, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "606fd3c586c8212f"}}, 0x48}}, 0x0) 09:37:45 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r1, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r3, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r2) accept4(r3, 0x0, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x7, 0x0) 09:37:45 executing program 3: openat$usbmon(0xffffffffffffff9c, &(0x7f0000000140)='/dev/usbmon0\x00', 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet6(0xa, 0x3, 0x88) openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee67, 0x401, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xdfffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000200)) perf_event_open(0x0, 0x0, 0xffffffffffffffff, r0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, 0x0, 0x0) getpid() perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffff9c, 0x0) openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) setsockopt$inet6_MRT6_ADD_MFC_PROXY(r1, 0x29, 0xd2, &(0x7f0000000480)={{0xa, 0x0, 0x1, @rand_addr="b015d2c9e964e064c0086e5006663b87", 0x1}, {0xa, 0x0, 0x400, @rand_addr="533428461f4b78c688a09785281a4779"}, 0x4, [0x0, 0x0, 0x7, 0x4, 0x64bc, 0x800, 0x384, 0x80000001]}, 0x5c) perf_event_open(&(0x7f00000002c0)={0x8000000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet_SIOCRTMSG(0xffffffffffffffff, 0x890d, &(0x7f0000000340)={0x0, {0x2, 0x4e20, @multicast2}, {0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x2, 0x4e22, @remote}, 0x8, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)='bcsf0\x00', 0x8}) sendto$inet(r2, 0x0, 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000440)='veth1\x00\x06\x00\xd6\x01\x00', 0x10) sendmsg$alg(0xffffffffffffffff, &(0x7f0000001100)={0x0, 0x0, &(0x7f00000010c0)=[{&(0x7f0000000000)="a7ce", 0x2}], 0x1}, 0x0) socket(0x0, 0xa, 0xfffffffffffffffb) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, 0x0, 0x0) ioctl$PPPIOCGUNIT(0xffffffffffffffff, 0x80047456, &(0x7f0000000500)) sendto$inet(r2, &(0x7f0000000000), 0xffffff45, 0x0, 0x0, 0xfffffffffffffdb9) setsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000240), 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6e, &(0x7f0000000000)=0x4, 0x16a) 09:37:45 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) 09:37:45 executing program 4: 09:37:45 executing program 1: r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'vxcan1\x00', 0x0}) connect$can_bcm(r0, &(0x7f0000000000)={0x1d, r1}, 0x10) sendmsg$can_bcm(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000600)={0x1, 0x43, 0x2, {0x0, 0x2710}, {0x0, 0x7530}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "606fd3c586c8212f"}}, 0x48}}, 0x0) [ 2552.795173][ C1] net_ratelimit: 17 callbacks suppressed [ 2552.795194][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2552.800954][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2552.800995][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2552.806722][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2553.674871][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2553.680760][ C1] protocol 88fb is buggy, dev hsr_slave_1 09:37:47 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r4, 0x0, 0x6, 0x0) readv(r3, &(0x7f0000000400)=[{&(0x7f00000003c0)=""/26, 0x3}], 0x100000000000025c) timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(0x0, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:37:47 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) 09:37:47 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r1, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r3, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r2) accept4(r3, 0x0, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x7, 0x0) 09:37:47 executing program 3: 09:37:47 executing program 1: 09:37:47 executing program 4: 09:37:47 executing program 1: 09:37:47 executing program 4: 09:37:47 executing program 3: [ 2553.821611][ C1] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 2553.834911][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2553.840708][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2553.846520][ C1] protocol 88fb is buggy, dev hsr_slave_0 09:37:48 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) 09:37:48 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r1, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r3, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r2) accept4(r3, 0x0, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x7, 0x0) 09:37:48 executing program 3: 09:37:48 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r4, 0x0, 0x6, 0x0) readv(r3, &(0x7f0000000400)=[{&(0x7f00000003c0)=""/26, 0x3}], 0x100000000000025c) timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(0x0, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:37:48 executing program 4: 09:37:48 executing program 1: 09:37:48 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) 09:37:48 executing program 3: 09:37:48 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r1, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r3, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r2) accept4(r3, 0x0, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x7, 0x0) 09:37:48 executing program 4: 09:37:48 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, 0xffffffffffffffff) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000140), 0x8) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_BTF_GET_FD_BY_ID(0x13, 0x0, 0x0) 09:37:48 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r4, 0x0, 0x6, 0x0) readv(r3, &(0x7f0000000400)=[{&(0x7f00000003c0)=""/26, 0x3}], 0x100000000000025c) timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(0x0, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:37:48 executing program 3: syz_open_dev$usbmon(&(0x7f00000008c0)='/dev/usbmon#\x00', 0x0, 0x4002) 09:37:48 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4309(aegis256-generic)\x00'}, 0x58) 09:37:48 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) 09:37:48 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r1, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r3, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r2) splice(r2, 0x0, r1, 0x0, 0x7, 0x0) 09:37:48 executing program 3: r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000004cc0)={0x2, 0x0, @multicast1}, 0x10) 09:37:48 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) close(r2) accept4(r1, 0x0, 0x0, 0x0) close(r2) 09:37:48 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r4, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:37:48 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r1, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r3, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r2) splice(r2, 0x0, r1, 0x0, 0x7, 0x0) 09:37:48 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) 09:37:48 executing program 3: r0 = socket$inet(0xa, 0x801, 0x84) listen(r0, 0x8) accept4(r0, 0x0, 0x0, 0x0) 09:37:48 executing program 1: socket$inet(0x2b, 0x0, 0x2000000000001) 09:37:48 executing program 4: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) close(r0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000240)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_LISTEN(r0, &(0x7f0000000000)={0x7, 0x8}, 0x10) 09:37:48 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r1, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r3, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r2) splice(r2, 0x0, r1, 0x0, 0x7, 0x0) 09:37:48 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x6, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r3, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:37:49 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) 09:37:49 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/snmp\x00') recvmmsg(0xffffffffffffffff, &(0x7f0000004200)=[{{0x0, 0x0, &(0x7f0000001bc0)=[{&(0x7f0000001ac0)=""/94, 0x5e}], 0x1}}], 0x1, 0x0, 0x0) preadv(r0, &(0x7f00000017c0), 0x100000000000019d, 0x4000000000000000) 09:37:49 executing program 3: r0 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) write$P9_RREMOVE(r0, &(0x7f0000000280)={0x1}, 0xff7f) r1 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) ftruncate(r1, 0x2081fc) r2 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) r3 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) fcntl$setstatus(r3, 0x4, 0x40400) write$FUSE_WRITE(r3, &(0x7f0000000080)={0x18}, 0x18) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r0}) 09:37:49 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x6, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r3, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:37:49 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r1, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r3, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) accept4(r3, 0x0, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x7, 0x0) 09:37:49 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @rand_addr="d214c0e12eb5e6ea076cca63e0537907"}, 0x1c) 09:37:49 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) connect$inet6(0xffffffffffffffff, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) 09:37:49 executing program 1: recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, &(0x7f0000000100)={@empty}, 0x20) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='net/anycast6\x00') preadv(r1, &(0x7f00000017c0), 0x3a8, 0x0) 09:37:49 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x6, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r3, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:37:49 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) connect$inet6(0xffffffffffffffff, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) 09:37:49 executing program 4: openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x106242, 0x0) 09:37:49 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x6, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000000)={0x7}, 0x176) 09:37:49 executing program 3: r0 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) write$P9_RREMOVE(r0, &(0x7f0000000280)={0x1}, 0xff7f) r1 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) ftruncate(r1, 0x2081fc) r2 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) r3 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) fcntl$setstatus(r3, 0x4, 0x40400) write$FUSE_WRITE(r3, &(0x7f0000000080)={0x18}, 0x18) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r0}) 09:37:49 executing program 1: r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r0, 0x8) r1 = accept4(r0, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x78, 0x0, 0x0) 09:37:49 executing program 4: pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = accept4$inet(r0, 0x0, 0x0, 0x80000) write(r0, &(0x7f00000001c0), 0xfffffef3) link(&(0x7f0000000180)='./file0\x00', 0x0) syz_open_procfs(0x0, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000080)={0x2, 0x2004e23, @broadcast}, 0x10) socket$packet(0x11, 0x0, 0x300) getsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000, 0x0, 0x0, 0x0, @perf_config_ext={0x8, 0x7}, 0x0, 0x7e0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$packet(0x11, 0xb, 0x300) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) bind$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4, 0x7}, 0x1c) setsockopt$sock_int(r3, 0x1, 0xe49d428c730620c2, &(0x7f0000000440)=0x3, 0xfffffffffffffe0f) r4 = socket$inet6(0xa, 0x2, 0xffffffffffffffff) setsockopt$IP_VS_SO_SET_STARTDAEMON(r1, 0x0, 0x48b, &(0x7f00000004c0)={0x2, 'team_slave_1\x00', 0x1}, 0xfffc) recvfrom(r0, &(0x7f0000000380)=""/72, 0x48, 0x3, 0x0, 0x0) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000200)=0x0) ptrace$peek(0x1, r5, &(0x7f00000002c0)) setsockopt$sock_int(r2, 0x1, 0x40000000000002e, &(0x7f0000000280)=0x70cc, 0xffffffffffffffb6) openat$cgroup_procs(r0, &(0x7f0000000400)='cgroup.threads\x00', 0x2, 0x0) bind$inet6(r4, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev}}, 0x1c) getitimer(0x0, &(0x7f0000000500)) getpid() mknod$loop(&(0x7f0000000040)='./file0\x00', 0x8000, 0x1) creat(&(0x7f00000007c0)='./file0\x00', 0x0) unlink(&(0x7f0000000340)='./file0\x00') sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r2, &(0x7f0000000980)="e8cb67772aef989a62fcbd59de746c1967d56d3f94ee42196953a9e3047d3ee1e5ef72e994f4be651252966115c805d577067f8c53868f321002ea04ae21ed0e66714ca37a543acea4dddbbd895961d1c7124bc3f6026c4723b0f08daa56d95260075ee94f8f54c037907908e5f7daffedf8a2884062a8624ffde3e539a145ede8f4062435895bfd449d37c1008eb45c670ddc89008f70267020763ba9eb47361808c73c5387d26bc3f13884c501f54641bbae8ce7859103b1773d45eec4159de85c95d03f26c0cadef3c8f3cf24798a21cd7ecd0ea8a41150e6f212fbc30c731110aae6f5894080c35eb2c01306a892cb82ee0000000000000000561b63ec75cbb0b63039bbe6cd91a13b9add7043700e6801fdaf4007d0f7567341c98387769e53443a7d23b4454a13de86461263980185d0ab211159d11140f2dcf16c261949c606077ffa6c31707e6a50a4f50ed8c49c22761b6c19ad4a06a4cbae3516efa8aa15ad9398350000000000009ed9386bb858c7dcd6e24299f9adc14d36fec0c081e3cde01e7ab8a5bb0e155e25bdb1226aa84b547c6e56af9b44b3367ca54cd1530ad467a1b95c4a2840c708e328a5c762f6532f61609efbe393f8236246ddcb5dc6d782176d465c73d289", 0xffffffffffffff74, 0x8000, 0x0, 0x0) shutdown(r2, 0x2) 09:37:49 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) connect$inet6(0xffffffffffffffff, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) [ 2557.834851][ C1] net_ratelimit: 20 callbacks suppressed [ 2557.834859][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2557.846435][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2558.004905][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2558.010761][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2558.016575][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2558.022359][ C1] protocol 88fb is buggy, dev hsr_slave_1 09:37:52 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r1, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r3, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) accept4(r3, 0x0, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x7, 0x0) 09:37:52 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x6, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000000)={0x7}, 0x176) 09:37:52 executing program 1: bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x8, 0x2, &(0x7f0000346fc8)=@framed={{}, [@alu]}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [0xff5ffe5f]}, 0x48) 09:37:52 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) 09:37:52 executing program 3: r0 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x0, 0x2) write$vhci(r0, 0x0, 0x0) 09:37:52 executing program 4: r0 = socket(0x1, 0x1, 0x0) sendmsg$inet(r0, &(0x7f0000001480)={&(0x7f0000000000)={0x2, 0x0, @local}, 0x10, &(0x7f0000001400), 0x6, &(0x7f0000001680), 0x38}, 0x0) 09:37:52 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x6, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000000)={0x7}, 0x176) 09:37:52 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/kvm\x00', 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000040)={0x0, 0x0, @pic={0x0, 0x5}}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[], 0x0, 0xffffffffffffffff}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:37:52 executing program 3: r0 = memfd_create(&(0x7f0000003380)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>\x9b\x94a\xac\xf8R?\x1c\xe2\xb5!\xfa\xcb\xd4\xb6\xe1_\xb4d>\xf6\xb7h\xb9Uql\b0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r2, 0x0, 0x6, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r3, 0x1000000000016) write$P9_RWSTAT(r1, &(0x7f0000000000)={0x7}, 0x176) [ 2558.439723][T16733] set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. 09:37:53 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r1, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r3, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) accept4(r3, 0x0, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x7, 0x0) 09:37:53 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='net/anycast6\x00') preadv(r0, &(0x7f00000017c0), 0x3a8, 0x7a) 09:37:53 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) 09:37:53 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000600)='/dev/dsp\x00', 0x0, 0x0) poll(&(0x7f0000000640)=[{r0}, {r1}], 0x2, 0x4) 09:37:53 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r2, 0x0, 0x6, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r3, 0x1000000000016) write$P9_RWSTAT(r1, &(0x7f0000000000)={0x7}, 0x176) 09:37:53 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_MIGRATE_ID(r1, &(0x7f0000000100)={0x12, 0x10, 0xfa00, {0x0, r2, r0}}, 0x18) [ 2559.034879][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2559.034894][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2559.040771][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2559.046471][ C1] protocol 88fb is buggy, dev hsr_slave_1 09:37:53 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) 09:37:53 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, 0x0}}, 0x20) 09:37:53 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r2, 0x0, 0x6, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r3, 0x1000000000016) write$P9_RWSTAT(r1, &(0x7f0000000000)={0x7}, 0x176) 09:37:53 executing program 1: r0 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f0000000140)={0x0, @vbi}) 09:37:53 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) 09:37:53 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x3a) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x0, 0x0, @dev, 0x3}, 0x1c) r1 = open(&(0x7f0000000040)='./bus\x00', 0x8001141042, 0x0) ftruncate(r1, 0x2008002) sendfile(r0, r1, 0x0, 0x8482) [ 2559.578295][ T26] audit: type=1800 audit(1567849073.688:225): pid=16790 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="bus" dev="sda1" ino=18131 res=0 09:37:54 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r1, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r3, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) close(r2) accept4(r3, 0x0, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x7, 0x0) 09:37:54 executing program 2: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r2, 0x0, 0x6, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r3, 0x1000000000016) write$P9_RWSTAT(r1, &(0x7f0000000000)={0x7}, 0x176) 09:37:54 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000040)={0x0, 0x0, @pic={0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f}}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[], 0x0, 0xffffffffffffffff}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:37:54 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) 09:37:54 executing program 3: ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000340)={'nr0\x01\x00', 0x1002}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, 0xffffffffffffffff) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x0, 0x70, 0x0, 0x5efa, 0x0, 0x7, 0x0, 0x0, 0x0, 0x9, 0x5, 0x0, 0x20, 0x742, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, 0x0, 0x0, 0x0, 0x1, 0x400, 0x4, 0x0, 0x0, 0x0, 0x101, 0x6, @perf_config_ext={0x6, 0x8001}, 0x0, 0x9, 0x0, 0x0, 0xfffffffffffffff8, 0x4000000000000}, 0x0, 0x8, r0, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000040)=ANY=[@ANYPTR64], 0xff39) write$cgroup_pid(r2, &(0x7f0000000000), 0x10000000d) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001c00)='memory.events\x00', 0x7a05, 0x1700) 09:37:54 executing program 4: ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000340)={'nr0\x01\x00', 0x1002}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x0, 0x70, 0x0, 0x5efa, 0x0, 0x7, 0x0, 0x0, 0x0, 0x9, 0x5, 0x0, 0x20, 0x742, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, 0x0, 0x0, 0x0, 0x1, 0x400, 0x4, 0x0, 0x0, 0x0, 0x101, 0x6, @perf_config_ext={0x6, 0x8001}, 0x0, 0x9, 0x0, 0x0, 0xfffffffffffffff8, 0x4000000000000}, 0x0, 0x8, r0, 0x8) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000040)=ANY=[@ANYPTR64], 0xff39) write$cgroup_pid(r2, &(0x7f0000000000), 0x10000000d) 09:37:54 executing program 0: bind$inet6(0xffffffffffffffff, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(0xffffffffffffffff, 0x10001) r0 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r0, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r0, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) [ 2560.042392][T16802] set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. 