[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 85.925742][ T27] kauditd_printk_skb: 4 callbacks suppressed [ 85.925753][ T27] audit: type=1800 audit(1580950950.004:29): pid=9765 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 85.952703][ T27] audit: type=1800 audit(1580950950.004:30): pid=9765 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.91' (ECDSA) to the list of known hosts. 2020/02/06 01:02:40 fuzzer started 2020/02/06 01:02:42 dialing manager at 10.128.0.26:35493 2020/02/06 01:02:42 syscalls: 2939 2020/02/06 01:02:42 code coverage: enabled 2020/02/06 01:02:42 comparison tracing: enabled 2020/02/06 01:02:42 extra coverage: enabled 2020/02/06 01:02:42 setuid sandbox: enabled 2020/02/06 01:02:42 namespace sandbox: enabled 2020/02/06 01:02:42 Android sandbox: /sys/fs/selinux/policy does not exist 2020/02/06 01:02:42 fault injection: enabled 2020/02/06 01:02:42 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2020/02/06 01:02:42 net packet injection: enabled 2020/02/06 01:02:42 net device setup: enabled 2020/02/06 01:02:42 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2020/02/06 01:02:42 devlink PCI setup: PCI device 0000:00:10.0 is not available 01:05:16 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000500)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000040)={0x0, 0x2, 0xf000, 0x1000, &(0x7f0000015000/0x1000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r3 = socket(0x10, 0x80002, 0x0) getpeername$packet(r3, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000080), 0xc, 0x0}, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x1f004}) ioctl$KVM_RUN(r2, 0xae80, 0x0) syzkaller login: [ 252.178174][ T9937] IPVS: ftp: loaded support on port[0] = 21 01:05:16 executing program 1: r0 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r0, &(0x7f0000000100)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x0, @empty}}, 0x24) listen(r0, 0x9) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r1, r0, 0x0) [ 252.334783][ T9937] chnl_net:caif_netlink_parms(): no params data found [ 252.444338][ T9937] bridge0: port 1(bridge_slave_0) entered blocking state [ 252.452107][ T9937] bridge0: port 1(bridge_slave_0) entered disabled state [ 252.461058][ T9937] device bridge_slave_0 entered promiscuous mode [ 252.472604][ T9937] bridge0: port 2(bridge_slave_1) entered blocking state [ 252.480595][ T9937] bridge0: port 2(bridge_slave_1) entered disabled state [ 252.490393][ T9937] device bridge_slave_1 entered promiscuous mode [ 252.519110][ T9937] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 252.532345][ T9937] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 252.558209][ T9942] IPVS: ftp: loaded support on port[0] = 21 [ 252.561207][ T9937] team0: Port device team_slave_0 added [ 252.574571][ T9937] team0: Port device team_slave_1 added 01:05:16 executing program 2: r0 = socket$inet(0x2, 0x4000000805, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x200000c, 0x10032, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000040)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r2, 0x84, 0x70, &(0x7f0000013ff4)=@assoc_value, &(0x7f0000002000)=0x8) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x2, &(0x7f0000000080), 0x8) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = dup2(r0, r2) dup3(r5, r1, 0x0) [ 252.612341][ T9937] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 252.619424][ T9937] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 252.646223][ T9937] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 252.664377][ T9937] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 252.671409][ T9937] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 252.698218][ T9937] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 252.817229][ T9937] device hsr_slave_0 entered promiscuous mode 01:05:17 executing program 3: recvmsg(0xffffffffffffffff, 0x0, 0x0) socket$kcm(0x10, 0x0, 0x10) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000140)="2e0000001e000507ed0080648c63000001006080000000000300f88000f01700d0bd000000000008000000000000", 0x2e}], 0x1}, 0x0) [ 252.943066][ T9937] device hsr_slave_1 entered promiscuous mode [ 253.074443][ T9944] IPVS: ftp: loaded support on port[0] = 21 [ 253.197392][ T9942] chnl_net:caif_netlink_parms(): no params data found [ 253.233166][ T9947] IPVS: ftp: loaded support on port[0] = 21 01:05:17 executing program 4: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup(0xffffffffffffffff, 0x0, 0x200002, 0x0) r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000140)="2e0000001e000507ed0080648c63000001006080000000000300f88000f01700d0bd000000000008000000000000", 0x2e}], 0x1}, 0x0) [ 253.361701][ T9937] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 253.435471][ T9937] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 253.509883][ T9937] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 253.571590][ T9937] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 253.647236][ T9942] bridge0: port 1(bridge_slave_0) entered blocking state [ 253.662805][ T9942] bridge0: port 1(bridge_slave_0) entered disabled state [ 253.670729][ T9942] device bridge_slave_0 entered promiscuous mode [ 253.682161][ T9942] bridge0: port 2(bridge_slave_1) entered blocking state [ 253.690025][ T9942] bridge0: port 2(bridge_slave_1) entered disabled state 01:05:17 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = shmget(0x0, 0x1000, 0x780012c9, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_RMID(r2, 0x0) write$sndseq(0xffffffffffffffff, 0x0, 0x0) [ 253.698702][ T9942] device bridge_slave_1 entered promiscuous mode [ 253.760545][ T9951] IPVS: ftp: loaded support on port[0] = 21 [ 253.815475][ T9942] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 253.853820][ T9942] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 253.885248][ T9944] chnl_net:caif_netlink_parms(): no params data found [ 253.952237][ T9942] team0: Port device team_slave_0 added [ 253.987616][ T9942] team0: Port device team_slave_1 added [ 254.034634][ T9942] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 254.041656][ T9942] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 254.068370][ T9942] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 254.085493][ T9942] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 254.092984][ T9942] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 254.119158][ T9942] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 254.137746][ T9954] IPVS: ftp: loaded support on port[0] = 21 [ 254.216856][ T9942] device hsr_slave_0 entered promiscuous mode [ 254.253104][ T9942] device hsr_slave_1 entered promiscuous mode [ 254.332897][ T9942] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 254.340878][ T9942] Cannot create hsr debugfs directory [ 254.389779][ T9944] bridge0: port 1(bridge_slave_0) entered blocking state [ 254.397603][ T9944] bridge0: port 1(bridge_slave_0) entered disabled state [ 254.405996][ T9944] device bridge_slave_0 entered promiscuous mode [ 254.425794][ T9944] bridge0: port 2(bridge_slave_1) entered blocking state [ 254.433212][ T9944] bridge0: port 2(bridge_slave_1) entered disabled state [ 254.441716][ T9944] device bridge_slave_1 entered promiscuous mode [ 254.512556][ T9951] chnl_net:caif_netlink_parms(): no params data found [ 254.531665][ T9947] chnl_net:caif_netlink_parms(): no params data found [ 254.549494][ T9944] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 254.563403][ T9944] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 254.597768][ T9944] team0: Port device team_slave_0 added [ 254.641655][ T9944] team0: Port device team_slave_1 added [ 254.665863][ T9944] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 254.672927][ T9944] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 254.699728][ T9944] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 254.715819][ T9944] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 254.723339][ T9944] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 254.749352][ T9944] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 254.858055][ T9951] bridge0: port 1(bridge_slave_0) entered blocking state [ 254.865366][ T9951] bridge0: port 1(bridge_slave_0) entered disabled state [ 254.874252][ T9951] device bridge_slave_0 entered promiscuous mode [ 254.882600][ T9951] bridge0: port 2(bridge_slave_1) entered blocking state [ 254.890091][ T9951] bridge0: port 2(bridge_slave_1) entered disabled state [ 254.898122][ T9951] device bridge_slave_1 entered promiscuous mode [ 254.976469][ T9944] device hsr_slave_0 entered promiscuous mode [ 255.033188][ T9944] device hsr_slave_1 entered promiscuous mode [ 255.072859][ T9944] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 255.080545][ T9944] Cannot create hsr debugfs directory [ 255.130631][ T9947] bridge0: port 1(bridge_slave_0) entered blocking state [ 255.138417][ T9947] bridge0: port 1(bridge_slave_0) entered disabled state [ 255.146565][ T9947] device bridge_slave_0 entered promiscuous mode [ 255.159493][ T9951] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 255.175176][ T9951] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 255.205473][ T9951] team0: Port device team_slave_0 added [ 255.211919][ T9947] bridge0: port 2(bridge_slave_1) entered blocking state [ 255.219405][ T9947] bridge0: port 2(bridge_slave_1) entered disabled state [ 255.230735][ T9947] device bridge_slave_1 entered promiscuous mode [ 255.279523][ T9951] team0: Port device team_slave_1 added [ 255.308904][ T9951] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 255.316023][ T9951] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 255.342452][ T9951] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 255.357017][ T9937] 8021q: adding VLAN 0 to HW filter on device bond0 [ 255.377460][ T9947] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 255.394541][ T9951] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 255.401561][ T9951] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 255.428996][ T9951] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 255.463579][ T9947] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 255.519863][ T9942] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 255.561271][ T9942] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 255.676245][ T9951] device hsr_slave_0 entered promiscuous mode [ 255.713307][ T9951] device hsr_slave_1 entered promiscuous mode [ 255.782855][ T9951] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 255.790477][ T9951] Cannot create hsr debugfs directory [ 255.796563][ T9954] chnl_net:caif_netlink_parms(): no params data found [ 255.814618][ T9947] team0: Port device team_slave_0 added [ 255.831005][ T9942] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 255.917509][ T9947] team0: Port device team_slave_1 added [ 255.925059][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 255.935091][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 255.943724][ T9942] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 255.989194][ T9937] 8021q: adding VLAN 0 to HW filter on device team0 [ 256.032170][ T9947] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 256.039230][ T9947] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 256.069173][ T9947] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 256.102834][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 256.111783][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 256.121466][ T16] bridge0: port 1(bridge_slave_0) entered blocking state [ 256.128959][ T16] bridge0: port 1(bridge_slave_0) entered forwarding state [ 256.142165][ T9947] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 256.153542][ T9947] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 256.184955][ T9947] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 256.198897][ T9944] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 256.257558][ T9944] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 256.321765][ T9944] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 256.376750][ T2701] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 256.385079][ T2701] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 256.394564][ T2701] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 256.403677][ T2701] bridge0: port 2(bridge_slave_1) entered blocking state [ 256.411070][ T2701] bridge0: port 2(bridge_slave_1) entered forwarding state [ 256.456792][ T9944] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 256.584807][ T9947] device hsr_slave_0 entered promiscuous mode [ 256.633284][ T9947] device hsr_slave_1 entered promiscuous mode [ 256.672802][ T9947] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 256.680566][ T9947] Cannot create hsr debugfs directory [ 256.696781][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 256.755439][ T9954] bridge0: port 1(bridge_slave_0) entered blocking state [ 256.762584][ T9954] bridge0: port 1(bridge_slave_0) entered disabled state [ 256.771710][ T9954] device bridge_slave_0 entered promiscuous mode [ 256.818066][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 256.828349][ T9954] bridge0: port 2(bridge_slave_1) entered blocking state [ 256.836130][ T9954] bridge0: port 2(bridge_slave_1) entered disabled state [ 256.844479][ T9954] device bridge_slave_1 entered promiscuous mode [ 256.869812][ T9954] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 256.911853][ T9954] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 256.923158][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 256.931820][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 256.941214][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 256.954234][ T9951] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 257.020966][ T9954] team0: Port device team_slave_0 added [ 257.035473][ T9951] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 257.105219][ T3104] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 257.114229][ T3104] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 257.127054][ T9954] team0: Port device team_slave_1 added [ 257.139263][ T9951] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 257.188739][ T9951] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 257.239919][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 257.248690][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 257.277376][ T9937] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 257.293506][ T9937] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 257.317079][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 257.325754][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 257.357726][ T9954] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 257.365406][ T9954] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 257.393527][ T9954] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 257.407545][ T9954] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 257.415079][ T9954] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 257.441468][ T9954] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 257.466634][ T9944] 8021q: adding VLAN 0 to HW filter on device bond0 [ 257.516265][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 257.524284][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 257.539587][ T9937] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 257.551031][ T9942] 8021q: adding VLAN 0 to HW filter on device bond0 [ 257.610574][ T9954] device hsr_slave_0 entered promiscuous mode [ 257.663706][ T9954] device hsr_slave_1 entered promiscuous mode [ 257.702889][ T9954] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 257.710489][ T9954] Cannot create hsr debugfs directory [ 257.744348][ T9944] 8021q: adding VLAN 0 to HW filter on device team0 [ 257.751516][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 257.760615][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 257.800337][ T9947] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 257.854840][ T3104] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 257.864010][ T3104] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 257.873379][ T3104] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 257.881138][ T3104] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 257.905123][ T9947] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 257.955516][ T9942] 8021q: adding VLAN 0 to HW filter on device team0 [ 257.976604][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 257.985367][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 257.994451][ T16] bridge0: port 1(bridge_slave_0) entered blocking state [ 258.004864][ T16] bridge0: port 1(bridge_slave_0) entered forwarding state [ 258.012552][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 258.021972][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 258.030575][ T16] bridge0: port 2(bridge_slave_1) entered blocking state [ 258.037816][ T16] bridge0: port 2(bridge_slave_1) entered forwarding state [ 258.045698][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 258.065053][ T9947] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 258.129591][ T9947] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 258.199914][ T2701] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 258.209485][ T2701] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 258.223938][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 258.233055][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 258.284003][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 258.291970][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 258.301449][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 258.310874][ T3019] bridge0: port 1(bridge_slave_0) entered blocking state [ 258.318179][ T3019] bridge0: port 1(bridge_slave_0) entered forwarding state [ 258.326991][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 258.336109][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 258.345365][ T3019] bridge0: port 2(bridge_slave_1) entered blocking state [ 258.352457][ T3019] bridge0: port 2(bridge_slave_1) entered forwarding state [ 258.360562][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 258.369577][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 258.378481][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 258.387449][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 258.397609][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 258.410151][ T9937] device veth0_vlan entered promiscuous mode [ 258.425748][ T9951] 8021q: adding VLAN 0 to HW filter on device bond0 [ 258.463011][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 258.471573][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 258.481913][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 258.490620][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 258.499628][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 258.508505][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 258.517347][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 258.526414][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 258.536173][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 258.546158][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 258.557592][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 258.595552][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 258.604961][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 258.617273][ T9944] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 258.643019][ T3028] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 258.650831][ T3028] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 258.666432][ T9937] device veth1_vlan entered promiscuous mode [ 258.717423][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 258.726732][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 258.736014][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 258.745121][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 258.754737][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 258.763348][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 258.775455][ T9951] 8021q: adding VLAN 0 to HW filter on device team0 [ 258.793821][ T9954] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 258.868936][ T9954] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 258.925714][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 258.936453][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 258.946954][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 258.956091][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 258.964841][ T9937] device veth0_macvtap entered promiscuous mode [ 258.979521][ T9954] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 259.025147][ T9954] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 259.088734][ T9937] device veth1_macvtap entered promiscuous mode [ 259.101575][ T9944] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 259.110547][ T3028] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 259.119578][ T3028] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 259.128376][ T3028] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 259.137508][ T3028] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 259.147136][ T3028] bridge0: port 1(bridge_slave_0) entered blocking state [ 259.154395][ T3028] bridge0: port 1(bridge_slave_0) entered forwarding state [ 259.195301][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 259.204493][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 259.217565][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 259.226685][ T3019] bridge0: port 2(bridge_slave_1) entered blocking state [ 259.233836][ T3019] bridge0: port 2(bridge_slave_1) entered forwarding state [ 259.245938][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 259.263820][ T9937] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 259.285290][ T9937] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 259.313735][ T3104] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 259.322616][ T3104] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 259.331488][ T3104] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 259.340906][ T3104] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 259.349949][ T3104] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 259.359397][ T3104] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 259.367332][ T3104] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 259.374914][ T3104] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 259.384289][ T3104] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 259.397046][ T9947] 8021q: adding VLAN 0 to HW filter on device bond0 [ 259.437175][ T9942] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 259.444965][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 259.479084][ T9951] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 259.490593][ T9951] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 259.521648][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 259.530924][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 259.539720][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 259.549664][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 259.558923][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 259.567817][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 259.578326][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 259.587170][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 259.595605][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 259.604658][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 259.614676][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 259.649232][ T9947] 8021q: adding VLAN 0 to HW filter on device team0 [ 259.715656][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 259.724662][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 259.768799][ T9944] device veth0_vlan entered promiscuous mode [ 259.776559][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 259.786245][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 259.794810][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 259.804274][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 259.813569][ T16] bridge0: port 1(bridge_slave_0) entered blocking state [ 259.820683][ T16] bridge0: port 1(bridge_slave_0) entered forwarding state [ 259.828677][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 259.836628][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 259.844298][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 259.853195][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 259.875305][ T9951] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 259.883635][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 259.891817][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 259.906181][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 259.916288][ T16] bridge0: port 2(bridge_slave_1) entered blocking state [ 259.923507][ T16] bridge0: port 2(bridge_slave_1) entered forwarding state [ 259.955318][ T9944] device veth1_vlan entered promiscuous mode [ 260.055418][ T2701] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 260.077842][ T2701] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 260.088149][ T2701] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 260.130377][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 260.139363][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 260.156338][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 260.179887][ T9942] device veth0_vlan entered promiscuous mode [ 260.206661][ T9954] 8021q: adding VLAN 0 to HW filter on device bond0 [ 260.242325][ T9974] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 260.244341][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 260.270305][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 260.279499][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 260.289663][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 260.299423][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 260.309887][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 260.371854][ T9944] device veth0_macvtap entered promiscuous mode [ 260.404447][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 260.412525][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready 01:05:24 executing program 0: [ 260.423124][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 260.432121][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 260.441501][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 260.466215][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 260.475708][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready 01:05:24 executing program 0: [ 260.520054][ T9942] device veth1_vlan entered promiscuous mode [ 260.530879][ T9954] 8021q: adding VLAN 0 to HW filter on device team0 [ 260.549336][ T9944] device veth1_macvtap entered promiscuous mode [ 260.558187][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready 01:05:24 executing program 0: [ 260.586370][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 260.603789][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 260.612086][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 260.622168][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready 01:05:24 executing program 0: [ 260.646852][ T9947] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 260.704991][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 260.724788][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 260.738809][ T16] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready 01:05:24 executing program 0: [ 260.763457][ T16] bridge0: port 1(bridge_slave_0) entered blocking state [ 260.770610][ T16] bridge0: port 1(bridge_slave_0) entered forwarding state 01:05:24 executing program 0: [ 260.816163][ T9944] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 260.829786][ T9944] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 260.855027][ T9944] batman_adv: batadv0: Interface activated: batadv_slave_0 01:05:25 executing program 0: [ 260.896450][ T2701] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 260.905820][ T2701] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 260.923392][ T2701] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 260.931948][ T2701] bridge0: port 2(bridge_slave_1) entered blocking state [ 260.939390][ T2701] bridge0: port 2(bridge_slave_1) entered forwarding state [ 260.949458][ T2701] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 260.958786][ T2701] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 260.970312][ T2701] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 260.986866][ T2701] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 260.998619][ T2701] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 261.010620][ T2701] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 261.019731][ T2701] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 261.037642][ T9951] device veth0_vlan entered promiscuous mode [ 261.071533][ T9947] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 261.084144][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 261.092102][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 261.101480][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 261.110656][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 261.119630][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 261.128726][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 261.138620][ T9944] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 261.151779][ T9944] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 261.165306][ T9944] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 261.191681][ T3104] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 261.201393][ T3104] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 261.214469][ T3104] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 261.223697][ T3104] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 261.236279][ T9942] device veth0_macvtap entered promiscuous mode [ 261.276237][ T9951] device veth1_vlan entered promiscuous mode [ 261.292411][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 261.301305][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 261.310713][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 261.319682][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 261.328310][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 261.337428][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 261.346510][ T3019] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 261.464095][ T9942] device veth1_macvtap entered promiscuous mode [ 261.478377][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 261.489038][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 261.498034][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 261.510900][ T9954] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 261.618023][ T9942] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 261.651235][ T9942] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 261.666823][ T9942] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 261.677386][ T9942] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 261.688992][ T9942] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 261.708829][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 261.718041][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 261.726849][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 261.737125][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 261.746704][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 261.755790][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 261.769766][ T9951] device veth0_macvtap entered promiscuous mode [ 261.785309][ T9942] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 261.796399][ T9942] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 261.807786][ T9942] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 261.818786][ T9942] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 261.831730][ T9942] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 261.841877][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 261.850597][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 261.858647][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 261.866965][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 261.874867][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 261.882508][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 261.891322][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 261.905460][ T9951] device veth1_macvtap entered promiscuous mode [ 261.933667][ T9947] device veth0_vlan entered promiscuous mode [ 261.959424][ T9954] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 262.049501][ T9951] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 262.061951][ T9951] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 262.072508][ T9951] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 262.083073][ T9951] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 262.093120][ T9951] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 262.103652][ T9951] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 262.115783][ T9951] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 262.132359][ T9947] device veth1_vlan entered promiscuous mode [ 262.146260][ T3104] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 262.156788][ T3104] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 262.211172][ T9951] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 262.223113][ T9951] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 262.234101][ T9951] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 262.244801][ T9951] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 262.255990][ T9951] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 262.266561][ T9951] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 262.278312][ T9951] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 262.300084][ T3104] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 262.317919][ T3104] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 262.468859][ T3104] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 262.484574][ T3104] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready 01:05:26 executing program 1: 01:05:26 executing program 0: [ 262.510561][ T3104] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 262.519726][ T3104] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 262.535965][ T9947] device veth0_macvtap entered promiscuous mode [ 262.594851][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 262.605008][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 262.643694][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 262.689064][ T9947] device veth1_macvtap entered promiscuous mode [ 262.698001][ C0] hrtimer: interrupt took 46048 ns [ 262.741430][ T9954] device veth0_vlan entered promiscuous mode [ 262.755392][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 262.774922][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 262.783246][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 262.802030][T10018] netlink: 26 bytes leftover after parsing attributes in process `syz-executor.4'. [ 262.869860][ T9954] device veth1_vlan entered promiscuous mode [ 262.909671][ T9947] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 262.921683][ T9947] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 262.931692][ T9947] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 262.943330][ T9947] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 262.954363][ T9947] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 262.965468][ T9947] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 262.975783][ T9947] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 262.986364][ T9947] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 262.998310][ T9947] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 263.010850][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 263.020775][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 263.029253][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 263.038234][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 263.056716][ T9947] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 263.068099][ T9947] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 263.078396][ T9947] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 263.089860][ T9947] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 263.100493][ T9947] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 263.111530][ T9947] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 263.121589][ T9947] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 263.132123][ T9947] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 263.144417][ T9947] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 263.163355][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 263.172184][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 263.205294][ T3104] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 263.215217][ T3104] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 263.231240][ T9954] device veth0_macvtap entered promiscuous mode [ 263.311990][ T9954] device veth1_macvtap entered promiscuous mode [ 263.432464][ T9954] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 263.443312][ T9954] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 263.453859][ T9954] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 263.464928][ T9954] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 263.474850][ T9954] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 263.486352][ T9954] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 263.497066][ T9954] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 263.507578][ T9954] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 263.517438][ T9954] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 263.527906][ T9954] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 263.541541][ T9954] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 263.554006][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 263.562163][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 263.571225][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 263.580729][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 263.593098][ T9954] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 263.605298][ T9954] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 263.635688][ T9954] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 263.646684][ T9954] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 263.665607][ T9954] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 263.680863][ T9954] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 263.691140][ T9954] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 263.701718][ T9954] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 263.711611][ T9954] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 263.723104][ T9954] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 263.736377][ T9954] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 263.751995][T10023] netlink: 26 bytes leftover after parsing attributes in process `syz-executor.3'. [ 263.765652][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 263.775071][ T2774] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 01:05:27 executing program 0: 01:05:27 executing program 2: [ 263.790994][T10024] netlink: 26 bytes leftover after parsing attributes in process `syz-executor.3'. 01:05:28 executing program 5: 01:05:28 executing program 1: 01:05:28 executing program 3: recvmsg(0xffffffffffffffff, 0x0, 0x0) socket$kcm(0x10, 0x0, 0x10) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000140)="2e0000001e000507ed0080648c63000001006080000000000300f88000f01700d0bd000000000008000000000000", 0x2e}], 0x1}, 0x0) 01:05:28 executing program 4: 01:05:28 executing program 2: 01:05:28 executing program 0: 01:05:28 executing program 1: 01:05:28 executing program 2: 01:05:28 executing program 4: 01:05:28 executing program 0: [ 264.178140][T10039] netlink: 26 bytes leftover after parsing attributes in process `syz-executor.3'. 01:05:28 executing program 5: 01:05:28 executing program 3: recvmsg(0xffffffffffffffff, 0x0, 0x0) socket$kcm(0x10, 0x0, 0x10) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000140)="2e0000001e000507ed0080648c63000001006080000000000300f88000f01700d0bd000000000008000000000000", 0x2e}], 0x1}, 0x0) 01:05:28 executing program 2: 01:05:28 executing program 0: 01:05:28 executing program 4: 01:05:28 executing program 1: 01:05:28 executing program 5: 01:05:28 executing program 4: [ 264.615256][T10057] netlink: 26 bytes leftover after parsing attributes in process `syz-executor.3'. 01:05:28 executing program 1: 01:05:28 executing program 2: 01:05:28 executing program 0: 01:05:28 executing program 3: recvmsg(0xffffffffffffffff, 0x0, 0x0) socket$kcm(0x10, 0x0, 0x10) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000140)="2e0000001e000507ed0080648c63000001006080000000000300f88000f01700d0bd000000000008000000000000", 0x2e}], 0x1}, 0x0) 01:05:28 executing program 5: 01:05:29 executing program 2: 01:05:29 executing program 4: 01:05:29 executing program 0: 01:05:29 executing program 1: [ 265.045873][T10078] netlink: 26 bytes leftover after parsing attributes in process `syz-executor.3'. 