[info] Using makefile-style concurrent boot in runlevel 2. [ 42.357750][ T26] audit: type=1800 audit(1576052537.421:21): pid=7440 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="bootlogs" dev="sda1" ino=2452 res=0 [ 42.387675][ T26] audit: type=1800 audit(1576052537.421:22): pid=7440 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="motd" dev="sda1" ino=2480 res=0 [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.28' (ECDSA) to the list of known hosts. 2019/12/11 08:22:30 fuzzer started 2019/12/11 08:22:32 dialing manager at 10.128.0.105:37821 2019/12/11 08:22:32 syscalls: 2689 2019/12/11 08:22:32 code coverage: enabled 2019/12/11 08:22:32 comparison tracing: enabled 2019/12/11 08:22:32 extra coverage: extra coverage is not supported by the kernel 2019/12/11 08:22:32 setuid sandbox: enabled 2019/12/11 08:22:32 namespace sandbox: enabled 2019/12/11 08:22:32 Android sandbox: /sys/fs/selinux/policy does not exist 2019/12/11 08:22:32 fault injection: enabled 2019/12/11 08:22:32 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/12/11 08:22:32 net packet injection: enabled 2019/12/11 08:22:32 net device setup: enabled 2019/12/11 08:22:32 concurrency sanitizer: enabled 2019/12/11 08:22:32 devlink PCI setup: PCI device 0000:00:10.0 is not available 2019/12/11 08:22:44 adding functions to KCSAN blacklist: 'list_lru_count_one' 'sit_tunnel_xmit' 'n_tty_receive_buf_common' 'ktime_get_real_seconds' 'do_signal_stop' 'blk_mq_get_request' 'css_set_move_task' 'exit_signals' 'inactive_list_is_low' '__add_to_page_cache_locked' 'generic_file_read_iter' 'pipe_wait' '__snd_rawmidi_transmit_ack' 'mem_cgroup_select_victim_node' 'ext4_mb_find_by_goal' 'fat_time_unix2fat' 'lo_ioctl' 'lruvec_lru_size' 'ext4_has_free_clusters' 'futex_wait_queue_me' 'blk_mq_dispatch_rq_list' '__delete_from_page_cache' '__skb_try_recv_from_queue' 'commit_echoes' 'find_get_pages_range_tag' 'tick_nohz_idle_stop_tick' 'audit_log_start' 'ext4_free_inodes_count' 'wbt_issue' '__dev_queue_xmit' 'do_syslog' 'run_timer_softirq' 'tick_sched_do_timer' 'evict' 'ext4_mark_iloc_dirty' 'tomoyo_supervisor' 'vm_area_dup' 'do_nanosleep' 'wbt_done' '__mark_inode_dirty' '__x64_sys_ptrace' 'ext4_nonda_switch' 'kauditd_thread' 'icmp_global_allow' 'rcu_gp_fqs_check_wake' 'pid_update_inode' 'tomoyo_check_acl' 'taskstats_exit' 'tcp_add_backlog' 'pipe_poll' '__ext4_new_inode' 'copy_process' 'wbt_wait' 'ext4_mb_good_group' 'xas_find_marked' 'timer_clear_idle' 'process_srcu' 'bio_endio' 'add_timer_on' 'blk_mq_sched_dispatch_requests' '__hrtimer_run_queues' 'generic_fillattr' 'yama_ptracer_del' 'page_counter_try_charge' 'xas_clear_mark' 'pcpu_alloc' 'mmap_region' 'tick_do_update_jiffies64' '__perf_event_overflow' 'snd_seq_check_queue' 'generic_write_end' 'dd_has_work' 'add_timer' 'echo_char' 'ktime_get_seconds' 'find_next_bit' 'ep_poll' 'mm_update_next_owner' 'common_perm_cond' 'rcu_gp_fqs_loop' 'handle_abnormal_pfn' 'fat12_ent_put' 'relay_switch_subbuf' 'ext4_free_inode' 'poll_schedule_timeout' 'mod_timer' syzkaller login: [ 69.411127][ T7603] KCSAN: could not find function: 'poll_schedule_timeout' 08:26:19 executing program 0: [ 284.814149][ T7607] IPVS: ftp: loaded support on port[0] = 21 08:26:19 executing program 1: [ 284.886447][ T7607] chnl_net:caif_netlink_parms(): no params data found [ 284.951025][ T7607] bridge0: port 1(bridge_slave_0) entered blocking state [ 284.969462][ T7607] bridge0: port 1(bridge_slave_0) entered disabled state [ 284.977210][ T7607] device bridge_slave_0 entered promiscuous mode [ 285.000510][ T7607] bridge0: port 2(bridge_slave_1) entered blocking state [ 285.007658][ T7607] bridge0: port 2(bridge_slave_1) entered disabled state [ 285.015733][ T7607] device bridge_slave_1 entered promiscuous mode [ 285.032870][ T7610] IPVS: ftp: loaded support on port[0] = 21 [ 285.045957][ T7607] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 285.069226][ T7607] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 285.102930][ T7607] team0: Port device team_slave_0 added [ 285.119171][ T7607] team0: Port device team_slave_1 added 08:26:20 executing program 2: [ 285.222090][ T7607] device hsr_slave_0 entered promiscuous mode [ 285.250246][ T7607] device hsr_slave_1 entered promiscuous mode [ 285.299153][ T7610] chnl_net:caif_netlink_parms(): no params data found [ 285.319675][ T7613] IPVS: ftp: loaded support on port[0] = 21 [ 285.404201][ T7607] bridge0: port 2(bridge_slave_1) entered blocking state [ 285.411357][ T7607] bridge0: port 2(bridge_slave_1) entered forwarding state [ 285.418752][ T7607] bridge0: port 1(bridge_slave_0) entered blocking state [ 285.426008][ T7607] bridge0: port 1(bridge_slave_0) entered forwarding state 08:26:20 executing program 3: [ 285.517580][ T7610] bridge0: port 1(bridge_slave_0) entered blocking state [ 285.532142][ T7610] bridge0: port 1(bridge_slave_0) entered disabled state [ 285.555836][ T7610] device bridge_slave_0 entered promiscuous mode [ 285.595194][ T7610] bridge0: port 2(bridge_slave_1) entered blocking state [ 285.620940][ T7610] bridge0: port 2(bridge_slave_1) entered disabled state [ 285.650546][ T7610] device bridge_slave_1 entered promiscuous mode [ 285.751522][ T7607] 8021q: adding VLAN 0 to HW filter on device bond0 [ 285.773118][ T7610] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 285.814319][ T7613] chnl_net:caif_netlink_parms(): no params data found [ 285.830336][ T7607] 8021q: adding VLAN 0 to HW filter on device team0 [ 285.838441][ T7610] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 285.869797][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 285.878320][ T17] bridge0: port 1(bridge_slave_0) entered disabled state [ 285.940931][ T17] bridge0: port 2(bridge_slave_1) entered disabled state [ 285.960770][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 286.031534][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 286.040756][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 286.070060][ T17] bridge0: port 1(bridge_slave_0) entered blocking state [ 286.077208][ T17] bridge0: port 1(bridge_slave_0) entered forwarding state [ 286.109971][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 286.141560][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 286.171305][ T17] bridge0: port 2(bridge_slave_1) entered blocking state [ 286.178371][ T17] bridge0: port 2(bridge_slave_1) entered forwarding state [ 286.230183][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 286.242282][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 286.270754][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 286.310258][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 286.354578][ T7641] IPVS: ftp: loaded support on port[0] = 21 [ 286.368761][ T7607] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 286.409434][ T7607] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network 08:26:21 executing program 4: [ 286.462113][ T7610] team0: Port device team_slave_0 added [ 286.471832][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 286.480856][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 286.531685][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 286.560145][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 286.600336][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 286.631543][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 286.660179][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 286.715703][ T7610] team0: Port device team_slave_1 added [ 286.730768][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 286.759783][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 286.767198][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 286.806883][ T7613] bridge0: port 1(bridge_slave_0) entered blocking state [ 286.819472][ T7613] bridge0: port 1(bridge_slave_0) entered disabled state [ 286.846233][ T7613] device bridge_slave_0 entered promiscuous mode [ 286.867694][ T7607] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 286.901683][ T7613] bridge0: port 2(bridge_slave_1) entered blocking state [ 286.908790][ T7613] bridge0: port 2(bridge_slave_1) entered disabled state [ 286.918794][ T7613] device bridge_slave_1 entered promiscuous mode 08:26:22 executing program 5: [ 287.001892][ T7610] device hsr_slave_0 entered promiscuous mode [ 287.050928][ T7610] device hsr_slave_1 entered promiscuous mode [ 287.089515][ T7610] debugfs: Directory 'hsr0' with parent '/' already present! [ 287.112353][ T7613] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 287.112826][ T7651] IPVS: ftp: loaded support on port[0] = 21 [ 287.122873][ T7613] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 287.149585][ T7655] IPVS: ftp: loaded support on port[0] = 21 [ 287.292561][ T7613] team0: Port device team_slave_0 added [ 287.442164][ T7613] team0: Port device team_slave_1 added [ 287.497008][ T7610] 8021q: adding VLAN 0 to HW filter on device bond0 [ 287.581961][ T7641] chnl_net:caif_netlink_parms(): no params data found [ 287.627452][ T7610] 8021q: adding VLAN 0 to HW filter on device team0 [ 287.692125][ T7613] device hsr_slave_0 entered promiscuous mode [ 287.719657][ T7613] device hsr_slave_1 entered promiscuous mode [ 287.749782][ T7613] debugfs: Directory 'hsr0' with parent '/' already present! [ 287.779768][ T3018] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 287.787463][ T3018] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 287.876444][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 287.893381][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready 08:26:23 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41ba, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x88) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r0, r1, 0x0, 0xedc0) [ 287.926258][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 287.933425][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 288.010243][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 288.018954][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 288.065221][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 288.072352][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 288.130064][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready 08:26:23 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000100)={0x750, {0x2, 0x0, @dev}, {0x2, 0x0, @dev}, {0x2, 0x0, @broadcast}, 0x0, 0x4000000000, 0x80000000000, 0xfffffffffffffffe}) [ 288.263479][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 288.290478][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 288.304423][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 288.336506][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 288.398176][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 288.448086][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 288.490306][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 288.522322][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 288.566660][ T7655] chnl_net:caif_netlink_parms(): no params data found [ 288.589316][ T7641] bridge0: port 1(bridge_slave_0) entered blocking state [ 288.604162][ T7641] bridge0: port 1(bridge_slave_0) entered disabled state [ 288.641720][ T7641] device bridge_slave_0 entered promiscuous mode [ 288.680171][ T7610] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 288.718227][ T7610] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 288.768967][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready 08:26:23 executing program 0: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000001200)=""/148, 0x94}], 0x100001c9, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='net/mcfilter\x00') preadv(r0, &(0x7f0000000480), 0x100000000000016a, 0x10400003) [ 288.812475][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 288.851974][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 288.887256][ T7641] bridge0: port 2(bridge_slave_1) entered blocking state [ 288.920037][ T7641] bridge0: port 2(bridge_slave_1) entered disabled state [ 288.962251][ T7641] device bridge_slave_1 entered promiscuous mode [ 288.990104][ T7651] chnl_net:caif_netlink_parms(): no params data found [ 289.043261][ T7623] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 289.065331][ T7623] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready 08:26:24 executing program 0: msgget(0x1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='/gro<#\xfbW\xe6\xc6\x0f\x1fKE\xb7M\x99\x9a\x9a\x8c,\xe1[.\xf6\x18\xa4\xcb:\x9c\xd1-\xce\xa4@\xd8\x99\xc2,e+\x8d\xed\xa6\\\x1c\xc3\x97\x94\xf6\xe0.+\xe3\x89\xde\x139E\xa3\x85\xbd\x81\xe9\xbd\xee\xee\x03\x00\x00\x00\x00\x00\x00\x00[T\aE\xdfK\x1d\xeeH;\x15v$\xc5\xbcq\x9a\t\x9ej5\t\x00\x00\x009\x8c4\xc4\x88C\xa2B\x8b\x81\v\xea\t\xf0\x8fw\a\f\x15\xe2\xd0q\xbb\r\x17`s\xec\x85>\xcf\xab9(\xf6.\x15\xcd2-\xf2\xc4\xd8\x00a\xd5\xd9\xb5Z\xd7\xb4\xac\x1d_+k\xd6\x8ag\xdceHE\xd5\x1c\x8a\xbd#\xcc\x82\xca\xc2(\xb6\xe1\x99p\x9b\xa3D\xd2\x91\x96\xef\x05\fv\x16\x14\xcc\xea\x9d\x11w\x1e\xb5VG\x9ad\x9a`=^h\x8c8\xc9\"\x1eO\xb5vk\xc9\xcfi\x90\xd7\xd3H\xa1\xb4\xda\v\x17\x95\xf7\x19\x99\x99\x92\xc3\xc0\x8a\x18\xc7\"g\xd7B\x8f\x85\x18\xf3\x02\xa7\xb6\x83\x92\xefY\xef\x85\x92\x10E\x18\xbc\xacy\xd6\xa7Wh\xcd\xd0\xfa\xcc\xde\xeb\xdf\xad\xfd\xb0\xee\xfb\xc2(\x8cj\xd0uj{4\xb2\xe1p\x88u6\x9a;\xaa\x9f+J\x9e\xe3\xcc\xc7O\xad\x84\x8c;\x92~,\x15\xb2\x97\f~\xa0W\x16\x8b\a\x88\xaa\xe4C\xaf\x90\xdf\x7f\xe51\x00/n\xb5f\x1a\x8c+\xea<\xe3N@\x9e\xec\xbe{\x90x\xc6\x95!\xea\x11\xda\xe1I\x1d\xcbY\xe1\x01\xd2d\xae\xd1(>\xa3\xa9\x93\x16\xc6G\x94|', 0x2761, 0x0) write$cgroup_pid(r0, &(0x7f0000000080), 0xfffffe38) perf_event_open(&(0x7f00000003c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000001c0), &(0x7f0000000240)=0x4) r1 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, 0x0, &(0x7f0000000140)) msgsnd(0x0, &(0x7f00000004c0)={0x0, "300bec3780d623dfb19ad5822fbc3da7e8b412d008ce9031ceafe8a2ac14673e49e2ba480f04fe7f59ba0d1689d488981ce76f0227c2edebb4fc8c951e69d7b08329a7a5e251f99c872075a7b1badbf2e59b8e2fdd664be8f0b012b3ddddde0845e3e716ba1c133b80c37945276c16c037946489554639cef052e49ac251af9f"}, 0x88, 0x800) getpriority(0x0, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x660c, 0x1) dup(r1) r3 = memfd_create(&(0x7f0000000040)='G\'\x00\x9c\x1cH\xf9\x9e\x00\x16~\xdb`\x89\x86\x9a\xd4\xceof-\xbc\x12\x94\xe7\xcbH\x8dU;Z\xfc\xe1id?\xd4\x8a\x00Y@\xfe\xfe\b\x8d\xd0\x84\xcd\xf5\xd5\x83\xec\x96;\x16\x17\xf2\xba\xe1=\xe6.