09:37:54 executing program 2: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r2, 0x0, 0x6, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r3, 0x1000000000016) write$P9_RWSTAT(r1, &(0x7f0000000000)={0x7}, 0x176) 09:37:54 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETQUEUE(r0, 0x5452, &(0x7f0000000040)={'ip6_vti0\x00'}) 09:37:54 executing program 0: bind$inet6(0xffffffffffffffff, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(0xffffffffffffffff, 0x10001) r0 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r0, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r0, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) 09:37:54 executing program 3: r0 = socket$caif_seqpacket(0x25, 0x5, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x311c1510df59826, 0x1) 09:37:54 executing program 2: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r2, 0x0, 0x6, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r3, 0x1000000000016) write$P9_RWSTAT(r1, &(0x7f0000000000)={0x7}, 0x176) 09:37:54 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r1, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r3, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) close(r2) accept4(r3, 0x0, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x7, 0x0) 09:37:54 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="11dca50d5e0bcfe47bf070") syz_mount_image$msdos(&(0x7f0000000000)='msdos\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)={[{@nodots='nodots'}]}) 09:37:54 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'teql0\x00', 0x102}) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000440)={0x33d, 0x0}) 09:37:54 executing program 0: bind$inet6(0xffffffffffffffff, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(0xffffffffffffffff, 0x10001) r0 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r0, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r0, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) 09:37:54 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r2, 0x0, 0x6, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r3, 0x1000000000016) write$P9_RWSTAT(r1, &(0x7f0000000000)={0x7}, 0x176) 09:37:54 executing program 4: ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000340)={'nr0\x01\x00', 0x1002}) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x0, 0x70, 0x0, 0x5efa, 0x0, 0x7, 0x0, 0x0, 0x0, 0x9, 0x5, 0x0, 0x20, 0x742, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, 0x0, 0x0, 0x0, 0x1, 0x400, 0x4, 0x0, 0x0, 0x0, 0x101, 0x6, @perf_config_ext={0x6, 0x8001}, 0x0, 0x9, 0x0, 0x0, 0xfffffffffffffff8, 0x4000000000000}, 0x0, 0x8, r0, 0x8) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000040)=ANY=[@ANYPTR64], 0xff39) write$cgroup_pid(r2, &(0x7f0000000000), 0x10000000d) 09:37:55 executing program 0: r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) 09:37:55 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r2, 0x0, 0x6, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r3, 0x1000000000016) write$P9_RWSTAT(r1, &(0x7f0000000000)={0x7}, 0x176) [ 2560.936034][T16846] FAT-fs (loop1): bogus number of reserved sectors [ 2560.955890][T16846] FAT-fs (loop1): Can't find a valid FAT filesystem 09:37:55 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x0, 0x0, @loopback}, 0x1c) [ 2561.065228][T16855] FAT-fs (loop1): bogus number of reserved sectors [ 2561.160180][T16855] FAT-fs (loop1): Can't find a valid FAT filesystem 09:37:55 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r2, 0x0, 0x6, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r3, 0x1000000000016) write$P9_RWSTAT(r1, &(0x7f0000000000)={0x7}, 0x176) 09:37:55 executing program 0: r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) 09:37:55 executing program 1: sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x501e}) r1 = socket$kcm(0x29, 0x80000000000005, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') write$cgroup_subtree(r0, &(0x7f00000000c0)={[{0x0, '\x03\x86\xdd'}]}, 0xfdef) [ 2561.461140][T16881] device nr0 entered promiscuous mode 09:37:55 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r1, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r3, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) close(r2) accept4(r3, 0x0, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x7, 0x0) 09:37:55 executing program 3: 09:37:55 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r4, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:37:55 executing program 0: r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) 09:37:55 executing program 4: 09:37:55 executing program 3: [ 2561.806310][T16881] device nr0 entered promiscuous mode 09:37:56 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000140)="11dca50d5e0bcfe47bf070") r1 = gettid() prctl$PR_SET_PTRACER(0x59616d61, r1) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0, 0xffffffffffffff9b}, {&(0x7f0000000100)="a4ab12f700db4b2b4d2f2f3ff7ad273b1e89e46f905080af4c0100b170e60b3a8bf56db763e3062d037dca291318d0a17288318b04aeb1747555ba16ea10e6ddb915ceb6397e514f3482ca3c4a1d3b9b3c08eaba138725c4fe54204eaa3d026ef9000000000000", 0x60}], 0x4, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x38) ptrace$cont(0x18, r2, 0x0, 0x0) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 09:37:56 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) 09:37:56 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r4, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:37:56 executing program 3: ioctl$sock_inet_udp_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) getegid() mlockall(0x1) openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ppp\x00', 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000180)='./file0\x00', 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) 09:37:56 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) 09:37:56 executing program 1: 09:37:56 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r1, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r3, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) syz_genetlink_get_family_id$SEG6(0x0) close(r2) accept4(r3, 0x0, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x7, 0x0) 09:37:56 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r4, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:37:56 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) 09:37:56 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x1}, 0xe) 09:37:56 executing program 1: 09:37:56 executing program 3: 09:37:56 executing program 3: 09:37:56 executing program 1: 09:37:57 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, 0x0, 0x0) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) 09:37:57 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r4, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:37:57 executing program 1: 09:37:57 executing program 4: [ 2563.194843][ C1] net_ratelimit: 16 callbacks suppressed [ 2563.194850][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2563.194867][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2563.200563][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2563.206291][ C0] protocol 88fb is buggy, dev hsr_slave_1 09:37:57 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r1, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r3, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) syz_genetlink_get_family_id$SEG6(0x0) close(r2) accept4(r3, 0x0, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x7, 0x0) 09:37:57 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, 0x0, 0x0) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) 09:37:57 executing program 3: 09:37:57 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r4, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:37:57 executing program 4: 09:37:57 executing program 1: 09:37:57 executing program 3: 09:37:57 executing program 4: 09:37:57 executing program 1: 09:37:57 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, 0x0, 0x0) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) 09:37:57 executing program 3: 09:37:57 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r4, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) [ 2564.084862][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2564.090628][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2564.244848][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2564.250776][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2564.256592][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2564.262334][ C1] protocol 88fb is buggy, dev hsr_slave_1 09:37:58 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r1, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r3, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) syz_genetlink_get_family_id$SEG6(0x0) close(r2) accept4(r3, 0x0, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x7, 0x0) 09:37:58 executing program 1: 09:37:58 executing program 3: 09:37:58 executing program 4: 09:37:58 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500), 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) 09:37:58 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r4, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:37:58 executing program 1: 09:37:58 executing program 3: 09:37:58 executing program 4: 09:37:58 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500), 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) 09:37:58 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r4, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:37:58 executing program 3: 09:37:59 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r1, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r3, 0x0) sendto$inet6(r2, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r2) accept4(r3, 0x0, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x7, 0x0) 09:37:59 executing program 1: 09:37:59 executing program 4: 09:37:59 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500), 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) 09:37:59 executing program 3: 09:37:59 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r4, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:37:59 executing program 4: 09:37:59 executing program 1: 09:37:59 executing program 3: 09:37:59 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(0xffffffffffffffff, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) 09:37:59 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0b") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r4, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:37:59 executing program 1: 09:38:00 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r1, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r3, 0x0) sendto$inet6(r2, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r2) accept4(r3, 0x0, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x7, 0x0) 09:38:00 executing program 4: 09:38:00 executing program 3: 09:38:00 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000002c0)="2e00000010008108040f80ecdb4cb9c00a480e1810000000e8bd6efb120009000e000100060000ff050005001204", 0x2e}], 0x1}, 0x0) 09:38:00 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0b") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r4, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:38:00 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(0xffffffffffffffff, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) 09:38:00 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cbcmac(des-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)='\b\x00\x00\x00\x00\x00\x00\x00', 0x8) r1 = accept4$alg(r0, 0x0, 0x0, 0x0) sendmmsg$sock(r1, &(0x7f0000003980)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 09:38:00 executing program 4: sendmsg(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="5500000018007f6800fe01b2a4a280930a060001fe80000214000000390009", 0x1f}], 0x1}, 0x0) r0 = socket(0x10, 0x800000000080003, 0x0) write(0xffffffffffffffff, &(0x7f0000000000)="240000001a0025f0006bb4f7fdff141c0a0700006f10b500002780cc08", 0x1d) sendmmsg$alg(r0, &(0x7f0000000140)=[{0x0, 0xd2efff7f00000000, &(0x7f0000000100), 0xa, &(0x7f0000000100)}], 0x492492492492805, 0x0) 09:38:00 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(0xffffffffffffffff, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) 09:38:00 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000002c0)="2e00000010008108040f80ecdb4cb9c00a480e1810000000e8bd6efb120009000e000100060000ff050005001204", 0x2e}], 0x1}, 0x0) 09:38:00 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0b") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r4, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:38:00 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:01 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r1, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r3, 0x0) sendto$inet6(r2, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r2) accept4(r3, 0x0, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x7, 0x0) 09:38:01 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x0) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) 09:38:01 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47b") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r4, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:38:01 executing program 1: munmap(&(0x7f000001d000/0x4000)=nil, 0x4000) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x3d, 0x0) write$binfmt_aout(r0, &(0x7f00000000c0)=ANY=[], 0xffffff78) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000180)) ioctl$TCSETA(r0, 0x5406, &(0x7f00000002c0)) r1 = syz_open_pts(r0, 0x0) dup3(r1, r0, 0x0) read(0xffffffffffffffff, 0x0, 0x0) 09:38:01 executing program 4: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0x22, 0x0, &(0x7f0000000100)="b901000000000000009e40f008001fffffe100004000630677fbac141414e9a33fa1", 0x0, 0x0, 0x6000000000000000}, 0x28) 09:38:01 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:01 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x0) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) 09:38:01 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000140)="11dca50d5e0bcfe47bf070") clone(0x80001100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='load '], 0x1, 0x0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180)={'syz'}, &(0x7f0000000100), 0xca, 0xfffffffffffffffe) 09:38:01 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47b") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r4, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:38:01 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x0) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) 09:38:01 executing program 1: recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, &(0x7f0000000100)={@empty}, 0x20) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='net/anycast6\x00') preadv(r1, &(0x7f00000017c0), 0x3a8, 0x7a) [ 2567.435043][T17120] encrypted_key: master key parameter '' is invalid 09:38:01 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x0, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) [ 2567.495511][T17130] encrypted_key: master key parameter '' is invalid 09:38:02 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r1, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r2) accept4(r3, 0x0, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x7, 0x0) 09:38:02 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47b") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r4, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:38:02 executing program 4: syz_open_procfs(0x0, &(0x7f0000000080)='net/sockstat\x00') 09:38:02 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mmap(&(0x7f0000000000/0xff7000)=nil, 0xff7000, 0x1004000000001001, 0x2000000008071, 0xffffffffffffffff, 0x0) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000001300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "bc6844e3273d26ce02000000226e94e117245ea7a2007e146861a0772e000000000f000000000000000000000000004000", "0ec832aa3708000000b25804d52cc4092a46931c5c31b6be78e000ed298300"}) socket$nl_xfrm(0x10, 0x3, 0x6) 09:38:02 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x0, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) 09:38:02 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:02 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000600)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_CARRIER={0x8}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x0) 09:38:02 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf0") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r4, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:38:02 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r1, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r2) accept4(r3, 0x0, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x7, 0x0) 09:38:02 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x0, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) [ 2568.234864][ C1] net_ratelimit: 14 callbacks suppressed [ 2568.234871][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2568.246492][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2568.340161][T17174] netlink: 'syz-executor.4': attribute type 33 has an invalid length. 09:38:02 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf0") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r4, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:38:02 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) [ 2568.395211][T17174] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 2568.410629][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2568.416443][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2568.422226][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2568.427996][ C1] protocol 88fb is buggy, dev hsr_slave_1 09:38:02 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r1, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r2) accept4(r3, 0x0, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x7, 0x0) 09:38:02 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000340)='\x00\xaf1\x00\x00\xe8\xee\xc9\x96\xc2;\xaf\t\xa8M*\xe4;~y\xb2\xb3\xba\b;/\xb6&\xa5\xaa\xcec\x1e\x8a;\xea;P\xb5w_2\f\xe5\xcc`\xa0\xce\xf0+\x19v\xb9I\xdf\xfe\x13\xd9\x1a\xd6;+\x16\x05\x1aul>\x82@\x0f\xdf\xcd\x99\x9a\x13\xe2[F\xf08\xa6D\x97\xb5\x1f\xf3\xe9\xd5\xbf\x13k\xbc)\xa1nbx\x9c\x02\xa6p?\x12\x89\nAr\xe9Q\xb0\x80Q\x8e\xf2\xf0yX\x9b\x96\xa4\x8b\x01f\xe0\x04\xbd\x93K!