01:05:29 executing program 5: 01:05:29 executing program 2: 01:05:29 executing program 3: 01:05:29 executing program 4: 01:05:29 executing program 0: 01:05:29 executing program 5: 01:05:29 executing program 2: 01:05:29 executing program 4: 01:05:29 executing program 3: 01:05:29 executing program 1: clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x0, 0x0) ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f00000000c0)={@remote, 0x15}) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000001c0)=""/57}], 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) dup(0xffffffffffffffff) ptrace$cont(0x9, r0, 0x0, 0x0) 01:05:29 executing program 0: setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_genetlink_get_family_id$netlbl_cipso(0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setstatus(r1, 0x4, 0x0) getsockopt$TIPC_DEST_DROPPABLE(r1, 0x10f, 0x81, &(0x7f0000000200), &(0x7f00000007c0)=0x4) sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000009c0)=ANY=[@ANYBLOB="48030000", @ANYRES16=r0, @ANYBLOB], 0x3}, 0x1, 0x0, 0x0, 0x20000000}, 0xc0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x1000, 0xffffffffffffff79}, 0x0) r2 = getpid() r3 = syz_open_dev$rtc(&(0x7f00000000c0)='/dev/rtc#\x00', 0x185effda00, 0x147480) ioctl$EXT4_IOC_MOVE_EXT(r3, 0xc028660f, &(0x7f0000000180)={0x0, 0xffffffffffffffff, 0x5, 0x80, 0x0, 0x10001}) sched_setattr(r2, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r4, &(0x7f0000001b40)=[{{&(0x7f0000000740)=@sco, 0x80, 0x0}, 0x80000000}], 0x1, 0x0, 0x0) pipe(&(0x7f0000001d40)={0xffffffffffffffff, 0xffffffffffffffff}) fremovexattr(0xffffffffffffffff, &(0x7f00000002c0)=ANY=[@ANYBLOB="5377d91d34cb87e71b0db11805f49db0c36d73082a99f1e18f263fb1f33bfe8b52deced3554a9b78a9e677cf47a954eaaf190f79be903799756e74730045b4c59d43d5ea5096fceb751e97ac485c77d45027f35e85ea71199d244fee8da55cc3b5696a19cde474a2105c1004e7e79b4428032dd1a81f91d223a1b7a595db24c713997a4222d295262e36c39c75401f4eedda5f2e366bd5ad02ef24bbce40b42ee8e4234a0bec872f6d2bb19bbcb8af3e83ebc3a622e262944bdb5fee673a2cfef6191760ef393eb35dc94900ef0a9b9b15b3710359a4a4454e6e3d9764c88aaa3d0545162b634071e413dc3588c6e653"]) fcntl$setpipe(r6, 0x407, 0x0) write(r6, &(0x7f0000000340), 0x41395527) socket$inet(0x2, 0x800, 0xf6) vmsplice(r5, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) clone(0x40000139, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r7 = socket$inet(0x2, 0x0, 0x0) fcntl$dupfd(r7, 0x0, 0xffffffffffffffff) 01:05:29 executing program 5: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) exit_group(0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r0 = creat(&(0x7f0000000280)='./file0\x00', 0x0) fallocate(r0, 0x0, 0x0, 0x2000402) 01:05:29 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x100000008d}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r0, 0x0, 0x0, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x20401, 0x0) write$binfmt_aout(r1, &(0x7f00000000c0)=ANY=[], 0xffffff78) ioctl$TCSETS(r1, 0x40045431, &(0x7f0000000200)) r2 = syz_open_pts(r1, 0x0) readv(r2, &(0x7f00000001c0)=[{&(0x7f0000000940)=""/4096, 0x1000}], 0x3c) ioctl$TCSETSW(r2, 0x5403, &(0x7f0000000000)) 01:05:29 executing program 4: 01:05:29 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) gettid() timer_create(0x0, 0x0, 0x0) write$binfmt_elf32(0xffffffffffffffff, 0x0, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) write$FUSE_LSEEK(0xffffffffffffffff, 0x0, 0x0) setxattr$trusted_overlay_upper(&(0x7f0000000440)='./file1\x00', &(0x7f0000000480)='trusted.overlay.upper\x00', 0x0, 0x0, 0x0) open(&(0x7f0000000100)='./file1\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x803, 0x2) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@dev, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x80000000000001}, {{@in6=@empty, 0x0, 0x3c}, 0x0, @in=@empty, 0x0, 0x0, 0x0, 0x1}}, 0xe8) ppoll(0x0, 0x0, &(0x7f00000005c0), 0x0, 0x0) sendmmsg(r0, &(0x7f0000008440)=[{{0x0, 0x536, 0x0}}], 0x400000000000107, 0x0) r1 = syz_open_procfs(0x0, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000140)={{{@in6=@mcast2}}, {{@in=@multicast1}, 0x0, @in=@initdev}}, &(0x7f0000000000)=0xe8) 01:05:29 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x2, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "000001000000000008fc9d71fc00000000000000f8ffff002e0b3836005404b0d6301a4ce875f2e3ff5f163ee340b76795008000f8000000000104003c5811039e15775027ecce66fd792bbf0e5bf5ff9b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ff42c65400"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x38, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_VFINFO_LIST={0x14, 0x16, 0x0, 0x1, [{0x8, 0x1, 0x0, 0x1, [@IFLA_VF_LINK_STATE={0xc}]}]}, @IFLA_IFALIASn={0x4}]}, 0x38}}, 0x0) [ 265.638964][T10110] ptrace attach of "/root/syz-executor.1"[10109] was attempted by "/root/syz-executor.1"[10110] [ 265.845819][T10133] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.1'. [ 265.866148][T10136] IPVS: ftp: loaded support on port[0] = 21 01:05:30 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ptype\x00') preadv(r0, &(0x7f00000001c0)=[{&(0x7f00000011c0)=""/116, 0x74}], 0x52, 0x2f) [ 265.964216][T10133] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. 01:05:30 executing program 5: clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000000c0)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x5b}) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000140)=""/73, 0x3f4fd7a220e5df02}], 0x0, 0x0, 0x15d, 0x0) tkill(r0, 0xe) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 01:05:30 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x3}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, 0x0, 0x0, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) socket$packet(0x11, 0x0, 0x300) socket$packet(0x11, 0x0, 0x300) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000240)='./file0\x00', 0x880, 0x24) fchdir(r4) r5 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r5, 0x800) lseek(r5, 0x0, 0x2) r6 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r5, r6, 0x0, 0x280900) 01:05:30 executing program 0: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x1}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x41395527) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = socket(0x0, 0x4, 0x0) r3 = socket(0x1e, 0x4, 0x0) r4 = socket(0x1e, 0x4, 0x0) recvfrom$unix(r4, 0x0, 0x0, 0x0, 0x0, 0x0) dup3(r4, r3, 0x0) setsockopt$packet_tx_ring(r3, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, 0x0, 0x0) r5 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r5, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc, 0x0, 0x2}, 0x10) sendmmsg(r5, &(0x7f00000030c0), 0xa, 0x0) r6 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', &(0x7f0000000180)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) r7 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, r6) r8 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', &(0x7f0000000180)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, r8) add_key$keyring(&(0x7f0000000200)='keyring\x00', 0x0, 0x0, 0x0, r7) keyctl$unlink(0x9, r7, r8) r9 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) renameat2(r9, &(0x7f0000000440)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0xffffffffffffff9c, &(0x7f0000000040)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x2) r10 = gettid() tkill(r10, 0x1000000000016) [ 266.291483][ T27] audit: type=1804 audit(1580951130.364:31): pid=10156 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir134900658/syzkaller.rtRhG8/10/file0/bus" dev="loop4" ino=23 res=1 [ 266.307575][T10155] ptrace attach of "/root/syz-executor.5"[10154] was attempted by "/root/syz-executor.5"[10155] [ 266.323352][ T266] tipc: TX() has been purged, node left! 01:05:30 executing program 1: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) gettid() timer_create(0x0, 0x0, 0x0) r0 = open(0x0, 0x141042, 0x0) write$binfmt_elf32(0xffffffffffffffff, 0x0, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) write$FUSE_LSEEK(r0, 0x0, 0x0) setxattr$trusted_overlay_upper(&(0x7f0000000440)='./file1\x00', &(0x7f0000000480)='trusted.overlay.upper\x00', 0x0, 0x0, 0x0) creat(&(0x7f00000004c0)='./file1\x00', 0x105) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x803, 0x2) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000340)={{{@in=@dev, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x80000000000001}, {{@in6=@empty, 0x4d2, 0x3c}, 0x0, @in=@empty, 0x20, 0x4, 0x0, 0x1}}, 0xe8) ppoll(0x0, 0x0, &(0x7f00000005c0), &(0x7f0000000600)={[0x3ff]}, 0x8) sendmmsg(r1, &(0x7f0000008440)=[{{0x0, 0x536, 0x0}}], 0x400000000000107, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000200)='oom_adj\x00') epoll_create1(0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000140)={{{@in6=@mcast2}}, {{@in=@multicast1}, 0x0, @in=@initdev}}, &(0x7f0000000000)=0xe8) 01:05:30 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f00000000c0)={0x2, 0x4e20, @multicast2}, 0x10) sendto$inet(r1, &(0x7f0000000200), 0xfffffffffffffeb4, 0x20008011, &(0x7f0000db4ff0)={0x2, 0x4e20, @loopback}, 0x10) [ 266.702126][T10172] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. 01:05:30 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) gettid() timer_create(0x0, 0x0, 0x0) write$binfmt_elf32(0xffffffffffffffff, 0x0, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) write$FUSE_LSEEK(0xffffffffffffffff, 0x0, 0x0) setxattr$trusted_overlay_upper(&(0x7f0000000440)='./file1\x00', &(0x7f0000000480)='trusted.overlay.upper\x00', 0x0, 0x0, 0x0) open(&(0x7f0000000100)='./file1\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x803, 0x2) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@dev, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x80000000000001}, {{@in6=@empty, 0x0, 0x3c}, 0x0, @in=@empty, 0x0, 0x0, 0x0, 0x1}}, 0xe8) ppoll(0x0, 0x0, &(0x7f00000005c0), 0x0, 0x0) sendmmsg(r0, &(0x7f0000008440)=[{{0x0, 0x536, 0x0}}], 0x400000000000107, 0x0) r1 = syz_open_procfs(0x0, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000140)={{{@in6=@mcast2}}, {{@in=@multicast1}, 0x0, @in=@initdev}}, &(0x7f0000000000)=0xe8) 01:05:30 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r2, 0x1, 0x29, &(0x7f0000000080)=0x5, 0x4) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000000)=0x80000000000701, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000280)={0xa, 0x4e02, 0x0, @mcast2}, 0x1c) recvfrom$inet6(r2, 0x0, 0x0, 0x2023, 0x0, 0xfffffc47) 01:05:30 executing program 0: openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x10000, 0x0) clone(0x3a3dd4008400af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f0000001340)=ANY=[@ANYBLOB="726177000000000000000000000000000000000000000000000000000000000002000000030000002004000000000000d0020000d0020000d00200000000000088030000880300008803000088030000880300000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ac00000000000000a002d00200000000000000000000000000000000000000003002627066000000000000000000000000000000000000000000000000000001000003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000011000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090a9cda6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000300053455400000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000b8000000000000000000000000000000000000000000480049444c4554494d45520000000000000000000000000000000000000000000000000073797a300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000980000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000004feffffff"], 0x1) 01:05:31 executing program 4: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket(0x1e, 0x4, 0x0) r1 = socket(0x1e, 0x4, 0x0) recvfrom$unix(r1, &(0x7f00000002c0)=""/186, 0xba, 0x0, 0x0, 0x0) dup3(r1, r0, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) r2 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc, 0x0, 0x2}, 0x10) sendmmsg(r2, &(0x7f00000030c0), 0xa, 0x0) r3 = gettid() tkill(r3, 0x1000000000016) [ 267.092346][T10194] xt_bpf: check failed: parse error [ 267.095104][ T537] attempt to access beyond end of device [ 267.120653][ T537] loop4: rw=1, want=78, limit=63 01:05:31 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) mount$bpf(0x20000000, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r4) r5 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r5, 0x800) lseek(r5, 0x0, 0x2) r6 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r5, r6, 0x0, 0x280900) 01:05:31 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) write$tun(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="0300280010002c00000060d2b402ac6f3a0000000000000000000000000001000000ff020000000000000000000000000001030000000000000000000000000040007c0f897c00"/98], 0xfdef) [ 267.139873][ T537] Buffer I/O error on dev loop4, logical block 77, lost async page write [ 267.209965][ T537] attempt to access beyond end of device [ 267.267080][ T537] loop4: rw=1, want=79, limit=63 [ 267.296124][ T537] Buffer I/O error on dev loop4, logical block 78, lost async page write [ 267.371879][ T537] attempt to access beyond end of device [ 267.390753][ T537] loop4: rw=1, want=80, limit=63 [ 267.409500][ T537] Buffer I/O error on dev loop4, logical block 79, lost async page write [ 267.441924][ T537] attempt to access beyond end of device [ 267.462440][T10201] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 267.471419][ T537] loop4: rw=1, want=81, limit=63 [ 267.506172][T10201] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 267.534708][ T27] audit: type=1804 audit(1580951131.614:32): pid=10207 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir274349878/syzkaller.0FeOGG/19/file0/bus" dev="loop0" ino=24 res=1 01:05:31 executing program 2: clone(0x4340100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) r0 = getpid() tkill(r0, 0x9) r1 = socket(0x10, 0x2, 0x0) write(r1, &(0x7f0000000280)="1c0000001a009b8a14e5f4070009042400000000ff00000000000000", 0x1e5) recvmmsg(r1, &(0x7f0000002ec0), 0x400000000000008, 0x0, &(0x7f00000001c0)={0x77359400}) [ 267.789100][ T537] Buffer I/O error on dev loop4, logical block 80, lost async page write [ 267.804738][ T537] attempt to access beyond end of device [ 267.810446][ T537] loop4: rw=1, want=130, limit=63 [ 267.821481][ T537] Buffer I/O error on dev loop4, logical block 129, lost async page write [ 267.839118][ T537] attempt to access beyond end of device [ 267.846572][ T537] loop4: rw=1, want=131, limit=63 [ 267.851732][ T537] Buffer I/O error on dev loop4, logical block 130, lost async page write [ 267.863759][T10201] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 267.884844][ T537] attempt to access beyond end of device [ 267.892121][ T537] loop4: rw=1, want=132, limit=63 [ 267.902262][ T537] Buffer I/O error on dev loop4, logical block 131, lost async page write [ 267.919474][ T537] attempt to access beyond end of device 01:05:32 executing program 1: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) gettid() timer_create(0x0, 0x0, 0x0) r0 = open(0x0, 0x141042, 0x0) write$binfmt_elf32(0xffffffffffffffff, 0x0, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) write$FUSE_LSEEK(r0, 0x0, 0x0) setxattr$trusted_overlay_upper(&(0x7f0000000440)='./file1\x00', &(0x7f0000000480)='trusted.overlay.upper\x00', 0x0, 0x0, 0x0) creat(&(0x7f00000004c0)='./file1\x00', 0x105) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x803, 0x2) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000340)={{{@in=@dev, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x80000000000001}, {{@in6=@empty, 0x4d2, 0x3c}, 0x0, @in=@empty, 0x20, 0x4, 0x0, 0x1}}, 0xe8) ppoll(0x0, 0x0, &(0x7f00000005c0), &(0x7f0000000600)={[0x3ff]}, 0x8) sendmmsg(r1, &(0x7f0000008440)=[{{0x0, 0x536, 0x0}}], 0x400000000000107, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000200)='oom_adj\x00') epoll_create1(0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000140)={{{@in6=@mcast2}}, {{@in=@multicast1}, 0x0, @in=@initdev}}, &(0x7f0000000000)=0xe8) [ 267.937159][ T537] loop4: rw=1, want=133, limit=63 01:05:32 executing program 5: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) gettid() timer_create(0x0, 0x0, 0x0) r0 = open(0x0, 0x141042, 0x0) write$binfmt_elf32(0xffffffffffffffff, 0x0, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) write$FUSE_LSEEK(r0, 0x0, 0x0) setxattr$trusted_overlay_upper(&(0x7f0000000440)='./file1\x00', &(0x7f0000000480)='trusted.overlay.upper\x00', 0x0, 0x0, 0x0) creat(&(0x7f00000004c0)='./file1\x00', 0x105) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x803, 0x2) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000340)={{{@in=@dev, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x80000000000001}, {{@in6=@empty, 0x4d2, 0x3c}, 0x0, @in=@empty, 0x20, 0x4, 0x0, 0x1}}, 0xe8) ppoll(0x0, 0x0, &(0x7f00000005c0), &(0x7f0000000600)={[0x3ff]}, 0x8) sendmmsg(r1, &(0x7f0000008440)=[{{0x0, 0x536, 0x0}}], 0x400000000000107, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000200)='oom_adj\x00') epoll_create1(0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000140)={{{@in6=@mcast2}}, {{@in=@multicast1}, 0x0, @in=@initdev}}, &(0x7f0000000000)=0xe8) 01:05:32 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0xb, 0x9, 0x200007, 0x5, 0x1}, 0x3c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r0, &(0x7f0000000040), 0x0}, 0x20) [ 267.980496][ T537] Buffer I/O error on dev loop4, logical block 132, lost async page write [ 268.003013][ T537] attempt to access beyond end of device [ 268.033112][ T537] loop4: rw=1, want=142, limit=63 [ 268.038178][ T537] Buffer I/O error on dev loop4, logical block 141, lost async page write 01:05:32 executing program 0: socket$packet(0x11, 0x4000000000000a, 0x300) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmmsg(r0, &(0x7f0000006d00)=[{{0x0, 0x1002000, 0x0}}], 0xc6, 0x0) [ 268.108352][ T537] attempt to access beyond end of device [ 268.139577][ T537] loop4: rw=1, want=143, limit=63 [ 268.189714][ T537] Buffer I/O error on dev loop4, logical block 142, lost async page write [ 268.199914][ T700] attempt to access beyond end of device [ 268.206715][ T537] attempt to access beyond end of device [ 268.211478][T10205] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 268.213919][ T537] loop4: rw=1, want=144, limit=63 [ 268.225461][ T537] attempt to access beyond end of device [ 268.231347][ T537] loop4: rw=1, want=145, limit=63 [ 268.239812][ T700] loop0: rw=1, want=78, limit=63 01:05:32 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'gretap0\x00', 0x420000014901}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000010005fba00000000fffffffffffffff1", @ANYRES32=0x0, @ANYBLOB="030000000000000008001b0000000000"], 0x28}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'gretap0\x00', 0x420000014901}) write$tun(r4, &(0x7f0000000300)=ANY=[@ANYBLOB="0000430503000700000004000000000000000000000000004500015600000000000690787f000001ac1e000100000000", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="50000000907802007dd5d8bb4e14a9af3eac703b12f849bf1fc2f343ecb9757b44cb04c9a4c687a96ff49c1dec44212d70a2757e7c8fda1ddbfdf6d77affaeb292267fc68264fff238ff4d9e6908739504e60342768556efa57d2cc0c0129afbcdf039f36c11baaa56601ec0ac2e226c53bd9dc7a378e04d876a236a8d2633a7da6efdec2b5f3045057cb4011c86c8515d3e34281d5432102b94feafcbd60ecfb88f63619ad5bc6a99b46a8d8223d5ecd9ff6fed624d9745d8b84010e5d2439a9417efb1c4c8a38b6b70cc59dcf08505454fab8b53e2148de8aa1d30843c09264306498cdd4815dbcb1bb15d6cbd45b4acb2023aedabed7bb438e1605395928070c4012bf473f1fc6cf112d5bb6aae218c2d869d56a9cc348a940500"/295], 0x16e) [ 268.278430][ T700] attempt to access beyond end of device [ 268.286239][ T537] attempt to access beyond end of device [ 268.298831][ T700] loop0: rw=1, want=79, limit=63 [ 268.304547][T10205] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 268.307853][ T537] loop4: rw=1, want=5258, limit=63 [ 268.362955][ T700] attempt to access beyond end of device [ 268.368659][ T700] loop0: rw=1, want=80, limit=63 [ 268.463359][ T700] attempt to access beyond end of device [ 268.469078][ T700] loop0: rw=1, want=81, limit=63 [ 268.502274][ T700] attempt to access beyond end of device [ 268.524905][ T700] loop0: rw=1, want=130, limit=63 [ 268.548664][ T700] attempt to access beyond end of device [ 268.572906][ T700] loop0: rw=1, want=131, limit=63 [ 268.597419][ T700] attempt to access beyond end of device [ 268.606328][T10232] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 268.620660][ T700] loop0: rw=1, want=132, limit=63 [ 268.630646][T10232] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 268.638647][ T700] attempt to access beyond end of device [ 268.644787][ T700] loop0: rw=1, want=133, limit=63 [ 268.653404][ T700] attempt to access beyond end of device [ 268.662797][ T700] loop0: rw=1, want=142, limit=63 [ 268.668053][ T700] attempt to access beyond end of device [ 268.674576][ T700] loop0: rw=1, want=143, limit=63 [ 268.683221][ T700] attempt to access beyond end of device [ 268.702797][T10232] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 268.728325][ T700] loop0: rw=1, want=144, limit=63 [ 268.752880][ T700] attempt to access beyond end of device [ 268.783277][ T700] loop0: rw=1, want=145, limit=63 01:05:32 executing program 3: setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_genetlink_get_family_id$netlbl_cipso(0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x41395527) fcntl$setstatus(r1, 0x4, 0x0) getsockopt$TIPC_DEST_DROPPABLE(r1, 0x10f, 0x81, &(0x7f0000000200), &(0x7f00000007c0)=0x4) sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000009c0)=ANY=[@ANYBLOB="48030000", @ANYRES16=r0, @ANYBLOB="000126bd7000fedbdf250100000090000880440007800800060065000000080005009cc23e06080006004300000008000600de000000080006000f000000080005008138d57108000500d247677208000600530000001400078008000500cf84115608000500662c69351400078008000600fb00000008000500aa0c9b390c00078008000600790000001400078008000500c1e9901a08000600870000005001088034000780080005007ded8a25080005007658662608000500e3e7ea65080006004900000008000500acec7d0b08000600780000003c00078008000500a711e07b0800060089000000080006000b000000080006006c00000008000500d592fd1108000600f300000008000500038ae56e4c000780080005002ec9a10a08000500bb02fb38080006002e000000080005000e318c7d08000500593cd000080005004c596c43080005005386065908000600820000000800050041f501520c0007800800050018d1a1401400078008000600a3001000080005001bd4ba054c0007800800050095736c48080005009040141e08000600360000000800050055607779080006006500000008000500c16f3218080006006f00000008000500fdd82661080006007d0000002400078008000600b1000000080005004f96d770080006000a00000008000600d7000000080002000200000034000c8004000b802c000b8008000900db5dcc5a08000a00bc0c000008000a00dc970000acdb0900b4cbcb5e08000a00a96600007c000c8024000b80080009005b87046f08000900266a1a3208000a00f587000008000900ae549f7f54000b8008000900620b305308000a0012b4000008000900b1b0b14808000a00b268000008000900ceeffd2e0800090067eb463608000a000000000008000900865f587a08000a0038c800000800090095f8451e080002000200000094000c8034000b800800090037df192f08000a0084f8000008000a009d50000008000a0018a7000008000a00f1c8000008000a00e25100000c000b8008000a002beb00004c000b8008000900bf160f0c08000a002d43000008000900ec97261108000a001a41000008000a0094220000080009007c0aa33508000a00004f000008000900a6e9016c080009003df93e6404000b80f4a4ad09dcfa39e2b3b7ea1847172abc391adc0542ec8b0ea4a459e322b4e399f2cefbff867f56b872bf576e859f33d04a37329e0eb2bf03baf05f8ce1d067662f970531a58a32663e688330b81df9608eb7d2b8d4dd6a27b1336918274e7017379bfefd50c1e7f8685d338d8b0850d4cd8733d13c1900946c03279beb"], 0x3}, 0x1, 0x0, 0x0, 0x20000000}, 0xc0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x1000, 0xffffffffffffff79}, 0x0) r2 = getpid() r3 = syz_open_dev$rtc(&(0x7f00000000c0)='/dev/rtc#\x00', 0x185effda00, 0x147480) ioctl$EXT4_IOC_MOVE_EXT(r3, 0xc028660f, &(0x7f0000000180)={0x0, 0xffffffffffffffff, 0x5, 0x80, 0x0, 0x10001}) sched_setattr(r2, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r4, &(0x7f0000001b40)=[{{&(0x7f0000000740)=@sco, 0x80, 0x0}, 0x80000000}], 0x1, 0x0, 0x0) pipe(&(0x7f0000001d40)={0xffffffffffffffff, 0xffffffffffffffff}) fremovexattr(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="5377d91d34cb87e71b0db11805f49db0c36d73082a99f1e18f263fb1f33bfe8b52deced3554a9b78a9e677cf47a954eaaf190f79be903791756e74730045b4c59d43d5ea5096fceb751e97ac485c77d45027f35e85ea71199d244fee8da55cc3b5696a19cde474a2105c1004e7e79b4428032dd1cd1f93d223a1b7a595db24c713997a4222d295262e36c39c75401f4eedda5f2e366bd5ad02ef24bbce40b42ee8e4234a0bec872f6d2bb19bbcb8af3ea3ebc3a622e262944bdb5fee673a2cfef6191760ef393eb35dc94900ef0a9bab15b3710359a4a4454e6e4ed1cbf62919e48d4c373d9764c88aaa3d0545162b634071e413dc3588c6e653"]) fcntl$setpipe(r6, 0x407, 0x0) write(r6, &(0x7f0000000340), 0x41395527) vmsplice(r5, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) clone(0x40000139, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r7 = socket$inet(0x2, 0x0, 0x0) fcntl$dupfd(r7, 0x0, 0xffffffffffffffff) 01:05:32 executing program 1: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f0000000100)=""/246) close(r0) [ 268.857251][T10233] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 268.889762][ T700] attempt to access beyond end of device [ 268.952747][ T700] loop0: rw=1, want=5258, limit=63 [ 268.965093][T10233] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. 01:05:33 executing program 2: clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f00000000c0)={@dev, 0x80}) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000001c0)=""/57, 0x39}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0xb) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) [ 269.144776][T10253] ptrace attach of "/root/syz-executor.2"[10252] was attempted by "/root/syz-executor.2"[10253] [ 269.230181][T10255] IPVS: ftp: loaded support on port[0] = 21 01:05:33 executing program 4: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket(0x1e, 0x4, 0x0) r1 = socket(0x1e, 0x4, 0x0) recvfrom$unix(r1, &(0x7f00000002c0)=""/186, 0xba, 0x0, 0x0, 0x0) dup3(r1, r0, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) r2 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc, 0x0, 0x2}, 0x10) sendmmsg(r2, &(0x7f00000030c0), 0xa, 0x0) r3 = gettid() tkill(r3, 0x1000000000016) 01:05:33 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x20401, 0x0) write$binfmt_aout(r0, &(0x7f00000000c0)=ANY=[], 0xffffff78) ioctl$TCXONC(r0, 0x540a, 0x2) 01:05:33 executing program 2: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) getpid() r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) write(r2, &(0x7f0000000340), 0x41395527) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) mount$bpf(0x20000000, 0x0, 0x0, 0x2001001, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r3 = open(&(0x7f0000000240)='./file0\x00', 0x880, 0x24) fchdir(r3) r4 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r4, 0x800) lseek(r4, 0x0, 0x2) r5 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r4, r5, 0x0, 0x280900) 01:05:33 executing program 1: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) fcntl$setstatus(r0, 0x4, 0x6100) write$cgroup_type(r0, &(0x7f0000000200)='threaded\x00', 0xf642e7e) 01:05:33 executing program 3: socketpair(0x0, 0x0, 0x0, &(0x7f0000000000)) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)={0xb, 0x6, 0x209e20, 0x2, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000300), &(0x7f0000000080)}, 0x20) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000000040)={r0, &(0x7f0000000000), &(0x7f0000000140)=""/130}, 0x18) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000000200)={r0, &(0x7f0000000440), &(0x7f0000000540)=""/203}, 0x20) 01:05:33 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) write$tun(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="0300280010002c00000060d2b402ac6f3a0000000000000000000000000001000000ff02000000000000000000050000000192ffffff0000000000000000000040007c0f897c00"/98], 0xfdef) [ 269.701990][T10276] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 269.711354][T10276] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 269.786582][T10276] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 269.808380][ T27] audit: type=1804 audit(1580951133.884:33): pid=10291 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir376885900/syzkaller.fRdopr/15/file0/bus" dev="loop2" ino=26 res=1 01:05:34 executing program 1: r0 = open(&(0x7f0000000340)='./file0\x00', 0x1070c5, 0x0) openat$vsock(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r1 = open$dir(0x0, 0x0, 