\xa5|\x02q', 0x0) mmap(&(0x7f00004ba000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0xfffff000) open(0x0, 0x253c246558bf43fb, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000300)={0x0, 0x10001, 0x0, 0x0, 0x19, 0x0, 0x3, 0x0, 0x0, 0x0, 0x9}) [ 289.123051][ T7610] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 289.204544][ T7641] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 289.281533][ T7613] 8021q: adding VLAN 0 to HW filter on device bond0 [ 289.293249][ T7655] bridge0: port 1(bridge_slave_0) entered blocking state [ 289.319806][ T7655] bridge0: port 1(bridge_slave_0) entered disabled state [ 289.341665][ T7655] device bridge_slave_0 entered promiscuous mode [ 289.366430][ T7641] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 289.397708][ T7613] 8021q: adding VLAN 0 to HW filter on device team0 [ 289.420089][ T7655] bridge0: port 2(bridge_slave_1) entered blocking state [ 289.427172][ T7655] bridge0: port 2(bridge_slave_1) entered disabled state [ 289.460138][ T7655] device bridge_slave_1 entered promiscuous mode [ 289.494166][ T7651] bridge0: port 1(bridge_slave_0) entered blocking state [ 289.501431][ T7651] bridge0: port 1(bridge_slave_0) entered disabled state [ 289.509399][ C1] hrtimer: interrupt took 25705 ns [ 289.536213][ T7651] device bridge_slave_0 entered promiscuous mode [ 289.566624][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 289.582798][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 289.661073][ T7651] bridge0: port 2(bridge_slave_1) entered blocking state [ 289.668297][ T7651] bridge0: port 2(bridge_slave_1) entered disabled state [ 289.709510][ T7651] device bridge_slave_1 entered promiscuous mode [ 289.748297][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 289.762386][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 289.799867][ T2647] bridge0: port 1(bridge_slave_0) entered blocking state [ 289.806969][ T2647] bridge0: port 1(bridge_slave_0) entered forwarding state [ 289.852844][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 289.893106][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 289.927988][ T2647] bridge0: port 2(bridge_slave_1) entered blocking state [ 289.935192][ T2647] bridge0: port 2(bridge_slave_1) entered forwarding state [ 289.987166][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 290.020745][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 290.059795][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 290.073626][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 290.103087][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 290.122641][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 290.160240][ T7641] team0: Port device team_slave_0 added [ 290.189263][ T7655] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link 08:26:25 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000740)=0x200, 0x4) bind$inet(r0, &(0x7f0000000480)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) recvmsg(r0, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xfdbe) [ 290.206086][ T7613] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 290.220031][ T7613] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 290.235585][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 290.244231][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 290.261846][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 290.272589][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 290.281168][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 290.289593][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 290.297942][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 290.306373][ T7641] team0: Port device team_slave_1 added [ 290.314210][ T7651] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 290.326920][ T7655] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 290.359717][ T7651] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link 08:26:25 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x5, 0x0) ioctl$BLKBSZSET(r0, 0x40081271, &(0x7f0000000080)=0x400) 08:26:25 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000003c0)=[@mss, @window={0x3, 0x100}, @mss, @sack_perm, @timestamp, @window], 0x20000000000001a8) [ 290.402944][ T7655] team0: Port device team_slave_0 added [ 290.420067][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 290.427642][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 290.473899][ T7613] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 290.493843][ T7655] team0: Port device team_slave_1 added 08:26:25 executing program 1: sendmsg$TIPC_NL_NODE_GET(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)=ANY=[@ANYBLOB="03000000e131e7c9ca686001c01c4f57d227915a6be58d0d2635e862c1812196344cdd7614cbf8b87a8da1c02765eb7d53da8bbc36006111ee9a103662b4729e923fa0bc1e1a05c8656500a83e1c93b0f30a2dae6c45a0cd5211fcdccb989293148ce67db218ac3e8f1c49e4a3c36d0e4e485ae36f1a2450905a357de0581deba9cfbd5e6408af3df56c115f2212e8acb8696141d38e2ecf943f4240dade149ff26a443fded8f772dffefd9127ee04fbcca54c827547a9526ca36cca4c63d081ca851324fe3171ab21d0ebb570e245f9c2e2dde6fb2e40cee17334f115235d76978b2053cf786b0263c83f921176c7cb1fb6c13aa3b4c8a7871fa9ffbd40dccfaaf4fc88ff4066cea402b29e551c45b9aaee59be6e1f4243b811f2d470d26b349e57377dcd7f3e10632d53ae4e3eaef2b8eae645e2fa57473685d725b08797608e821d89b9c8fd07", @ANYRES16=0x0, @ANYBLOB="000000000000000000000d0000001c000200080002000000000008000200000000000800010000000000240007000c000400000000000000000008000100000000000c00040000000000000000001400060004000200040002000400020004000200380004001400010062726f6164636173742d6c696e6b00000c00010073797a31000000001400010062726f6164636173742d6c696e6b0000"], 0x339}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0xabb, &(0x7f0000000100)=[{&(0x7f00000000c0)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0x4db, 0x400}], 0x4801, 0x0) [ 290.541726][ T7641] device hsr_slave_0 entered promiscuous mode [ 290.563249][ T7641] device hsr_slave_1 entered promiscuous mode [ 290.611500][ T7641] debugfs: Directory 'hsr0' with parent '/' already present! [ 290.620563][ T7651] team0: Port device team_slave_0 added [ 290.665465][ T7766] EXT4-fs (loop1): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 290.671350][ T7655] device hsr_slave_0 entered promiscuous mode [ 290.675295][ T7766] EXT4-fs (loop1): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 290.691676][ T7766] EXT4-fs (loop1): ext4_check_descriptors: Inode table for group 0 overlaps superblock [ 290.712531][ T7766] EXT4-fs error (device loop1): ext4_fill_super:4489: inode #2: comm syz-executor.1: iget: bad extended attribute block 135266304 [ 290.726646][ T7655] device hsr_slave_1 entered promiscuous mode [ 290.727927][ T7766] EXT4-fs (loop1): get root inode failed [ 290.738749][ T7766] EXT4-fs (loop1): mount failed [ 290.759454][ T7655] debugfs: Directory 'hsr0' with parent '/' already present! [ 290.767986][ T7651] team0: Port device team_slave_1 added [ 290.981596][ T7651] device hsr_slave_0 entered promiscuous mode [ 291.034085][ T7651] device hsr_slave_1 entered promiscuous mode [ 291.149488][ T7651] debugfs: Directory 'hsr0' with parent '/' already present! 08:26:26 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)={0x9, 0x18, 0x249e1e, 0x8000000001}, 0x2c) r1 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8476071") bpf$BPF_MAP_FREEZE(0x16, &(0x7f0000000180)=r0, 0x4) bpf$MAP_LOOKUP_ELEM(0x4, &(0x7f00000002c0)={r0, 0x0, 0x0}, 0x20) [ 291.418261][ T7655] 8021q: adding VLAN 0 to HW filter on device bond0 [ 291.522179][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 291.560540][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 291.651590][ T7655] 8021q: adding VLAN 0 to HW filter on device team0 [ 291.668571][ T7641] 8021q: adding VLAN 0 to HW filter on device bond0 [ 291.818477][ T7641] 8021q: adding VLAN 0 to HW filter on device team0 [ 291.880005][ T7623] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 291.912650][ T7623] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 291.959900][ T7623] bridge0: port 1(bridge_slave_0) entered blocking state [ 291.967100][ T7623] bridge0: port 1(bridge_slave_0) entered forwarding state [ 292.070000][ T7623] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 292.122270][ T7623] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 292.172152][ T7623] bridge0: port 2(bridge_slave_1) entered blocking state [ 292.179281][ T7623] bridge0: port 2(bridge_slave_1) entered forwarding state [ 292.292842][ T7623] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 292.340602][ T7623] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 292.409958][ T7623] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 292.483716][ T7623] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 292.553328][ T7623] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 292.600157][ T7623] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 292.703254][ T7651] 8021q: adding VLAN 0 to HW filter on device bond0 [ 292.758697][ T7655] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 292.832185][ T7655] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 292.919837][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 292.927943][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 293.003345][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 293.060271][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 293.069060][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 293.180084][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 293.188747][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 293.300008][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 293.379998][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 293.429855][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 293.513049][ T2647] bridge0: port 1(bridge_slave_0) entered blocking state [ 293.520147][ T2647] bridge0: port 1(bridge_slave_0) entered forwarding state [ 293.590148][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 293.659926][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 293.739785][ T2647] bridge0: port 2(bridge_slave_1) entered blocking state [ 293.746865][ T2647] bridge0: port 2(bridge_slave_1) entered forwarding state [ 293.832528][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 293.885943][ T7651] 8021q: adding VLAN 0 to HW filter on device team0 [ 293.970260][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 293.978054][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 294.050055][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 294.119818][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 294.127654][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 294.210539][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 294.219209][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 294.338199][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 294.422462][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 294.483356][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 294.540033][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 294.565136][ T7655] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 294.582718][ T7641] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 294.632849][ T7641] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 294.673958][ T7651] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 294.715069][ T7651] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 294.746672][ T7749] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 294.770680][ T7749] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 294.779331][ T7749] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 294.814925][ T7749] bridge0: port 1(bridge_slave_0) entered blocking state [ 294.822050][ T7749] bridge0: port 1(bridge_slave_0) entered forwarding state [ 294.842995][ T7749] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 294.857953][ T7749] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 294.892830][ T7749] bridge0: port 2(bridge_slave_1) entered blocking state [ 294.900087][ T7749] bridge0: port 2(bridge_slave_1) entered forwarding state [ 294.914133][ T7749] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 294.923455][ T7749] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 294.936026][ T7749] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 294.945346][ T7749] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 294.957803][ T7749] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 294.966925][ T7749] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 294.979071][ T7749] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 294.986944][ T7749] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 294.998133][ T7749] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 295.007252][ T7749] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 295.015553][ T7749] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 295.023943][ T7749] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 295.032445][ T7749] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 295.040712][ T7749] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 295.057314][ T7641] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 295.066214][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 295.074680][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 295.083031][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 295.091044][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 295.098725][ T2647] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 295.115570][ T7651] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 295.130262][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 295.137795][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready 08:26:30 executing program 3: r0 = openat$random(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/random\x00', 0x0, 0x0) ppoll(&(0x7f00000000c0)=[{r0}], 0x1, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001600)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) 08:26:30 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x9}, 0x0) ioctl$sock_SIOCSPGRP(r1, 0x8902, &(0x7f0000000100)=r2) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) open(&(0x7f00000000c0)='.\x00', 0x80, 0x234a6e725b869989) fcntl$setpipe(r4, 0x407, 0x0) write(r4, &(0x7f0000000340), 0x41395527) socket(0x0, 0x0, 0x2c) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000540)={{{@in6=@initdev, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in=@initdev}}, &(0x7f00000001c0)=0xe8) ioctl$sock_inet6_SIOCSIFADDR(r4, 0x8916, &(0x7f0000000640)={@dev={0xfe, 0x80, [], 0x22}, 0x0, r5}) write$apparmor_exec(0xffffffffffffffff, &(0x7f0000000880)={'\\C\x1b(0\x0e\x06C\x9bqY\x1d\x9b8d\xc3\x16\xb1\x9bV\\\xc4%T\x94M\xc7`\x83\xa1\xa0\xc8gn\xe3\xfe\xef[\xb3\xbd\x18R\x1b=\xab\x97$\x03\xaa\x84C\x0eWD\xeea\xf5\xb9\x82\xea\xbd5:\"\xf6f/\xa1\x8f%8\xa8\x1e\xcf\xb6\xa7\xe1\x1b1\x94\xc1G\xf9\xfc\xc77\x1c\x00]LD\xef\xf1Jg\xb9a\xe7\xe2k\xc6\x11\x8d>\x80\x9f\xddZ\xb3\xe5\xc8\x04s\xe6E\xfbQ\x0f\x82\x13\xdfP\xcc\xb3\xba\"\x18}\x04GxG\xeeN\xac\xc05`'}, 0x2c1) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000380)=ANY=[@ANYBLOB="69cf0000000000000a004e210001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000a004e240000000000000000000000000000000000000001ff010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a004e2041cf54aafe8000000000000000000000eb34578e16424d79a1a3c3a70000002b26060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d00"/400], 0x190) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3, 0x0, 0xfffffffffffffffd}, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) prctl$PR_SET_MM(0x23, 0x8, &(0x7f0000ffd000/0x1000)=nil) r6 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) pipe(0x0) symlinkat(&(0x7f0000000040)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', r6, &(0x7f00000000c0)='./file0\x00') mkdirat(r6, &(0x7f0000000200)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x315, 0x800000) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{0x0, 0x1c2}], 0xffffffffffffd50, 0x0) mount(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0) r7 = socket$key(0xf, 0x3, 0x2) sendmmsg(r7, &(0x7f0000000180), 0x400024c, 0x0) 08:26:30 executing program 0: bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x0, 0x2}}, &(0x7f0000000300)=""/250, 0x1a, 0xfa, 0x8}, 0x20) 08:26:30 executing program 1: perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x100, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x80c5, 0x3ce47c9a4b8a4c9e) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) clone(0x20102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={0x0, &(0x7f0000000300)=""/250, 0x0, 0xfa, 0x8}, 0x20) 08:26:30 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=@newlink={0x38, 0x10, 0xffffff1f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x18, 0x12, @gre={{0x8, 0x1, 'gre\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IGNORE_DF={0x8}]]}}}]}, 0x38}}, 0x0) 08:26:30 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff7c, &(0x7f00000bfff0)={&(0x7f0000006440)=ANY=[@ANYBLOB="b800000019000100000006005b000000ff010000000000000000000000000001e00000015bcb0a97ae3ad38b0000000000000000000000000a00600100000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000fbbccf810000000000000000fd85d16e79bad40ac3794899000000000000000000000000000000d94bfeadbfce0d4ed6f71b242b42000000ea0000000000000000000000000000000000000500000000000000000000000000000000000000e6010000000100000000002000"], 0xb8}}, 0x0) [ 295.414478][ T7906] netlink: 'syz-executor.2': attribute type 19 has an invalid length. 