\xa0D-\xfc\x12\x02\xe2\xb5WQ\xb4\xb1\xf2\x16)\xc8\b\xc2\x99\x9a\xd9\xa6p\xedK\xb5\x8b\xe8\xbf\xa0\f\x9a\xa1\x13\xd78Mt$\x06\xb6c\xd0Y\x05\xd1l\x98|0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r4, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:38:03 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) 09:38:03 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r1, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r3, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r2) accept4(r3, 0x0, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x7, 0x0) 09:38:03 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='/group.stat\x00', 0x2761, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x42c462c55a135728, 0x0, 0x0, 0x3a74bea9, 0x7, 0x0, 0x9, 0x0, 0x7ff, 0xffffffff00000001, 0x2, 0x0, 0x5ff, 0x100000000000, 0x0, 0x1f, 0x0, 0x7fff, 0x6, 0x607, 0x0, 0x4, 0x0, 0x5, 0x0, 0xd09, 0x4, 0x1000, 0x0, 0x0, 0x0, 0x5, 0x2, @perf_config_ext={0x0, 0x8fa}, 0x88a98700bcf47ad, 0x0, 0x0, 0x0, 0x0, 0x5}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x8) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r0 = getpid() perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000040), 0x12) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 09:38:03 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:03 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) 09:38:03 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r4, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:38:03 executing program 4: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup\x00', 0x200002, 0x0) openat$cgroup_ro(r0, &(0x7f0000000100)='cpu.stat\x00', 0x2761, 0x0) 09:38:03 executing program 1: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1fb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0x22, 0x0, &(0x7f0000000100)="b901000000000000009e40f008001fffffe100004000630677fbac141414e9a33fa1", 0x0, 0x0, 0x6000000000000000}, 0x28) 09:38:03 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, 0x0, 0x0) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) 09:38:03 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r4, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:38:03 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r1, &(0x7f0000006880)={0x0, 0x0, 0x0}, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) 09:38:03 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:03 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r4, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) [ 2569.434886][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2569.434890][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2569.434956][ C1] protocol 88fb is buggy, dev hsr_slave_1 09:38:03 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r1, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r3, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r2) accept4(r3, 0x0, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x7, 0x0) 09:38:03 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0xed15}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r0, &(0x7f0000000380)={&(0x7f0000000140)=@id={0x1e, 0x3, 0x0, {0x4e24}}, 0x10, &(0x7f0000000240)}, 0x0) 09:38:03 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, 0x0, 0x0) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) 09:38:03 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, 0x0) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x6, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000000)={0x7}, 0x176) 09:38:03 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x7, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) getpid() getpid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(0xffffffffffffffff, 0x40086602, 0x0) write$cgroup_pid(r0, &(0x7f0000000040), 0x12) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001c00)='memory.events\x00', 0x7a05, 0x1700) 09:38:03 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:04 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, 0x0) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x6, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000000)={0x7}, 0x176) 09:38:04 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, 0x0, 0x0) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) 09:38:04 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, 0x0) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x6, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000000)={0x7}, 0x176) 09:38:04 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) 09:38:04 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:04 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x7, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) getpid() getpid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(0xffffffffffffffff, 0x40086602, 0x0) write$cgroup_pid(r0, &(0x7f0000000040), 0x12) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001c00)='memory.events\x00', 0x7a05, 0x1700) 09:38:04 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r1, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r3, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r2) accept4(r3, 0x0, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x7, 0x0) 09:38:04 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0xed15}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r0, &(0x7f0000000380)={&(0x7f0000000140)=@id={0x1e, 0x3, 0x0, {0x4e24}}, 0x10, &(0x7f0000000240)}, 0x0) 09:38:04 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(0x0) splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x6, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r3, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:38:04 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) 09:38:04 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x7, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) getpid() getpid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(0xffffffffffffffff, 0x40086602, 0x0) write$cgroup_pid(r0, &(0x7f0000000040), 0x12) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001c00)='memory.events\x00', 0x7a05, 0x1700) 09:38:04 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:04 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) 09:38:04 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(0x0) splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x6, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r3, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:38:05 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0xed15}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r0, &(0x7f0000000380)={&(0x7f0000000140)=@id={0x1e, 0x3, 0x0, {0x4e24}}, 0x10, &(0x7f0000000240)}, 0x0) 09:38:05 executing program 4: 09:38:05 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) 09:38:05 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(0x0) splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x6, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r3, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:38:05 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r1, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r3, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r2) accept4(r3, 0x0, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x7, 0x0) 09:38:05 executing program 4: 09:38:05 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:05 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) 09:38:05 executing program 1: 09:38:05 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(0xffffffffffffffff, 0x0, r2, 0x0, 0x6, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r3, 0x1000000000016) write$P9_RWSTAT(r1, &(0x7f0000000000)={0x7}, 0x176) 09:38:05 executing program 1: socket$unix(0x1, 0x0, 0x0) pipe(0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$GIO_CMAP(0xffffffffffffffff, 0x4b70, 0x0) openat$cgroup_subtree(0xffffffffffffffff, 0x0, 0x2, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self\x00', 0x200240, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) r0 = gettid() write$P9_RRENAMEAT(0xffffffffffffffff, 0x0, 0x0) setreuid(0x0, 0x0) setuid(0x0) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) prctl$PR_SET_PDEATHSIG(0x1, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x1c9c380}, {0x0, 0x9}}, 0x0) inotify_init1(0x0) tkill(r0, 0x1000000000016) 09:38:05 executing program 4: gettid() socketpair$nbd(0x1, 0x1, 0x0, 0x0) epoll_create(0x0) readv(0xffffffffffffffff, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) inotify_init1(0x0) timer_settime(0x0, 0x0, 0x0, 0x0) getsockopt$sock_int(r0, 0x1, 0x9, 0x0, 0x0) 09:38:05 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}, {0x10}], 0x20}}], 0x1, 0x0) 09:38:05 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(0xffffffffffffffff, 0x0, r2, 0x0, 0x6, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r3, 0x1000000000016) write$P9_RWSTAT(r1, &(0x7f0000000000)={0x7}, 0x176) 09:38:06 executing program 4: write$P9_RREMOVE(0xffffffffffffffff, 0x0, 0x1a427f762e0bb594) r0 = gettid() fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='smaps\x00') ioctl$sock_SIOCSPGRP(r1, 0x8902, &(0x7f0000000600)) accept4$inet(r1, &(0x7f00000000c0)={0x2, 0x0, @dev}, &(0x7f0000000100)=0x10, 0x0) r2 = gettid() tkill(r2, 0x1000000000016) ioctl$sock_FIOSETOWN(0xffffffffffffffff, 0x8901, &(0x7f0000000040)=r2) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) ioctl$sock_ifreq(0xffffffffffffffff, 0x8938, &(0x7f0000000180)={'rose0\x00', @ifru_addrs=@xdp={0x2c, 0x3, 0x0, 0xb}}) r4 = epoll_create(0x9) fstat(r4, 0x0) r5 = add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff8) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r5, 0x0, 0x0) add_key(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) keyctl$get_persistent(0x16, 0x0, 0x0) setsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000001c0)={{{@in6=@mcast1, @in6=@initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x4e21, 0x4, 0x0, 0x0, 0x2, 0x80, 0xa0, 0x16, r3}, {0x40, 0x1, 0x719c, 0x0, 0x7fff, 0x571, 0x200}, {0xb90, 0x9, 0x0, 0x9}, 0x4, 0x6e6bc0, 0x2, 0x0, 0x3}, {{@in6=@initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x4d3, 0xbb}, 0x7abe4889d9bdb858, @in6=@empty, 0x0, 0x1, 0x0, 0x100, 0x16}}, 0xe8) ioctl$TIOCLINUX7(0xffffffffffffffff, 0x541c, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) pivot_root(0x0, 0x0) ioctl$TIOCGWINSZ(0xffffffffffffffff, 0x5413, 0x0) ioctl$TIOCSPGRP(r1, 0x5410, &(0x7f00000003c0)=r2) tkill(r0, 0x1000000000016) 09:38:06 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r1, 0x0, 0x0, 0x0) 09:38:06 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r1, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r3, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r2) accept4(r3, 0x0, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x7, 0x0) 09:38:06 executing program 1: 09:38:06 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(0xffffffffffffffff, 0x0, r2, 0x0, 0x6, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r3, 0x1000000000016) write$P9_RWSTAT(r1, &(0x7f0000000000)={0x7}, 0x176) 09:38:06 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:06 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r1, 0x0, 0x0, 0x0) 09:38:06 executing program 1: 09:38:06 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)) splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x6, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r3, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:38:06 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r1, 0x0, 0x0, 0x0) 09:38:06 executing program 1: 09:38:06 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 2573.594856][ C1] net_ratelimit: 17 callbacks suppressed [ 2573.594862][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2573.594907][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2573.600620][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2574.484843][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2574.490606][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2574.634871][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2574.640727][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2574.646578][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2574.652324][ C1] protocol 88fb is buggy, dev hsr_slave_1 09:38:09 executing program 4: 09:38:09 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000006900), 0x0, 0x0) 09:38:09 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)) splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x6, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r3, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:38:09 executing program 1: 09:38:09 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:09 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r1, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r3, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r2) accept4(r3, 0x0, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x7, 0x0) 09:38:09 executing program 1: 09:38:09 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000006900), 0x0, 0x0) 09:38:09 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)) splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x6, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r3, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:38:09 executing program 4: r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bpf$OBJ_GET_PROG(0x7, 0x0, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) pipe2(0x0, 0x0) accept4$packet(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, 0x0) pipe2(0x0, 0x0) accept4$packet(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, 0x0) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000008, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmsg$TIPC_NL_PEER_REMOVE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1d149e63fb86627fd26d9b2e0d31164363f12ec08976a201159bf589ef3a607454836b25b2ea51bad7407caac26bb7556374fd1d8795914317b65362cc1b8c7b00c92c6d80c6889db2c744e812ea550000000000001dc666d02dbb9b645416f974ac5ef63e35f109eac5fd"], 0x1}}, 0x4c080) r2 = syz_open_procfs(0x0, &(0x7f0000000200)='net/tcp6\x00') preadv(r2, &(0x7f0000000240)=[{&(0x7f00000000c0)=""/162, 0xa2}], 0x1, 0x0) 09:38:09 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000006900), 0x0, 0x0) 09:38:09 executing program 1: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @loopback}, 0x10) close(r0) 09:38:09 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x0, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r4, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) [ 2575.212020][T17421] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. 09:38:09 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:09 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 09:38:09 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x0, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r4, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:38:09 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @local}}, 0x1c) [ 2575.674852][ C1] protocol 88fb is buggy, dev hsr_slave_0 09:38:09 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r1, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r2) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x7, 0x0) 09:38:09 executing program 4: pkey_mprotect(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000015, 0xffffffffffffffff) 09:38:09 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 09:38:09 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x0, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r4, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:38:09 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000140), 0x0) r1 = dup(r0) ioctl$int_in(r1, 0x5421, &(0x7f0000000040)) 09:38:09 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:10 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 09:38:10 executing program 4: clock_gettime(0x4, &(0x7f00000003c0)) 09:38:10 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) r4 = gettid() timer_create(0x0, 0x0, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r4, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:38:10 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:10 executing program 1: perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) open(&(0x7f0000000380)='./file0\x00', 0x0, 0x0) 09:38:10 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r1, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r2) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x7, 0x0) 09:38:10 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) 09:38:10 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) r4 = gettid() timer_create(0x0, 0x0, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r4, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:38:10 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}], 0x10}}], 0x1, 0x0) 09:38:10 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r1, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r2) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x7, 0x0) 09:38:10 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}], 0x10}}], 0x1, 0x0) 09:38:10 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:10 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000080)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) 09:38:10 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) r4 = gettid() timer_create(0x0, 0x0, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r4, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:38:10 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r1, 0x0, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r3, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r2) accept4(r3, 0x0, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x7, 0x0) 09:38:10 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}], 0x10}}], 0x1, 0x0) 09:38:10 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x890b, &(0x7f00000001c0)={'bridge_slave_0\x00?'