0x0) write$9p(r0, &(0x7f0000001400)="3b27a4b46ee92b4a59073c369a5e19f9db153c4fdbc76aa2a4bb9f3e5e1aa197a9e97d1016c01813792e50c2692c175aad715d110a892949ccc6e2e54c2d5c8f0b7932b69797f217168b0c1feb128ae34f0daf487a70b5c117acd43725fe17993634f1695dabd7f998cd55e9d5bd911e86aa7a4ad75a574bb96951d6018b25d942a9544bca1ebb0e8d10c092cdcb85797673972099e4041aaf8d636f66cb1103ef2050ad28fabaed33d6927889d97f4b5ce0de71d3fd832980f4f088d0d824e20549b4bbd906ffa51ce9de54d779eb4de462faac20a3ab0ed9934373ca22cea5454f4c2a740cd461e39956bb5f98df2aebc60cf32623adbffbcc378fa7250b6a3fc863dadcf6d4f8b855c4e70f0796eee6218445dad2811dd6b540ff52efa2f167dd9c1b8b016268d37db430983fefc0645d20614c8df2eb0872c58e09664e672b0b6a9970fec199257e1c606ec3e364c66a0f4d258c74accd43b987c756d602fd8787fed3aa43fd8d84e9656d4a413fa9a423bc54b873583d6d497005e54712fafc71384988d80134fbf84f53fdd74b354848006b8b5b67e7cc5a472475d3ae545ca1fcf7628b873e31ba83a98a7ad5b0cfbe9711b517a9a1388ad0efa2a3b4e22152021d631b731e2e100a9831111db7acce948bb5deeea260463c140ac929e77c58402776caf85d4569a75dde2f64c4491508afb541ed9b2c81fc95c06706235f383e31cf662c95b1e49cfd94871e22720a41535756e419b271276941692bd023dd9c9dbec4f7db1e5c00d8b3be7b8e826a6aadd001edd0dfeb00f8048442b5c48456fd642e629dcb2ff55592665ff491cd832672ce4d999da186db2c3a1f8b6b1f7d3750d7cdb3097954e6e14fb2183ad662c63d4ce8b82dc2487f0fe2ea2827b53a7c6dcced878d2fb29c1d3ff583570e7bc172d1a5c716e0447cb08ce3c468ffdf975da372f3f3eb455aaf5822bc04a51b6cad24a2331369df81c123b009a2381b42e9aeb077f621608d81c12a5f5c6c295d74afd4dd5c051296be0b54c70bf899b347c36bff62f313079983409d7f9cf1242c917985c1b5d0736fe21f8514f63d0369a374c42da40bd5140bc3e602d00c3cb4f8e621863ab47422778d67d72de34753fd72cef80649a1548e4e8dcbcffe4054cc9d8a1f922623a75904cbdaacde768131e587269a4a99d82f7009c1b8ab79aa232a2fd45ad71b603803123f6ba979fa6a87525884b08d721a21400fb1f950b96ead82f408cc4388d3b78fb456616429a520656d5e5a876fd04748498902c86f58d45f4c1b3919eb846a00edf07e7a830bf723e4774f085f15534dd3b5246c0c0970b5ad7bb39b30b156a9430378c5b0aab1261c78d72ac301cd552d5e8dd4b642ec1dc0672745d593bb26d095b5b23576e3cfd6ab580f6e09419d0f0c64250fafaa3759aa1888da48d89c3f7c9454b0b3d0ab40445f5bed4493ef43ab08f31b1345ac4ffd94ad79c9eee53904ed6f572817153190d2e6863f2e39356bb99926419fd314341a536b7e76cae60bf7750a4c29e3f4c7f005530b1d4ee0e25b93b76fcc1108222f0b00de52cf4100e97adfd7b9db1370586ba27e1e183299be00d0df8439c380edf2f79deb441eac59b814b04accdff5e17f02046139f91f0332661676ff506e575f0cb2850bcc9f8666f6d1f69f8f4271cb804a79fccd7016f049d1a494c26a527c437fa0be6d51ec7543d9bd7a2f016194ebe3c99080a6c9b5119863dfe865f8e60cae29f50b67dbfaa0a3c9794d73034485ca1613344c572783db3dfab01b28089c51cda99cefa4c1c881a29e229f04c7e0fd04dc425ae8417852e6e31520c6207e9d4e35285feef2a2cb8a3bceb08a166fa4284a516362621e2c06731a442791f1db063a32cf1f005c914102c7273cb4d7ab1bf567d72f230783d2ea99c43a60e8729132441ee6c5362c33f9b613f84417c3c5549f4e3d9e73c6f83f16c8e57ae22fe5f54515e111fe43ad7c400d214281452bb6141cecad84b23a695f061988d906d03be5d89584634b9e9d9a9b072f8e7cbb47c47719318a2001cafa665dd2c82672d16877ea115bd023fc1975f7c59664bfb06f66a1a5e3f05cb283fb45ea67a2727ee6e10bf35b31fdd03d43ec67b753f6737e0d2f4a5275031595878cefc8f0ca", 0x600) sendfile(r0, r1, 0x0, 0x1c500) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x4ffe0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='trusted.overlay.upper\x00', &(0x7f0000000500)={0x0, 0xfb, 0x99, 0x4, 0x2, "78077afb8ee8e2c83075e7eb9e2d2f84", "69649301fa63da13c69cac2791776118847bcc7312a897ebed1b9908fefdec406e4f217ad29707d4313c6d546fb9adf0a0b63aab15208c9bf053c6ce27f8f441eb177220bec17cf9ec1dd54bb99903f791800554885f8f7e9a0d99b844259d7f2ea466a750fd68573c764544667fe1c17b69af3481ce0162586f0b5bfe8bbb8fafab0792"}, 0x99, 0x1) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, &(0x7f0000000400)={0x6, &(0x7f00000003c0)=[{}, {}, {}, {}, {}, {}]}) 01:05:34 executing program 3: socketpair(0x0, 0x0, 0x0, &(0x7f0000000000)) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)={0xb, 0x6, 0x209e20, 0x2, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000300), &(0x7f0000000080)}, 0x20) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000000040)={r0, &(0x7f0000000000), &(0x7f0000000140)=""/130}, 0x18) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000000200)={r0, &(0x7f0000000440), &(0x7f0000000540)=""/203}, 0x20) 01:05:34 executing program 1: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x10000000000000, 0x0, 0x5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) recvmsg(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x4, &(0x7f0000002540)=[{0x0}, {0x0}, {&(0x7f0000003800)=""/4100, 0xffffff5f}], 0x3, 0x0, 0x17b, 0x3e8}, 0x180) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[@ANYRESHEX, @ANYRES32, @ANYPTR64=&(0x7f0000000480)=ANY=[@ANYBLOB="dc9d3f74a43a0d71057c1b77e359e891ebc9be6d698388e17f307e9262c2707a6eaf0a3fd080f30c88b7d15df32d79372552e3f6183e7b93e113d30073f4bfcf1f07ce6139d8df7ece1e66bcd28e3d3add076d4074d976da5071d55d742176f715134b6a3306fad5d79f9434aa1020211a2e779e3c719abe102ee4eaa538627d5d779deb9f7f1fc9560f9462692ece7a38628afd934717e3634be1a63985e7f6f82ee38b5e17282790773c0751b02885194fad573cf3fc720667baba8db2afc22f6e335d9f2a24631376c9f4a7752adb998ec54a042fb300"/231, @ANYBLOB="bfc98e8192cb0a9e79f202467c4be532cb8509741d6b35b9087b516de574e75eb6e7707a648644a4648487a557ec9d89ce3c0304e0d899911dc395259c95cc049b413fcc8bb534aee4d921485ca5cf773b0cab00346675446489d0", @ANYPTR64=&(0x7f0000000740)=ANY=[@ANYRES64, @ANYRES64, @ANYRESHEX=0x0, @ANYPTR], @ANYPTR64=&(0x7f0000000440)=ANY=[], @ANYRESHEX=0x0, @ANYRESOCT, @ANYRES64, @ANYRESHEX], @ANYRES64, @ANYRES32, @ANYBLOB, @ANYBLOB="3d483beb6f8ee2ac6416956cf25e7ea9172f6e0c9d5f58cca3f716e5d7b76b9c083a7fc51d4be1dae09bfd7b089056691907d42c4566b4f51dee02492769a2249fc20ace3a92ee4b9fd04167a298ab7256bace21c52f10b1dcaad3f4df3a513a900a2668324e7ca788ddd3439472b01e00141f6394def5a6008414a1f11cac70a6f55541c33c35dd104ed5e3aecc64a96a3b6f54f2adb2c6d5b9580f2a0cfb7b11cde15cef99c9b0721e46e2b626b9926f0bceca144d2073733eddda9f7540e6f4ecd8251b60a93f372daec25c44f4a3935134aae19b8902ab8fc34d182a00000000000000000000000000000000000d784b64e6f3cad072fbe90d18a1e738884ebcf41ba7041903a463eb9b696374a4f7c0623d1467ae89b4ffca7a5ef35434c4c7c0c299b7600f22ff51363527034579471082ed0bd1e165a9e086169ac0d57d05bc629ab8d695646dc2a6e54d37bdacf7ff7e7c509f1e0e2e4dca291d011345def500ef93bba6a1e1db519b79ed6d391f0cb109fd18b62b9ccb48c208e39fdd0a46e60f0a54ba6b8a8bb0db70a19f01dfd5c169bc4169854834a170e70d"], 0x1c9) add_key$keyring(0x0, &(0x7f00000000c0)={'syz', 0x2}, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000495000/0x400000)=nil, 0x404000, 0x15) [ 270.264180][T10276] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 270.334934][T10276] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. 01:05:34 executing program 2: socketpair(0x0, 0x0, 0x0, &(0x7f0000000000)) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)={0xb, 0x6, 0x209e20, 0x2, 0x1}, 0x2c) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = eventfd2(0x0, 0x0) r3 = fcntl$dupfd(r1, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000300), &(0x7f0000000080)}, 0x20) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000000040)={r0, &(0x7f0000000000), &(0x7f0000000140)=""/130}, 0x18) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000200)={r0, &(0x7f0000000440)="bfecfadd68", &(0x7f0000000540)=""/203}, 0x18) 01:05:34 executing program 3: socketpair(0x0, 0x0, 0x0, &(0x7f0000000000)) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)={0xb, 0x6, 0x209e20, 0x2, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000300), &(0x7f0000000080)}, 0x20) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000000040)={r0, &(0x7f0000000000), &(0x7f0000000140)=""/130}, 0x18) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000000200)={r0, &(0x7f0000000440), &(0x7f0000000540)=""/203}, 0x20) [ 270.497433][ T359] attempt to access beyond end of device [ 270.516684][ T359] loop2: rw=1, want=78, limit=63 [ 270.550444][ T359] attempt to access beyond end of device 01:05:34 executing program 4: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000080)={0x1, 0x0, {0x0, 0x0, 0x0, 0x1f, 0xb, 0x80}}) [ 270.600029][ T359] loop2: rw=1, want=79, limit=63 01:05:34 executing program 0: openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f0000001340)=ANY=[@ANYBLOB="726177000000000000000000000000000000000000000000000000000000000002000000030000002004000000000000d0020000d0020000d00200000000000088030000880300008803000088030000880300000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ac00000000000000a002d00200000000000000000000000000000000000000003002627066000000000000000000000000000000000000000000000000000001000003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000011000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090a9cda6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000300053455400000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000b8000000000000000000000000000000000000000000480049444c4554494d45520000000000000000000000000000000000000000000000000073797a300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000980000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000004feffffff"], 0x1) 01:05:34 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000080)={0x0, 0x0, {0x7a000000, 0x0, 0x0, 0x1f, 0x0, 0x80}}) [ 270.634336][ T359] attempt to access beyond end of device [ 270.702740][ T359] loop2: rw=1, want=80, limit=63 [ 270.722094][ T359] attempt to access beyond end of device [ 270.759432][ T359] loop2: rw=1, want=81, limit=63 [ 270.791585][ T359] attempt to access beyond end of device [ 270.816997][ T359] loop2: rw=1, want=130, limit=63 [ 270.821626][T10326] rtc_cmos 00:00: Alarms can be up to one day in the future [ 270.822154][T10322] xt_bpf: check failed: parse error [ 270.852986][ T359] attempt to access beyond end of device [ 270.867421][ T359] loop2: rw=1, want=131, limit=63 [ 270.890724][ T359] attempt to access beyond end of device 01:05:35 executing program 3: socketpair(0x0, 0x0, 0x0, &(0x7f0000000000)) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)={0xb, 0x6, 0x209e20, 0x2, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000300), &(0x7f0000000080)}, 0x20) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000000040)={r0, &(0x7f0000000000), &(0x7f0000000140)=""/130}, 0x18) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000000200)={r0, &(0x7f0000000440), &(0x7f0000000540)=""/203}, 0x20) 01:05:35 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ptype\x00') preadv(r0, &(0x7f00000001c0)=[{&(0x7f00000011c0)=""/116, 0x74}], 0x52, 0xa3) [ 270.922913][ T359] loop2: rw=1, want=132, limit=63 01:05:35 executing program 4: r0 = socket(0x200000000000011, 0x4000000000080002, 0xdd86) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'ip_vti0\x00', 0x0}) bind$packet(r0, &(0x7f0000000040)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @broadcast}, 0x14) sendmmsg$inet(r0, &(0x7f0000002b00)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="96c6322ea684879088175969ec15e10d40e4719016cbc15a36a88c6c843e12b1f5cb6a73613ceec274", 0x33}], 0x1, 0x0, 0x0, 0x534}}], 0x40001c0, 0x0) [ 270.945601][ T359] attempt to access beyond end of device [ 270.971933][ T359] loop2: rw=1, want=133, limit=63 [ 271.000016][ T359] attempt to access beyond end of device [ 271.074086][ T359] loop2: rw=1, want=142, limit=63 [ 271.089568][ T359] attempt to access beyond end of device [ 271.132611][ T359] loop2: rw=1, want=143, limit=63 01:05:35 executing program 0: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = open(0x0, 0x0, 0x44) gettid() timer_create(0x8, 0x0, 0x0) r1 = open(0x0, 0x141042, 0x0) write$binfmt_elf32(0xffffffffffffffff, 0x0, 0x0) dup2(r0, 0xffffffffffffffff) write$FUSE_LSEEK(r1, 0x0, 0x0) setxattr$trusted_overlay_upper(&(0x7f0000000440)='./file1\x00', &(0x7f0000000480)='trusted.overlay.upper\x00', 0x0, 0x0, 0x0) creat(&(0x7f00000004c0)='./file1\x00', 0x105) open(&(0x7f0000000100)='./file1\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffa}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x803, 0x2) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000340)={{{@in=@dev, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x20000}, {}, 0x0, 0x0, 0x80000000000001}, {{@in6=@empty, 0x4d2, 0x3c}, 0x0, @in=@empty, 0x20, 0x4, 0x0, 0x1}}, 0xe8) ppoll(0x0, 0x0, &(0x7f00000005c0), &(0x7f0000000600)={[0x3ff]}, 0x8) sendmmsg(r2, &(0x7f0000008440)=[{{0x0, 0x536, 0x0}}], 0x400000000000107, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000200)='oom_adj\x00') epoll_create1(0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000140)={{{@in6=@mcast2}}, {{@in=@multicast1}, 0x0, @in=@initdev}}, &(0x7f0000000000)=0xe8) 01:05:35 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x0, 0x0, 0xfffffffffffffffd}, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) write(r2, &(0x7f0000000340), 0x41395527) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) ioctl$FS_IOC_GETFLAGS(r3, 0x80086601, 0x0) pipe(&(0x7f0000000000)) socket$packet(0x11, 0x3, 0x300) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB="3000000014000100000000000000000002000000", @ANYRES32, @ANYBLOB="08000800ac14140008000200ac260c7ebc000400e0000002"], 0x30}}, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'batadv0\x00'}) remap_file_pages(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0) r6 = socket(0x40000000002, 0x3, 0x2) setsockopt$inet_int(r6, 0x0, 0x17, &(0x7f0000000000)=0x5, 0x4) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f00000012c0)='syz_tun\x00', 0x10) sendto$unix(r6, 0x0, 0x0, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0x10000e0}, 0x6e) setsockopt$inet_int(r6, 0x0, 0x12, &(0x7f0000000140)=0xffffffff, 0x4) recvmmsg(r6, &(0x7f0000000240)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffec8}}], 0x4000000000002c5, 0x2, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000000)=0x5, 0x4) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x12, &(0x7f0000000140)=0xffffffff, 0x4) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, r7) connect(0xffffffffffffffff, &(0x7f0000000000)=@nfc_llcp={0x27, 0x0, 0x0, 0x5, 0x27, 0xfd, "fc5f1e4bf6361cc12cf476a326c35d79048457a5e3ebfe8ef2c9f1f054ae317c001a65bbad83d05efcaf9e8803b3555ba4bddacf50fb44dae8f7e4dfbcda5a", 0x6}, 0x80) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) r8 = socket(0x11, 0x800000003, 