1043]  ? nmi_trigger_cpumask_backtrace+0x1fa/0x236
[  287.339247][ T1043]  ? nmi_trigger_cpumask_backtrace+0x204/0x236
[  287.347515][ T1043]  ? nmi_trigger_cpumask_backtrace+0x19e/0x236
[  287.374463][ T1043]  watchdog+0x9c8/0xec0
[  287.379080][ T1043]  kthread+0x357/0x430
[  287.383385][ T1043]  ? reset_hung_task_detector+0x30/0x30
[  287.389232][ T1043]  ? kthread_cancel_delayed_work_sync+0x20/0x20
[  287.396296][ T1043]  ret_from_fork+0x3a/0x50
[  287.402034][ T1043] Kernel Offset: disabled
[  287.406626][ T1043] Rebooting in 86400 seconds..