}) 09:38:10 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x0, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r4, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:38:11 executing program 4: clock_adjtime(0x0, &(0x7f00000004c0)) 09:38:11 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}], 0x10}}], 0x1, 0x0) 09:38:11 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:11 executing program 1: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f000000d000)={0xa, 0x4e20}, 0x1c) connect$inet6(r1, &(0x7f000000cfe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmsg(r1, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) 09:38:11 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}], 0x10}}], 0x1, 0x0) 09:38:11 executing program 4: r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) write$cgroup_type(r0, &(0x7f0000000100)='threaded\x00', 0xffffffffffffff1f) unlink(&(0x7f00000004c0)='./file0\x00') mknod(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) 09:38:11 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000300)={0xa, 0x8000002}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, 0x0) sendto$packet(r0, &(0x7f0000000340), 0xfffffffffffffd72, 0x4000800, 0x0, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, r0, 0x0) 09:38:11 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000006900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000041c0)=[{0x10}], 0x10}}], 0x1, 0x0) 09:38:11 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r1, 0x0, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r3, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r2) accept4(r3, 0x0, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x7, 0x0) 09:38:11 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x2, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000001c0)={'veth0\x00', 0x201a}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000140)={'veth0\x00'}) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @rand_addr="d214c0e12eb5e6ea076cca63e0537907"}, 0x1c) 09:38:11 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 2578.634843][ C1] net_ratelimit: 13 callbacks suppressed [ 2578.634848][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2578.646328][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2578.794840][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2578.800690][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2578.806455][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2578.812179][ C1] protocol 88fb is buggy, dev hsr_slave_1 09:38:13 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x0, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r4, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:38:13 executing program 4: inotify_add_watch(0xffffffffffffffff, 0x0, 0x2000062) 09:38:13 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @empty}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x0, 0x1}, 0xe) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:38:13 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) 09:38:13 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) recvmmsg(r0, &(0x7f0000002d80), 0x400000000000368, 0x0, &(0x7f0000000180)={0x77359400}) sendmsg$nl_generic(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1100000042000501000000366ab1001000ed623c087d41ee19776b1d9ada6676c7517f97b2d2add33be3693e6a4c651514fd9a9c7c4b9d5f8e1656e057a8cbb9cd3712f039298f55000000000000000000"], 0x14}}, 0x0) 09:38:13 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r1, 0x0, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r3, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r2) accept4(r3, 0x0, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x7, 0x0) 09:38:13 executing program 4: sendmmsg$alg(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000040)=0x2000000000000074, 0x4) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='bbr\x00', 0x3) sendto$inet(r0, &(0x7f0000000640)="3232ce2774e7a3797748648df71c7b4542839e347be35844e42ad67454cd5e140e0ab73493d6b6921681e5536dbc0f309747cc199a7f9a20d01e04d55fb1c26504e3e4738aac76780b5c2363a6dc4d10fe9adc2b363abf6981a31f6a58ef2103e7a145b11649eac6d4cc29a315faf899c2e35d08b1974199c08bf4798207b78d8dd89e727382318265acc85a4444869dfc22ba7fd79b455635a715fa1e705070e2857ef21a3076cdfc2c29b26547360add94ef9c349ae62f54e7a90e1aae762a11b2cc6bd720034fac41f1de628e2a3166ec21e03c68a60708328e1606a83211bc78be79097861ce52747ac474593d76f9ec5cdd91725cb16e62b4bb027fbb96eab344de0401076c6345a7d32e9fe9ba1e68ac07081a7d1e0ed1eb9e96b41214af554f1831dfd8bd2b466789f4295317d17c138abe5fa9044a44792e9aecfb3f9130ff673786a8ef2b14c4999c29a5713c2fb5e35f2fae0d58b64355a697efd45e36528e57c68a62c6edc7879962e05419c7c5fa64ec92e670821df50d0f3a7312d2120f363954e72ba0322fc4318f819b1e2b1a17fb939a5db9c1a0a83b44abcffc3dd555d4dd30c0a4bd524c29d4d57bc906c012446c99a882162f3f72cce0702d7394288807fe2a308e01adc9bbf2a9cd78fabaa3c10640777e0813726a70df3323924035b235fd39ae4ab08d3f09bd231b38dca4389b098b0d3538dd3ef5bf068c1df8fbe00b0b2aa9ec3de5d3fba56594328a643c2799b8371adc6ecdfd9b9c4e52102eaa83b57da14645e442b4b7ad5f555d872dc50c330d145ca853b768b990dbaa18ab7f7e2e2d695e980f96d646e8c893ad912bc71237e9aa3ef2d8a40b5629ca02a82556bd433a7222dc3257fd6ace72b00b6f8c9d621c54f777ee5fd1fc59d11a7ea96855d58bb21d40d1bbdfecad8ed15a25062f7692e1879793657f91b6c78d739ef6811d677cf64b4346ac28740f143d5fd3e00e15416e2dbc76c17b1c09fd0b4065d2252b29370c8ec3", 0x2d1, 0x0, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0x1da9, 0x4) recvmsg(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001dc0)=[{&(0x7f00000002c0)=""/186, 0xba}, {&(0x7f00000000c0)=""/62, 0x3e}], 0x2}, 0x0) sendto$inet(r0, &(0x7f0000000180)="20268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf9221a7511bf746bec66ba5c0fe3ac47b61db6b4c41bd1a5259e62506cda287b857aac", 0x8293, 0x4000002, 0x0, 0x27) 09:38:13 executing program 0: uselib(0x0) 09:38:13 executing program 0: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mremap(&(0x7f000014d000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f000030a000/0x1000)=nil) r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) mmap(&(0x7f0000a05000/0x400000)=nil, 0x400000, 0x0, 0x8012, r0, 0x0) userfaultfd(0x0) [ 2579.834844][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2579.834858][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2579.840727][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2579.846462][ C0] protocol 88fb is buggy, dev hsr_slave_1 09:38:14 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) 09:38:14 executing program 4: sendmmsg$alg(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000040)=0x2000000000000074, 0x4) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='bbr\x00', 0x3) sendto$inet(r0, &(0x7f0000000640)="3232ce2774e7a3797748648df71c7b4542839e347be35844e42ad67454cd5e140e0ab73493d6b6921681e5536dbc0f309747cc199a7f9a20d01e04d55fb1c26504e3e4738aac76780b5c2363a6dc4d10fe9adc2b363abf6981a31f6a58ef2103e7a145b11649eac6d4cc29a315faf899c2e35d08b1974199c08bf4798207b78d8dd89e727382318265acc85a4444869dfc22ba7fd79b455635a715fa1e705070e2857ef21a3076cdfc2c29b26547360add94ef9c349ae62f54e7a90e1aae762a11b2cc6bd720034fac41f1de628e2a3166ec21e03c68a60708328e1606a83211bc78be79097861ce52747ac474593d76f9ec5cdd91725cb16e62b4bb027fbb96eab344de0401076c6345a7d32e9fe9ba1e68ac07081a7d1e0ed1eb9e96b41214af554f1831dfd8bd2b466789f4295317d17c138abe5fa9044a44792e9aecfb3f9130ff673786a8ef2b14c4999c29a5713c2fb5e35f2fae0d58b64355a697efd45e36528e57c68a62c6edc7879962e05419c7c5fa64ec92e670821df50d0f3a7312d2120f363954e72ba0322fc4318f819b1e2b1a17fb939a5db9c1a0a83b44abcffc3dd555d4dd30c0a4bd524c29d4d57bc906c012446c99a882162f3f72cce0702d7394288807fe2a308e01adc9bbf2a9cd78fabaa3c10640777e0813726a70df3323924035b235fd39ae4ab08d3f09bd231b38dca4389b098b0d3538dd3ef5bf068c1df8fbe00b0b2aa9ec3de5d3fba56594328a643c2799b8371adc6ecdfd9b9c4e52102eaa83b57da14645e442b4b7ad5f555d872dc50c330d145ca853b768b990dbaa18ab7f7e2e2d695e980f96d646e8c893ad912bc71237e9aa3ef2d8a40b5629ca02a82556bd433a7222dc3257fd6ace72b00b6f8c9d621c54f777ee5fd1fc59d11a7ea96855d58bb21d40d1bbdfecad8ed15a25062f7692e1879793657f91b6c78d739ef6811d677cf64b4346ac28740f143d5fd3e00e15416e2dbc76c17b1c09fd0b4065d2252b29370c8ec3", 0x2d1, 0x0, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0x1da9, 0x4) recvmsg(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001dc0)=[{&(0x7f00000002c0)=""/186, 0xba}, {&(0x7f00000000c0)=""/62, 0x3e}], 0x2}, 0x0) sendto$inet(r0, &(0x7f0000000180)="20268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf9221a7511bf746bec66ba5c0fe3ac47b61db6b4c41bd1a5259e62506cda287b857aac", 0x8293, 0x4000002, 0x0, 0x27) 09:38:14 executing program 0: r0 = epoll_create1(0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000000)) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r1, &(0x7f0000000180)={0x80000005}) 09:38:16 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x0, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r4, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:38:16 executing program 0: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 09:38:16 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) 09:38:16 executing program 4: sendmmsg$alg(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000040)=0x2000000000000074, 0x4) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='bbr\x00', 0x3) sendto$inet(r0, &(0x7f0000000640)="3232ce2774e7a3797748648df71c7b4542839e347be35844e42ad67454cd5e140e0ab73493d6b6921681e5536dbc0f309747cc199a7f9a20d01e04d55fb1c26504e3e4738aac76780b5c2363a6dc4d10fe9adc2b363abf6981a31f6a58ef2103e7a145b11649eac6d4cc29a315faf899c2e35d08b1974199c08bf4798207b78d8dd89e727382318265acc85a4444869dfc22ba7fd79b455635a715fa1e705070e2857ef21a3076cdfc2c29b26547360add94ef9c349ae62f54e7a90e1aae762a11b2cc6bd720034fac41f1de628e2a3166ec21e03c68a60708328e1606a83211bc78be79097861ce52747ac474593d76f9ec5cdd91725cb16e62b4bb027fbb96eab344de0401076c6345a7d32e9fe9ba1e68ac07081a7d1e0ed1eb9e96b41214af554f1831dfd8bd2b466789f4295317d17c138abe5fa9044a44792e9aecfb3f9130ff673786a8ef2b14c4999c29a5713c2fb5e35f2fae0d58b64355a697efd45e36528e57c68a62c6edc7879962e05419c7c5fa64ec92e670821df50d0f3a7312d2120f363954e72ba0322fc4318f819b1e2b1a17fb939a5db9c1a0a83b44abcffc3dd555d4dd30c0a4bd524c29d4d57bc906c012446c99a882162f3f72cce0702d7394288807fe2a308e01adc9bbf2a9cd78fabaa3c10640777e0813726a70df3323924035b235fd39ae4ab08d3f09bd231b38dca4389b098b0d3538dd3ef5bf068c1df8fbe00b0b2aa9ec3de5d3fba56594328a643c2799b8371adc6ecdfd9b9c4e52102eaa83b57da14645e442b4b7ad5f555d872dc50c330d145ca853b768b990dbaa18ab7f7e2e2d695e980f96d646e8c893ad912bc71237e9aa3ef2d8a40b5629ca02a82556bd433a7222dc3257fd6ace72b00b6f8c9d621c54f777ee5fd1fc59d11a7ea96855d58bb21d40d1bbdfecad8ed15a25062f7692e1879793657f91b6c78d739ef6811d677cf64b4346ac28740f143d5fd3e00e15416e2dbc76c17b1c09fd0b4065d2252b29370c8ec3", 0x2d1, 0x0, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0x1da9, 0x4) recvmsg(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001dc0)=[{&(0x7f00000002c0)=""/186, 0xba}, {&(0x7f00000000c0)=""/62, 0x3e}], 0x2}, 0x0) sendto$inet(r0, &(0x7f0000000180)="20268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf9221a7511bf746bec66ba5c0fe3ac47b61db6b4c41bd1a5259e62506cda287b857aac", 0x8293, 0x4000002, 0x0, 0x27) 09:38:16 executing program 1: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu\x005\n\xff\xd9\x15\xc1m\xd6\xcc\x05\xed\xac\xb3\xfe\x13\xadD\x1ai\xfck\x948\xcfT\xa4Q8\xcb\x9d\x80\x01V\xea\x8a\x112\xd8\xfe\x7f\x0f\"pX\xa4>\xf9\x00r\x14+\x1e\xdc\xb3]N\b\x00\x00\x00 +\xf4\xe1.\xb6\xde\xce\xe7`\xb2{\xeeu\x88b\xd7j`\xa8z\x89H\xcb\xfb\xc0\x06\xf8.\aA\xcf', 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f00000000c0)='cgroup.procs\x00', 0x2, 0x0) r2 = openat$cgroup_int(r0, &(0x7f0000000140)='cpuset.mem_hardwall\x00', 0x2, 0x0) sendfile(r2, r1, &(0x7f00000001c0)=0xc000ffd, 0x10a000d02) add_key$user(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb) 09:38:16 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r3, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r2) accept4(r3, 0x0, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x7, 0x0) 09:38:16 executing program 0: r0 = socket$inet(0x2, 0x100000000805, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x0, 0x0, 0x0) 09:38:17 executing program 1: bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0xffffffbd, 0x11}, [@ldst={0x5, 0x0, 0x2, 0x0, 0x0, 0x80ffff}]}, &(0x7f0000000080)='GPL\x00', 0x3, 0x3f7, &(0x7f000000cf3d)=""/195}, 0x48) 09:38:17 executing program 0: futex(0x0, 0x400000085, 0x0, 0x0, 0x0, 0x3ffffffc) 09:38:17 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:17 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="020b0001020000000000424000000000ab365a8fb2aa840ba9d89bb8a0ea0957974e9247e5f57124c88972f5b191489b58dc0605fb11e34b7aaa8749ae782ad86a6042f3c66b7767b7191ab6c6c950c4bd5e0dd5b7dc1ceeed4195095d98d27a7cf9e25240fe8d0811d5bcc1cc6fcfd9ee2669332b2b780d66c14817d34d"], 0x10}}, 0x0) sendmsg$key(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=ANY=[@ANYBLOB="02120300020000000a000097c3d344734e3403e52d584581675821c250d1744de9ccb0356a0dda50c4b5b97076fe1fc60b2b689ad6589f0eac9806886259cc2e494229d3b39bdb0a15dd32819fdbbea6d7881177540a3c0b23a322b9506673be785195034910537b54bd7d72fa301a277ca071c4a6add5dab83edf3ebb7cf3e8e926d990403ea5d3a45710db9a9dddf7580e56d0"], 0x10}}, 0x0) recvmmsg(r0, &(0x7f0000000f00), 0x274, 0x10000, &(0x7f0000001000)={0x77359400}) 09:38:17 executing program 0: futex(0x0, 0x400000085, 0x0, 0x0, 0x0, 0x3ffffffc) [ 2583.994859][ C1] net_ratelimit: 16 callbacks suppressed [ 2583.994867][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2583.994872][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2583.994919][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2584.000772][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2584.874857][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2584.880625][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2585.034925][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2585.040684][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2585.046467][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2585.052198][ C1] protocol 88fb is buggy, dev hsr_slave_1 09:38:19 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r4, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:38:19 executing program 1: fcntl$getown(0xffffffffffffffff, 0x9) socket$inet6_dccp(0xa, 0x6, 0x0) r0 = syz_open_dev$vivid(&(0x7f0000000100)='/dev/video#\x00', 0x3, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, r0) ioctl$VIDIOC_S_INPUT(r0, 0xc0045627, &(0x7f00000004c0)) r1 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r1, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x20010}, 0xc) openat$vimc1(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_open_dev$amidi(0x0, 0x0, 0x20a000) syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0)='TIPCv2\x00') io_cancel(0x0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000340)}, &(0x7f0000000480)) clock_gettime(0x7, 0x0) socket$netlink(0x10, 0x3, 0xe) r2 = syz_open_dev$swradio(0x0, 0x0, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r2, 0xc0205647, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, 0x0) 09:38:19 executing program 0: futex(0x0, 0x400000085, 0x0, 0x0, 0x0, 0x3ffffffc) 09:38:19 executing program 4: clone(0x808100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f000000aff5)='asymmetric\x00', &(0x7f0000001ffb)={'\x00\x00\x10', 0xffffffffffffffff, 0x4c00000000006800}, &(0x7f0000001fee)='R\x10rist\xe3cusgrVid:De', 0x0) 09:38:19 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:19 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r3, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r2) accept4(r3, 0x0, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x7, 0x0) 09:38:19 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 09:38:20 executing program 0: futex(0x0, 0x400000085, 0x0, 0x0, 0x0, 0x3ffffffc) 09:38:20 executing program 1: fcntl$getown(0xffffffffffffffff, 0x9) socket$inet6_dccp(0xa, 0x6, 0x0) r0 = syz_open_dev$vivid(&(0x7f0000000100)='/dev/video#\x00', 0x3, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, r0) ioctl$VIDIOC_S_INPUT(r0, 0xc0045627, &(0x7f00000004c0)) r1 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r1, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x20010}, 0xc) openat$vimc1(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_open_dev$amidi(0x0, 0x0, 0x20a000) syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0)='TIPCv2\x00') io_cancel(0x0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000340)}, &(0x7f0000000480)) clock_gettime(0x7, 0x0) socket$netlink(0x10, 0x3, 0xe) r2 = syz_open_dev$swradio(0x0, 0x0, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r2, 0xc0205647, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, 0x0) 09:38:20 executing program 0: futex(0x0, 0x0, 0x0, 0x0, 0x0, 0x3ffffffc) 09:38:20 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:20 executing program 0: futex(0x0, 0x0, 0x0, 0x0, 0x0, 0x3ffffffc) 09:38:22 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r4, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:38:22 executing program 0: futex(0x0, 0x0, 0x0, 0x0, 0x0, 0x3ffffffc) 09:38:22 executing program 1: fcntl$getown(0xffffffffffffffff, 0x9) socket$inet6_dccp(0xa, 0x6, 0x0) r0 = syz_open_dev$vivid(&(0x7f0000000100)='/dev/video#\x00', 0x3, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, r0) ioctl$VIDIOC_S_INPUT(r0, 0xc0045627, &(0x7f00000004c0)) r1 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r1, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x20010}, 0xc) openat$vimc1(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_open_dev$amidi(0x0, 0x0, 0x20a000) syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0)='TIPCv2\x00') io_cancel(0x0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000340)}, &(0x7f0000000480)) clock_gettime(0x7, 0x0) socket$netlink(0x10, 0x3, 0xe) r2 = syz_open_dev$swradio(0x0, 0x0, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r2, 0xc0205647, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, 0x0) 09:38:22 executing program 3: openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(0xffffffffffffffff, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r0, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r0, 0xae9a) ioctl$KVM_RUN(r0, 0xae80, 0x0) 09:38:22 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r3, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r2) accept4(r3, 0x0, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x7, 0x0) 09:38:23 executing program 0: futex(0x0, 0x400000085, 0x0, 0x0, 0x0, 0x0) 09:38:23 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmmsg(r0, &(0x7f0000000480), 0x2e9, 0xffd8) 09:38:23 executing program 3: openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(0xffffffffffffffff, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r0, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r0, 0xae9a) ioctl$KVM_RUN(r0, 0xae80, 0x0) 09:38:23 executing program 0: futex(0x0, 0x400000085, 0x0, 0x0, 0x0, 0x0) [ 2589.034840][ C1] net_ratelimit: 13 callbacks suppressed [ 2589.034847][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2589.046396][ C1] protocol 88fb is buggy, dev hsr_slave_1 09:38:23 executing program 3: openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(0xffffffffffffffff, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r0, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r0, 0xae9a) ioctl$KVM_RUN(r0, 0xae80, 0x0) 09:38:23 executing program 0: futex(0x0, 0x400000085, 0x0, 0x0, 0x0, 0x0) 09:38:23 executing program 1: fcntl$getown(0xffffffffffffffff, 0x9) socket$inet6_dccp(0xa, 0x6, 0x0) r0 = syz_open_dev$vivid(&(0x7f0000000100)='/dev/video#\x00', 0x3, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, r0) ioctl$VIDIOC_S_INPUT(r0, 0xc0045627, &(0x7f00000004c0)) r1 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r1, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x20010}, 0xc) openat$vimc1(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_open_dev$amidi(0x0, 0x0, 0x20a000) syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0)='TIPCv2\x00') io_cancel(0x0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000340)}, &(0x7f0000000480)) clock_gettime(0x7, 0x0) socket$netlink(0x10, 0x3, 0xe) r2 = syz_open_dev$swradio(0x0, 0x0, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r2, 0xc0205647, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, 0x0) [ 2589.194871][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2589.200774][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2589.206659][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2589.212413][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2590.234863][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2590.234867][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2590.234913][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2590.240712][ C1] protocol 88fb is buggy, dev hsr_slave_1 09:38:26 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r4, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:38:26 executing program 3: r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r0, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r0, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r1, 0xae9a) ioctl$KVM_RUN(r1, 0xae80, 0x0) 09:38:26 executing program 0: syz_open_dev$ndb(&(0x7f0000000140)='/dev/nbd#\x00', 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@textreal={0x8, &(0x7f0000000080)="f2a6bad004b00fee0f090f3036f30f1a970000660f3806581e0f08bad004b0beeef30f2af8baa100b000ee", 0x2b}], 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f0000000040)=0x96d1, 0x4) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) accept4(0xffffffffffffffff, &(0x7f0000000480)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @dev}}, &(0x7f0000000000)=0x80, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x0, 0x0, 0x40000004, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:26 executing program 4: unshare(0x2000400) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'gcm_base(ctr(aes-aesni),ghash-generic)\x00'}, 0x58) accept4(r0, 0x0, 0x0, 0x0) 09:38:26 executing program 1: fcntl$getown(0xffffffffffffffff, 0x9) socket$inet6_dccp(0xa, 0x6, 0x0) r0 = syz_open_dev$vivid(&(0x7f0000000100)='/dev/video#\x00', 0x3, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, r0) ioctl$VIDIOC_S_INPUT(r0, 0xc0045627, &(0x7f00000004c0)) r1 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r1, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x20010}, 0xc) openat$vimc1(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_open_dev$amidi(0x0, 0x0, 0x20a000) syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0)='TIPCv2\x00') io_cancel(0x0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000340)}, &(0x7f0000000480)) clock_gettime(0x7, 0x0) socket$netlink(0x10, 0x3, 0xe) r2 = syz_open_dev$swradio(0x0, 0x0, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r2, 0xc0205647, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, 0x0) 09:38:26 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4$packet(r1, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r3, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r2) accept4(r3, 0x0, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x7, 0x0) 09:38:26 executing program 3: r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r0, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r0, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r1, 0xae9a) ioctl$KVM_RUN(r1, 0xae80, 0x0) 09:38:26 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x1000000000000002, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r0, 0x161) sendmsg$kcm(r1, &(0x7f0000003d00)={&(0x7f0000000380)=@in={0x2, 0x4e23, @multicast1}, 0x80, 0x0}, 0xfd00) write$cgroup_subtree(r1, 0x0, 0x0) [ 2592.014405][T17764] kvm_hv_set_msr: 114 callbacks suppressed [ 2592.014419][T17764] kvm [17757]: vcpu0, guest rIP: 0x8a Hyper-V uhandled wrmsr: 0x4000006d data 0x4d00000000f [ 2592.035046][T17764] kvm [17757]: vcpu0, guest rIP: 0x8a Hyper-V uhandled wrmsr: 0x4000003b data 0x4d00000000f 09:38:26 executing program 3: r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r0, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r0, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r1, 0xae9a) ioctl$KVM_RUN(r1, 0xae80, 0x0) 09:38:26 executing program 1: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001000)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000bc700000000000009500000000000000"], &(0x7f0000000140)='vS\xfdIG|\x8aL[\xf2\'\x9c\xea\xb1\xc0\xb1\x19\x91\x9d/Q\xd9\xe3T\xce\xdax;\x02%\xc5\x1c\xd5GA\xad[(\xbblZ\x01\x1dF\x92#]%sj\xd0i\xc6C\x1f&\xe2\xc5\xa5z\x7f\xe1 \xfb\xc27\x03\x84\x8e\xef\x82-\xfc$$\xaf\v\xbd\x95\x1e\x0f\xbeVI\xec\r!