0x0) getsockname$packet(r8, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) socket(0x10, 0x803, 0x0) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r9, 0x6, 0x4000010000000013, &(0x7f0000000040)=0x1, 0x4) connect$inet(r9, &(0x7f0000000080)={0x2, 0x4e21, @loopback}, 0x10) r10 = socket$inet(0x2, 0x80001, 0x0) bind$inet(r10, &(0x7f00000000c0)={0x2, 0x4e21, @multicast2}, 0x10) sendto$inet(r10, &(0x7f0000000200)="f9", 0x1, 0x0, 0x0, 0x0) [ 271.179855][ T359] attempt to access beyond end of device [ 271.237562][ T359] loop2: rw=1, want=144, limit=63 [ 271.262470][ T359] attempt to access beyond end of device [ 271.298071][ T359] loop2: rw=1, want=145, limit=63 01:05:35 executing program 3: socketpair(0x0, 0x0, 0x0, &(0x7f0000000000)) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)={0xb, 0x6, 0x209e20, 0x2, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000300), &(0x7f0000000080)}, 0x20) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000000200)={r0, &(0x7f0000000440), &(0x7f0000000540)=""/203}, 0x20) [ 271.361682][ T359] attempt to access beyond end of device [ 271.376300][ T27] audit: type=1804 audit(1580951135.454:34): pid=10347 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir274349878/syzkaller.0FeOGG/23/file1" dev="sda1" ino=16578 res=1 [ 271.390849][ T359] loop2: rw=1, want=5258, limit=63 [ 271.413378][T10348] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. [ 271.424033][T10348] mmap: syz-executor.5 (10348) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.rst. [ 271.437230][T10348] raw_sendmsg: syz-executor.5 forgot to set AF_INET. Fix it! [ 271.511989][ T27] audit: type=1804 audit(1580951135.504:35): pid=10345 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir274349878/syzkaller.0FeOGG/23/file1" dev="sda1" ino=16578 res=1 01:05:35 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) getsockname$packet(r4, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010000507000200"/20, @ANYRES32=r5, @ANYBLOB="00000016010000001800120008000100736974000c00020008000300", @ANYRES32=r6], 0x38}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=@ipv6_newaddr={0x2c, 0x14, 0x131, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r6}, [@IFA_LOCAL={0x14, 0x2, @remote}]}, 0x2c}}, 0x0) [ 272.136127][ T27] audit: type=1804 audit(1580951136.204:36): pid=10347 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir274349878/syzkaller.0FeOGG/23/file1" dev="sda1" ino=16578 res=1 01:05:36 executing program 2: socketpair(0x0, 0x0, 0x0, &(0x7f0000000000)) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)={0xb, 0x6, 0x209e20, 0x2, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000300), &(0x7f0000000080)}, 0x20) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000000040)={r0, &(0x7f0000000000), &(0x7f0000000140)=""/130}, 0x18) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000200)={r0, &(0x7f0000000440), &(0x7f0000000540)=""/203}, 0x20) 01:05:36 executing program 5: clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000000c0)={@empty, 0x4f}) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000240)=""/80, 0x50}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0xe) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 01:05:36 executing program 4: r0 = socket(0x10, 0x2, 0x0) write(r0, &(0x7f0000000280)="1c0000001a009b8a14e5f4070009042400000000ff00000000000000", 0x1e5) recvmmsg(r0, &(0x7f0000002ec0), 0x400000000000008, 0x0, &(0x7f00000001c0)={0x77359400}) syz_genetlink_get_family_id$batadv(0x0) 01:05:36 executing program 3: socketpair(0x0, 0x0, 0x0, &(0x7f0000000000)) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)={0xb, 0x6, 0x209e20, 0x2, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000300), &(0x7f0000000080)}, 0x20) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000000200)={r0, &(0x7f0000000440), &(0x7f0000000540)=""/203}, 0x20) 01:05:36 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) waitid(0x5, 0x0, &(0x7f00000002c0), 0x0, 0x0) sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) pipe(&(0x7f0000000840)={0xffffffffffffffff, 0xffffffffffffffff}) modify_ldt$write(0x1, &(0x7f00000001c0)={0x3, 0x1800, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x10) write(r1, &(0x7f0000000340), 0x41395527) 01:05:36 executing program 0: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = open(0x0, 0x0, 0x44) gettid() timer_create(0x8, 0x0, 0x0) r1 = open(0x0, 0x141042, 0x0) write$binfmt_elf32(0xffffffffffffffff, 0x0, 0x0) dup2(r0, 0xffffffffffffffff) write$FUSE_LSEEK(r1, 0x0, 0x0) setxattr$trusted_overlay_upper(&(0x7f0000000440)='./file1\x00', &(0x7f0000000480)='trusted.overlay.upper\x00', 0x0, 0x0, 0x0) creat(&(0x7f00000004c0)='./file1\x00', 0x105) open(&(0x7f0000000100)='./file1\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffa}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x803, 0x2) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000340)={{{@in=@dev, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x20000}, {}, 0x0, 0x0, 0x80000000000001}, {{@in6=@empty, 0x4d2, 0x3c}, 0x0, @in=@empty, 0x20, 0x4, 0x0, 0x1}}, 0xe8) ppoll(0x0, 0x0, &(0x7f00000005c0), &(0x7f0000000600)={[0x3ff]}, 0x8) sendmmsg(r2, &(0x7f0000008440)=[{{0x0, 0x536, 0x0}}], 0x400000000000107, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000200)='oom_adj\x00') epoll_create1(0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000140)={{{@in6=@mcast2}}, {{@in=@multicast1}, 0x0, @in=@initdev}}, &(0x7f0000000000)=0xe8) [ 272.361719][T10380] ptrace attach of "/root/syz-executor.5"[10379] was attempted by "/root/syz-executor.5"[10380] 01:05:36 executing program 5: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) gettid() timer_create(0x0, 0x0, 0x0) r0 = open(0x0, 0x141042, 0x0) write$binfmt_elf32(0xffffffffffffffff, 0x0, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) write$FUSE_LSEEK(r0, 0x0, 0x0) setxattr$trusted_overlay_upper(&(0x7f0000000440)='./file1\x00', &(0x7f0000000480)='trusted.overlay.upper\x00', 0x0, 0x0, 0x0) creat(&(0x7f00000004c0)='./file1\x00', 0x105) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x803, 0x2) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) ppoll(0x0, 0x0, &(0x7f00000005c0), 0x0, 0x0) sendmmsg(r1, &(0x7f0000008440)=[{{0x0, 0x536, 0x0}}], 0x400000000000107, 0x0) r2 = syz_open_procfs(0x0, 0x0) epoll_create1(0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000140)={{{@in6=@mcast2}}, {{@in=@multicast1}, 0x0, @in=@initdev}}, &(0x7f0000000000)=0xe8) 01:05:36 executing program 3: socketpair(0x0, 0x0, 0x0, &(0x7f0000000000)) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)={0xb, 0x6, 0x209e20, 0x2, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000300), &(0x7f0000000080)}, 0x20) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000000200)={r0, &(0x7f0000000440), &(0x7f0000000540)=""/203}, 0x20) 01:05:36 executing program 4: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_WKALM_SET(r0, 0x80247008, &(0x7f0000000080)) [ 272.454390][ T27] audit: type=1804 audit(1580951136.534:37): pid=10387 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir274349878/syzkaller.0FeOGG/24/file1" dev="sda1" ino=16591 res=1 01:05:36 executing program 2: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x100000008d}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) socket$inet6(0xa, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x20401, 0x0) write$binfmt_aout(r0, &(0x7f00000000c0)=ANY=[], 0xffffff78) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000200)) r1 = syz_open_pts(r0, 0x0) readv(r1, &(0x7f00000001c0)=[{&(0x7f0000000940)=""/4096, 0x1000}], 0x3c) ioctl$TCSETSW(r1, 0x5403, &(0x7f0000000000)) 01:05:36 executing program 3: socketpair(0x0, 0x0, 0x0, &(0x7f0000000000)) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)={0xb, 0x6, 0x209e20, 0x2, 0x1}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000000040)={r0, &(0x7f0000000000), &(0x7f0000000140)=""/130}, 0x18) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000000200)={r0, &(0x7f0000000440), &(0x7f0000000540)=""/203}, 0x20) 01:05:36 executing program 4: r0 = fsopen(&(0x7f0000000000)='cgroup\x00', 0x0) fsconfig$FSCONFIG_SET_FD(r0, 0x3, 0x0, 0x0, 0xffffffffffffffff) 01:05:37 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ptype\x00') preadv(r0, &(0x7f00000001c0)=[{&(0x7f00000011c0)=""/116, 0x74}], 0x52, 0x74) 01:05:37 executing program 4: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000080)={0x1, 0x0, {0x0, 0x0, 0x0, 0x1f, 0x6, 0x80}}) 01:05:37 executing program 3: socketpair(0x0, 0x0, 0x0, &(0x7f0000000000)) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)={0xb, 0x6, 0x209e20, 0x2, 0x1}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000000040)={r0, &(0x7f0000000000), &(0x7f0000000140)=""/130}, 0x18) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000000200)={r0, &(0x7f0000000440), &(0x7f0000000540)=""/203}, 0x20) [ 273.406850][T10430] rtc_cmos 00:00: Alarms can be up to one day in the future 01:05:37 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x100000000011, 0x2, 0x0) bind(r1, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=@ipv6_getroute={0x24, 0x1a, 0x1, 0x0, 0x0, {}, [@RTA_IIF={0x8, 0x3, r2}]}, 0x24}}, 0x0) 01:05:37 executing program 4: r0 = socket(0x200000000000011, 0x4000000000080002, 0xdd86) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'ip_vti0\x00', 0x0}) bind$packet(r0, &(0x7f0000000040)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @broadcast}, 0x14) bind(0xffffffffffffffff, &(0x7f0000000080)=@generic={0x0, "000001000000000008fc9d71fc00000000000000f8ffff002e0b3836005404b0d6301a4ce875f2e3ff5f163ee340b76795008000f8000000000104003c5811039e15775027ecce66fd792bbf0e5bf5ff9b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ff42c65400"}, 0x80) sendmmsg$inet(r0, &(0x7f0000002b00)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="96c6322ea684879088175969ec15e10d40e4719016cbc15a36a88c6c843e12b1f5cb6a73613ceec274", 0x33}], 0x1, 0x0, 0x0, 0x534}}], 0x40001c0, 0x0) 01:05:37 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x100000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x41395527) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x20401, 0x0) write$binfmt_aout(r2, &(0x7f00000000c0)=ANY=[], 0xffffff78) ioctl$TCSETS(r2, 0x40045431, &(0x7f0000000200)) r3 = syz_open_pts(r2, 0x0) readv(r3, &(0x7f00000001c0)=[{&(0x7f0000000940)=""/4096, 0x1000}], 0x3c) ioctl$TCSETSW(0xffffffffffffffff, 0x5403, 0x0) ioctl$TIOCGPGRP(r3, 0x540f, 0x0) prlimit64(0x0, 0x0, 0x0, &(0x7f0000000180)) 01:05:37 executing program 3: socketpair(0x0, 0x0, 0x0, &(0x7f0000000000)) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)={0xb, 0x6, 0x209e20, 0x2, 0x1}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000000040)={r0, &(0x7f0000000000), &(0x7f0000000140)=""/130}, 0x18) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000000200)={r0, &(0x7f0000000440), &(0x7f0000000540)=""/203}, 0x20) 01:05:37 executing program 1: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) open(0x0, 0x141042, 0x0) write$binfmt_elf32(0xffffffffffffffff, 0x0, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) setxattr$trusted_overlay_upper(0x0, &(0x7f0000000480)='trusted.overlay.upper\x00', 0x0, 0x0, 0x0) creat(&(0x7f00000004c0)='./file1\x00', 0x105) open(&(0x7f0000000100)='./file1\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffa}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x803, 0x2) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmmsg(r0, &(0x7f0000008440)=[{{0x0, 0x536, 0x0}}], 0x400000000000107, 0x0) r1 = syz_open_procfs(0x0, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000140)={{{@in6=@mcast2}}, {{@in=@multicast1}, 0x0, @in=@initdev}}, &(0x7f0000000000)=0xe8) 01:05:37 executing program 2: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x3}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff}) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r3 = open(&(0x7f0000000240)='./file0\x00', 0x880, 0x24) fchdir(r3) r4 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r4, 0x800) lseek(r4, 0x0, 0x2) r5 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r4, r5, 0x0, 0x280900) 01:05:37 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = creat(&(0x7f0000000280)='./file0\x00', 0x0) fallocate(r2, 0x0, 0x0, 0x2000402) fallocate(r1, 0x0, 0x0, 0x110001) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000040)={0x0, r2}) lseek(r0, 0x0, 0x4) 01:05:38 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x100000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) socket$inet6(0xa, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) process_vm_readv(r0, &(0x7f0000005f40)=[{&(0x7f0000003f40)=""/4096, 0x1000}, {&(0x7f0000004f40)=""/4096, 0x1000}], 0x2, &(0x7f0000005f80), 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) write(r2, &(0x7f0000000340), 0x41395527) vmsplice(r1, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1}, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_mount_image$ext4(0x0, 0x0, 0x7, 0x1, &(0x7f00000007c0)=[{&(0x7f0000000680)="62f23e748cdfecc0d3bcb88248f9f8f8e8ba030000000000001dcdc6041c8d8a0957939950c15c7ac6360c7820e1d5957ba4167f17600b58767db91e29eb92a20f86dddfb0f8dda322d3ddeadba924051c7894f228f090746b1a55e851e7dcaae4d8411f6806d216b4f2e7eca231a30142ee9bb4bb5598a94336a99790d3b77dcda45483c1fb1194c56ddfddb587442754e6c815", 0xfffffd92, 0xb6}], 0x80000, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)=ANY=[@ANYBLOB="6c000002000000240002801400018008000100ffffffff08000200ac1414000c0002800500010000000000300003802c00018014000300fe88000000000000000000000000000114000400000000000000000000000000000000010400018000"/108], 0x6c}}, 0x0) clock_gettime(0x0, &(0x7f0000003ec0)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f00000000c0)=""/61, 0x3d}, {&(0x7f0000000100)=""/216, 0xd8}, {&(0x7f00000002c0)=""/193, 0xc1}, {&(0x7f00000003c0)=""/70, 0x46}, {&(0x7f0000000800)=""/4096, 0x1000}], 0x5, &(0x7f00000005c0)=""/184, 0xb8}, 0x2}, {{&(0x7f0000000740)=@in={0x2, 0x0, @remote}, 0x80, &(0x7f0000001800)=[{&(0x7f0000000240)=""/54, 0x36}], 