08:26:30 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_emit_ethernet(0x5a, &(0x7f0000000580)=ANY=[@ANYBLOB="aaaaaa8aaa0d798e214a086b81003d00000d010000600e030000309e24ed8b0db415d523e393214b0b401c8a34e27239829fae6c76767f473e0f275ab08e41fdfa7dd8a5e40acac995aacf43e6bd007166490289ee5dc0c25404218cde35df6820ebb7cf0f686dc83c420cf3d5cf3a9424c290fd0a3c08a5e71becba4111195082a5"], &(0x7f0000000400)) 08:26:30 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) add_key$keyring(&(0x7f0000002500)='keyring\x00', &(0x7f0000004f00)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) 08:26:30 executing program 0: r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6100) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ftruncate(r1, 0x8200) r2 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r2, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000006580)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000008100)=[{0x10}], 0x10}}], 0x1, 0x0) r3 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffa) r4 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r4, &(0x7f00000001c0), 0xffffff7f) 08:26:30 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41ba, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x88) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r0, r1, 0x0, 0xedc0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) [ 295.625033][ T26] kauditd_printk_skb: 8 callbacks suppressed [ 295.625050][ T26] audit: type=1804 audit(1576052790.691:31): pid=7925 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir900841764/syzkaller.FjxDsF/8/bus" dev="sda1" ino=16542 res=1 08:26:30 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) recvmsg(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000080)=""/31, 0x1f}], 0x1}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0x9cf4, 0x0, 0x0, 0x800e00516) shutdown(r1, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r3, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000002700)=[{&(0x7f0000000040)=""/40, 0x28}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x7}, 0x0) r4 = dup(r3) r5 = dup(r4) r6 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r6, 0x0, 0x27c7, 0x0, 0x0, 0x800e0050e) shutdown(r5, 0x0) ppoll(&(0x7f00000001c0)=[{}], 0x1, 0x0, 0x0, 0x0) shutdown(r6, 0x0) shutdown(r2, 0x0) [ 295.713788][ T26] audit: type=1804 audit(1576052790.701:32): pid=7925 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir900841764/syzkaller.FjxDsF/8/bus" dev="sda1" ino=16542 res=1 08:26:30 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(r0, &(0x7f0000000000), 0x200) write$cgroup_int(r0, &(0x7f0000000340), 0x12) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='memory.events\x00', 0x2da8020000100000, 0x500001c) [ 295.812539][ T26] audit: type=1804 audit(1576052790.711:33): pid=7925 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir900841764/syzkaller.FjxDsF/8/bus" dev="sda1" ino=16542 res=1 [ 295.886925][ T7936] syz-executor.2 (7936) used greatest stack depth: 9944 bytes left [ 295.902870][ T26] audit: type=1804 audit(1576052790.731:34): pid=7925 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir900841764/syzkaller.FjxDsF/8/bus" dev="sda1" ino=16542 res=1 [ 295.965049][ T26] audit: type=1804 audit(1576052791.021:35): pid=7945 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir168647389/syzkaller.yzuMfZ/4/memory.events" dev="sda1" ino=16553 res=1 [ 296.013968][ T26] audit: type=1804 audit(1576052791.021:36): pid=7949 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir168647389/syzkaller.yzuMfZ/4/memory.events" dev="sda1" ino=16553 res=1 08:26:31 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = socket(0x400000000010, 0x3, 0x0) ioctl(r1, 0x1000008912, 0x0) getsockopt$inet_sctp6_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f0000002200)={0x0, 0x9, 0x6}, &(0x7f0000002240)=0x10) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r0, 0x84, 0x19, &(0x7f0000002280)={r2, 0x9}, 0x8) syz_emit_ethernet(0x1, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0) socket(0xa, 0x1, 0x0) r3 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e23}, 0x1c) listen(r3, 0x5eb857) r4 = socket$inet_dccp(0x2, 0x6, 0x0) r5 = socket$inet(0x2, 0x3, 0x800000800000001) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x7}, 0x2c) connect$inet(r4, &(0x7f0000000340)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r6 = syz_genetlink_get_family_id$tipc2(0x0) ioctl$sock_proto_private(0xffffffffffffffff, 0x0, &(0x7f0000000540)="4aaa608f2348766630fbf6dc4d2b7ce4d0e47dca973b3bc0b110f984475ba4b942da2bdff7f0d492eb60") sendmsg$TIPC_NL_BEARER_DISABLE(r5, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000380)={0x160, r6, 0x300, 0x70bd28, 0x25dfdbff, {}, [@TIPC_NLA_MON={0x2c, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x2}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xd19}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x200}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_BEARER={0x114, 0x1, [@TIPC_NLA_BEARER_PROP={0x24, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x40}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1f}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}]}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffff}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x6}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffffffffffb}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3f}]}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x1, @mcast1, 0xc8b}}, {0x14, 0x2, @in={0x2, 0x4e22, @multicast2}}}}]}, @TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x5}]}]}, 0x160}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) r7 = accept4(r3, 0x0, 0x0, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$TIPC_CMD_SHOW_STATS(r7, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x1c, 0x0, 0x400, 0x70bd2b, 0x25dfdbfc, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x2004c0c0}, 0x800) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f0000000100)={'veth1_to_bond\x00'}) getsockopt$TIPC_SRC_DROPPABLE(r8, 0x10f, 0x80, 0x0, &(0x7f00000002c0)) write$cgroup_int(r8, &(0x7f0000000000), 0xffffff6a) sendmmsg(r4, &(0x7f0000000a00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) sendmmsg(r7, &(0x7f0000000c00), 0x4000000000001e6, 0x0) sendmmsg(r4, &(0x7f0000007400)=[{{0x0, 0x0, &(0x7f00000000c0)=[{0x0}], 0x1}}, {{0x0, 0x0, &(0x7f0000005ac0)}}, {{0x0, 0x0, 0x0}}], 0x3, 0x40000) syz_emit_ethernet(0x0, &(0x7f0000000580)=ANY=[], 0x0) 08:26:31 executing program 0: r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6100) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ftruncate(r1, 0x8200) r2 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r2, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000006580)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000008100)=[{0x10}], 0x10}}], 0x1, 0x0) r3 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffa) r4 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r4, &(0x7f00000001c0), 0xffffff7f) 08:26:31 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41ba, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x88) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r0, r1, 0x0, 0xedc0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) 08:26:31 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0x14, &(0x7f0000002180)=0xfc, 0x4) socket$inet6_sctp(0xa, 0x0, 0x84) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'team0\x00', 0x0}) bind$packet(r0, &(0x7f0000000040)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @local}, 0x14) sendto$inet6(r0, &(0x7f00000001c0)="030400000a03600003000000fff5", 0xe, 0x0, 0x0, 0x0) 08:26:31 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(r0, &(0x7f0000000000), 0x200) write$cgroup_int(r0, &(0x7f0000000340), 0x12) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='memory.events\x00', 0x2da8020000100000, 0x500001c) [ 296.255543][ T26] audit: type=1804 audit(1576052791.321:37): pid=7962 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir900841764/syzkaller.FjxDsF/9/bus" dev="sda1" ino=16556 res=1 08:26:31 executing program 2: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x182) memfd_create(0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_CAPACITY(r0, 0x4c07) 08:26:31 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000000)={0x8, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) getsockopt$inet6_buf(r0, 0x29, 0x30, &(0x7f0000000000)=""/40, &(0x7f0000001000)=0xfffffffffffffff9) [ 296.285928][ T26] audit: type=1804 audit(1576052791.331:38): pid=7965 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir168647389/syzkaller.yzuMfZ/5/memory.events" dev="sda1" ino=16557 res=1 [ 296.319113][ T26] audit: type=1804 audit(1576052791.351:39): pid=7962 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir900841764/syzkaller.FjxDsF/9/bus" dev="sda1" ino=16556 res=1 08:26:31 executing program 0: r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6100) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ftruncate(r1, 0x8200) r2 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r2, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000006580)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000008100)=[{0x10}], 0x10}}], 0x1, 0x0) r3 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffa) r4 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r4, &(0x7f00000001c0), 0xffffff7f) 08:26:31 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0x14, &(0x7f0000002180)=0xfc, 0x4) socket$inet6_sctp(0xa, 0x0, 0x84) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'team0\x00', 0x0}) bind$packet(r0, &(0x7f0000000040)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @local}, 0x14) sendto$inet6(r0, &(0x7f00000001c0)="030400000a03600003000000fff5", 0xe, 0x0, 0x0, 0x0) 08:26:31 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) readv(r0, &(0x7f0000000480)=[{0x0}, {0x0}, {&(0x7f0000000240)=""/242, 0xf2}, {0x0}, {0x0}], 0x5) r1 = dup(r0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0x896e, 0x0, 0x0, 0x800e00519) shutdown(r1, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) r4 = dup(r3) recvmsg(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000080)=""/157, 0x9d}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0xd}, 0x0) shutdown(r2, 0x0) [ 296.597430][ T26] audit: type=1804 audit(1576052791.661:40): pid=7987 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir900841764/syzkaller.FjxDsF/10/bus" dev="sda1" ino=16557 res=1 08:26:31 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000002700)=[{&(0x7f0000000040)=""/40, 0x28}, {0x0}, {0x0}, {0x0}, {0x0}], 0x5}, 0x0) r1 = dup(r0) r2 = dup(r1) r3 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r3, 0x0, 0x27c7, 0x0, 0x0, 0x800e0050e) shutdown(r2, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x3806cfcb4148b6ae, 0x0) ppoll(&(0x7f00000001c0)=[{r4}], 0x1, 0x0, 0x0, 0x0) shutdown(r3, 0x0) 08:26:31 executing program 1: poll(&(0x7f0000000040), 0x2000000000000014, 0x4e) r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r0, 0x0, 0xccf3, 0x0, 0x0, 0x800e00551) poll(&(0x7f0000000040)=[{}, {}], 0x2, 0x52) shutdown(r0, 0x0) [ 297.026471][ T7967] dccp_close: ABORT with 28 bytes unread 08:26:32 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = socket(0x400000000010, 0x3, 0x0) ioctl(r1, 0x1000008912, 0x0) getsockopt$inet_sctp6_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f0000002200)={0x0, 0x9, 0x6}, &(0x7f0000002240)=0x10) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r0, 0x84, 0x19, &(0x7f0000002280)={r2, 0x9}, 0x8) syz_emit_ethernet(0x1, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0) socket(0xa, 0x1, 0x0) r3 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e23}, 0x1c) listen(r3, 0x5eb857) r4 = socket$inet_dccp(0x2, 0x6, 0x0) r5 = socket$inet(0x2, 0x3, 0x800000800000001) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x7}, 0x2c) connect$inet(r4, &(0x7f0000000340)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r6 = syz_genetlink_get_family_id$tipc2(0x0) ioctl$sock_proto_private(0xffffffffffffffff, 0x0, &(0x7f0000000540)="4aaa608f2348766630fbf6dc4d2b7ce4d0e47dca973b3bc0b110f984475ba4b942da2bdff7f0d492eb60") sendmsg$TIPC_NL_BEARER_DISABLE(r5, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000380)={0x160, r6, 0x300, 0x70bd28, 0x25dfdbff, {}, [@TIPC_NLA_MON={0x2c, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x2}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xd19}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x200}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_BEARER={0x114, 0x1, [@TIPC_NLA_BEARER_PROP={0x24, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x40}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1f}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}]}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffff}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x6}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffffffffffb}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3f}]}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x1, @mcast1, 0xc8b}}, {0x14, 0x2, @in={0x2, 0x4e22, @multicast2}}}}]}, @TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x5}]}]}, 0x160}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) r7 = accept4(r3, 0x0, 0x0, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$TIPC_CMD_SHOW_STATS(r7, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x1c, 0x0, 0x400, 0x70bd2b, 0x25dfdbfc, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x2004c0c0}, 0x800) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f0000000100)={'veth1_to_bond\x00'}) getsockopt$TIPC_SRC_DROPPABLE(r8, 0x10f, 0x80, 0x0, &(0x7f00000002c0)) write$cgroup_int(r8, &(0x7f0000000000), 0xffffff6a) sendmmsg(r4, &(0x7f0000000a00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) sendmmsg(r7, &(0x7f0000000c00), 0x4000000000001e6, 0x0) sendmmsg(r4, &(0x7f0000007400)=[{{0x0, 0x0, &(0x7f00000000c0)=[{0x0}], 0x1}}, {{0x0, 0x0, &(0x7f0000005ac0)}}, {{0x0, 0x0, 0x0}}], 0x3, 0x40000) syz_emit_ethernet(0x0, &(0x7f0000000580)=ANY=[], 0x0) 08:26:32 executing program 0: r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6100) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ftruncate(r1, 0x8200) r2 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r2, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000006580)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000008100)=[{0x10}], 0x10}}], 0x1, 0x0) r3 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffa) r4 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r4, &(0x7f00000001c0), 0xffffff7f) 08:26:32 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) recvmsg(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000080)=""/31, 0x1f}], 0x1}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0x9cf4, 0x0, 0x0, 0x800e00516) shutdown(r1, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r3, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000002700)=[{&(0x7f0000000040)=""/40, 0x28}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x6}, 0x0) r4 = dup(r3) r5 = dup(r4) r6 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r6, 0x0, 0x27c7, 0x0, 0x0, 0x800e0050e) shutdown(r5, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x3806cfcb4148b6ae, 0x0) ppoll(&(0x7f00000001c0)=[{r7}], 0x1, 0x0, 0x0, 0x0) shutdown(r6, 0x0) shutdown(r2, 0x0) 08:26:32 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) readv(r0, &(0x7f0000000480)=[{0x0}, {0x0}, {&(0x7f0000000240)=""/242, 0xf2}, {0x0}, {0x0}, {0x0}], 0x6) r1 = dup(r0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0x896e, 0x0, 0x0, 0x800e00519) shutdown(r1, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) r4 = dup(r3) recvmsg(r4, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000080)=""/157, 0x9d}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x8}, 0x0) shutdown(r2, 0x0) 08:26:32 executing program 0: r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6100) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ftruncate(r1, 0x8200) r2 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r2, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000006580)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000008100)=[{0x10}], 0x10}}], 0x1, 0x0) r3 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffa) write$eventfd(0xffffffffffffffff, &(0x7f00000001c0), 0xffffff7f) 08:26:32 executing program 0: r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6100) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ftruncate(r1, 0x8200) r2 