\f\x86\xf5\xfb[Y\x1e\xd4\xdfc\xb1\xc8\xa2\xc1/5\xffr\x1f\x80@\xb8F\xea\xde\x93\xa1\xcb6\xee\xf2\xce\x95\xf2\xfdxR\x17F\xad\xc1~\xa2\x97=O^o\"\xbb\xa8\x9746'}, 0x48) [ 2592.114397][T17764] kvm [17757]: vcpu0, guest rIP: 0x8a Hyper-V uhandled wrmsr: 0x40000009 data 0x4d00000000f [ 2592.153515][T17764] kvm [17757]: vcpu0, guest rIP: 0x8a Hyper-V uhandled wrmsr: 0x40000041 data 0x4d00000000f 09:38:26 executing program 4: r0 = getpgid(0x0) prctl$PR_SET_PTRACER(0x59616d61, r0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x11) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xa8}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r1, 0x0, 0x0) [ 2592.201552][T17764] kvm [17757]: vcpu0, guest rIP: 0x8a Hyper-V uhandled wrmsr: 0x4000000f data 0x4d00000000f 09:38:26 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000000)=[@window, @sack_perm], 0x2) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000740)={0x3, 0x2, 0xf000, 0x1000, &(0x7f0000000000/0x1000)=nil}) ioctl$sock_proto_private(0xffffffffffffffff, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ptrace$setopts(0xffffffffffffffff, 0x0, 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) shmget(0x3, 0x4000, 0x804, &(0x7f0000000000/0x4000)=nil) shmctl$SHM_LOCK(0x0, 0xb) ioctl$KVM_RUN(r2, 0xae80, 0x0) prctl$PR_SET_KEEPCAPS(0x8, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000380)) ptrace$peekuser(0x3, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) setsockopt$inet6_MRT6_DEL_MFC(0xffffffffffffffff, 0x29, 0xcd, 0x0, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_MRT6_DEL_MFC(r3, 0x29, 0xcd, &(0x7f0000000180)={{0xa, 0x0, 0x4, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x3}, {0xa, 0x4e23, 0x5, @ipv4={[], [], @multicast1}, 0x400}, 0x3, [0x7fffffff, 0x1, 0x80, 0x3, 0x0, 0x1ff, 0x0, 0xff]}, 0x5c) [ 2592.243252][T17764] kvm [17757]: vcpu0, guest rIP: 0x8a Hyper-V uhandled wrmsr: 0x40000079 data 0x4d00000000f [ 2592.306070][T17764] kvm [17757]: vcpu0, guest rIP: 0x8a Hyper-V uhandled wrmsr: 0x40000047 data 0x4d00000000f [ 2592.346264][T17764] kvm [17757]: vcpu0, guest rIP: 0x8a Hyper-V uhandled wrmsr: 0x40000015 data 0x4d00000000f [ 2592.362292][T17764] kvm [17757]: vcpu0, guest rIP: 0x8a Hyper-V uhandled wrmsr: 0x4000007f data 0x4d00000000f [ 2592.388204][T17764] kvm [17757]: vcpu0, guest rIP: 0x8a Hyper-V uhandled wrmsr: 0x4000004d data 0x4d00000000f [ 2594.394903][ C0] net_ratelimit: 16 callbacks suppressed [ 2594.394910][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2594.395012][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2594.400686][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2594.406395][ C1] protocol 88fb is buggy, dev hsr_slave_1 09:38:29 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, 0x0, 0x0) tkill(r4, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:38:29 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:29 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, &(0x7f0000000100)={@empty}, 0x20) ioctl$EVIOCGEFFECTS(0xffffffffffffffff, 0x80044584, 0x0) ioctl$EXT4_IOC_PRECACHE_EXTENTS(0xffffffffffffffff, 0x6612) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='net/anycast6\x00') preadv(r1, &(0x7f00000017c0), 0x3a8, 0x7a) 09:38:29 executing program 0: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000001200)=""/148, 0x94}], 0x100001c9, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000440)='oom_score_adj\x00') preadv(r0, &(0x7f0000000480), 0x100000000000022c, 0x0) 09:38:29 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000000)=[@window, @sack_perm], 0x2) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000740)={0x3, 0x2, 0xf000, 0x1000, &(0x7f0000000000/0x1000)=nil}) ioctl$sock_proto_private(0xffffffffffffffff, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ptrace$setopts(0xffffffffffffffff, 0x0, 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) shmget(0x3, 0x4000, 0x804, &(0x7f0000000000/0x4000)=nil) shmctl$SHM_LOCK(0x0, 0xb) ioctl$KVM_RUN(r2, 0xae80, 0x0) prctl$PR_SET_KEEPCAPS(0x8, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000380)) ptrace$peekuser(0x3, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) setsockopt$inet6_MRT6_DEL_MFC(0xffffffffffffffff, 0x29, 0xcd, 0x0, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_MRT6_DEL_MFC(r3, 0x29, 0xcd, &(0x7f0000000180)={{0xa, 0x0, 0x4, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x3}, {0xa, 0x4e23, 0x5, @ipv4={[], [], @multicast1}, 0x400}, 0x3, [0x7fffffff, 0x1, 0x80, 0x3, 0x0, 0x1ff, 0x0, 0xff]}, 0x5c) 09:38:29 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4$packet(r1, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r3, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r2) accept4(r3, 0x0, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x7, 0x0) 09:38:29 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:29 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, &(0x7f0000000100)={@empty}, 0x20) ioctl$EVIOCGEFFECTS(0xffffffffffffffff, 0x80044584, 0x0) ioctl$EXT4_IOC_PRECACHE_EXTENTS(0xffffffffffffffff, 0x6612) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='net/anycast6\x00') preadv(r1, &(0x7f00000017c0), 0x3a8, 0x7a) 09:38:29 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:29 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000000)=[@window, @sack_perm], 0x2) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000740)={0x3, 0x2, 0xf000, 0x1000, &(0x7f0000000000/0x1000)=nil}) ioctl$sock_proto_private(0xffffffffffffffff, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ptrace$setopts(0xffffffffffffffff, 0x0, 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) shmget(0x3, 0x4000, 0x804, &(0x7f0000000000/0x4000)=nil) shmctl$SHM_LOCK(0x0, 0xb) ioctl$KVM_RUN(r2, 0xae80, 0x0) prctl$PR_SET_KEEPCAPS(0x8, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000380)) ptrace$peekuser(0x3, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) setsockopt$inet6_MRT6_DEL_MFC(0xffffffffffffffff, 0x29, 0xcd, 0x0, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_MRT6_DEL_MFC(r3, 0x29, 0xcd, &(0x7f0000000180)={{0xa, 0x0, 0x4, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x3}, {0xa, 0x4e23, 0x5, @ipv4={[], [], @multicast1}, 0x400}, 0x3, [0x7fffffff, 0x1, 0x80, 0x3, 0x0, 0x1ff, 0x0, 0xff]}, 0x5c) 09:38:29 executing program 3: openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r0, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r0, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r1, 0xae9a) ioctl$KVM_RUN(r1, 0xae80, 0x0) [ 2595.274849][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2595.280737][ C1] protocol 88fb is buggy, dev hsr_slave_1 09:38:29 executing program 3: openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r0, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r0, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r1, 0xae9a) ioctl$KVM_RUN(r1, 0xae80, 0x0) [ 2595.434907][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2595.440804][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2595.446665][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2595.452421][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2595.465250][T17835] syz-executor.0 invoked oom-killer: gfp_mask=0x402dc2(GFP_KERNEL_ACCOUNT|__GFP_HIGHMEM|__GFP_NOWARN|__GFP_ZERO), order=0, oom_score_adj=1000 [ 2595.536408][T17835] CPU: 1 PID: 17835 Comm: syz-executor.0 Not tainted 5.3.0-rc6-next-20190830 #75 [ 2595.545518][T17835] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2595.555559][T17835] Call Trace: [ 2595.558852][T17835] dump_stack+0x172/0x1f0 [ 2595.563293][T17835] dump_header+0x177/0x1152 [ 2595.567796][T17835] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2595.574127][T17835] ? ___ratelimit+0x2c8/0x595 [ 2595.578796][T17835] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2595.584603][T17835] ? lockdep_hardirqs_on+0x418/0x5d0 [ 2595.589882][T17835] ? trace_hardirqs_on+0x67/0x240 [ 2595.594903][T17835] ? pagefault_out_of_memory+0x11c/0x11c [ 2595.600545][T17835] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 2595.606350][T17835] ? ___ratelimit+0x60/0x595 [ 2595.610930][T17835] ? do_raw_spin_unlock+0x57/0x270 [ 2595.616052][T17835] oom_kill_process.cold+0x10/0x15 [ 2595.621153][T17835] out_of_memory+0x334/0x1340 [ 2595.625822][T17835] ? lock_downgrade+0x920/0x920 [ 2595.630665][T17835] ? mem_cgroup_unmark_under_oom+0x8d/0xb0 [ 2595.636462][T17835] ? oom_killer_disable+0x280/0x280 [ 2595.641687][T17835] mem_cgroup_out_of_memory+0x1d8/0x240 [ 2595.647227][T17835] ? mem_cgroup_nr_lru_pages+0x1b0/0x1b0 [ 2595.652856][T17835] ? do_raw_spin_unlock+0x57/0x270 [ 2595.657960][T17835] ? _raw_spin_unlock+0x2d/0x50 [ 2595.662803][T17835] try_charge+0xf4b/0x1440 [ 2595.667222][T17835] ? mem_cgroup_oom_trylock+0x1a0/0x1a0 [ 2595.673254][T17835] ? find_held_lock+0x35/0x130 [ 2595.678012][T17835] ? get_mem_cgroup_from_mm+0x139/0x320 [ 2595.683572][T17835] ? lock_downgrade+0x920/0x920 [ 2595.688412][T17835] ? percpu_ref_tryget_live+0x111/0x290 [ 2595.693957][T17835] __memcg_kmem_charge_memcg+0x71/0xf0 [ 2595.699408][T17835] ? memcg_kmem_put_cache+0x50/0x50 [ 2595.704602][T17835] ? get_mem_cgroup_from_mm+0x156/0x320 [ 2595.710153][T17835] __memcg_kmem_charge+0x13a/0x3a0 [ 2595.715260][T17835] __alloc_pages_nodemask+0x4f7/0x900 [ 2595.720623][T17835] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 2595.726157][T17835] ? __alloc_pages_slowpath+0x2540/0x2540 [ 2595.731870][T17835] ? kasan_unpoison_shadow+0x35/0x50 [ 2595.737147][T17835] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 2595.743383][T17835] alloc_pages_current+0x107/0x210 [ 2595.748515][T17835] __vmalloc_node_range+0x4a9/0x7e0 [ 2595.753712][T17835] ? __kvm_set_memory_region+0x1c71/0x1d00 [ 2595.759518][T17835] __vmalloc_node_flags_caller+0x71/0x90 [ 2595.765143][T17835] ? __kvm_set_memory_region+0x1c71/0x1d00 [ 2595.771325][T17835] kvmalloc_node+0xdc/0x100 [ 2595.775819][T17835] __kvm_set_memory_region+0x1c71/0x1d00 [ 2595.781448][T17835] ? gfn_to_hva+0x470/0x470 [ 2595.785973][T17835] ? lock_downgrade+0x920/0x920 [ 2595.790827][T17835] kvm_set_memory_region+0x2f/0x50 [ 2595.795938][T17835] kvm_vm_ioctl+0x729/0x1860 [ 2595.800524][T17835] ? debug_check_no_obj_freed+0x20a/0x43f [ 2595.806258][T17835] ? find_held_lock+0x35/0x130 [ 2595.811018][T17835] ? kvm_unregister_device_ops+0x70/0x70 [ 2595.816649][T17835] ? lock_downgrade+0x920/0x920 [ 2595.821496][T17835] ? rwlock_bug.part.0+0x90/0x90 [ 2595.826424][T17835] ? tomoyo_path_number_perm+0x214/0x520 [ 2595.832048][T17835] ? find_held_lock+0x35/0x130 [ 2595.836809][T17835] ? lock_downgrade+0x920/0x920 [ 2595.841649][T17835] ? lockdep_hardirqs_on+0x418/0x5d0 [ 2595.846935][T17835] ? tomoyo_path_number_perm+0x459/0x520 [ 2595.852579][T17835] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 2595.858821][T17835] ? tomoyo_path_number_perm+0x263/0x520 [ 2595.864447][T17835] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 2595.870528][T17835] ? kvm_unregister_device_ops+0x70/0x70 [ 2595.876173][T17835] do_vfs_ioctl+0xdb6/0x13e0 [ 2595.880754][T17835] ? ioctl_preallocate+0x210/0x210 [ 2595.885852][T17835] ? __fget+0x384/0x560 [ 2595.890002][T17835] ? ksys_dup3+0x3e0/0x3e0 [ 2595.894406][T17835] ? nsecs_to_jiffies+0x30/0x30 [ 2595.899249][T17835] ? tomoyo_file_ioctl+0x23/0x30 [ 2595.904177][T17835] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2595.910409][T17835] ? security_file_ioctl+0x8d/0xc0 [ 2595.915512][T17835] ksys_ioctl+0xab/0xd0 [ 2595.919652][T17835] __x64_sys_ioctl+0x73/0xb0 [ 2595.924219][T17835] do_syscall_64+0xfa/0x760 [ 2595.928696][T17835] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2595.934571][T17835] RIP: 0033:0x4598e9 [ 2595.938448][T17835] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2595.958076][T17835] RSP: 002b:00007f0b10c4fc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2595.966469][T17835] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004598e9 [ 2595.974445][T17835] RDX: 0000000020000100 RSI: 000000004020ae46 RDI: 0000000000000005 [ 2595.982402][T17835] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 2595.990389][T17835] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f0b10c506d4 [ 2595.998351][T17835] R13: 00000000004cd3d0 R14: 00000000004d65e8 R15: 00000000ffffffff [ 2596.042245][T17835] memory: usage 307200kB, limit 307200kB, failcnt 5396 [ 2596.056825][T17835] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2596.089338][T17835] Memory cgroup stats for /syz0: [ 2596.089427][T17835] anon 275214336 [ 2596.089427][T17835] file 2269184 [ 2596.089427][T17835] kernel_stack 4784128 [ 2596.089427][T17835] slab 12333056 [ 2596.089427][T17835] sock 77824 [ 2596.089427][T17835] shmem 2174976 [ 2596.089427][T17835] file_mapped 0 [ 2596.089427][T17835] file_dirty 135168 [ 2596.089427][T17835] file_writeback 0 [ 2596.089427][T17835] anon_thp 260046848 [ 2596.089427][T17835] inactive_anon 2027520 [ 2596.089427][T17835] active_anon 275140608 [ 2596.089427][T17835] inactive_file 94208 [ 2596.089427][T17835] active_file 102400 [ 2596.089427][T17835] unevictable 0 [ 2596.089427][T17835] slab_reclaimable 2568192 [ 2596.089427][T17835] slab_unreclaimable 9764864 [ 2596.089427][T17835] pgfault 234795 [ 2596.089427][T17835] pgmajfault 0 [ 2596.089427][T17835] workingset_refault 1320 [ 2596.089427][T17835] workingset_activate 0 [ 2596.089427][T17835] workingset_nodereclaim 0 [ 2596.089427][T17835] pgrefill 406 [ 2596.089427][T17835] pgscan 39493 [ 2596.089427][T17835] pgsteal 1516 [ 2596.197328][T17835] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz0,mems_allowed=0-1,oom_memcg=/syz0,task_memcg=/syz0,task=syz-executor.0,pid=8853,uid=0 [ 2596.213117][T17835] Memory cgroup out of memory: Killed process 8853 (syz-executor.0) total-vm:72708kB, anon-rss:2200kB, file-rss:35812kB, shmem-rss:0kB, UID:0 pgtables:143360kB oom_score_adj:1000 [ 2596.232748][ T1064] oom_reaper: reaped process 8853 (syz-executor.0), now anon-rss:0kB, file-rss:34852kB, shmem-rss:0kB [ 2596.240861][T17834] syz-executor.0 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 2596.259800][T17834] CPU: 1 PID: 17834 Comm: syz-executor.0 Not tainted 5.3.0-rc6-next-20190830 #75 [ 2596.268898][T17834] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2596.278969][T17834] Call Trace: [ 2596.282231][T17834] dump_stack+0x172/0x1f0 [ 2596.286544][T17834] dump_header+0x177/0x1152 [ 2596.291022][T17834] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2596.296799][T17834] ? ___ratelimit+0x2c8/0x595 [ 2596.301446][T17834] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2596.307223][T17834] ? lockdep_hardirqs_on+0x418/0x5d0 [ 2596.312493][T17834] ? trace_hardirqs_on+0x67/0x240 [ 2596.317490][T17834] ? pagefault_out_of_memory+0x11c/0x11c [ 2596.323121][T17834] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 2596.328896][T17834] ? ___ratelimit+0x60/0x595 [ 2596.333478][T17834] ? do_raw_spin_unlock+0x57/0x270 [ 2596.338559][T17834] oom_kill_process.cold+0x10/0x15 [ 2596.343641][T17834] out_of_memory+0x334/0x1340 [ 2596.348290][T17834] ? lock_downgrade+0x920/0x920 [ 2596.353116][T17834] ? oom_killer_disable+0x280/0x280 [ 2596.358291][T17834] mem_cgroup_out_of_memory+0x1d8/0x240 [ 2596.363806][T17834] ? mem_cgroup_nr_lru_pages+0x1b0/0x1b0 [ 2596.369428][T17834] ? do_raw_spin_unlock+0x57/0x270 [ 2596.374519][T17834] ? _raw_spin_unlock+0x2d/0x50 [ 2596.379351][T17834] try_charge+0xa2d/0x1440 [ 2596.383741][T17834] ? mem_cgroup_oom_trylock+0x1a0/0x1a0 [ 2596.389256][T17834] ? percpu_ref_tryget_live+0x111/0x290 [ 2596.394779][T17834] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2596.401010][T17834] ? __kasan_check_read+0x11/0x20 [ 2596.406006][T17834] ? get_mem_cgroup_from_mm+0x156/0x320 [ 2596.411520][T17834] mem_cgroup_try_charge+0x136/0x590 [ 2596.416775][T17834] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 2596.422985][T17834] mem_cgroup_try_charge_delay+0x1f/0xa0 [ 2596.428608][T17834] __handle_mm_fault+0x1e34/0x3f20 [ 2596.433695][T17834] ? vmf_insert_mixed_mkwrite+0x40/0x40 [ 2596.439218][T17834] ? __kasan_check_read+0x11/0x20 [ 2596.444214][T17834] handle_mm_fault+0x1b5/0x6c0 [ 2596.448953][T17834] __do_page_fault+0x536/0xdd0 [ 2596.453689][T17834] do_page_fault+0x38/0x590 [ 2596.458201][T17834] page_fault+0x39/0x40 [ 2596.462364][T17834] RIP: 0033:0x41122f [ 2596.466232][T17834] Code: 0f 84 c8 02 00 00 48 83 bd 78 ff ff ff 00 0f 84 f9 04 00 00 48 8b 95 68 ff ff ff 44 89 95 38 ff ff ff 4c 8d ac 10 00 f7 ff ff <49> 89 85 90 06 00 00 49 8d 85 10 03 00 00 49 89 95 98 06 00 00 41 [ 2596.485826][T17834] RSP: 002b:00007ffd393be690 EFLAGS: 00010206 [ 2596.491862][T17834] RAX: 00007f0b10c0f000 RBX: 0000000000020000 RCX: 000000000045993a [ 2596.499806][T17834] RDX: 0000000000021000 RSI: 0000000000021000 RDI: 0000000000000000 [ 2596.507792][T17834] RBP: 00007ffd393be770 R08: ffffffffffffffff R09: 0000000000000000 [ 2596.515738][T17834] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd393be860 [ 2596.523706][T17834] R13: 00007f0b10c2f700 R14: 0000000000000001 R15: 000000000075bfd4 [ 2596.534458][T17834] memory: usage 304952kB, limit 307200kB, failcnt 5396 [ 2596.541363][T17834] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2596.548228][T17834] Memory cgroup stats