0x1, &(0x7f0000001840)=""/52, 0x34}, 0x80000000}, {{&(0x7f0000001880)=@nfc_llcp, 0x80, &(0x7f0000002d00)=[{&(0x7f0000001900)=""/4096, 0x1000}, {&(0x7f0000002900)=""/144, 0x90}, {&(0x7f00000029c0)=""/225, 0xe1}, {&(0x7f0000002ac0)=""/21, 0x15}, {&(0x7f0000002c00)=""/250, 0xfa}], 0x5, &(0x7f0000002d80)=""/9, 0x9}, 0x62}, {{&(0x7f0000002dc0)=@can, 0x80, &(0x7f0000002f00)=[{&(0x7f0000002e40)=""/157, 0x9d}], 0x1}, 0xfffeffff}, {{&(0x7f0000002f40)=@can, 0x80, &(0x7f0000003340)=[{&(0x7f0000002fc0)=""/156, 0x9c}, {&(0x7f0000003080)=""/176, 0xb0}, {&(0x7f0000003140)=""/223, 0xdf}, {&(0x7f0000003240)=""/167, 0xa7}, {&(0x7f0000003300)=""/36, 0x24}], 0x5}}, {{&(0x7f00000033c0), 0x80, &(0x7f0000003800)=[{&(0x7f0000003440)=""/108, 0x6c}, {&(0x7f00000034c0)=""/93, 0x5d}, {&(0x7f0000003540)=""/243, 0xf3}, {&(0x7f0000003640)=""/18, 0x12}, {&(0x7f0000003680)=""/250, 0xfa}, {&(0x7f0000003780)=""/25, 0x19}, {&(0x7f00000037c0)=""/27, 0x1b}], 0x7, &(0x7f0000003880)=""/217, 0xd9}, 0x80000001}, {{0x0, 0x0, &(0x7f00000039c0)=[{&(0x7f0000003980)=""/31, 0x1f}], 0x1, 0xfffffffffffffffd}, 0x8}, {{&(0x7f0000003a00)=@llc, 0x80, &(0x7f0000003c40)=[{&(0x7f0000003a80)=""/243, 0xf3}, {&(0x7f0000003b80)=""/109, 0x6d}, {&(0x7f0000003c00)=""/16, 0x10}], 0x3, &(0x7f0000003c80)=""/28, 0x1c}, 0x80}], 0x8, 0x40000000, &(0x7f0000003f00)={r4, r5+30000000}) [ 274.051180][ T27] audit: type=1804 audit(1580951138.124:38): pid=10463 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir442597207/syzkaller.oC9naW/19/file1" dev="sda1" ino=16583 res=1 01:05:38 executing program 3: socketpair(0x0, 0x0, 0x0, &(0x7f0000000000)) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={0xffffffffffffffff, &(0x7f0000000300), &(0x7f0000000080)}, 0x20) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000140)=""/130}, 0x18) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000000200)={0xffffffffffffffff, &(0x7f0000000440), &(0x7f0000000540)=""/203}, 0x20) [ 274.236690][ T27] audit: type=1804 audit(1580951138.314:39): pid=10471 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir376885900/syzkaller.fRdopr/19/file0/bus" dev="loop2" ino=27 res=1 01:05:38 executing program 0: r0 = socket$inet(0x2, 0x8000000003, 0x2f) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000400)='ip_vti0\x00', 0x10) r1 = fcntl$dupfd(r0, 0x0, r0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) connect$inet(r1, &(0x7f0000000000)={0x2, 0x0, @initdev}, 0x10) write$P9_RAUTH(r1, 0x0, 0x0) 01:05:38 executing program 3: socketpair(0x0, 0x0, 0x0, &(0x7f0000000000)) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={0xffffffffffffffff, &(0x7f0000000300), &(0x7f0000000080)}, 0x20) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000140)=""/130}, 0x18) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000000200)={0xffffffffffffffff, &(0x7f0000000440), &(0x7f0000000540)=""/203}, 0x20) [ 274.831724][ T27] audit: type=1804 audit(1580951138.904:40): pid=10466 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir442597207/syzkaller.oC9naW/19/file1" dev="sda1" ino=16583 res=1 01:05:39 executing program 1: pipe(0x0) socket$vsock_stream(0x28, 0x1, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, 0x0, 0x0) socket(0x25, 0x0, 0x0) connect$rxrpc(0xffffffffffffffff, 0x0, 0x0) getpid() socket$rds(0x15, 0x5, 0x0) readv(0xffffffffffffffff, 0x0, 0x0) close(0xffffffffffffffff) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f00000001c0), 0x0) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000000100)={r0, 0x80000001}, 0x0) r1 = socket$rds(0x15, 0x5, 0x0) r2 = io_uring_setup(0xa2, &(0x7f0000000080)) io_uring_register$IORING_REGISTER_FILES(r2, 0x2, &(0x7f0000000280)=[r1], 0x14) write$evdev(0xffffffffffffffff, 0x0, 0x0) [ 274.958161][ T27] audit: type=1804 audit(1580951138.984:41): pid=10491 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir376885900/syzkaller.fRdopr/19/file0/bus" dev="loop2" ino=27 res=1 01:05:39 executing program 0: mount(0x0, 0x0, 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, 0x0, 0x0) connect$rxrpc(0xffffffffffffffff, 0x0, 0x0) readv(0xffffffffffffffff, 0x0, 0x0) close(0xffffffffffffffff) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000001a00)=@assoc_value, 0x0) r0 = io_uring_setup(0xa2, &(0x7f0000000080)) io_uring_register$IORING_REGISTER_FILES(r0, 0x2, &(0x7f0000000280)=[0xffffffffffffffff], 0x1) write$evdev(0xffffffffffffffff, 0x0, 0x0) 01:05:39 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000480)=ANY=[@ANYBLOB="4400000010001fff00"/20, @ANYRES32=0x0, @ANYBLOB="00110400040405001c0012000c0001007866726d000000000c000200080002000300000008000a006315f776d7e2", @ANYRES32, @ANYBLOB="4b8030255e42ead0a303d1588726cbe91430a5fd1e5eae3bfc774dc24efff17aa3fb4966d1361530dc728c04e91d2a12f210cee7f3cd71b269f35f75ec95d7a34dd6005cb83c0640570738335c2eeceefe4d06ae2d5bdb53fe604803f199f74c29dee7733f6a36e46f1c61e8fc1bcb3ee7d1ba40329ae33ce5f587a1b6b15fa15aeb47be63ce75b9382f"], 0x44}}, 0x0) [ 275.111654][ T27] audit: type=1800 audit(1580951138.984:42): pid=10494 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.2" name="bus" dev="loop2" ino=27 res=0 01:05:39 executing program 3: socketpair(0x0, 0x0, 0x0, &(0x7f0000000000)) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={0xffffffffffffffff, &(0x7f0000000300), &(0x7f0000000080)}, 0x20) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000140)=""/130}, 0x18) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000000200)={0xffffffffffffffff, &(0x7f0000000440), &(0x7f0000000540)=""/203}, 0x20) 01:05:39 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = creat(&(0x7f0000000280)='./file0\x00', 0x0) fallocate(r2, 0x0, 0x0, 0x2000402) fallocate(r1, 0x0, 0x0, 0x110001) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000040)={0x0, r2}) lseek(r0, 0x0, 0x4) 01:05:39 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x100000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x41395527) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x20401, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f0000000200)) r3 = syz_open_pts(r2, 0x0) readv(r3, &(0x7f00000001c0)=[{&(0x7f0000000940)=""/4096, 0x1000}], 0x3c) ioctl$TCSETSW(r3, 0x5403, &(0x7f0000000000)) 01:05:39 executing program 3: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)={0xb, 0x6, 0x209e20, 0x2, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000300), &(0x7f0000000080)}, 0x20) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000000040)={r0, &(0x7f0000000000), &(0x7f0000000140)=""/130}, 0x18) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000000200)={r0, &(0x7f0000000440), &(0x7f0000000540)=""/203}, 0x20) [ 275.434174][T10506] ------------[ cut here ]------------ [ 275.439789][T10506] ODEBUG: free active (active state 0) object type: work_struct hint: io_ring_file_ref_switch+0x0/0xac0 [ 275.450365][T10504] ------------[ cut here ]------------ [ 275.451423][T10506] WARNING: CPU: 1 PID: 10506 at lib/debugobjects.c:481 debug_print_object+0x168/0x250 [ 275.456508][T10504] ODEBUG: free active (active state 0) object type: work_struct hint: io_ring_file_ref_switch+0x0/0xac0 [ 275.466043][T10506] Kernel panic - not syncing: panic_on_warn set ... [ 275.477560][T10504] WARNING: CPU: 0 PID: 10504 at lib/debugobjects.c:481 debug_print_object+0x168/0x250 [ 275.483769][T10506] CPU: 1 PID: 10506 Comm: syz-executor.0 Not tainted 5.5.0-rc6-next-20200116-syzkaller #0 [ 275.493315][T10504] Modules linked in: [ 275.503212][T10506] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 275.503225][T10506] Call Trace: [ 275.507148][T10504] CPU: 0 PID: 10504 Comm: syz-executor.1 Not tainted 5.5.0-rc6-next-20200116-syzkaller #0 [ 275.517477][T10506] dump_stack+0x197/0x210 [ 275.520606][T10504] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 275.530515][T10506] ? debug_print_object+0x100/0x250 [ 275.534849][T10504] RIP: 0010:debug_print_object+0x168/0x250 [ 275.545102][T10506] panic+0x2e3/0x75c [ 275.550233][T10504] Code: dd 00 d4 91 88 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 b5 00 00 00 48 8b 14 dd 00 d4 91 88 48 c7 c7 60 c9 91 88 e8 57 9c a1 fd <0f> 0b 83 05 e3 13 01 07 01 48 83 c4 20 5b 41 5c 41 5d 41 5e 5d c3 [ 275.556168][T10506] ? add_taint.cold+0x16/0x16 [ 275.560043][T10504] RSP: 0018:ffffc900070afc30 EFLAGS: 00010082 [ 275.579754][T10506] ? __kasan_check_write+0x14/0x20 [ 275.584328][T10504] RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000 [ 275.590507][T10506] ? __warn.cold+0x14/0x3e [ 275.595609][T10504] RDX: 0000000000000000 RSI: ffffffff815eb7c6 RDI: fffff52000e15f78 [ 275.595626][T10504] RBP: ffffc900070afc70 R08: ffff88809382c1c0 R09: ffffed1015d045c9 [ 275.603618][T10506] ? __warn+0xd9/0x1cf [ 275.608006][T10504] R10: ffffed1015d045c8 R11: ffff8880ae822e43 R12: 0000000000000002 [ 275.615999][T10506] ? debug_print_object+0x168/0x250 [ 275.623978][T10504] R13: ffffffff89b7e460 R14: ffffffff814c81f0 R15: ffff8880a4450188 [ 275.628052][T10506] __warn.cold+0x2f/0x3e [ 275.636018][T10504] FS: 0000000000c40940(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 [ 275.641219][T10506] ? debug_print_object+0x168/0x250 [ 275.649179][T10504] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 275.649197][T10504] CR2: 000000000176cfd0 CR3: 0000000094f4d000 CR4: 00000000001406f0 [ 275.653479][T10506] report_bug+0x289/0x300 [ 275.662408][T10504] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 275.667719][T10506] do_error_trap+0x11b/0x200 [ 275.674209][T10504] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 275.682207][T10506] do_invalid_op+0x37/0x50 [ 275.686520][T10504] Call Trace: [ 275.694742][T10506] ? debug_print_object+0x168/0x250 [ 275.699320][T10504] debug_check_no_obj_freed+0x2d4/0x43f [ 275.707380][T10506] invalid_op+0x23/0x30 [ 275.711816][T10504] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 275.715025][T10506] RIP: 0010:debug_print_object+0x168/0x250 [ 275.720224][T10504] kfree+0xf8/0x2c0 [ 275.725767][T10506] Code: dd 00 d4 91 88 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 b5 00 00 00 48 8b 14 dd 00 d4 91 88 48 c7 c7 60 c9 91 88 e8 57 9c a1 fd <0f> 0b 83 05 e3 13 01 07 01 48 83 c4 20 5b 41 5c 41 5d 41 5e 5d c3 [ 275.729917][T10504] io_sqe_files_unregister+0x3b1/0x6c0 [ 275.735457][T10506] RSP: 0018:ffffc9000688fc30 EFLAGS: 00010082 [ 275.741299][T10504] io_ring_ctx_wait_and_kill+0x430/0x9a0 [ 275.745093][T10506] RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000 [ 275.764896][T10504] ? __sanitizer_cov_trace_cmp8+0x10/0x20 [ 275.770271][T10506] RDX: 0000000000000000 RSI: ffffffff815eb7c6 RDI: fffff52000d11f78 [ 275.770287][T10506] RBP: ffffc9000688fc70 R08: ffff8880942b0380 R09: ffffed1015d245c9 [ 275.776393][T10504] io_uring_release+0x42/0x50 [ 275.782005][T10506] R10: ffffed1015d245c8 R11: ffff8880ae922e43 R12: 0000000000000001 [ 275.790175][T10504] __fput+0x2ff/0x890 [ 275.795810][T10506] R13: ffffffff89b7e460 R14: ffffffff814c81f0 R15: ffff88809e762070 [ 275.795908][T10506] ? __exit_umh+0x2e0/0x2e0 [ 275.803938][T10504] ? io_ring_ctx_wait_and_kill+0x9a0/0x9a0 [ 275.812318][T10506] ? vprintk_func+0x86/0x189 [ 275.816886][T10504] ____fput+0x16/0x20 [ 275.824894][T10506] debug_check_no_obj_freed+0x2d4/0x43f [ 275.828952][T10504] task_work_run+0x145/0x1c0 [ 275.836825][T10506] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 275.841358][T10504] exit_to_usermode_loop+0x316/0x380 [ 275.847094][T10506] kfree+0xf8/0x2c0 [ 275.851667][T10504] do_syscall_64+0x676/0x790 [ 275.855633][T10506] io_sqe_files_unregister+0x3b1/0x6c0 [ 275.861198][T10504] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 275.865784][T10506] io_ring_ctx_wait_and_kill+0x430/0x9a0 [ 275.871335][T10504] RIP: 0033:0x414f31 [ 275.876640][T10506] ? __sanitizer_cov_trace_cmp8+0x10/0x20 [ 275.880450][T10504] Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 04 1b 00 00 c3 48 83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 275.885026][T10506] io_uring_release+0x42/0x50 [ 275.890448][T10504] RSP: 002b:00007ffcf25901e0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 [ 275.896358][T10506] __fput+0x2ff/0x890 [ 275.901997][T10504] RAX: 0000000000000000 RBX: 0000000000000008 RCX: 0000000000414f31 [ 275.902013][T10504] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000007 [ 275.905920][T10506] ? io_ring_ctx_wait_and_kill+0x9a0/0x9a0 [ 275.911600][T10504] RBP: 0000000000000001 R08: 00000000f7cdcd26 R09: 00000000f7cdcd2a [ 275.931212][T10506] ____fput+0x16/0x20 [ 275.935867][T10504] R10: 00007ffcf25902c0 R11: 0000000000000293 R12: 000000000075c9a0 [ 275.944371][T10506] task_work_run+0x145/0x1c0 [ 275.948315][T10504] R13: 000000000075c9a0 R14: 00000000007614f0 R15: 000000000075bfd4 [ 275.948340][T10504] irq event stamp: 2862 [ 275.956295][T10506] exit_to_usermode_loop+0x316/0x380 [ 275.964246][T10504] hardirqs last enabled at (2861): [] kfree+0x226/0x2c0 [ 275.964264][T10504] hardirqs last disabled at (2862): [] kfree+0x73/0x2c0 [ 275.970052][T10506] do_syscall_64+0x676/0x790 [ 275.978136][T10504] softirqs last enabled at (2738): [] rds_release+0x27c/0x430 [ 275.981975][T10506] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 275.989927][T10504] softirqs last disabled at (2736): [] rds_release+0x15c/0x430 [ 275.994494][T10506] RIP: 0033:0x414f31 [ 276.002441][T10504] ---[ end trace b12f29dfd53ae8f9 ]--- [ 276.006597][T10506] Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 04 1b 00 00 c3 48 83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 276.086797][T10506] RSP: 002b:00007ffc0219f830 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 [ 276.095218][T10506] RAX: 0000000000000000 RBX: 0000000000000004 RCX: 0000000000414f31 [ 276.103213][T10506] RDX: 0000001b30c20000 RSI: 0000000000000000 RDI: 0000000000000003 [ 276.111208][T10506] RBP: 0000000000000001 R08: 00000000f7cdcd26 R09: 00000000f7cdcd2a [ 276.119199][T10506] R10: 00007ffc0219f910 R11: 0000000000000293 R12: 000000000075bf20 [ 276.127187][T10506] R13: 0000000000043394 R14: 0000000000760948 R15: 000000000075bf2c [ 276.136843][T10506] Kernel Offset: disabled [ 276.141290][T10506] Rebooting in 86400 seconds..