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r2, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000006580)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000008100)=[{0x10}], 0x10}}], 0x1, 0x0) r3 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffa) write$eventfd(0xffffffffffffffff, &(0x7f00000001c0), 0xffffff7f) 08:26:32 executing program 0: r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6100) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ftruncate(r1, 0x8200) r2 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r2, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000006580)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000008100)=[{0x10}], 0x10}}], 0x1, 0x0) r3 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffa) write$eventfd(0xffffffffffffffff, &(0x7f00000001c0), 0xffffff7f) 08:26:32 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = socket(0x400000000010, 0x3, 0x0) ioctl(r1, 0x1000008912, 0x0) getsockopt$inet_sctp6_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f0000002200)={0x0, 0x9, 0x6}, &(0x7f0000002240)=0x10) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r0, 0x84, 0x19, &(0x7f0000002280)={r2, 0x9}, 0x8) syz_emit_ethernet(0x1, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0) socket(0xa, 0x1, 0x0) r3 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e23}, 0x1c) listen(r3, 0x5eb857) r4 = socket$inet_dccp(0x2, 0x6, 0x0) r5 = socket$inet(0x2, 0x3, 0x800000800000001) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x7}, 0x2c) connect$inet(r4, &(0x7f0000000340)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r6 = syz_genetlink_get_family_id$tipc2(0x0) ioctl$sock_proto_private(0xffffffffffffffff, 0x0, &(0x7f0000000540)="4aaa608f2348766630fbf6dc4d2b7ce4d0e47dca973b3bc0b110f984475ba4b942da2bdff7f0d492eb60") sendmsg$TIPC_NL_BEARER_DISABLE(r5, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000380)={0x160, r6, 0x300, 0x70bd28, 0x25dfdbff, {}, [@TIPC_NLA_MON={0x2c, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x2}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xd19}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x200}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_BEARER={0x114, 0x1, [@TIPC_NLA_BEARER_PROP={0x24, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x40}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1f}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}]}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffff}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x6}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffffffffffb}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3f}]}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x1, @mcast1, 0xc8b}}, {0x14, 0x2, @in={0x2, 0x4e22, @multicast2}}}}]}, @TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x5}]}]}, 0x160}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) r7 = accept4(r3, 0x0, 0x0, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$TIPC_CMD_SHOW_STATS(r7, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x1c, 0x0, 0x400, 0x70bd2b, 0x25dfdbfc, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x2004c0c0}, 0x800) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f0000000100)={'veth1_to_bond\x00'}) getsockopt$TIPC_SRC_DROPPABLE(r8, 0x10f, 0x80, 0x0, &(0x7f00000002c0)) write$cgroup_int(r8, &(0x7f0000000000), 0xffffff6a) sendmmsg(r4, &(0x7f0000000a00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) sendmmsg(r7, &(0x7f0000000c00), 0x4000000000001e6, 0x0) sendmmsg(r4, &(0x7f0000007400)=[{{0x0, 0x0, &(0x7f00000000c0)=[{0x0}], 0x1}}, {{0x0, 0x0, &(0x7f0000005ac0)}}, {{0x0, 0x0, 0x0}}], 0x3, 0x40000) syz_emit_ethernet(0x0, &(0x7f0000000580)=ANY=[], 0x0) 08:26:32 executing program 0: r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6100) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ftruncate(r1, 0x8200) r2 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r2, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000006580)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000008100)=[{0x10}], 0x10}}], 0x1, 0x0) open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) r3 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r3, &(0x7f00000001c0), 0xffffff7f) 08:26:32 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = socket(0x400000000010, 0x3, 0x0) ioctl(r1, 0x1000008912, 0x0) getsockopt$inet_sctp6_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f0000002200)={0x0, 0x9, 0x6}, &(0x7f0000002240)=0x10) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r0, 0x84, 0x19, &(0x7f0000002280)={r2, 0x9}, 0x8) syz_emit_ethernet(0x1, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0) socket(0xa, 0x1, 0x0) r3 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e23}, 0x1c) listen(r3, 0x5eb857) r4 = socket$inet_dccp(0x2, 0x6, 0x0) r5 = socket$inet(0x2, 0x3, 0x800000800000001) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x7}, 0x2c) connect$inet(r4, &(0x7f0000000340)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r6 = syz_genetlink_get_family_id$tipc2(0x0) ioctl$sock_proto_private(0xffffffffffffffff, 0x0, &(0x7f0000000540)="4aaa608f2348766630fbf6dc4d2b7ce4d0e47dca973b3bc0b110f984475ba4b942da2bdff7f0d492eb60") sendmsg$TIPC_NL_BEARER_DISABLE(r5, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000380)={0x160, r6, 0x300, 0x70bd28, 0x25dfdbff, {}, [@TIPC_NLA_MON={0x2c, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x2}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xd19}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x200}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_BEARER={0x114, 0x1, [@TIPC_NLA_BEARER_PROP={0x24, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x40}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1f}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}]}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffff}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x6}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffffffffffb}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3f}]}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x1, @mcast1, 0xc8b}}, {0x14, 0x2, @in={0x2, 0x4e22, @multicast2}}}}]}, @TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x5}]}]}, 0x160}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) r7 = accept4(r3, 0x0, 0x0, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$TIPC_CMD_SHOW_STATS(r7, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x1c, 0x0, 0x400, 0x70bd2b, 0x25dfdbfc, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x2004c0c0}, 0x800) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f0000000100)={'veth1_to_bond\x00'}) getsockopt$TIPC_SRC_DROPPABLE(r8, 0x10f, 0x80, 0x0, &(0x7f00000002c0)) write$cgroup_int(r8, &(0x7f0000000000), 0xffffff6a) sendmmsg(r4, &(0x7f0000000a00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) sendmmsg(r7, &(0x7f0000000c00), 0x4000000000001e6, 0x0) sendmmsg(r4, &(0x7f0000007400)=[{{0x0, 0x0, &(0x7f00000000c0)=[{0x0}], 0x1}}, {{0x0, 0x0, &(0x7f0000005ac0)}}, {{0x0, 0x0, 0x0}}], 0x3, 0x40000) syz_emit_ethernet(0x0, &(0x7f0000000580)=ANY=[], 0x0) 08:26:32 executing program 0: r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6100) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ftruncate(r1, 0x8200) r2 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r2, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000006580)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000008100)=[{0x10}], 0x10}}], 0x1, 0x0) open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) r3 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r3, &(0x7f00000001c0), 0xffffff7f) 08:26:33 executing program 0: r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6100) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ftruncate(r1, 0x8200) r2 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r2, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000006580)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000008100)=[{0x10}], 0x10}}], 0x1, 0x0) open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) r3 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r3, &(0x7f00000001c0), 0xffffff7f) 08:26:33 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = socket(0x400000000010, 0x3, 0x0) ioctl(r1, 0x1000008912, 0x0) getsockopt$inet_sctp6_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f0000002200)={0x0, 0x9, 0x6}, &(0x7f0000002240)=0x10) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r0, 0x84, 0x19, &(0x7f0000002280)={r2, 0x9}, 0x8) syz_emit_ethernet(0x1, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0) socket(0xa, 0x1, 0x0) r3 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e23}, 0x1c) listen(r3, 0x5eb857) r4 = socket$inet_dccp(0x2, 0x6, 0x0) r5 = socket$inet(0x2, 0x3, 0x800000800000001) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x7}, 0x2c) connect$inet(r4, &(0x7f0000000340)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r6 = syz_genetlink_get_family_id$tipc2(0x0) ioctl$sock_proto_private(0xffffffffffffffff, 0x0, &(0x7f0000000540)="4aaa608f2348766630fbf6dc4d2b7ce4d0e47dca973b3bc0b110f984475ba4b942da2bdff7f0d492eb60") sendmsg$TIPC_NL_BEARER_DISABLE(r5, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000380)={0x160, r6, 0x300, 0x70bd28, 0x25dfdbff, {}, [@TIPC_NLA_MON={0x2c, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x2}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xd19}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x200}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_BEARER={0x114, 0x1, [@TIPC_NLA_BEARER_PROP={0x24, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x40}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1f}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}]}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffff}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x6}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffffffffffb}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3f}]}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x1, @mcast1, 0xc8b}}, {0x14, 0x2, @in={0x2, 0x4e22, @multicast2}}}}]}, @TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x5}]}]}, 0x160}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) r7 = accept4(r3, 0x0, 0x0, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$TIPC_CMD_SHOW_STATS(r7, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x1c, 0x0, 0x400, 0x70bd2b, 0x25dfdbfc, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x2004c0c0}, 0x800) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f0000000100)={'veth1_to_bond\x00'}) getsockopt$TIPC_SRC_DROPPABLE(r8, 0x10f, 0x80, 0x0, &(0x7f00000002c0)) write$cgroup_int(r8, &(0x7f0000000000), 0xffffff6a) sendmmsg(r4, &(0x7f0000000a00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) sendmmsg(r7, &(0x7f0000000c00), 0x4000000000001e6, 0x0) sendmmsg(r4, &(0x7f0000007400)=[{{0x0, 0x0, &(0x7f00000000c0)=[{0x0}], 0x1}}, {{0x0, 0x0, &(0x7f0000005ac0)}}, {{0x0, 0x0, 0x0}}], 0x3, 0x40000) syz_emit_ethernet(0x0, &(0x7f0000000580)=ANY=[], 0x0) 08:26:33 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) recvmsg(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000080)=""/31, 0x1f}], 0x1}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0x9cf4, 0x0, 0x0, 0x800e00516) shutdown(r1, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r3, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000002700)=[{&(0x7f0000000040)=""/40, 0x28}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x7}, 0x0) r4 = dup(r3) r5 = dup(r4) r6 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r6, 0x0, 0x27c7, 0x0, 0x0, 0x800e0050e) shutdown(r5, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) shutdown(r6, 0x0) shutdown(r2, 0x0) 08:26:33 executing program 4: 08:26:33 executing program 0: r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6100) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ftruncate(r1, 0x8200) r2 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r2, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000006580)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000008100)=[{0x10}], 0x10}}], 0x1, 0x0) sendfile(r0, 0xffffffffffffffff, 0x0, 0x8000fffffffa) r3 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r3, &(0x7f00000001c0), 0xffffff7f) 08:26:33 executing program 4: 08:26:33 executing program 4: 08:26:33 executing program 0: r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6100) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ftruncate(r1, 0x8200) r2 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r2, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000006580)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000008100)=[{0x10}], 0x10}}], 0x1, 0x0) sendfile(r0, 0xffffffffffffffff, 0x0, 0x8000fffffffa) r3 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r3, &(0x7f00000001c0), 0xffffff7f) [ 298.580591][ T8042] dccp_close: ABORT with 28 bytes unread 08:26:33 executing program 2: 08:26:33 executing program 4: [ 298.725589][ T8052] dccp_close: ABORT with 28 bytes unread 08:26:33 executing program 5: 08:26:33 executing program 0: r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6100) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ftruncate(r1, 0x8200) r2 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r2, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000006580)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000008100)=[{0x10}], 0x10}}], 0x1, 0x0) sendfile(r0, 0xffffffffffffffff, 0x0, 0x8000fffffffa) r3 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r3, &(0x7f00000001c0), 0xffffff7f) 08:26:33 executing program 4: 08:26:34 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = socket(0x400000000010, 0x3, 0x0) ioctl(r1, 0x1000008912, 0x0) getsockopt$inet_sctp6_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f0000002200)={0x0, 0x9, 0x6}, &(0x7f0000002240)=0x10) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r0, 0x84, 0x19, &(0x7f0000002280)={r2, 0x9}, 0x8) syz_emit_ethernet(0x1, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0) socket(0xa, 0x1, 0x0) r3 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e23}, 0x1c) listen(r3, 0x5eb857) r4 = socket$inet_dccp(0x2, 0x6, 0x0) r5 = socket$inet(0x2, 0x3, 0x800000800000001) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x7}, 0x2c) connect$inet(r4, &(0x7f0000000340)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r6 = syz_genetlink_get_family_id$tipc2(0x0) ioctl$sock_proto_private(0xffffffffffffffff, 0x0, &(0x7f0000000540)="4aaa608f2348766630fbf6dc4d2b7ce4d0e47dca973b3bc0b110f984475ba4b942da2bdff7f0d492eb60") sendmsg$TIPC_NL_BEARER_DISABLE(r5, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000380)={0x160, r6, 0x300, 0x70bd28, 0x25dfdbff, {}, [@TIPC_NLA_MON={0x2c, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x2}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xd19}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x200}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_BEARER={0x114, 0x1, [@TIPC_NLA_BEARER_PROP={0x24, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x40}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1f}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}]}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffff}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x6}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffffffffffb}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3f}]}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x1, @mcast1, 0xc8b}}, {0x14, 0x2, @in={0x2, 0x4e22, @multicast2}}}}]}, @TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x5}]}]}, 0x160}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) r7 = accept4(r3, 0x0, 0x0, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$TIPC_CMD_SHOW_STATS(r7, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x1c, 0x0, 0x400, 0x70bd2b, 0x25dfdbfc, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x2004c0c0}, 0x800) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f0000000100)={'veth1_to_bond\x00'}) getsockopt$TIPC_SRC_DROPPABLE(r8, 0x10f, 0x80, 0x0, &(0x7f00000002c0)) write$cgroup_int(r8, &(0x7f0000000000), 