for /syz0: [ 2596.548316][T17834] anon 272932864 [ 2596.548316][T17834] file 2269184 [ 2596.548316][T17834] kernel_stack 4784128 [ 2596.548316][T17834] slab 12333056 [ 2596.548316][T17834] sock 77824 [ 2596.548316][T17834] shmem 2174976 [ 2596.548316][T17834] file_mapped 0 [ 2596.548316][T17834] file_dirty 135168 [ 2596.548316][T17834] file_writeback 0 [ 2596.548316][T17834] anon_thp 257949696 [ 2596.548316][T17834] inactive_anon 2027520 [ 2596.548316][T17834] active_anon 272932864 [ 2596.548316][T17834] inactive_file 94208 [ 2596.548316][T17834] active_file 102400 [ 2596.548316][T17834] unevictable 0 [ 2596.548316][T17834] slab_reclaimable 2568192 [ 2596.548316][T17834] slab_unreclaimable 9764864 [ 2596.548316][T17834] pgfault 234795 [ 2596.548316][T17834] pgmajfault 0 [ 2596.548316][T17834] workingset_refault 1320 [ 2596.548316][T17834] workingset_activate 0 [ 2596.548316][T17834] workingset_nodereclaim 0 [ 2596.548316][T17834] pgrefill 406 [ 2596.548316][T17834] pgscan 39493 [ 2596.548316][T17834] pgsteal 1516 [ 2596.643962][T17834] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz0,mems_allowed=0-1,oom_memcg=/syz0,task_memcg=/syz0,task=syz-executor.0,pid=8541,uid=0 [ 2596.659347][T17834] Memory cgroup out of memory: Killed process 8541 (syz-executor.0) total-vm:72840kB, anon-rss:2208kB, file-rss:35804kB, shmem-rss:0kB, UID:0 pgtables:143360kB oom_score_adj:1000 [ 2596.679010][ T1064] oom_reaper: reaped process 8541 (syz-executor.0), now anon-rss:0kB, file-rss:34844kB, shmem-rss:0kB 09:38:32 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, 0x0, 0x0) tkill(r4, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:38:32 executing program 3: openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r0, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r0, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r1, 0xae9a) ioctl$KVM_RUN(r1, 0xae80, 0x0) 09:38:32 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000000)=[@window, @sack_perm], 0x2) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000740)={0x3, 0x2, 0xf000, 0x1000, &(0x7f0000000000/0x1000)=nil}) ioctl$sock_proto_private(0xffffffffffffffff, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ptrace$setopts(0xffffffffffffffff, 0x0, 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) shmget(0x3, 0x4000, 0x804, &(0x7f0000000000/0x4000)=nil) shmctl$SHM_LOCK(0x0, 0xb) ioctl$KVM_RUN(r2, 0xae80, 0x0) prctl$PR_SET_KEEPCAPS(0x8, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000380)) ptrace$peekuser(0x3, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) setsockopt$inet6_MRT6_DEL_MFC(0xffffffffffffffff, 0x29, 0xcd, 0x0, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_MRT6_DEL_MFC(r3, 0x29, 0xcd, &(0x7f0000000180)={{0xa, 0x0, 0x4, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x3}, {0xa, 0x4e23, 0x5, @ipv4={[], [], @multicast1}, 0x400}, 0x3, [0x7fffffff, 0x1, 0x80, 0x3, 0x0, 0x1ff, 0x0, 0xff]}, 0x5c) 09:38:32 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4$packet(r1, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r3, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r2) accept4(r3, 0x0, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x7, 0x0) 09:38:32 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000000)=[@window, @sack_perm], 0x2) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000740)={0x3, 0x2, 0xf000, 0x1000, &(0x7f0000000000/0x1000)=nil}) ioctl$sock_proto_private(0xffffffffffffffff, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ptrace$setopts(0xffffffffffffffff, 0x0, 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) shmget(0x3, 0x4000, 0x804, &(0x7f0000000000/0x4000)=nil) shmctl$SHM_LOCK(0x0, 0xb) ioctl$KVM_RUN(r2, 0xae80, 0x0) prctl$PR_SET_KEEPCAPS(0x8, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000380)) ptrace$peekuser(0x3, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) setsockopt$inet6_MRT6_DEL_MFC(0xffffffffffffffff, 0x29, 0xcd, 0x0, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_MRT6_DEL_MFC(r3, 0x29, 0xcd, &(0x7f0000000180)={{0xa, 0x0, 0x4, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x3}, {0xa, 0x4e23, 0x5, @ipv4={[], [], @multicast1}, 0x400}, 0x3, [0x7fffffff, 0x1, 0x80, 0x3, 0x0, 0x1ff, 0x0, 0xff]}, 0x5c) 09:38:32 executing program 0: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000001200)=""/148, 0x94}], 0x100001c9, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000440)='oom_score_adj\x00') preadv(r0, &(0x7f0000000480), 0x100000000000022c, 0x0) 09:38:32 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000040)=0xc80, 0x4) bind$inet6(r1, &(0x7f0000f5dfe4)={0xa, 0x0, 0x0, @mcast1, 0x8}, 0x1c) 09:38:32 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:32 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000000)=[@window, @sack_perm], 0x2) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000740)={0x3, 0x2, 0xf000, 0x1000, &(0x7f0000000000/0x1000)=nil}) ioctl$sock_proto_private(0xffffffffffffffff, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ptrace$setopts(0xffffffffffffffff, 0x0, 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) shmget(0x3, 0x4000, 0x804, &(0x7f0000000000/0x4000)=nil) shmctl$SHM_LOCK(0x0, 0xb) ioctl$KVM_RUN(r2, 0xae80, 0x0) prctl$PR_SET_KEEPCAPS(0x8, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000380)) ptrace$peekuser(0x3, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) setsockopt$inet6_MRT6_DEL_MFC(0xffffffffffffffff, 0x29, 0xcd, 0x0, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_MRT6_DEL_MFC(r3, 0x29, 0xcd, &(0x7f0000000180)={{0xa, 0x0, 0x4, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x3}, {0xa, 0x4e23, 0x5, @ipv4={[], [], @multicast1}, 0x400}, 0x3, [0x7fffffff, 0x1, 0x80, 0x3, 0x0, 0x1ff, 0x0, 0xff]}, 0x5c) 09:38:32 executing program 0: 09:38:32 executing program 0: 09:38:32 executing program 1: [ 2599.434864][ C1] net_ratelimit: 14 callbacks suppressed [ 2599.440618][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2599.446374][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2599.594862][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2599.600644][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2599.606477][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2599.612237][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2600.634862][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2600.634867][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2600.634917][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2600.640647][ C1] protocol 88fb is buggy, dev hsr_slave_1 09:38:35 executing program 0: 09:38:35 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:35 executing program 1: 09:38:35 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000000)=[@window, @sack_perm], 0x2) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000740)={0x3, 0x2, 0xf000, 0x1000, &(0x7f0000000000/0x1000)=nil}) ioctl$sock_proto_private(0xffffffffffffffff, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ptrace$setopts(0xffffffffffffffff, 0x0, 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) shmget(0x3, 0x4000, 0x804, &(0x7f0000000000/0x4000)=nil) shmctl$SHM_LOCK(0x0, 0xb) ioctl$KVM_RUN(r2, 0xae80, 0x0) prctl$PR_SET_KEEPCAPS(0x8, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000380)) ptrace$peekuser(0x3, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) setsockopt$inet6_MRT6_DEL_MFC(0xffffffffffffffff, 0x29, 0xcd, 0x0, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_MRT6_DEL_MFC(r3, 0x29, 0xcd, &(0x7f0000000180)={{0xa, 0x0, 0x4, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x3}, {0xa, 0x4e23, 0x5, @ipv4={[], [], @multicast1}, 0x400}, 0x3, [0x7fffffff, 0x1, 0x80, 0x3, 0x0, 0x1ff, 0x0, 0xff]}, 0x5c) 09:38:35 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, 0x0, 0x0) tkill(r4, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:38:35 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r1, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(0xffffffffffffffff) accept4(r2, 0x0, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x7, 0x0) 09:38:35 executing program 0: 09:38:35 executing program 1: 09:38:35 executing program 1: 09:38:35 executing program 0: 09:38:35 executing program 0: 09:38:35 executing program 1: 09:38:35 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:35 executing program 1: 09:38:35 executing program 0: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1fb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0x2b, 0x0, &(0x7f0000000100)="b901000000000000009e40f008001fffffe100004000630677fbac141414e9a33fa1be3e7d2a182fff34b4", 0x0, 0x100, 0x6000000000000000}, 0x28) 09:38:35 executing program 4: syz_open_dev$sndctrl(&(0x7f00000002c0)='/dev/snd/controlC#\x00', 0x0, 0x0) process_vm_readv(0x0, &(0x7f0000000080)=[{&(0x7f0000000040)=""/44, 0x2c}], 0x9b, &(0x7f00000014c0), 0x0, 0x0) 09:38:38 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(0x0, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:38:38 executing program 1: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000001200)=""/148, 0xffffff87}], 0x100000c7, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000280)='status\x00') syz_open_dev$radio(&(0x7f00000000c0)='/dev/radio#\x00', 0x1, 0x2) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) pwrite64(r1, 0x0, 0x0, 0x3200) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000240)='bridge_slave_1\x00', 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080), 0x4) ioctl$sock_ifreq(r2, 0x0, &(0x7f0000000140)={'veth0\x00', @ifru_settings={0x10001, 0x0, @fr=0x0}}) setsockopt$inet_mreqsrc(r2, 0x0, 0x12, &(0x7f0000000180)={@local, @broadcast, @loopback}, 0x3) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) 09:38:38 executing program 4: r0 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/video2\x00', 0x2, 0x0) ioctl$VIDIOC_STREAMOFF(r0, 0x40045613, &(0x7f00000001c0)) 09:38:38 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:38 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r1, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(0xffffffffffffffff) accept4(r2, 0x0, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x7, 0x0) 09:38:38 executing program 0: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1fb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0x2b, 0x0, &(0x7f0000000100)="b901000000000000009e40f008001fffffe100004000630677fbac141414e9a33fa1be3e7d2a182fff34b4", 0x0, 0x100, 0x6000000000000000}, 0x28) 09:38:38 executing program 4: r0 = socket$pptp(0x18, 0x1, 0x2) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x0, 0x0) close(r0) 09:38:38 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(0x0, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:38:38 executing program 4: r0 = socket$pptp(0x18, 0x1, 0x2) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x0, 0x0) close(r0) 09:38:38 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(0x0, 0x1000000000016) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:38:38 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:38 executing program 4: r0 = socket$pptp(0x18, 0x1, 0x2) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x0, 0x0) close(r0) 09:38:38 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r4, 0x0) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) [ 2604.794860][ C1] net_ratelimit: 16 callbacks suppressed [ 2604.794866][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2604.796190][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2604.800697][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2604.806620][ C0] protocol 88fb is buggy, dev hsr_slave_1 09:38:39 executing program 1: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000001200)=""/148, 0xffffff87}], 0x100000c7, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000280)='status\x00') syz_open_dev$radio(&(0x7f00000000c0)='/dev/radio#\x00', 0x1, 0x2) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) pwrite64(r1, 0x0, 0x0, 0x3200) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000240)='bridge_slave_1\x00', 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080), 0x4) ioctl$sock_ifreq(r2, 0x0, &(0x7f0000000140)={'veth0\x00', @ifru_settings={0x10001, 0x0, @fr=0x0}}) setsockopt$inet_mreqsrc(r2, 0x0, 0x12, &(0x7f0000000180)={@local, @broadcast, @loopback}, 0x3) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) 09:38:39 executing program 4: r0 = socket$pptp(0x18, 0x1, 0x2) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x0, 0x0) close(r0) 09:38:39 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r1, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(0xffffffffffffffff) accept4(r2, 0x0, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x7, 0x0) 09:38:39 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r4, 0x0) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:38:39 executing program 0: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1fb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0x2b, 0x0, &(0x7f0000000100)="b901000000000000009e40f008001fffffe100004000630677fbac141414e9a33fa1be3e7d2a182fff34b4", 0x0, 0x100, 0x6000000000000000}, 0x28) 09:38:39 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r4, 0x0) write$P9_RWSTAT(r2, &(0x7f0000000000)={0x7}, 0x176) 09:38:39 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:39 executing program 4: r0 = socket$pptp(0x18, 0x1, 0x2) close(r0) 09:38:39 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r2, 0x0, 0x6, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r3, 0x1000000000016) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000000)={0x7}, 0x176) 09:38:39 executing program 4: r0 = socket$pptp(0x18, 0x1, 0x2) close(r0) 09:38:39 executing program 0: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000001200)=""/148, 0xffffff87}], 0x100000c7, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000280)='status\x00') syz_open_dev$radio(&(0x7f00000000c0)='/dev/radio#\x00', 0x1, 0x2) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) pwrite64(r1, 0x0, 0x0, 0x3200) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000240)='bridge_slave_1\x00', 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080), 0x4) ioctl$sock_ifreq(r2, 0x0, &(0x7f0000000140)={'veth0\x00', @ifru_settings={0x10001, 0x0, @fr=0x0}}) setsockopt$inet_mreqsrc(r2, 0x0, 0x12, &(0x7f0000000180)={@local, @broadcast, @loopback}, 0x3) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) 09:38:39 executing program 4: r0 = socket$pptp(0x18, 0x1, 0x2) close(r0) [ 2605.674848][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2605.680808][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2605.834841][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2605.840665][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2605.846495][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2605.852232][ C1] protocol 88fb is buggy, dev hsr_slave_1 09:38:40 executing program 4: openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x0, 0x0) close(0xffffffffffffffff) 09:38:40 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:40 executing program 1: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x243b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x222}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0x1f, 0x0, &(0x7f00000000c0)="b9ff03c6630d698cb89e40f088ca1fffffff0000000063a377fbac14140ce9", 0x0}, 0x28) 09:38:40 executing program 0: r0 = inotify_init() poll(&(0x7f0000000080)=[{r0}], 0x1, 0x1) 09:38:40 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r1) accept4(r2, 0x0, 0x0, 0x0) splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x7, 0x0) 09:38:40 executing program 4: openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x0, 0x0) close(0xffffffffffffffff) 09:38:40 executing program 0: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_IMPORTANCE(r0, 0x10f, 0x7f, &(0x7f0000000040), 0x4) 09:38:40 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:40 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r2, 0x0, 0x6, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r3, 0x1000000000016) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000000)={0x7}, 0x176) 09:38:40 executing program 1: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x243b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x222}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0x1f, 0x0, &(0x7f00000000c0)="b9ff03c6630d698cb89e40f088ca1fffffff0000000063a377fbac14140ce9", 0x0}, 0x28) 09:38:40 executing program 4: openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x0, 0x0) close(0xffffffffffffffff) 09:38:40 executing program 0: mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mq_timedreceive(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000001000)={0x77359400}) 09:38:40 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:40 executing program 4: r0 = socket$pptp(0x18, 0x1, 0x2) openat$snapshot(0xffffffffffffff9c, 0x0, 0x0, 0x0) close(r0) 09:38:40 executing program 0: semctl$SETALL(0x0, 0x0, 0x10, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000000)) 09:38:40 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getsockopt$inet_tcp_int(r0, 0x6, 0x12, 0x0, &(0x7f0000000300)=0x332) 09:38:41 executing program 0: semctl$SETALL(0x0, 0x0, 0x10, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000000)) 09:38:41 executing program 4: r0 = socket$pptp(0x18, 0x1, 0x2) openat$snapshot(0xffffffffffffff9c, 0x0, 0x0, 0x0) close(r0) 09:38:41 executing program 1: r0 = socket$inet(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x0, &(0x7f0000319ff0)={0x2, 0x4e20}, 0x10) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000100)=""/124, 0x7c, 0x0, &(0x7f0000000000)={0x2, 0x0, @loopback}, 0x710000) 09:38:41 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r1) accept4(r2, 0x0, 0x0, 0x0) splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x7, 0x0) 09:38:41 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r2, 0x0, 0x6, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r3, 0x1000000000016) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000000)={0x7}, 0x176) 09:38:41 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:41 executing program 0: semctl$SETALL(0x0, 0x0, 0x10, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000000)) 09:38:41 executing program 4: r0 = socket$pptp(0x18, 0x1, 0x2) openat$snapshot(0xffffffffffffff9c, 0x0, 0x0, 0x0) close(r0) 09:38:41 executing program 1: r0 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) symlinkat(&(0x7f0000000040)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', r0, &(0x7f00000000c0)='./file0\x00') mkdirat(r0, &(0x7f0000000200)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) symlinkat(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', r1, &(0x7f0000000280)='./file0/file0\x00') renameat2(r1, &(0x7f0000000100)='./file0/file0\x00', r1, &(0x7f0000000340)='./file0\x00', 0x0) 09:38:41 executing program 0: semctl$SETALL(0x0, 0x0, 0x10, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000000)) 09:38:41 executing program 4: socket$pptp(0x18, 0x1, 0x2) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x0, 0x0) close(0xffffffffffffffff) 09:38:41 executing program 1: r0 = socket$kcm(0xa, 0x922000000003, 0x11) sendmsg$kcm(r0, &(0x7f0000000140)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x10000120}, 0x80, 0x0}, 0x0) 09:38:41 executing program 0: semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000000)) 09:38:41 executing program 1: write$FUSE_DIRENTPLUS(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$hfsplus(&(0x7f0000000000)='hfsplus\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={[{@part={'part', 0x3d, 0x100000001}}]}) 09:38:41 executing program 4: socket$pptp(0x18, 0x1, 0x2) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x0, 