0xffffff6a) sendmmsg(r4, &(0x7f0000000a00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) sendmmsg(r7, &(0x7f0000000c00), 0x4000000000001e6, 0x0) sendmmsg(r4, &(0x7f0000007400)=[{{0x0, 0x0, &(0x7f00000000c0)=[{0x0}], 0x1}}, {{0x0, 0x0, &(0x7f0000005ac0)}}, {{0x0, 0x0, 0x0}}], 0x3, 0x40000) syz_emit_ethernet(0x0, &(0x7f0000000580)=ANY=[], 0x0) 08:26:34 executing program 4: 08:26:34 executing program 0: r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6100) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ftruncate(r1, 0x8200) r2 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r2, 0x0) r3 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffa) r4 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r4, &(0x7f00000001c0), 0xffffff7f) 08:26:34 executing program 2: 08:26:34 executing program 1: 08:26:34 executing program 5: 08:26:34 executing program 5: 08:26:34 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41ba, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x88) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r0, r1, 0x0, 0xedc0) 08:26:34 executing program 2: 08:26:34 executing program 1: 08:26:34 executing program 0: r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6100) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ftruncate(r1, 0x8200) r2 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r2, 0x0) r3 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffa) r4 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r4, &(0x7f00000001c0), 0xffffff7f) 08:26:34 executing program 1: [ 299.707308][ T8115] syz-executor.4 (8115) used greatest stack depth: 9856 bytes left 08:26:35 executing program 3: 08:26:35 executing program 5: 08:26:35 executing program 2: 08:26:35 executing program 1: 08:26:35 executing program 0: r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6100) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ftruncate(r1, 0x8200) r2 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r2, 0x0) r3 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffa) r4 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r4, &(0x7f00000001c0), 0xffffff7f) 08:26:35 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41ba, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x88) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r0, r1, 0x0, 0xedc0) 08:26:35 executing program 1: 08:26:35 executing program 5: [ 300.705532][ T26] kauditd_printk_skb: 17 callbacks suppressed [ 300.705551][ T26] audit: type=1804 audit(1576052795.771:58): pid=8143 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir900841764/syzkaller.FjxDsF/23/bus" dev="sda1" ino=16579 res=1 08:26:35 executing program 0: r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6100) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ftruncate(r1, 0x8200) open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000006580)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000008100)=[{0x10}], 0x10}}], 0x1, 0x0) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r2, 0x0, 0x8000fffffffa) r3 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r3, &(0x7f00000001c0), 0xffffff7f) 08:26:35 executing program 2: 08:26:35 executing program 4: [ 300.873039][ T26] audit: type=1804 audit(1576052795.781:59): pid=8143 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir900841764/syzkaller.FjxDsF/23/bus" dev="sda1" ino=16579 res=1 08:26:36 executing program 1: [ 300.988527][ T26] audit: type=1804 audit(1576052796.021:60): pid=8152 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir900841764/syzkaller.FjxDsF/24/bus" dev="sda1" ino=16583 res=1 [ 301.102414][ T26] audit: type=1804 audit(1576052796.031:61): pid=8152 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir900841764/syzkaller.FjxDsF/24/bus" dev="sda1" ino=16583 res=1 08:26:36 executing program 3: 08:26:36 executing program 5: 08:26:36 executing program 2: 08:26:36 executing program 4: 08:26:36 executing program 1: 08:26:36 executing program 5: 08:26:36 executing program 2: 08:26:36 executing program 4: 08:26:36 executing program 0: r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6100) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ftruncate(r1, 0x8200) open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000006580)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000008100)=[{0x10}], 0x10}}], 0x1, 0x0) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r2, 0x0, 0x8000fffffffa) r3 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r3, &(0x7f00000001c0), 0xffffff7f) 08:26:36 executing program 3: 08:26:36 executing program 1: 08:26:36 executing program 5: 08:26:36 executing program 2: 08:26:36 executing program 4: 08:26:37 executing program 2: 08:26:37 executing program 1: 08:26:37 executing program 5: 08:26:37 executing program 4: 08:26:37 executing program 3: 08:26:37 executing program 2: [ 302.266185][ T26] audit: type=1804 audit(1576052797.331:62): pid=8202 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir900841764/syzkaller.FjxDsF/25/bus" dev="sda1" ino=16519 res=1 [ 302.364784][ T26] audit: type=1804 audit(1576052797.331:63): pid=8202 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir900841764/syzkaller.FjxDsF/25/bus" dev="sda1" ino=16519 res=1 08:26:37 executing program 0: r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6100) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ftruncate(r1, 0x8200) open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000006580)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000008100)=[{0x10}], 0x10}}], 0x1, 0x0) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r2, 0x0, 0x8000fffffffa) r3 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r3, &(0x7f00000001c0), 0xffffff7f) 08:26:37 executing program 5: 08:26:37 executing program 3: 08:26:37 executing program 1: 08:26:37 executing program 4: 08:26:37 executing program 2: 08:26:37 executing program 5: 08:26:37 executing program 4: 08:26:37 executing program 3: 08:26:37 executing program 2: 08:26:37 executing program 1: 08:26:38 executing program 5: [ 303.014916][ T26] audit: type=1804 audit(1576052798.081:64): pid=8223 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir900841764/syzkaller.FjxDsF/26/bus" dev="sda1" ino=16602 res=1 [ 303.067258][ T26] audit: type=1804 audit(1576052798.081:65): pid=8223 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir900841764/syzkaller.FjxDsF/26/bus" dev="sda1" ino=16602 res=1 08:26:38 executing program 2: 08:26:38 executing program 3: 08:26:38 executing program 4: 08:26:38 executing program 1: 08:26:38 executing program 0: r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6100) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ftruncate(r1, 0x8200) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, 0xffffffffffffffff, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000006580)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000008100)=[{0x10}], 0x10}}], 0x1, 0x0) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r2, 0x0, 0x8000fffffffa) r3 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r3, &(0x7f00000001c0), 0xffffff7f) 08:26:38 executing program 5: 08:26:38 executing program 1: 08:26:38 executing program 3: 08:26:38 executing program 2: 08:26:38 executing program 4: 08:26:38 executing program 5: 08:26:38 executing program 5: 08:26:38 executing program 3: 08:26:38 executing program 2: 08:26:38 executing program 1: 08:26:39 executing program 4: [ 303.946741][ T26] audit: type=1804 audit(1576052799.011:66): pid=8254 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir900841764/syzkaller.FjxDsF/27/bus" dev="sda1" ino=16603 res=1 [ 304.043441][ T26] audit: type=1804 audit(1576052799.061:67): pid=8254 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir900841764/syzkaller.FjxDsF/27/bus" dev="sda1" ino=16603 res=1 08:26:39 executing program 0: r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6100) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ftruncate(r1, 0x8200) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, 0xffffffffffffffff, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000006580)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000008100)=[{0x10}], 0x10}}], 0x1, 0x0) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r2, 0x0, 0x8000fffffffa) r3 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r3, &(0x7f00000001c0), 0xffffff7f) 08:26:39 executing program 1: 08:26:39 executing program 2: 08:26:39 executing program 3: 08:26:39 executing program 5: 08:26:39 executing program 4: 08:26:39 executing program 3: 08:26:39 executing program 2: 08:26:39 executing program 5: 08:26:39 executing program 1: 08:26:39 executing program 4: 08:26:39 executing program 3: 08:26:40 executing program 0: r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6100) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ftruncate(r1, 0x8200) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, 0xffffffffffffffff, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000006580)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000008100)=[{0x10}], 0x10}}], 0x1, 0x0) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r2, 0x0, 0x8000fffffffa) r3 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r3, &(0x7f00000001c0), 0xffffff7f) 08:26:40 executing program 2: 08:26:40 executing program 5: 08:26:40 executing program 1: 08:26:40 executing program 4: 08:26:40 executing program 3: 08:26:40 executing program 4: 08:26:40 executing program 2: 08:26:40 executing program 5: 08:26:40 executing program 3: 08:26:40 executing program 1: 08:26:40 executing program 4: 08:26:41 executing program 0: r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6100) creat(&(0x7f0000000180)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000006580)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000008100)=[{0x10}], 0x10}}], 0x1, 0x0) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r2, 0x0, 0x8000fffffffa) r3 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r3, &(0x7f00000001c0), 0xffffff7f) 08:26:41 executing program 5: 08:26:41 executing program 3: 08:26:41 executing program 1: 08:26:41 executing program 2: 08:26:41 executing program 4: 08:26:41 executing program 1: 08:26:41 executing program 2: 08:26:41 executing program 3: 08:26:41 executing program 5: 08:26:41 executing program 4: 08:26:41 executing program 1: 08:26:41 executing program 0: r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6100) creat(&(0x7f0000000180)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000006580)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000008100)=[{0x10}], 0x10}}], 0x1, 0x0) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r2, 0x0, 0x8000fffffffa) r3 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r3, &(0x7f00000001c0), 0xffffff7f) 08:26:41 executing program 5: 08:26:41 executing program 2: 08:26:41 executing program 3: 08:26:41 executing program 1: 08:26:41 executing program 4: 08:26:41 executing program 5: 08:26:41 executing program 2: 08:26:41 executing program 3: 08:26:41 executing program 1: 08:26:41 executing program 4: 08:26:42 executing program 0: r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6100) creat(&(0x7f0000000180)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000006580)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000008100)=[{0x10}], 0x10}}], 0x1, 0x0) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r2, 0x0, 0x8000fffffffa) r3 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r3, &(0x7f00000001c0), 0xffffff7f) 08:26:42 executing program 5: 08:26:42 executing program 3: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x10, 0xffffffffffffffff, 0x0) shmget(0x2, 0x1000, 0x1c, &(0x7f000096d000/0x1000)=nil) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$MON_IOCG_STATS(0xffffffffffffffff, 0x80089203, 0x0) openat$dlm_control(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-control\x00', 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000180)='mountinfo\x00') preadv(r0, &(0x7f0000000940)=[{0x0}, {&(0x7f00000007c0)=""/242, 0xf2}], 0x2, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) shmget$private(0x0, 0x4000, 0x0, &(0x7f0000ffc000/0x4000)=nil) close(0xffffffffffffffff) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000040)) 08:26:42 executing program 2: 08:26:42 executing program 4: 08:26:42 executing program 1: 08:26:42 executing program 5: 08:26:42 executing program 2: 08:26:42 executing program 3: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = msgget$private(0x0, 0x0) msgctl$IPC_RMID(r1, 0x0) recvfrom$inet(r0, 0x0, 0x0, 0x0, 0x0, 0x800e00300) 08:26:42 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) readv(r0, &(0x7f0000001e40)=[{&(0x7f0000000940)=""/246, 0xf6}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x6) r1 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r1, 0x0, 0x73a0b1b, 0x0, 0x0, 0x800e00549) shutdown(r0, 0x0) r2 = socket$inet6_udp(0x1c, 0x2, 0x0) fcntl$dupfd(r2, 0x0, r2) recvfrom$inet(r1, 0x0, 0xa23b, 0x0, 0x0, 0x800e00541) shutdown(r1, 0x0) 08:26:42 executing program 4: socketpair(0x1e, 0x80005, 0x0, &(0x7f0000000340)={0x0, 0x0}) close(r0) recvmsg(r1, &(0x7f000000e980)={0x0, 0x0, &(0x7f000000e900)=[{&(0x7f000000e840)=""/135, 0x87}], 0x1, &(0x7f000000e940)=""/17, 0x11}, 0x0) 08:26:42 executing program 0: r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6100) ftruncate(0xffffffffffffffff, 0x8200) r1 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000006580)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000008100)=[{0x10}], 0x10}}], 0x1, 0x0) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r2, 0x0, 0x8000fffffffa) r3 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r3, &(0x7f00000001c0), 0xffffff7f) 08:26:42 executing program 5: perf_event_open(&(0x7f00000001c0)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x3, 0x73) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x541b, &(0x7f0000000040)) 08:26:42 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mknod$loop(&(0x7f0000000080)='./file0\x00', 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x4007fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='[d::],0::6:\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='ceph\x00', 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='memory.events\x000Y\b/\xe5I\xdd\xdd/fu7\xc6{\x06\xa2\bW]\x05\x7f\xfa\xc3\xed\xbdA~\xb1\xb0+\x1dw{\x12\xd8p\xf9\xd0s\xc2jP\xdd\xca\x9e\x1f\xe8\xe3\xce\xc7\x05\xf7s\xd6\x19\xadj\x90N\\\xf3\x86\xbb\xa9}\x9feIM\xbb\xb7b\vc\xe1c\xf6~}\x0f\xa9\x92x&T\xe7\xc8o\xaa\x86\xfa\xee\xda`H\x87\v\x04b\xc5\x9f%\xd6N\vR^\x13\x84\xddE\xe9', 0x7a05, 0x1700) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000040)=""/119, 0x77}, {&(0x7f00000000c0)=""/106, 0x6a}, {&(0x7f00000001c0)=""/77, 0x4d}, {&(0x7f0000000240)=""/118, 0x76}, {&(0x7f0000000140)=""/31, 0x1f}, {&(0x7f00000003c0)=""/215, 0xd7}, {&(0x7f00000002c0)=""/52, 0x34}], 0x7) 08:26:42 executing program 4: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x6abe7a90a4ff63e1) syz_open_procfs$namespace(0x0, &(0x7f0000000140)='ns/mnt\x00') 08:26:42 executing program 0: r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6100) ftruncate(0xffffffffffffffff, 0x8200) r1 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000006580)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000008100)=[{0x10}], 0x10}}], 0x1, 0x0) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r2, 0x0, 0x8000fffffffa) r3 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r3, &(0x7f00000001c0), 0xffffff7f) 08:26:42 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) readv(r0, &(0x7f0000002980)=[{&(0x7f0000001340)=""/4096, 0x1000}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x6) r1 = dup(r0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0x896e, 0x0, 0x0, 0x800e00519) shutdown(r1, 0x0) r3 = socket$inet_sctp(0x2, 0x1, 0x84) poll(&(0x7f00000000c0)=[{r3}, {}, {}, {}, {}], 0x5, 0x3799) shutdown(r2, 0x0) 08:26:42 executing program 0: r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6100) ftruncate(0xffffffffffffffff, 0x8200) r1 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000006580)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000008100)=[{0x10}], 