0x0) close(0xffffffffffffffff) [ 2607.694948][T18117] hfsplus: part requires an argument [ 2607.708446][T18117] hfsplus: unable to parse mount options 09:38:41 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r1) accept4(r2, 0x0, 0x0, 0x0) splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x7, 0x0) 09:38:42 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r4, 0x1000000000016) write$P9_RWSTAT(r2, 0x0, 0x0) 09:38:42 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:42 executing program 0: semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000000)) 09:38:42 executing program 4: socket$pptp(0x18, 0x1, 0x2) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x0, 0x0) close(0xffffffffffffffff) 09:38:42 executing program 1: syz_mount_image$hfsplus(&(0x7f0000000000)='hfsplus\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={[{@part={'part', 0x3d, 0x100000001}}]}) 09:38:42 executing program 0: semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000000)) [ 2608.277665][T18141] hfsplus: part requires an argument 09:38:42 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f0000000540)=""/246) preadv(r0, &(0x7f0000000100)=[{&(0x7f0000000080)=""/53, 0x35}], 0x1, 0x0) [ 2608.310553][T18141] hfsplus: unable to parse mount options 09:38:42 executing program 0: semctl$SETALL(0x0, 0x0, 0x10, 0x0) semctl$SETALL(0x0, 0x0, 0x11, 0x0) [ 2608.424699][T18141] hfsplus: part requires an argument 09:38:42 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:42 executing program 0: semctl$SETALL(0x0, 0x0, 0x10, 0x0) semctl$SETALL(0x0, 0x0, 0x11, 0x0) [ 2608.451173][T18141] hfsplus: unable to parse mount options 09:38:42 executing program 1: 09:38:42 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r0, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r1) accept4(r2, 0x0, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x7, 0x0) 09:38:43 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r4, 0x1000000000016) write$P9_RWSTAT(r2, 0x0, 0x0) 09:38:43 executing program 0: semctl$SETALL(0x0, 0x0, 0x10, 0x0) semctl$SETALL(0x0, 0x0, 0x11, 0x0) 09:38:43 executing program 1: 09:38:43 executing program 4: 09:38:43 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:43 executing program 4: 09:38:43 executing program 1: 09:38:43 executing program 0: 09:38:43 executing program 4: r0 = socket$inet6(0xa, 0x801, 0x0) r1 = dup(r0) bind$inet6(r1, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) accept$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_inet6_SIOCDIFADDR(0xffffffffffffffff, 0x8936, 0x0) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_emit_ethernet(0x7ffff, &(0x7f0000000080)={@local, @local, [], {@ipv4={0x800, {{0x8, 0x4, 0x0, 0x0, 0x21c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev, @remote={0xac, 0x14, 0x223}}, @icmp=@timestamp_reply={0xffffff83, 0xa, 0x0, 0x0, 0x0, 0x8906}}}}}, &(0x7f0000000040)) setsockopt$packet_tx_ring(r3, 0x107, 0x5, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x44) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) 09:38:43 executing program 1: r0 = socket(0x10, 0x2, 0x0) close(r0) fsetxattr$trusted_overlay_origin(r0, 0x0, 0x0, 0x0, 0x0) 09:38:43 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:43 executing program 0: mknod$loop(&(0x7f0000000000)='./file0\x00', 0x6000, 0x0) clone(0x20000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=ANY=[@ANYBLOB='./file0'], &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='udf\x00b\xdd\xd3\xb5\xcd\xbay\xb4\'Y\xa8\xcai\x8d\xcc\x10\xfaZ\xc4#\xd5\xb0\xe3\xbb\x01[\x83\x8c\x06z\xcb\xbd\nW\xa7n>\xcb\xecX\xf0\xbdA@\xc7\xad\xa7/\xfc7\xc0\x8b\xb4\xd9\xa2c\xd2u\xea?\xea\xa1\x03\xb0\x92-\x84\xbf\x06r\x80\xcf\xd2\xd0\xd70\x98\\\xa47\xc0w\x836\\U\xf4v:Pw\x84f~\x9f\xd5Q7\t\xa5\xc9[\x996HI\xd5\xcc\x86\x03&\f\xab)\x1ag^\xb8\xa2>/\xc9Fc]\xf6\xa6\xc9\xb6\xf0\x8ca\\\xcd\xe6\xe2^XV\xcb\xe9\xd3\x9f\xbe\xbfR=\x9b;*\a\v\xa6\x0f\x1a7\xca\x96_\xfb]\x1c\xb9\xbf\xd2w\xd1\xc4q.ol\xf4\xd9H\x86\x8b\x1b\xc6eN\xfd\xde6\xeeO\x1319\xa9\xb7\xa9', 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2609.675595][ T2495] blk_update_request: I/O error, dev loop0, sector 64 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 2609.686911][ T2495] blk_update_request: I/O error, dev loop0, sector 256 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 2609.699697][T18212] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=256, location=256 [ 2609.722411][ T2495] blk_update_request: I/O error, dev loop0, sector 512 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 2609.733697][T18212] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=512, location=512 [ 2609.748469][T18212] UDF-fs: warning (device loop0): udf_load_vrs: No anchor found [ 2609.760047][T18212] UDF-fs: Scanning with blocksize 512 failed [ 2609.771295][ T2495] blk_update_request: I/O error, dev loop0, sector 64 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 2609.783611][ T2495] blk_update_request: I/O error, dev loop0, sector 512 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 2609.796623][ T26] audit: type=1800 audit(1567849123.908:226): pid=18210 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="bus" dev="sda1" ino=17521 res=0 [ 2609.814864][T18212] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=256, location=256 [ 2609.826082][ T2494] blk_update_request: I/O error, dev loop0, sector 1024 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 2609.837644][T18212] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=512, location=512 [ 2609.844857][ C1] net_ratelimit: 14 callbacks suppressed [ 2609.844863][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2609.847424][T18212] UDF-fs: warning (device loop0): udf_load_vrs: No anchor found [ 2609.852828][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2609.858839][T18212] UDF-fs: Scanning with blocksize 1024 failed [ 2609.880303][ T2494] blk_update_request: I/O error, dev loop0, sector 64 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 2609.891662][ T2495] blk_update_request: I/O error, dev loop0, sector 1024 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 2609.903388][T18212] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=256, location=256 [ 2609.913183][ T2495] blk_update_request: I/O error, dev loop0, sector 2048 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 2609.924504][T18212] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=512, location=512 [ 2609.934113][T18212] UDF-fs: warning (device loop0): udf_load_vrs: No anchor found [ 2609.941794][T18212] UDF-fs: Scanning with blocksize 2048 failed [ 2609.948323][ T2495] blk_update_request: I/O error, dev loop0, sector 64 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 2609.959426][T18212] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=256, location=256 09:38:44 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x2000000000012, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r4, 0x1000000000016) write$P9_RWSTAT(r2, 0x0, 0x0) 09:38:44 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:38:44 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:44 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r0, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r1) accept4(r2, 0x0, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x7, 0x0) 09:38:44 executing program 4: r0 = socket$inet6(0xa, 0x801, 0x0) r1 = dup(r0) bind$inet6(r1, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) accept$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_inet6_SIOCDIFADDR(0xffffffffffffffff, 0x8936, 0x0) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_emit_ethernet(0x7ffff, &(0x7f0000000080)={@local, @local, [], {@ipv4={0x800, {{0x8, 0x4, 0x0, 0x0, 0x21c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev, @remote={0xac, 0x14, 0x223}}, @icmp=@timestamp_reply={0xffffff83, 0xa, 0x0, 0x0, 0x0, 0x8906}}}}}, &(0x7f0000000040)) setsockopt$packet_tx_ring(r3, 0x107, 0x5, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x44) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) [ 2609.969581][T18212] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=512, location=512 [ 2609.988539][T18212] UDF-fs: warning (device loop0): udf_load_vrs: No anchor found [ 2609.996419][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2609.996475][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2609.996569][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2609.996609][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2610.024833][T18212] UDF-fs: Scanning with blocksize 4096 failed [ 2610.030988][T18212] UDF-fs: warning (device loop0): udf_fill_super: No partition found (1) 09:38:44 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) [ 2610.093923][T18216] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=256, location=256 [ 2610.114207][T18216] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=512, location=512 [ 2610.124608][T18216] UDF-fs: warning (device loop0): udf_load_vrs: No anchor found [ 2610.147155][T18216] UDF-fs: Scanning with blocksize 512 failed [ 2610.182861][T18216] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=256, location=256 09:38:44 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 2610.225090][T18216] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=512, location=512 [ 2610.262240][T18216] UDF-fs: warning (device loop0): udf_load_vrs: No anchor found 09:38:44 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:38:44 executing program 4: sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = perf_event_open(0x0, 0x0, 0xb, 0xffffffffffffffff, 0x0) fremovexattr(r0, &(0x7f0000000140)=@random={'user.', '\\\'GPL(\x00'}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@textreal={0x8, &(0x7f0000000080)="f2a6bad004b00fee0f090f3036f30f1a970000660f3806581e0f08bad004b0beeef30f2af8baa100b000ee", 0x2b}], 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f0000000040)=0x96d1, 0x4) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000340)=ANY=[@ANYBLOB="1300000036"], 0x5) r5 = dup(r4) write$FUSE_BMAP(r5, &(0x7f0000000000)={0x18}, 0x18) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000cc0)='/dev/hwrng\x00', 0x18001, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000d00)='/dev/hwrng\x00', 0xe0540, 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r6, 0x0, 0x0) dup(r6) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f00000002c0)={[0x0, 0x0, 0x40000004, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) keyctl$revoke(0x3, 0x0) keyctl$instantiate_iov(0x14, 0x0, 0x0, 0x0, 0x0) [ 2610.272579][T18216] UDF-fs: Scanning with blocksize 1024 failed [ 2610.291607][T18216] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=256, location=256 [ 2610.345474][T18216] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=512, location=512 [ 2610.396948][T18216] UDF-fs: warning (device loop0): udf_load_vrs: No anchor found [ 2610.424922][T18216] UDF-fs: Scanning with blocksize 2048 failed [ 2610.450284][T18216] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=256, location=256 [ 2610.491028][T18216] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=512, location=512 [ 2610.502600][T18216] UDF-fs: warning (device loop0): udf_load_vrs: No anchor found [ 2610.514179][T18216] UDF-fs: Scanning with blocksize 4096 failed 09:38:44 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) [ 2610.535666][T18216] UDF-fs: warning (device loop0): udf_fill_super: No partition found (1) 09:38:44 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:44 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$inet6_int(r1, 0x29, 0x12, &(0x7f0000000040), &(0x7f0000000080)=0xf3) 09:38:45 executing program 4: r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) fallocate(r0, 0x0, 0xc478, 0x5) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x0) fallocate(r0, 0x3, 0x0, 0x7ff) 09:38:45 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:38:45 executing program 0: clone(0x100000203, 0x0, 0x0, 0x0, 0x0) mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) r0 = creat(&(0x7f00000000c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x10a) symlink(&(0x7f0000000280)='./file0/file0\x00', &(0x7f0000000300)='./file1\x00') close(r0) execve(&(0x7f0000000100)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) close(0xffffffffffffffff) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200800000000013, &(0x7f00000001c0)=0x400100000001, 0x4) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @empty}, 0x1c) r2 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x131f64) open$dir(&(0x7f0000000240)='./file0\x00', 0x841, 0x0) clone(0x3102001ff0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file1\x00', 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f00000002c0), 0x4) 09:38:45 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r0, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r1) accept4(r2, 0x0, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x7, 0x0) 09:38:45 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f00000002c0)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x13, 0x0, 0x0, 0xfffffffffffffe6d, 0x6, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, 0x0}, @fda, @fd}, &(0x7f0000000280)={0x0, 0x28, 0x48}}}], 0x0, 0x0, 0x0}) [ 2611.034870][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2611.034877][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2611.034917][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2611.040792][ C0] protocol 88fb is buggy, dev hsr_slave_1 09:38:45 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:38:45 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000580)={@local, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x0, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd]}, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) 09:38:45 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="11dca5055e0bcfe47bf070") getsockopt$inet_tcp_int(r0, 0x6, 0x3, 0x0, &(0x7f0000000300)=0x3d22) 09:38:45 executing program 2: recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0xfffffd1e, 0x0, 0x229}}], 0x0, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip6_tables_targets\x00') perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) set_thread_area(0x0) preadv(r0, &(0x7f00000017c0), 0x33d, 0x0) 09:38:45 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:45 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:38:45 executing program 4: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580)='/dev/zero\x00', 0x0, 0x0) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000540)='/dev/uinput\x00', 0x1802, 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0xfffe, &(0x7f0000000440)="00100000000000006515b2dfd88b486fb597db5490fd1467902726e77a44ad20d8d3f9d61d70cc08f30ee29d543c1c290cf245973ca3279d3af810c7f6183913cf7dbf853d07bc27b0b7d8203a1c689d22db6d188d6645d5d2378edd483c7f919aa027c48e47d55421fa92fa247157ff86b3d2f928664b03e22eaef9") r3 = mq_open(&(0x7f0000000000)='eth0\x00', 0x42, 0x0, 0x0) seccomp(0x0, 0x1, &(0x7f0000000240)={0x2, &(0x7f0000000100)=[{0x4, 0x0, 0x7ff}, {0x7, 0xff, 0x80000001, 0x4}]}) clock_adjtime(0x0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}) clock_gettime(0x0, &(0x7f00000000c0)={0x0, 0x0}) r6 = openat$full(0xffffffffffffff9c, &(0x7f0000000400)='/dev/full\x00', 0x4040, 0x0) ftruncate(r6, 0x401) write$FUSE_NOTIFY_RETRIEVE(r6, &(0x7f00000004c0)={0x30, 0x5, 0x0, {0x0, 0x1, 0x0, 0x401}}, 0x30) fsetxattr$security_smack_entry(r2, &(0x7f0000000340)='security.SMACK64MMAP\x00', &(0x7f0000000380)='\x00', 0x1, 0x1) ppoll(&(0x7f00000007c0)=[{r6, 0x20}, {r3, 0x4000000000000001}, {r3, 0x2}], 0x3, &(0x7f0000000140)={r4, r5+10000000}, &(0x7f0000000180)={0x7ff}, 0x8) r7 = open(&(0x7f0000000200)='./file0\x00', 0x80, 0xe4) write$P9_RFLUSH(r7, &(0x7f00000001c0)={0x7, 0x6d, 0x1}, 0x7) ioctl$TUNSETPERSIST(r7, 0x400454cb, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r8 = socket$inet(0x2, 0x4000000000000001, 0x0) r9 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) ioctl$FS_IOC_FIEMAP(r6, 0xc020660b, &(0x7f0000000c40)=ANY=[@ANYBLOB="0900000000000000000f00004025000000000000000000000000000001000000000000000900000000000000000000000000000000000000000000000400000000301c538e9eb6d83800000001000000000000000100000000000000ffffffff0000000000000000000000000000000000000000c909f5620000000000000000000000000600000000000000010000000000000002000000000000000800000000000000000000000000000000310000000000000000000000000000ffffffff000000001f000000000000000000000000000000000000000000000000000000000000000012000000000000000000000000000005000000000000000500000000000000289acb340000000000000000000000000000000000000000800200000000000000000000180000003d00000000000000010000000100000001040000000000000000000000000000000000000000000000010000000000000000000000000000020e00000000000008000000000000ac273e1d7f3ff3ca59b761756a27000000000000000000000000000000000000000400076a0000000000000000000000000000090000000800000001010000000000b65be65938186cc6000000000000000000000000000000000080000000000100000000000000feffff0000040000000000000000000000000000000000040000000000009d8eecb8b83a7f3f40975d4c4ab41877ecb71d7321e6011ff20905968f38000000000000000000a26c54b827f4c04d301990c942306a017a47fa99f3226490731ab485406b9a95075c2b858b1633277c90000000006fb13e6139e621ea9e9ce3729cc0725649a88a26c829b966812831774e81cb3d2529146dafc32ffad40cdcbeec95dee96c628e22bcd9f80ed89fba39590050c8f9caef9e9e1b41030b8eddc3ac5961997c16e9be200c70867a8dd5e0bb233cc184115ac80c9174117f46766ce0d7e1dc87343c21230c63c09604010c28ea30769b576d5b61993899372ad3b87e1d21185ae81551d518d300000000000000003e63f9a1b5bf2a314e4e0eda565b21dffc2bb4347351bd8dcc1649f3a7bdbaa9fd78d9b1f409aec1617f1e87c7857472a5213bc5a16bcdf62be07951058921e026ac28c9f6a0277c77b6ccb67d4ab1006aade4d1c74bee152b6da8f7edbd81c7b8afdabc0216e1693fb8b2ab1e841afaf1ab25b448ee1f560a9de0ec68c49dc2adffd88e2d05b02307532a20924beeb3112d28ca8b3a3fe3e202c5dcdd70810548cd16815e5b96846ff31d2ca3e0263a01c752ea1455ee580775f1a837c0c73c0627a8e04ed9d6ac0f87f2aa34d9d7efb45b5175e18f48e753915d98f92de4c4c4ca3baaf9933135c9e36e5534ed0bcdb63bcc9f36d5ecd04ef7eb1dcaf63a5cdcd037549a15e840db87f539a94c4aa63348b6790d030f81dea26286a3fb22b1b9bb8b63"]) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) r10 = dup3(r9, r8, 0x0) ioctl$TIOCLINUX6(r10, 0x541c, 0x0) mq_timedsend(r3, &(0x7f0000000640)="76b06a56e206f889180a4aa8984485043ba03b111d0fe0ea1f7f79990b5791e7caaba21ee1f2a5c22c6047ca0a00ad25e87bd7c646d3ed5d62d35fc880b8ee8ea055be4d339880471af3cf76a36debf37fcfb1a61ebf1bfa4819d48bfb660eed391643c6b680499af9ec836eb6f78fd261d857770bd4c348af3a7f27c6435576ad9b7572d6c9c5b96971f77103ef4f4f39cc53c985d4512ecdd1a1c83df73ba6642cbbfb212cd0f5f0e6678c1ed3e1658dded2163a68e4", 0x2a9, 0x6, 0x0) mq_timedsend(r3, 0x0, 0x0, 0x7f, 0x0) 09:38:45 executing program 2: mmap$perf(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x10, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0xfffffd1e, 0x0, 0x229}}], 0x0, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip6_tables_targets\x00') geteuid() perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) preadv(r0, &(0x7f00000017c0), 0x33d, 0x0) 09:38:45 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = creat(&(0x7f0000000080)='./bus\x00', 0x0) r2 = creat(&(0x7f0000000080)='./bus\x00', 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000200)='security.selinux\x00', &(0x7f00000001c0)='unconfined_u:system_r:insmod_t:s0-s0:c0.c1023\x00', 0xae, 0x0) fsetxattr$security_selinux(r1, &(0x7f0000000200)='security.selinux\x00', 0x0, 0x0, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) 09:38:45 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r0, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r1) accept4(r2, 0x0, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x7, 0x0) 09:38:45 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:38:45 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:45 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@textreal={0x8, &(0x7f0000000080)="f2a6bad004b00fee0f090f3036f30f1a970000660f3806581e0f08bad004b0beeef30f2af8baa100b000ee", 0x2b}], 0x1, 0x0, 0x0, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000500)=ANY=[@ANYBLOB="73797a30a99916007ef67a31a8bddf3b8a527c4ae452d5ea7461d017429d9ced80e034febfd165004b8ff158ee05f30a7e328c53f81e373ae72adeb533bf3d516c6b462481f8515e6bff9b123b175668d564bb7bd3e5fb3254e7de44194664ef6e7f9dd775d5a65b1ee873ec4a3e91a9a61c38f3470c5fdf61bce340ef5001de7a5f8f7004dd33e4e5df6fdb9ace582b2db9a73f3f30a631796fd2cfabb9b5226dd7492a1c44d71026077d82d01c8a72908236e71f86fc0fe64e697f9466eb6d7f32b60207291da14fe2ee788c05aee3cd750ebfa7274cf3e7d187b3fddf483fe7bfc4f7c5645cae1d10280e6760e237c5c4c58b6aab3e2c5c840e07870956cf4a699d0481e868fa32a75fde0676b88440704d2cd957130e2bfbd7d965b937d29c653805e5f876d7326e6aa0a24e457b25997d6c171eb929317d398ee2b81f406c76209775ac34fec115f031ec8a041a1dea8496d33c6d1f339a6788075ca96d0e89170c1e09cde578469909c320cbf62e86f785145b30cf97fb1a1b77e2c1d65c7e81324c9321272655dfb9495defdb7a4e654f2d3530b3796a6323e4ce5adcb0e208593f257f72c49dd1b777ea454f9c1f547db18aed7e1ad43bb63b0a431112e8dda69498a648042a86bb1a9ee3eb2e73e05b3e8d48c7aab0f06b875bad59799d0985b18459b8b8464420af3cdbb866ff3a0b6c6efe5e67613bcb2ba3baa46fbfdc4355f917055d9623483eb24b6f3fe644fabb84b7f891ea540b02dfc3126b1d820f9cf43a54a71d1efb6ba878bb0397db842c85cc9bdf283bdb4c5c4d591f5599509c1907008ebe8be2ca1c7fdc13330d78c7d4a7eddf653d57af5a044dfd108a2d2fea3ceb15adcc1046e69834c08ad4fc5ff3f34247495ddca75f0d4bd66384b6577a5b7c5f885408206bed4009e8d1795183ce0952050a127986af5c47c072e6477f939cb2147c9e3b3b3630416c5ddc3f3a58d359a2e2ebfddcdab3cf39f6ca5357e50b668ec186f4cdb4e92d4bdb25b2f3780704e76a750b1c7d5e4abde4e53972712ea6198c8b3adf87db132125c77fe1b5d2288a15f0da655f4890af295750437f2465e5e30ce7b6154a26a6a6fcca5209fe53c715b8ae2a1fcaa2f5e94c24d82607e37f63e011b0c2908779dc2a37e9e722252fd01cdab4e85f7ac78fa1e88833eaab0737a33c2e94121ee4e003fcdb4564849cc612eb20ebc946b0378f6130ceda953e4343cd68df45bd4a3d638542f968e7ed8632c97db9359af990baf4d6cb26b0b1ea002becdb32e554cf9cd410a38cf9981736c040ac59b72980472686828f1e4236f79d7da1cd46"], 0x3b1) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f0000000040)=0x96d1, 0x4) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) accept4(0xffffffffffffffff, &(0x7f0000000480)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @dev}}, &(0x7f0000000000)=0x80, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x0, 0x0, 0x40000004, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:45 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000080)='\x00\x00\x00\x00\x00\x00\x00\xeb\xff\xff(1\x18\xc7\xc1\xde\xdc(,J\\\xc4hM=\xf4\x04\xd0\xe9\'rT\x8dm\x1a?