0x10}}], 0x1, 0x0) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r2, 0x0, 0x8000fffffffa) r3 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r3, &(0x7f00000001c0), 0xffffff7f) 08:26:42 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r0, &(0x7f0000002700)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000001700)=""/4096, 0x1000}, {0x0}], 0x2}, 0x0) r1 = dup(r0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0xfd1d, 0x0, 0x0, 0x800e00516) shutdown(r1, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) readv(r3, &(0x7f00000005c0)=[{&(0x7f00000006c0)=""/4096, 0x1000}, {0x0}], 0x2) r4 = dup(r3) r5 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r5, 0x0, 0x1de, 0x0, 0x0, 0x800e0050e) shutdown(r4, 0x0) r6 = socket$inet6_sctp(0x1c, 0x3, 0x84) readv(r6, &(0x7f0000000400)=[{&(0x7f0000000240)=""/254}, {&(0x7f00000000c0)=""/54, 0x3db}, {&(0x7f0000000340)=""/179}, {&(0x7f0000000100)=""/38}, {&(0x7f0000002740)=""/244}, {&(0x7f0000000140)=""/54}], 0x211) shutdown(r5, 0x0) shutdown(r2, 0x0) 08:26:43 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) readv(r0, &(0x7f0000002980)=[{&(0x7f0000001340)=""/4096, 0x1000}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x6) r1 = dup(r0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0x896e, 0x0, 0x0, 0x800e00519) shutdown(r1, 0x0) poll(&(0x7f00000000c0)=[{}, {}, {}, {}, {}], 0x5, 0x3799) shutdown(r2, 0x0) 08:26:43 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) readv(r0, &(0x7f0000002980)=[{&(0x7f0000001340)=""/4096, 0x1000}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0, 0x17d}], 0x9) r1 = dup(r0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0x896e, 0x0, 0x0, 0x800e00519) shutdown(r1, 0x0) r3 = socket$inet_sctp(0x2, 0x1, 0x84) poll(&(0x7f00000000c0)=[{r3}], 0x1, 0x3799) shutdown(r2, 0x0) 08:26:43 executing program 0: r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ftruncate(r1, 0x8200) r2 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r2, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000006580)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000008100)=[{0x10}], 0x10}}], 0x1, 0x0) r3 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffa) r4 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r4, &(0x7f00000001c0), 0xffffff7f) 08:26:43 executing program 5: poll(&(0x7f0000000000)=[{}, {}, {}, {}], 0x4, 0x49) r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r0, 0x0, 0xfd1d, 0x0, 0x0, 0x800e00509) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$sock_timeval(r2, 0xffff, 0x1006, 0x0, 0x0) recvfrom$inet(r1, 0x0, 0xfec5, 0x0, 0x0, 0x800e00505) shutdown(r1, 0x0) [ 308.403444][ T26] kauditd_printk_skb: 4 callbacks suppressed [ 308.403471][ T26] audit: type=1804 audit(1576052803.471:72): pid=8443 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir900841764/syzkaller.FjxDsF/36/bus" dev="sda1" ino=16643 res=1 08:26:43 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mknod$loop(&(0x7f0000000080)='./file0\x00', 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x4007fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='[d::],0::6:\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='ceph\x00', 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='memory.events\x000Y\b/\xe5I\xdd\xdd/fu7\xc6{\x06\xa2\bW]\x05\x7f\xfa\xc3\xed\xbdA~\xb1\xb0+\x1dw{\x12\xd8p\xf9\xd0s\xc2jP\xdd\xca\x9e\x1f\xe8\xe3\xce\xc7\x05\xf7s\xd6\x19\xadj\x90N\\\xf3\x86\xbb\xa9}\x9feIM\xbb\xb7b\vc\xe1c\xf6~}\x0f\xa9\x92x&T\xe7\xc8o\xaa\x86\xfa\xee\xda`H\x87\v\x04b\xc5\x9f%\xd6N\vR^\x13\x84\xddE\xe9', 0x7a05, 0x1700) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000040)=""/119, 0x77}, {&(0x7f00000000c0)=""/106, 0x6a}, {&(0x7f00000001c0)=""/77, 0x4d}, {&(0x7f0000000240)=""/118, 0x76}, {&(0x7f0000000140)=""/31, 0x1f}, {&(0x7f00000003c0)=""/215, 0xd7}, {&(0x7f00000002c0)=""/52, 0x34}], 0x7) 08:26:43 executing program 0: r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ftruncate(r1, 0x8200) r2 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r2, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000006580)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000008100)=[{0x10}], 0x10}}], 0x1, 0x0) r3 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffa) r4 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r4, &(0x7f00000001c0), 0xffffff7f) [ 308.465287][ T26] audit: type=1804 audit(1576052803.501:73): pid=8443 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir900841764/syzkaller.FjxDsF/36/bus" dev="sda1" ino=16643 res=1 08:26:43 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) readv(r0, &(0x7f0000001e40)=[{&(0x7f0000000940)=""/246, 0xf6}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x6) r1 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r1, 0x0, 0x73a0b1b, 0x0, 0x0, 0x800e00549) shutdown(r0, 0x0) setsockopt$sock_timeval(r1, 0xffff, 0x1006, &(0x7f0000000040)={0x2}, 0x10) r2 = socket$inet6_udp(0x1c, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r3, 0x84, 0x900, 0x0, 0x0) recvfrom$inet(r1, 0x0, 0xa23b, 0x0, 0x0, 0x800e00541) shutdown(r1, 0x0) 08:26:43 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff) unshare(0x40e0200) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0x0, 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x88682, 0x6, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x403}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) r2 = getpid() tkill(r2, 0x9) getsockname$inet(0xffffffffffffffff, 0x0, 0x0) openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0xa100, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stau\x00<#\xfbW*\x1f\x02\x94\xe6\xf3\x1dS\xd1\xe5KM\x9d\x9a\x1fc\xf8xZ\xd1\x88\xa7\xe1\xc8\x88u\xe0[\x18\xa4\xcb:\x9c\xd1-\xce\xa4@\xd8\x93n,e+:G\x1bJ\x7f\xa2\xf6\xe04\x8c\x04\xe5\xf0\xdfK\x1d\xee\xc8;\x15v$\xc5\x9c\x01\x00\xe8\x9ej5|\x00\x00\x00\x00\x00a.\xfd\x1d\xf5\x86\xa7\xec]\xe8\x04\x00\x00\x00\x9c f\x11\x9ay0U\x10\xae\x0es\x96\xd0\xbf\xa0f\xfb4\xbbB\xc6b\xaa\xbc\x82\x99\xff\xf9\xe1\x82.\xd2\xac\xb1\xa5\xa0\xdf.\xaaO\x03\xa1\xa0j\xaf4\xc4Y\x94\xe3\x90\xfe\x04(dl\x90\x8fCqwc2\xc4\x951\x1e\x8e\xb6|s\xfb\x06+w^\x98N>sr\xcal\x18\x9c\xed\x1dC\x8a4\b\xcc\v\x1e@\xe4x5', 0x2761, 0x0) ioctl$FITRIM(r3, 0xc0185879, 0x0) r4 = openat$cgroup_ro(r1, &(0x7f0000000100)='p\xcc\xa5sCevents\x00', 0x2761, 0x0) ioctl$FITRIM(r4, 0xc0185879, &(0x7f0000000040)={0x0, 0x7ffffffc, 0x6}) r5 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stau\x00<#\xfbW*\x1f\x02\x94\xe6\xf3\x1dS\xd1\xe5KM\x9d\x9a\x1fc\xf8xZ\xd1\x88\xa7\xe1\xc8\x88u\xe0[\x18\xa4\xcb:\x9c\xd1-\xce\xa4@\xd8\x93n,e+:G\x1bJ\x7f\xa2\xf6\xe04\x8c\x04\xe5\xf0\xdfK\x1d\xee\xc8;\x15v$\xc5\x9c\x01\x00\xe8\x9ej5|\x00\x00\x00\x00\x00a.\xfd\x1d\xf5\x86\xa7\xec]\xe8\x04\x00\x00\x00\x9c f\x11\x9ay0U\x10\xae\x0es\x96\xd0\xbf\xa0f\xfb4\xbbB\xc6b\xaa\xbc\x82\x99\xff\xf9\xe1\x82.\xd2\xac\xb1\xa5\xa0\xdf.\xaaO\x03\xa1\xa0j\xaf4\xc4Y\x94\xe3\x90\xfe\x04(dl\x90\x8fCqwc2\xc4\x951\x1e\x8e\xb6|s\xfb\x06+w^\x98N>sr\xcal\x18\x9c\xed\x1dC\x8a4\b\xcc\v\x1e@\xe4x5', 0x2761, 0x0) ioctl$FITRIM(r5, 0xc0185879, 0x0) ioctl$RTC_VL_CLR(r5, 0x7014) r6 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r6, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) bind$inet6(r6, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2, &(0x7f0000000300)=0x1, 0x3e1) r7 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r7, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) bind$inet6(r7, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c) ioctl$sock_ifreq(0xffffffffffffffff, 0x8990, &(0x7f0000000240)={'bond0\x00\xe1\x03\n\x00!!\x00\x01\x00', @ifru_names='bond_slave_1\x00\x00\x00\b'}) [ 308.597589][ T26] audit: type=1804 audit(1576052803.661:74): pid=8461 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir900841764/syzkaller.FjxDsF/37/bus" dev="sda1" ino=16519 res=1 08:26:43 executing program 0: r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ftruncate(r1, 0x8200) r2 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r2, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000006580)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000008100)=[{0x10}], 0x10}}], 0x1, 0x0) r3 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffa) r4 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r4, &(0x7f00000001c0), 0xffffff7f) [ 308.648733][ T26] audit: type=1804 audit(1576052803.661:75): pid=8461 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir900841764/syzkaller.FjxDsF/37/bus" dev="sda1" ino=16519 res=1 08:26:43 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff) unshare(0x40e0200) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0x0, 0x5}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0xa) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x88682, 0x6, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x403}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) r2 = getpid() tkill(r2, 0x9) getsockname$inet(0xffffffffffffffff, 0x0, 0x0) openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0xa100, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stau\x00<#\xfbW*\x1f\x02\x94\xe6\xf3\x1dS\xd1\xe5KM\x9d\x9a\x1fc\xf8xZ\xd1\x88\xa7\xe1\xc8\x88u\xe0[\x18\xa4\xcb:\x9c\xd1-\xce\xa4@\xd8\x93n,e+:G\x1bJ\x7f\xa2\xf6\xe04\x8c\x04\xe5\xf0\xdfK\x1d\xee\xc8;\x15v$\xc5\x9c\x01\x00\xe8\x9ej5|\x00\x00\x00\x00\x00a.\xfd\x1d\xf5\x86\xa7\xec]\xe8\x04\x00\x00\x00\x9c f\x11\x9ay0U\x10\xae\x0es\x96\xd0\xbf\xa0f\xfb4\xbbB\xc6b\xaa\xbc\x82\x99\xff\xf9\xe1\x82.\xd2\xac\xb1\xa5\xa0\xdf.\xaaO\x03\xa1\xa0j\xaf4\xc4Y\x94\xe3\x90\xfe\x04(dl\x90\x8fCqwc2\xc4\x951\x1e\x8e\xb6|s\xfb\x06+w^\x98N>sr\xcal\x18\x9c\xed\x1dC\x8a4\b\xcc\v\x1e@\xe4x5', 0x2761, 0x0) ioctl$FITRIM(r4, 0xc0185879, 0x0) r5 = openat$cgroup_ro(r1, &(0x7f0000000100)='p\xcc\xa5sCevents\x00', 0x2761, 0x0) ioctl$FITRIM(r5, 0xc0185879, &(0x7f0000000040)={0x0, 0x7ffffffc, 0x6}) r6 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stau\x00<#\xfbW*\x1f\x02\x94\xe6\xf3\x1dS\xd1\xe5KM\x9d\x9a\x1fc\xf8xZ\xd1\x88\xa7\xe1\xc8\x88u\xe0[\x18\xa4\xcb:\x9c\xd1-\xce\xa4@\xd8\x93n,e+:G\x1bJ\x7f\xa2\xf6\xe04\x8c\x04\xe5\xf0\xdfK\x1d\xee\xc8;\x15v$\xc5\x9c\x01\x00\xe8\x9ej5|\x00\x00\x00\x00\x00a.\xfd\x1d\xf5\x86\xa7\xec]\xe8\x04\x00\x00\x00\x9c f\x11\x9ay0U\x10\xae\x0es\x96\xd0\xbf\xa0f\xfb4\xbbB\xc6b\xaa\xbc\x82\x99\xff\xf9\xe1\x82.\xd2\xac\xb1\xa5\xa0\xdf.\xaaO\x03\xa1\xa0j\xaf4\xc4Y\x94\xe3\x90\xfe\x04(dl\x90\x8fCqwc2\xc4\x951\x1e\x8e\xb6|s\xfb\x06+w^\x98N>sr\xcal\x18\x9c\xed\x1dC\x8a4\b\xcc\v\x1e@\xe4x5', 0x2761, 0x0) ioctl$FITRIM(r6, 0xc0185879, 0x0) ioctl$RTC_VL_CLR(r6, 0x7014) r7 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r7, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) bind$inet6(r7, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c) r8 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r8, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) bind$inet6(r8, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c) ioctl$sock_ifreq(r3, 0x8990, &(0x7f0000000240)={'bond0\x00\xe1\x03\n\x00!!\x00\x01\x00', @ifru_names='bond_slave_1\x00\x00\x00\b'}) r9 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nvram\x00', 0x80000, 0x0) ioctl$KVM_HYPERV_EVENTFD(r9, 0x4018aebd, &(0x7f0000000080)={0x4, 0xffffffffffffffff, 0x1}) [ 308.762133][ T26] audit: type=1804 audit(1576052803.831:76): pid=8474 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir900841764/syzkaller.FjxDsF/38/bus" dev="sda1" ino=16643 res=1 [ 308.786967][ T26] audit: type=1804 audit(1576052803.831:77): pid=8474 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir900841764/syzkaller.FjxDsF/38/bus" dev="sda1" ino=16643 res=1 08:26:43 executing program 5: mkdir(&(0x7f0000000100)='./file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB='lowerdir=.:file0']) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0) lstat(0x0, 0x0) chown(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0) getpid() tkill(0x0, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 08:26:43 executing program 0: fcntl$setstatus(0xffffffffffffffff, 0x4, 0x6100) r0 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ftruncate(r0, 0x8200) r1 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000006580)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000008100)=[{0x10}], 0x10}}], 0x1, 0x0) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r2, 0x0, 0x8000fffffffa) r3 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r3, &(0x7f00000001c0), 0xffffff7f) [ 308.968513][ T8486] overlayfs: overlapping lowerdir path [ 308.994853][ T8486] overlayfs: overlapping lowerdir path [ 309.013643][ T26] audit: type=1804 audit(1576052804.081:78): pid=8490 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir900841764/syzkaller.FjxDsF/39/bus" dev="sda1" ino=16652 res=1 08:26:44 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000100)="2e0000002e00815be00f80ecdb4cb904084865160800030000000000000004140e000a001500cd5edc2976d153b4", 0x2e}], 0x1}, 0x0) [ 309.130000][ T26] audit: type=1804 audit(1576052804.081:79): pid=8490 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir900841764/syzkaller.FjxDsF/39/bus" dev="sda1" ino=16652 res=1 08:26:44 executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$kcm(0xa, 0x802, 0x88) sendmsg$kcm(r1, &(0x7f0000000240)={&(0x7f0000000080)=@in6={0xa, 0x4e24, 0x0, @mcast2}, 0x80, 0x0}, 0x8000) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) 08:26:44 executing program 2: r0 = open(&(0x7f00000009c0)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) r1 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6100) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0xe, 0x0) setsockopt$sock_int(r3, 0x1, 0x7, &(0x7f0000000300), 0x4) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) utimensat(0xffffffffffffffff, 0x0, &(0x7f00000001c0)={{0x0, r4/1000+10000}, {0x77359400}}, 0x0) fallocate(r2, 0x0, 0x0, 0x1000f4) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ftruncate(r1, 0x8200) syz_open_pts(0xffffffffffffffff, 0x10080) ioctl$TCSETSF(0xffffffffffffffff, 0x5412, 0x0) getsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) openat$vsock(0xffffffffffffff9c, 0x0, 0x0, 0x0) renameat2(r2, 0x0, 0xffffffffffffffff, 0x0, 0x5) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = syz_open_procfs(0x0, 0x0) getdents(0xffffffffffffffff, 0x0, 0x0) ioctl$TCSETA(r5, 0x5406, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140)}, 0x0, 0xdf}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$cgroup_type(r1, &(0x7f0000000200)='threaded\x00', 0x175d900f) 08:26:44 executing program 5: syz_mount_image$f2fs(&(0x7f0000000000)='f2fs\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x1, &(0x7f00000002c0)=[{0x0, 0x0, 0x385}], 0x0, 0x0) 08:26:44 executing program 0: fcntl$setstatus(0xffffffffffffffff, 0x4, 0x6100) r0 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ftruncate(r0, 0x8200) r1 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000006580)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000008100)=[{0x10}], 0x10}}], 0x1, 0x0) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r2, 0x0, 0x8000fffffffa) r3 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r3, &(0x7f00000001c0), 0xffffff7f) 08:26:44 executing program 1: prlimit64(0x0, 0xe, 0x0, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = msgget$private(0x0, 0x0) msgctl$IPC_SET(r1, 0x1, &(0x7f0000258f88)) msgrcv(r1, &(0x7f0000000180)={0x0, ""/93}, 0x65, 0x0, 0x0) msgsnd(r1, &(0x7f0000000340)={0x3}, 0x0, 0x0) msgctl$IPC_SET(r1, 0x1, &(0x7f0000000700)={{}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) msgctl$MSG_INFO(r1, 0xc, &(0x7f0000000480)=""/4096) msgctl$IPC_INFO(r1, 0x3, &(0x7f0000000640)=""/4096) write(0xffffffffffffffff, &(0x7f0000000100), 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{0x0}], 0x1, 0x0) sched_setattr(0x0, 0x0, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, 0x100000478) getsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, 0x0, &(0x7f0000000580)=0x80) r4 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getuid() setresuid(0x0, 0x0, 0x0) fchown(0xffffffffffffffff, 0x0, 0x0) setresuid(0x0, 0x0, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r4, 0x89a1, &(0x7f00000000c0)={@local={0xfe, 0x80, [0x600, 0x3ef, 0x0, 0x3f00000000000000, 0x100000000000000, 0x0, 0x1103, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0xfffffffe}) 08:26:44 executing program 4: mknod(&(0x7f00000005c0)='./bus\x00', 0x800b, 0x0) lsetxattr$security_capability(&(0x7f00000000c0)='./bus\x00', &(0x7f0000000100)='security.capability\x00', &(0x7f0000000240)=@v3={0x3000000, [{0xffd}]}, 0x18, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setuid(0xee01) execve(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) 08:26:44 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) sched_rr_get_interval(0x0, 0x0) unlink(&(0x7f0000000100)='./file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x40000000002}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = request_key(&(0x7f0000000180)='dns_resolver\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000340)='[\'eth1-#\x00', 0xffffffffffffffff) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), r4) [ 309.387116][ T8514] F2FS-fs (loop5): Unable to read 1th superblock [ 309.412813][ T8514] F2FS-fs (loop5): Unable to read 2th superblock [ 309.427420][ T26] audit: type=1804 audit(1576052804.481:80): pid=8509 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir900841764/syzkaller.FjxDsF/40/bus" dev="sda1" ino=16655 res=1 08:26:44 executing program 3: socket$unix(0x1, 0x1, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) r2 = syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x0) ioctl$BLKFLSBUF(r2, 0x1261, &(0x7f00000003c0)=0x9) perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528ac06}], 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 309.497111][ T26] audit: type=1804 audit(1576052804.491:81): pid=8509 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir900841764/syzkaller.FjxDsF/40/bus" dev="sda1" ino=16655 res=1 08:26:44 executing program 0: fcntl$setstatus(0xffffffffffffffff, 0x4, 0x6100) r0 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ftruncate(r0, 0x8200) r1 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000006580)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000008100)=[{0x10}], 0x10}}], 0x1, 0x0) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r2, 0x0, 0x8000fffffffa) r3 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r3, &(0x7f00000001c0), 0xffffff7f) 08:26:44 executing program 2: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) mkdir(0x0, 0x0) unlink(&(0x7f0000000100)='./file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = request_key(&(0x7f0000000180)='dns_resolver\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000340)='[\'eth1-#\x00', 0xffffffffffffffff) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, 0x0, r4) [ 309.591138][ T8514] F2FS-fs (loop5): Unable to read 1th superblock 08:26:44 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) sched_rr_get_interval(0x0, 0x0) unlink(&(0x7f0000000100)='./file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x40000000002}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = request_key(&(0x7f0000000180)='dns_resolver\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000340)='[\'eth1-#\x00', 0xffffffffffffffff) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), r4) [ 309.655965][ T8514] F2FS-fs (loop5): Unable to read 2th superblock 08:26:44 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) sched_rr_get_interval(0x0, 0x0) unlink(&(0x7f0000000100)='./file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x40000000002}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = request_key(&(0x7f0000000180)='dns_resolver\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000340)='[\'eth1-#\x00', 0xffffffffffffffff) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), r4) 08:26:44 executing program 0: r0 = creat(0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x6100) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ftruncate(r1, 0x8200) r2 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r2, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000006580)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000008100)=[{0x10}], 0x10}}], 0x1, 0x0) r3 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffa) r4 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r4, &(0x7f00000001c0), 0xffffff7f) 08:26:45 executing program 2: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) mkdir(0x0, 0x0) unlink(&(0x7f0000000100)='./file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = request_key(&(0x7f0000000180)='dns_resolver\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000340)='[\'eth1-#\x00', 0xffffffffffffffff) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, 0x0, r4) 08:26:45 executing program 5: socketpair$unix(0x1, 0x0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="480000002400070500"/20, @ANYRES32, @ANYBLOB="00000400f1ffffff0000000008000100687462001c000200180002000300000000010000000000000800000000000000ce204b707596906260a7cefc"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="340000002500070500"/20, @ANYRES32, @ANYBLOB="0000ffff0000ffff000000000cb40100677265640000000004000200"], 0x34}}, 0x0) 08:26:45 executing program 0: r0 = creat(0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x6100) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ftruncate(r1, 0x8200) r2 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r2, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000006580)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000008100)=[{0x10}], 0x10}}], 0x1, 0x0) r3 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffa) r4 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r4, &(0x7f00000001c0), 0xffffff7f) 08:26:45 executing program 1: prlimit64(0x0, 0xe, 0x0, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = msgget$private(0x0, 0x0) msgctl$IPC_SET(r1, 0x1, &(0x7f0000258f88)) msgrcv(r1, &(0x7f0000000180)={0x0, ""/93}, 0x65, 0x0, 0x0) msgsnd(r1, &(0x7f0000000340)={0x3}, 0x0, 0x0) msgctl$IPC_SET(r1, 0x1, &(0x7f0000000700)={{}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) msgctl$MSG_INFO(r1, 0xc, &(0x7f0000000480)=""/4096) msgctl$IPC_INFO(r1, 0x3, &(0x7f0000000640)=""/4096) write(0xffffffffffffffff, &(0x7f0000000100), 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r2, 0x0, 0x0, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{0x0}], 0x1, 0x0) sched_setattr(0x0, 0x0, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, 0x100000478) getsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, 0x0, &(0x7f0000000580)=0x80) r4 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getuid() setresuid(0x0, 0x0, 0x0) fchown(0xffffffffffffffff, 0x0, 0x0) setresuid(0x0, 0x0, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r4, 0x89a1, &(0x7f00000000c0)={@local={0xfe, 0x80, [0x600, 0x3ef, 0x0, 0x3f00000000000000, 0x100000000000000, 0x0, 0x1103, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0xfffffffe}) socketpair$unix(0x1, 0x0, 0x0, 0x0) 08:26:45 executing program 2: socket$unix(0x1, 0x1, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) r2 = syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x0) ioctl$BLKFLSBUF(r2, 0x1261, &(0x7f00000003c0)) perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528ac06}], 0x1, 0x0) 08:26:45 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) keyctl$join(0x1, &(0x7f0000000240)={'syz', 0x1}) ioctl$DRM_IOCTL_GET_UNIQUE(0xffffffffffffffff, 0xc0106401, 0x0) [ 310.466254][ T8591] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.5'. [ 310.540468][ T8591] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.5'. [ 310.561208][ T8600] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.5'. 08:26:45 executing program 3: inotify_init1(0x0) open(0x0, 0x0, 0x0) r0 = socket(0x1, 0x1, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0) getpeername$netlink(r0, 0x0, 0x0) 08:26:45 executing program 0: r0 = creat(0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x6100) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ftruncate(r1, 0x8200) r2 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r2, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000006580)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000008100)=[{0x10}], 0x10}}], 0x1, 0x0) r3 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffa) r4 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r4, &(0x7f00000001c0), 0xffffff7f) 08:26:45 executing program 4: r0 = getpgrp(0x0) setpriority(0x0, r0, 0xffff) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ppp\x00', 0x101002, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f00000002c0)=""/246) r2 = memfd_create(&(0x7f0000000280)='^\x00', 0x0) pwritev(r2, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a8", 0x1}], 0x1, 0x81003) sendfile(r1, r2, 0x0, 0x102002700) 08:26:45 executing program 5: r0 = creat(&(0x7f0000000380)='./bus\x00', 0x0) lseek(r0, 0x7ffffc, 0x0) ioctl$EXT4_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[@ANYRESDEC], 0xfd14) fallocate(r0, 0x100000003, 0x0, 0x28120001) 08:26:45 executing program 3: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x2000802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket$netlink(0x10, 0x3, 0x16) 08:26:46 executing program 0: r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x6100) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ftruncate(r1, 0x8200) r2 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r2, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000006580)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000008100)=[{0x10}], 0x10}}], 0x1, 0x0) r3 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffa) r4 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r4, &(0x7f00000001c0), 0xffffff7f) 08:26:46 executing program 5: r0 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r0, 0x0, 0x0) creat(&(0x7f0000000100)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x220f1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(0x0, &(0x7f0000000380)='./file0\x00', &(0x7f00000001c0)='nfs\x00\xef\xf1a\x17\x12\x9e\xd0Y\x8a\xa8\xd4', 0x0, &(0x7f0000000000)) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000000c0)) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x0) prctl$PR_SET_PDEATHSIG(0x1, 0x0) open(&(0x7f00000000c0)='./bus\x00', 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x80040, 0x0) fcntl$setlease(r1, 0x400, 0x0) fcntl$setlease(r1, 0x400, 0x2) r2 = open(&(0x7f00000001c0)='./file0\x00', 0x80040, 0x0) fcntl$setlease(r2, 0x400, 0x0) fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) getsockopt$inet6_mreq(r0, 0x29, 0x15, &(0x7f0000000200)={@empty}, &(0x7f0000000240)=0x6d5) r3 = socket$nl_generic(0x10, 0x3, 0x10) getsockname$netlink(r3, &(0x7f0000000000), &(0x7f0000000040)=0xc) connect$packet(r1, 0x0, 0x0) socket(0x0, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) openat$bsg(0xffffffffffffff9c, &(0x7f0000000180)='/dev/bsg\x00', 0x100, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0, 0x0) 08:26:46 executing program 5: perf_event_open(&(0x7f00000001c0)={0x2, 0x70, 0x76, 0x8000000000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setpriority(0x0, 0x0, 0x6) prctl$PR_MCE_KILL(0x21, 0x0, 0x0) 08:26:46 executing program 0: r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x6100) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ftruncate(r1, 0x8200) r2 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r2, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000006580)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000008100)=[{0x10}], 0x10}}], 0x1, 0x0) r3 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffa) r4 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r4, &(0x7f00000001c0), 0xffffff7f) 08:26:46 executing program 1: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_elf64(r0, 0x0, 0x0) write$binfmt_misc(r0, 0x0, 0x0) 08:26:46 executing program 2: socket$unix(0x1, 0x1, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) r2 = syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x0) ioctl$BLKFLSBUF(r2, 0x1261, &(0x7f00000003c0)) perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528ac06}], 0x1, 0x0) 08:26:46 executing program 3: r0 = open(&(0x7f00000001c0)='./file0\x00', 0x80040, 0x0) fcntl$setlease(r0, 0x400, 0x0) exit(0x0) creat(&(0x7f0000000000)='./file0\x00', 0x0) fcntl$getflags(r0, 0x401) 08:26:46 executing program 4: r0 = getpgrp(0x0) setpriority(0x0, r0, 0xffff) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ppp\x00', 0x101002, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f00000002c0)=""/246) r2 = memfd_create(&(0x7f0000000280)='^\x00', 0x0) pwritev(r2, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a8", 0x1}], 0x1, 0x81003) sendfile(r1, r2, 0x0, 0x102002700) 08:26:46 executing program 0: r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x6100) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ftruncate(r1, 0x8200) r2 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r2, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000006580)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000008100)=[{0x10}], 0x10}}], 0x1, 0x0) r3 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffa) r4 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r4, &(0x7f00000001c0), 0xffffff7f) 08:26:46 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f00000000c0)={@empty, 0x77}) ptrace$setopts(0x4206, r2, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0, 0xfffffffffffffe9c}, {&(0x7f0000000140)=""/64, 0xfffffffffffffdbe}], 0x3, 0x0, 0x0, 0x0) tkill(r2, 0x3c) fsetxattr$smack_xattr_label(0xffffffffffffffff, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="68660800a50f000000005cdfc9574f"], 0x1, 0x0) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r2, 0x0, 0x0) 08:26:46 executing program 1: socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0) getgid() setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), 0xc) r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) r2 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', &(0x7f0000000180)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$chown(0x4, r2, r1, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) r3 = socket(0x0, 0x0, 0x88) getsockopt$inet6_mreq(r3, 0x29, 0x1, 0x0, &(0x7f00000001c0)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000000c0)={0x0}, &(0x7f0000000140)=0xc) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x6, 0xe, &(0x7f0000000540)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff3d6405000000000065040400010000000404000001007d60b7030000400000006a0a00fe000000008500000017000000b7000000000000009500000000000000bde05000f227d2ee27cd370a7e678e383e26d5eb467a71272d6cf31ded4035b9fbff345761e1ffb50a754e948031c255c01835758f20542a527530f189e8b937b3bf2780ebf6b2cc0f8bcc63c371e6470300c122d4da1751e883e1e03c52a3cc91f187be12e1d49ec00348a55b485205b36ef41a488237c9fcebf8d5ba244a154018ed2698a8edfe66d277de03317cbfc7afbd6f59acd28a2d237cad742841abfa63ca729c740be74d3ac30481b3b2db6e85b1fe921438b0e982d36486865f3092a570f5702ce8817b634d6d16180c066fae9b9b43cfdbe4e3fdf1d84a69aff196038e555ba97d1ab85858cb963a2b0e1ea525591323fdd399cd33e1c99cd08e3dcf5003496d77183d976f8300"/395], &(0x7f0000000280)='\xd8e_\x9c\xb1\xb1\xd0\xca\xfe\xe8\xc6\xb7y\xc7\x1f\x1c \x828\xf8\xa2Q\x18\xa1\xed\x88MoS\xf6g\xdd\xa1IK\x80\x13(b\x85zO\xf3u\xa9\x9a\xfd `V\xcaRIU\xff\x8a\x80', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000040), 0x0, 0x10, &(0x7f0000000000), 0xfd15}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r5, 0x18000000000002a0, 0x1f, 0x0, &(0x7f0000000500)="b9ff0300000d698cb89e14f008000015ffff00000500638877fbac141414e9", 0x0, 0x100}, 0x28) kcmp$KCMP_EPOLL_TFD(r4, 0xffffffffffffffff, 0x7, r5, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff, 0xffffffff}) 08:26:46 executing program 5: socket$unix(0x1, 0x1, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) r2 = syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x0) ioctl$BLKFLSBUF(r2, 0x1261, &(0x7f00000003c0)) perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528ac06}], 0x1, 0x0) 08:26:46 executing program 0: r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ftruncate(r1, 0x8200) r2 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r2, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000006580)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000008100)=[{0x10}], 0x10}}], 0x1, 0x0) r3 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffa) r4 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r4, &(0x7f00000001c0), 0xffffff7f) 08:26:46 executing program 0: r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ftruncate(r1, 0x8200) r2 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r2, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000006580)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000008100)=[{0x10}], 0x10}}], 0x1, 0x0) r3 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffa) r4 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r4, &(0x7f00000001c0), 0xffffff7f) 08:26:47 executing program 4: prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x6, 0xe, &(0x7f0000000540)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff3d6405000000000065040400010000000404000001007d60b7030000400000006a0a00fe000000008500000017000000b7000000000000009500000000000000bde05000f227d2ee27cd370a7e678e383e26d5eb467a71272d6cf31ded4035b9fbff345761e1ffb50a754e948031c255c01835758f20542a527530f189e8b937b3bf2780ebf6b2cc0f8bcc63c371e6470300c122d4da1751e883e1e03c52a3cc91f187be12e1d49ec00348a55b485205b36ef41a488237c9fcebf8d5ba244a154018ed2698a8edfe66d277de03317cbfc7afbd6f59acd28a2d237cad742841abfa63ca729c740be74d3ac30481b3b2db6e85b1fe921438b0e982d36486865f3092a570f5702ce8817b634d6d16180c066fae9b9b43cfdbe4e3fdf1d84a69aff196038e555ba97d1ab85858cb963a2b0e1ea525591323fdd399cd33e1c99cd08e3dcf5003496d77183d976f8300"/395], &(0x7f0000000280)='\xd8e_\x9c\xb1\xb1\xd0\xca\xfe\xe8\xc6\xb7y\xc7\x1f\x1c \x828\xf8\xa2Q\x18\xa1\xed\x88MoS\xf6g\xdd\xa1IK\x80\x13(b\x85zO\xf3u\xa9\x9a\xfd `V\xcaRIU\xff\x8a\x80', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000040), 0x0, 0x10, &(0x7f0000000000), 0xfd15}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0x1f, 0x0, &(0x7f0000000500)="b9ff0300000d698cb89e14f008000015ffff00000500638877fbac141414e9", 0x0, 0x100}, 0x28) 08:26:47 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{0x0, 0x0, 0x0}, 0xfffffffd}], 0x1, 0x0, 0x0) getsockopt$bt_BT_SNDMTU(0xffffffffffffffff, 0x112, 0xc, 0x0, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x3) perf_event_open(&(0x7f00000003c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) keyctl$search(0xa, 0x0, 0x0, 0x0, 0x0) recvmsg(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, 0x0}, 0x1a1) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) syz_emit_ethernet(0x1a, &(0x7f00000005c0)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @random="931ccfe3d616", [{[], {0x8100, 0x4}}], {@llc_tr={0x11, {@snap={0x1fe, 0xab, 'P', '/!>', 0x884c}}}}}, &(0x7f0000000080)={0x0, 0x1, [0xdbb, 0x0, 0x0, 0x67d]}) setsockopt$bt_BT_SNDMTU(r0, 0x112, 0xc, &(0x7f00000002c0)=0x5, 0x2) 08:26:47 executing program 0: r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ftruncate(r1, 0x8200) r2 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r2, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000006580)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000008100)=[{0x10}], 0x10}}], 0x1, 0x0) r3 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffa) r4 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r4, &(0x7f00000001c0), 0xffffff7f) 08:26:47 executing program 2: mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x2, 0x840000000000a132, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r0, &(0x7f0000000140), 0xff4d) sendfile(r2, r1, &(0x7f0000000040)=0x1600, 0x100000001) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00&\x86\x17x+y\xa5\xa8\x1e\xea/=\x9f\xdf\xa1y\xd0\x13\xe6T$\xb1\xfd2\xd76\xc0\xc3\xb2{\xbf\xb2\x14\xf6\x8a\xc8\x9c\x89\xa0b\x10\"\xe40\x93#\\\xcd\xb0aP,\xff\x9f\f\x89\xb9\xa9\xe2\xd6\t\"\f\xde\x00oO:\xba\x14\xdc\xe7H=\xb6\xfb\x96%\xc1\x95\xb4\xad\x98\x870\x92\xb0en{\xea\xdc\xa9+\xbb\xd7\x01\x03d\xb9\x92L\xaf\xe8\t\x80R*1\x12\x10\x9a\x01\xb2\xa2lLN\xde\xd6\xed\xa5\x06\xc5\xad\x8fs \'\v\xc3\x10#\x9f\x90\xe3Q\xc7\xf3;l\xe8{\x19\xc33v\xc35\xde^T&\xee\xd1\x90L\x87\xcb\xc8.\x1c\xae?\xf5\xd9\x9d\x98\"g\xf3\xa7gVv<\x92\t\xe0\xd5\xc8\xca\xda\xe4N\xc9p\x82\x1f=6\x1e\x92\xb9\xd6!.\xb0\xa5\xfcp\n\xd4J\x05n\x101oC\xb6', 0x275a, 0x0) 08:26:47 executing program 4: prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x6, 0xe, &(0x7f0000000540)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff3d6405000000000065040400010000000404000001007d60b7030000400000006a0a00fe000000008500000017000000b7000000000000009500000000000000bde05000f227d2ee27cd370a7e678e383e26d5eb467a71272d6cf31ded4035b9fbff345761e1ffb50a754e948031c255c01835758f20542a527530f189e8b937b3bf2780ebf6b2cc0f8bcc63c371e6470300c122d4da1751e883e1e03c52a3cc91f187be12e1d49ec00348a55b485205b36ef41a488237c9fcebf8d5ba244a154018ed2698a8edfe66d277de03317cbfc7afbd6f59acd28a2d237cad742841abfa63ca729c740be74d3ac30481b3b2db6e85b1fe921438b0e982d36486865f3092a570f5702ce8817b634d6d16180c066fae9b9b43cfdbe4e3fdf1d84a69aff196038e555ba97d1ab85858cb963a2b0e1ea525591323fdd399cd33e1c99cd08e3dcf5003496d77183d976f8300"/395], &(0x7f0000000280)='\xd8e_\x9c\xb1\xb1\xd0\xca\xfe\xe8\xc6\xb7y\xc7\x1f\x1c \x828\xf8\xa2Q\x18\xa1\xed\x88MoS\xf6g\xdd\xa1IK\x80\x13(b\x85zO\xf3u\xa9\x9a\xfd `V\xcaRIU\xff\x8a\x80', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000040), 0x0, 0x10, &(0x7f0000000000), 0xfd15}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0x1f, 0x0, &(0x7f0000000500)="b9ff0300000d698cb89e14f008000015ffff00000500638877fbac141414e9", 0x0, 0x100}, 0x28) 08:26:47 executing program 0: r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6100) r1 = creat(0x0, 0x0) ftruncate(r1, 0x8200) r2 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r2, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000006580)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000008100)=[{0x10}], 0x10}}], 0x1, 0x0) r3 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffa) r4 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r4, &(0x7f00000001c0), 0xffffff7f) 08:26:47 executing program 3: prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x6, 0xe, &(0x7f0000000540)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff3d6405000000000065040400010000000404000001007d60b7030000400000006a0a00fe000000008500000017000000b7000000000000009500000000000000bde05000f227d2ee27cd370a7e678e383e26d5eb467a71272d6cf31ded4035b9fbff345761e1ffb50a754e948031c255c01835758f20542a527530f189e8b937b3bf2780ebf6b2cc0f8bcc63c371e6470300c122d4da1751e883e1e03c52a3cc91f187be12e1d49ec00348a55b485205b36ef41a488237c9fcebf8d5ba244a154018ed2698a8edfe66d277de03317cbfc7afbd6f59acd28a2d237cad742841abfa63ca729c740be74d3ac30481b3b2db6e85b1fe921438b0e982d36486865f3092a570f5702ce8817b634d6d16180c066fae9b9b43cfdbe4e3fdf1d84a69aff196038e555ba97d1ab85858cb963a2b0e1ea525591323fdd399cd33e1c99cd08e3dcf5003496d77183d976f8300"/395], &(0x7f0000000280)='\xd8e_\x9c\xb1\xb1\xd0\xca\xfe\xe8\xc6\xb7y\xc7\x1f\x1c \x828\xf8\xa2Q\x18\xa1\xed\x88MoS\xf6g\xdd\xa1IK\x80\x13(b\x85zO\xf3u\xa9\x9a\xfd `V\xcaRIU\xff\x8a\x80', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000040), 0x0, 0x10, &(0x7f0000000000), 0xfd15}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0x1f, 0x0, &(0x7f0000000500)="b9ff0300000d698cb89e14f008000015ffff00000500638877fbac141414e9", 0x0, 0x100}, 0x28) 08:26:47 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{0x0, 0x0, 0x0}, 0xfffffffd}], 0x1, 0x0, 0x0) getsockopt$bt_BT_SNDMTU(0xffffffffffffffff, 0x112, 0xc, 0x0, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x3) perf_event_open(&(0x7f00000003c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) keyctl$search(0xa, 0x0, 0x0, 0x0, 0x0) recvmsg(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, 0x0}, 0x1a1) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/igmp\x00') preadv(r1, &(0x7f00000017c0), 0x1000000000000277, 0x400000000000) syz_emit_ethernet(0x1a, &(0x7f00000005c0)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @random="931ccfe3d616", [{[], {0x8100, 0x4}}], {@llc_tr={0x11, {@snap={0x1fe, 0xab, 'P', '/!>', 0x884c}}}}}, &(0x7f0000000080)={0x0, 0x1, [0xdbb, 0x0, 0x0, 0x67d]}) setsockopt$bt_BT_SNDMTU(r0, 0x112, 0xc, &(0x7f00000002c0)=0x5, 0x2) 08:26:47 executing program 0: r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6100) r1 = creat(0x0, 0x0) ftruncate(r1, 0x8200) r2 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r2, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000006580)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000008100)=[{0x10}], 0x10}}], 0x1, 0x0) r3 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffa) r4 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$eventfd(r4, &(0x7f00000001c0), 0xffffff7f) [ 312.659072][ C0] ================================================================== [ 312.667230][ C0] BUG: KCSAN: data-race in virtqueue_disable_cb / virtqueue_get_buf_ctx [ 312.675552][ C0] [ 312.677893][ C0] read to 0xffff88812a9b52b0 of 2 bytes by interrupt on cpu 1: [ 312.685444][ C0] virtqueue_get_buf_ctx+0x4da/0x5c0 [ 312.690737][ C0] virtqueue_get_buf+0x29/0x40 [ 312.695502][ C0] free_old_xmit_skbs+0x9e/0x170 [ 312.700448][ C0] start_xmit+0xd3/0xbe0 [ 312.704722][ C0] dev_hard_start_xmit+0xef/0x430 [ 312.709753][ C0] sch_direct_xmit+0x2b3/0x900 [ 312.714518][ C0] __dev_queue_xmit+0x19a3/0x1b40 [ 312.719541][ C0] dev_queue_xmit+0x21/0x30 [ 312.724047][ C0] ip_finish_output2+0x836/0xe40 [ 312.728991][ C0] __ip_finish_output+0x23a/0x490 [ 312.734023][ C0] ip_finish_output+0x41/0x160 [ 312.738800][ C0] ip_output+0xdf/0x210 [ 312.742963][ C0] ip_local_out+0x74/0x90 [ 312.747295][ C0] __ip_queue_xmit+0x3a8/0xa40 [ 312.752061][ C0] ip_queue_xmit+0x45/0x60 [ 312.756486][ C0] __tcp_transmit_skb+0xe81/0x1d60 [ 312.761597][ C0] __tcp_send_ack+0x246/0x300 [ 312.766289][ C0] tcp_send_ack+0x34/0x40 [ 312.770762][ C0] __tcp_ack_snd_check+0xd9/0x4f0 [ 312.775800][ C0] tcp_rcv_established+0xce9/0xf50 [ 312.780917][ C0] tcp_v4_do_rcv+0x3b5/0x520 [ 312.785542][ C0] tcp_v4_rcv+0x19ec/0x1bd0 [ 312.790052][ C0] ip_protocol_deliver_rcu+0x4d/0x420 [ 312.795427][ C0] ip_local_deliver_finish+0x110/0x140 [ 312.800891][ C0] ip_local_deliver+0x133/0x210 [ 312.805745][ C0] ip_rcv_finish+0x121/0x160 [ 312.810341][ C0] ip_rcv+0x18f/0x1a0 [ 312.814326][ C0] __netif_receive_skb_one_core+0xa7/0xe0 [ 312.820045][ C0] __netif_receive_skb+0x37/0xf0 [ 312.824992][ C0] netif_receive_skb_internal+0x59/0x190 [ 312.830636][ C0] napi_gro_receive+0x28f/0x330 [ 312.835761][ C0] receive_buf+0x284/0x30b0 [ 312.840270][ C0] virtnet_poll+0x436/0x7d0 [ 312.844773][ C0] net_rx_action+0x3ae/0xa90 [ 312.850407][ C0] __do_softirq+0x115/0x33f [ 312.854909][ C0] irq_exit+0xbb/0xe0 [ 312.858896][ C0] do_IRQ+0x81/0x130 [ 312.862802][ C0] ret_from_intr+0x0/0x19 [ 312.867139][ C0] __tsan_read1+0x86/0x100 [ 312.871556][ C0] memcmp+0x3c/0x70 [ 312.875365][ C0] strstr+0x5a/0x80 [ 312.879173][ C0] tomoyo_supervisor+0xc00/0xd20 [ 312.884239][ C0] tomoyo_path_permission+0x121/0x160 [ 312.889619][ C0] tomoyo_path_perm+0x23e/0x390 [ 312.894476][ C0] tomoyo_inode_getattr+0x26/0x40 [ 312.899505][ C0] security_inode_getattr+0x9b/0xd0 [ 312.904714][ C0] vfs_getattr+0x2e/0x70 [ 312.909024][ C0] vfs_statx_fd+0x7a/0xd0 [ 312.913375][ C0] __do_sys_newfstat+0x49/0xa0 [ 312.918146][ C0] __x64_sys_newfstat+0x3a/0x50 [ 312.923000][ C0] do_syscall_64+0xcc/0x370 [ 312.927513][ C0] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 312.933393][ C0] [ 312.935730][ C0] write to 0xffff88812a9b52b0 of 2 bytes by interrupt on cpu 0: [ 312.943371][ C0] virtqueue_disable_cb+0xe9/0x130 [ 312.948492][ C0] skb_xmit_done+0x6a/0x110 [ 312.952992][ C0] vring_interrupt+0x1a1/0x1c0 [ 312.957859][ C0] __handle_irq_event_percpu+0x9a/0x430 [ 312.963504][ C0] handle_irq_event_percpu+0x4b/0xe0 [ 312.968963][ C0] handle_irq_event+0x85/0xca [ 312.973642][ C0] handle_edge_irq+0x1a4/0x4a0 [ 312.978415][ C0] do_IRQ+0x7c/0x130 [ 312.982294][ C0] ret_from_intr+0x0/0x19 [ 312.986661][ C0] __sanitizer_cov_trace_switch+0x9/0x80 [ 312.992289][ C0] __read_once_size+0x25/0xe0 [ 312.996997][ C0] lock_hrtimer_base+0x4e/0xf0 [ 313.001849][ C0] hrtimer_try_to_cancel+0x97/0x260 [ 313.007147][ C0] hrtimer_cancel+0x20/0x50 [ 313.011669][ C0] futex_wait+0x37a/0x3f0 [ 313.015982][ C0] do_futex+0xe9/0x18d0 [ 313.020261][ C0] __x64_sys_futex+0x2cd/0x3f0 [ 313.025114][ C0] do_syscall_64+0xcc/0x370 [ 313.029722][ C0] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 313.035644][ C0] [ 313.037963][ C0] Reported by Kernel Concurrency Sanitizer on: [ 313.045079][ C0] CPU: 0 PID: 8714 Comm: syz-executor.2 Not tainted 5.4.0-syzkaller #0 [ 313.053535][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 313.063690][ C0] ================================================================== [ 313.071746][ C0] Kernel panic - not syncing: panic_on_warn set ... [ 313.078599][ C0] CPU: 0 PID: 8714 Comm: syz-executor.2 Not tainted 5.4.0-syzkaller #0 [ 313.086872][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 313.096917][ C0] Call Trace: [ 313.100188][ C0] [ 313.103079][ C0] dump_stack+0x11d/0x181 [ 313.107938][ C0] panic+0x210/0x640 [ 313.111830][ C0] ? vprintk_func+0x8d/0x140 [ 313.117147][ C0] kcsan_report.cold+0xc/0xd [ 313.121735][ C0] kcsan_setup_watchpoint+0x3fe/0x460 [ 313.127185][ C0] __tsan_unaligned_write2+0xc4/0x100 [ 313.132552][ C0] virtqueue_disable_cb+0xe9/0x130 [ 313.137661][ C0] skb_xmit_done+0x6a/0x110 [ 313.142158][ C0] ? virtnet_poll_tx+0x1d0/0x1d0 [ 313.147088][ C0] vring_interrupt+0x1a1/0x1c0 [ 313.151855][ C0] ? virtqueue_enable_cb+0x40/0x40 [ 313.156989][ C0] __handle_irq_event_percpu+0x9a/0x430 [ 313.163844][ C0] handle_irq_event_percpu+0x4b/0xe0 [ 313.169172][ C0] handle_irq_event+0x85/0xca [ 313.173843][ C0] handle_edge_irq+0x1a4/0x4a0 [ 313.178603][ C0] do_IRQ+0x7c/0x130 [ 313.182491][ C0] common_interrupt+0xf/0xf [ 313.187089][ C0] [ 313.190026][ C0] RIP: 0010:__sanitizer_cov_trace_switch+0x9/0x80 [ 313.196441][ C0] Code: 00 55 48 89 f2 48 89 fe bf 07 00 00 00 48 89 e5 48 8b 4d 08 e8 98 fe ff ff 5d c3 66 0f 1f 44 00 00 55 48 89 fa 48 89 e5 41 55 <41> 54 49 89 f4 53 48 8b 46 08 48 83 f8 20 74 55 77 3a 48 83 f8 08 [ 313.216040][ C0] RSP: 0018:ffffc90000d8bb28 EFLAGS: 00000293 ORIG_RAX: ffffffffffffffd6 [ 313.224448][ C0] RAX: ffff8880a4ab3080 RBX: 0000000000000008 RCX: ffffffff813ae548 [ 313.232409][ C0] RDX: 0000000000000008 RSI: ffffffff84e391c0 RDI: 0000000000000008 [ 313.240373][ C0] RBP: ffffc90000d8bb30 R08: ffff8880a4ab3080 R09: 0000c90000d8bc88 [ 313.248339][ C0] R10: 0000000000000000 R11: 0000c90000d8bb6b R12: ffffc90000d8bc80 [ 313.256302][ C0] R13: ffffc90000d8bb68 R14: ffffc90000d8bc50 R15: ffffc90000d8bc80 [ 313.264273][ C0] ? hrtimer_try_to_cancel+0x48/0x260 [ 313.269651][ C0] __read_once_size+0x25/0xe0 [ 313.274325][ C0] lock_hrtimer_base+0x4e/0xf0 [ 313.279086][ C0] hrtimer_try_to_cancel+0x97/0x260 [ 313.284287][ C0] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 313.290511][ C0] hrtimer_cancel+0x20/0x50 [ 313.294999][ C0] futex_wait+0x37a/0x3f0 [ 313.299315][ C0] ? refcount_sub_and_test_checked+0xc8/0x190 [ 313.305385][ C0] ? hrtimer_active+0x1a0/0x1a0 [ 313.310231][ C0] do_futex+0xe9/0x18d0 [ 313.314371][ C0] ? __handle_mm_fault+0x84e/0x2c70 [ 313.319568][ C0] ? __read_once_size+0x5a/0xe0 [ 313.324421][ C0] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 313.330129][ C0] ? ktime_get+0x1c4/0x210 [ 313.334530][ C0] __x64_sys_futex+0x2cd/0x3f0 [ 313.339294][ C0] do_syscall_64+0xcc/0x370 [ 313.343791][ C0] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 313.349666][ C0] RIP: 0033:0x45a849 [ 313.353549][ C0] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 313.373134][ C0] RSP: 002b:00007ffdfff4f978 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 313.381530][ C0] RAX: ffffffffffffffda RBX: 00000000000003e8 RCX: 000000000045a849 [ 313.389490][ C0] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000075bfd4 [ 313.397487][ C0] RBP: 000000000000002d R08: ffffffffffffffff R09: ffffffffffffffff [ 313.405445][ C0] R10: 00007ffdfff4fa50 R11: 0000000000000246 R12: 000000000075bfc8 [ 313.413442][ C0] R13: 000000000004c547 R14: 000000000004c574 R15: 000000000075bfd4 [ 313.422281][ C0] Kernel Offset: disabled [ 313.426608][ C0] Rebooting in 86400 seconds..