\x1a\b\x93\x82\xbf\xfe\x83\xcb4tX{$\x9f\xbfHY\x1e;\xd0\xcf\xdb&\x12G\xfd\xd7\xe71\xd8K\x9b\xc9\x04C\xf5$\xd0\x93k\x12u\x9eMM\x03\x00\x00\x00\xc8\x83\x16\x9c2)\xaa\x9fh\xa4\xd2\x0f\x98.\x06t^\xc0\xcd\x95\x81*\xece1\x9e*3\xfa\xb5=\xd2\x1e-\xd3]}\xa7\xbfDZn\xd4\x82\x19\xfb\x1bjE\xc3D\xd8\xd56G\xd9\xc3\x90\xf5\xb9\xdc\x98\xb8\x8f=\xdf\xf0,e\x1dl\xe0\xc5\x80\a\xb1\xad\xbf\xc5\x88!j\xce\x00\x00\x00\x00\x00\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1fb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0xe80, 0x6000000000000000, &(0x7f00000000c0)="b9ff03f0000d698cb89e40f008061fffffff00004000632177fbac141414e9", 0x0, 0x100}, 0x28) 09:38:45 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_mr_cache\x00') sendfile(r1, r2, 0x0, 0x320f) 09:38:46 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:38:46 executing program 2: socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f0000940000)={0x0, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = gettid() clone(0xfc5865b86938af97, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x11) wait4(0x0, 0x0, 0x0, 0x0) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, 0xffffffffffffffff) socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)) 09:38:46 executing program 4: futex(&(0x7f000000cffc), 0x800000000006, 0x0, &(0x7f0000000040), 0x0, 0x0) 09:38:46 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:46 executing program 0: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000480)=ANY=[@ANYBLOB="d3d2b9a322f1369c0400cd80"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) socket(0x10, 0x0, 0x0) bind(0xffffffffffffffff, &(0x7f0000000080)=@generic={0x0, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYRES32], 0x0, 0x4}, 0x20) tkill(r0, 0x1f) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 2612.067184][T18350] ptrace attach of "/root/syz-executor.2"[18349] was attempted by "/root/syz-executor.2"[18350] 09:38:46 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) [ 2612.213362][T18362] ptrace attach of "/root/syz-executor.0"[18361] was attempted by "/root/syz-executor.0"[18362] [ 2612.270009][T18350] IPVS: ftp: loaded support on port[0] = 21 [ 2612.276665][T18349] IPVS: ftp: loaded support on port[0] = 21 09:38:46 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r0, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r1) accept4(r2, 0x0, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x7, 0x0) 09:38:46 executing program 4: r0 = socket$inet6(0xa, 0x1000080002, 0x100000000000088) bind$inet6(r0, &(0x7f0000d85fe4)={0xa, 0x4e23}, 0x1c) r1 = socket$inet6(0xa, 0x802, 0x88) setsockopt$inet6_udp_int(r1, 0x11, 0x100000000a, &(0x7f00000003c0)=0x800000001, 0x4) sendto$inet6(r1, 0x0, 0x0, 0x8800, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) sendto$inet6(r1, &(0x7f00000000c0)="dd", 0x1, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000000380)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 09:38:46 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(0xffffffffffffffff, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:46 executing program 0: r0 = socket(0x10, 0x2, 0x0) close(r0) readahead(r0, 0x0, 0x0) 09:38:46 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:38:46 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000840)="2e0000001e000503ed0080647e6394f23200d2000600170111407f480f0001002700000002000000f88000f01700", 0x2e}], 0x1}, 0x0) 09:38:46 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:38:47 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_emit_ethernet(0x4a, &(0x7f0000000580)={@local, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd]}, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) 09:38:47 executing program 2: socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f0000940000)={0x0, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = gettid() clone(0xfc5865b86938af97, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x11) wait4(0x0, 0x0, 0x0, 0x0) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, 0xffffffffffffffff) socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)) 09:38:47 executing program 4: ioperm(0x0, 0x3, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 09:38:47 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:38:47 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(0xffffffffffffffff, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:47 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r0, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r1) accept4(r2, 0x0, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x7, 0x0) 09:38:47 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x200) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000002c0)={r2}) 09:38:47 executing program 4: clone(0x400004100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000300)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_WKALM_RD(r1, 0x80287010, 0x0) 09:38:48 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) [ 2613.862681][T18419] ptrace attach of "/root/syz-executor.2"[18417] was attempted by "/root/syz-executor.2"[18419] 09:38:48 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(0xffffffffffffffff, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:48 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x200) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000002c0)={r2}) [ 2614.075006][T18417] IPVS: ftp: loaded support on port[0] = 21 09:38:48 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:38:48 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 2615.194856][ C1] net_ratelimit: 16 callbacks suppressed [ 2615.194862][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2615.194889][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2615.200632][ C1] protocol 88fb is buggy, dev hsr_slave_1 09:38:50 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000400)='./cgroup.cpu\x00E\xab\xcbw\x83.\xf3\x8a\xf6\xb3\xac\xfe\x9ek9\xcd\"\x84\x18/~[{\xfb\xc2\t}\xaaCSM^Z\x98\x0eZ\xfca5b\xd6\x92\a\xd6*\xd8v\xd0\xb1\x00=k|\xf1P\xbf\x17\x1b\x8f\xd6LT`V\\\xaeuJ[:\xcd<\xa1L\xec\x9fU\xe9\x14_g=\xfc\x7f\xbd-\xb2\xfa\xee\xe3\a~\x90\xd4\x90\a\x83\x81\xac\x1bWE_\x05;\xefk\x1e\xed:\x90\xc1\xba\x96\xde\xfac\xf0\'&:dn`\xe8\xa6-\x1dh\xb07#T\xa6\xa3\x9c\x91_jM@\x06\x8c\xf5\xbb\x81G\xb9\xa9\x8b\xf3\x8f\xa2\xee', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000000)='cpuset.sched_load_balance\x00', 0x2, 0x0) write$cgroup_int(r1, &(0x7f00000003c0), 0x12) ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) close(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000040)=0x7, 0x12) 09:38:50 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:38:50 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x200) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000002c0)={r2}) 09:38:50 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r1, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r3, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r2) accept4(r3, 0x0, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x7, 0x0) 09:38:50 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:50 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) [ 2616.074859][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2616.080826][ C1] protocol 88fb is buggy, dev hsr_slave_1 09:38:50 executing program 1: setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(0xffffffffffffffff, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(0xffffffffffffffff, 0x80047437, &(0x7f0000000200)) sendmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:38:50 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000040)=0x2000000000000074, 0x4) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000080)='hybla\x00', 0x15b) sendto$inet(r0, &(0x7f00000004c0)="3232ce2774e7a3797748648df71c7b4542839e347be35844e42ad67454cd5e140e0ab73493d6b6921681e5536dbc0f309747cc199a7f9a20d01e04d55fb1c26504e3e4738aac76780b5c2363a6dc4d10fe9adc2b363abf6981a31f6a58ef2103e7a145b11649eac6d4cc29a315faf899c2e35d08b1974199c08bf4798207b78d8dd89e727382318265acc85a4444869dfc22ba7fd79b455635a715fa1e705070e2857ef21a3076cdfc2c29b26547360add94ef9c349ae62f54e7a90e1aae762a11b2cc6bd720034fac41f1de628e2a3166ec21e03c68a60708328e1606a83211bc78be79097861ce52747ac474593d76f96c5cdd91725cb16e62b4bb027fbb96eab344de0401076c6345a7d32e9fe9ba1e68ac07081a7d1e0ed1eb9e96b41214af554f1831dfd8bd2b466789f4295317d17c138abe5fa9044a44792e9aecfb3f9130ff673786a8ef2b14c4999c29a5713c2fb5e35f2fae0d58b64355a697efd45e36528e57c68a62c6edc7879962e05419c7c5fa64ec92e670821df50d0f3a7312d2120f363954e72ba0322fc4318f819b1e2b1a17fb939a5db9c1a0a83b44abcffc3dd555d4dd30c0a4bd524c29d4d57bc906c012446c99a882162f3f72cce0702d7394288807fe2a308e01adc9bbf2a9cd78fa70df3323924035b235fd39ae4ab08d3f09bd231b38dca4389b098b0d3538dd3ef5bf068c1df8fbe00b0b2aa9ec3de5d3fba56594328a643c2799b8371adc6ecdfd9b9c4e52102eaa83b57da14645e442b4b7ad5f555d872dc50c330d145ca853b768b990dbaa18ab7f7e2e2d695e980f96d646e8c893ad912bc71237e9aa3ef2d8a40b5629ca02a82556bd433a7222dc3257fd6ace72b00b6f8c9d621c54f777ee5fd1fc59d11a7ea96855d58bb21d40d1bbdfecad8ed15a25062f7692e1874b4346ac28740f143d5fd3e00e15416e2dbc76c17b1c09fd0b4065d2252b29370c8ec3ce36242c6a22c7891eaa1008655748cb4740ec7dec2626b209d1c24c991066939ab3fb2d868ce7dc1334ccbb01fe228f3c163569527235c8323e727c6ee81c89aea3c0b8de2a35f2b538c49bb40fe4ad72d16b538eb3e9688b9699a907a034e9bc7c8bbab635b3b64394a8ef77f5ff2d762669cebe55803a86f7826d991f4da3c497214e06ca19e132ea2f", 0x341, 0x0, 0x0, 0x0) 09:38:50 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x200) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000002c0)={r2}) [ 2616.234848][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2616.240791][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2616.246633][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2616.252383][ C1] protocol 88fb is buggy, dev hsr_slave_1 09:38:50 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x400001000008912, &(0x7f00000000c0)="11dca5055e0bcfe47bf070") r1 = syz_open_procfs(0x0, &(0x7f0000000040)='net/igmp6\x00') preadv(r1, &(0x7f0000001380)=[{0x0}, {&(0x7f00000011c0)=""/231, 0xe7}], 0x2, 0x0) 09:38:50 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:50 executing program 1: setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(0xffffffffffffffff, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(0xffffffffffffffff, 0x80047437, &(0x7f0000000200)) sendmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:38:50 executing program 2: mkdir(&(0x7f0000000080)='./control\x00', 0x0) r0 = open(&(0x7f0000022ff6)='./control\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000000100)='./control\x00', 0x0) getdents64(r0, &(0x7f0000fc4fbe)=""/80, 0x50) 09:38:50 executing program 4: socket$kcm(0x11, 0xa, 0x300) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x10, 0x3, 0x0) socket$kcm(0x29, 0x2, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x1000000000000002, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r0, 0x161) sendmsg$kcm(r1, &(0x7f0000003d00)={&(0x7f0000000380)=@in={0x2, 0x4e23, @multicast1}, 0x80, 0x0}, 0xfd00) write$cgroup_subtree(r1, &(0x7f0000000280)={[{0x0, 'memory'}]}, 0xfdef) 09:38:50 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x200) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000002c0)={r2}) 09:38:51 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r1, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r3, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r2) accept4(r3, 0x0, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x7, 0x0) 09:38:51 executing program 1: setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(0xffffffffffffffff, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(0xffffffffffffffff, 0x80047437, &(0x7f0000000200)) sendmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:38:51 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") fchdir(r0) 09:38:51 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x200) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000002c0)={r2}) 09:38:51 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:51 executing program 4: socket$kcm(0x11, 0xa, 0x300) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x10, 0x3, 0x0) socket$kcm(0x29, 0x2, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x1000000000000002, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r0, 0x161) sendmsg$kcm(r1, &(0x7f0000003d00)={&(0x7f0000000380)=@in={0x2, 0x4e23, @multicast1}, 0x80, 0x0}, 0xfd00) write$cgroup_subtree(r1, &(0x7f0000000280)={[{0x0, 'memory'}]}, 0xfdef) 09:38:51 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:38:51 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x200) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000002c0)={r2}) 09:38:51 executing program 2: 09:38:51 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:38:51 executing program 4: socket$kcm(0x11, 0xa, 0x300) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x5452, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x10, 0x3, 0x0) socket$kcm(0x29, 0x2, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x1000000000000002, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r0, 0x161) sendmsg$kcm(r1, &(0x7f0000003d00)={&(0x7f0000000380)=@in={0x2, 0x4e23, @multicast1}, 0x80, 0x0}, 0xfd00) write$cgroup_subtree(r1, &(0x7f0000000280)={[{0x0, 'memory'}]}, 0xfdef) 09:38:51 executing program 2: [ 2617.274857][ C0] protocol 88fb is buggy, dev hsr_slave_0 09:38:51 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r1, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r3, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r2) accept4(r3, 0x0, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x7, 0x0) 09:38:51 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:51 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000002c0)) 09:38:51 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:38:51 executing program 2: 09:38:51 executing program 4: 09:38:51 executing program 4: [ 2617.810350][T18549] syz-executor.0 invoked oom-killer: gfp_mask=0x40cd0(GFP_KERNEL|__GFP_COMP|__GFP_RECLAIMABLE), order=0, oom_score_adj=1000 [ 2617.897152][T18549] CPU: 1 PID: 18549 Comm: syz-executor.0 Not tainted 5.3.0-rc6-next-20190830 #75 [ 2617.906386][T18549] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2617.916432][T18549] Call Trace: [ 2617.919732][T18549] dump_stack+0x172/0x1f0 [ 2617.924065][T18549] dump_header+0x177/0x1152 [ 2617.928573][T18549] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2617.934372][T18549] ? ___ratelimit+0x2c8/0x595 [ 2617.939037][T18549] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2617.944843][T18549] ? lockdep_hardirqs_on+0x418/0x5d0 [ 2617.950135][T18549] ? trace_hardirqs_on+0x67/0x240 [ 2617.955153][T18549] ? pagefault_out_of_memory+0x11c/0x11c [ 2617.960777][T18549] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 2617.966578][T18549] ? ___ratelimit+0x60/0x595 [ 2617.971154][T18549] ? do_raw_spin_unlock+0x57/0x270 [ 2617.971170][T18549] oom_kill_process.cold+0x10/0x15 [ 2617.981449][T18549] out_of_memory+0x334/0x1340 [ 2617.981472][T18549] ? lock_downgrade+0x920/0x920 [ 2617.981490][T18549] ? mem_cgroup_unmark_under_oom+0x8d/0xb0 [ 2617.996738][T18549] ? oom_killer_disable+0x280/0x280 [ 2618.001929][T18549] mem_cgroup_out_of_memory+0x1d8/0x240 [ 2618.007468][T18549] ? mem_cgroup_nr_lru_pages+0x1b0/0x1b0 [ 2618.013079][T18549] ? do_raw_spin_unlock+0x57/0x270 [ 2618.018192][T18549] ? _raw_spin_unlock+0x2d/0x50 [ 2618.023018][T18549] try_charge+0xf4b/0x1440 [ 2618.027412][T18549] ? __lock_acquire+0x800/0x4a00 [ 2618.032324][T18549] ? mem_cgroup_oom_trylock+0x1a0/0x1a0 [ 2618.037848][T18549] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 2618.043806][T18549] ? cache_grow_begin+0x122/0xd20 [ 2618.048809][T18549] ? find_held_lock+0x35/0x130 [ 2618.053551][T18549] ? cache_grow_begin+0x122/0xd20 [ 2618.058569][T18549] __memcg_kmem_charge_memcg+0x71/0xf0 [ 2618.064003][T18549] ? memcg_kmem_put_cache+0x50/0x50 [ 2618.069175][T18549] ? __kasan_check_read+0x11/0x20 [ 2618.074176][T18549] cache_grow_begin+0x629/0xd20 [ 2618.079003][T18549] ? __sanitizer_cov_trace_cmp2+0x11/0x20 [ 2618.084695][T18549] ? mempolicy_slab_node+0x139/0x390 [ 2618.089954][T18549] fallback_alloc+0x1fd/0x2d0 [ 2618.094607][T18549] ____cache_alloc_node+0x1bc/0x1d0 [ 2618.099779][T18549] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 2618.105994][T18549] kmem_cache_alloc+0x1ef/0x710 [ 2618.110827][T18549] alloc_inode+0x16f/0x1e0 [ 2618.115221][T18549] new_inode_pseudo+0x19/0xf0 [ 2618.119873][T18549] new_inode+0x1f/0x40 [ 2618.123965][T18549] debugfs_get_inode+0x1a/0x130 [ 2618.128806][T18549] __debugfs_create_file+0xb7/0x3f0 [ 2618.133984][T18549] debugfs_create_file+0x5a/0x70 [ 2618.138898][T18549] kvm_dev_ioctl+0xa04/0x1650 [ 2618.143566][T18549] ? kvm_debugfs_release+0x90/0x90 [ 2618.148659][T18549] ? kvm_debugfs_release+0x90/0x90 [ 2618.153750][T18549] do_vfs_ioctl+0xdb6/0x13e0 [ 2618.158324][T18549] ? ioctl_preallocate+0x210/0x210 [ 2618.163419][T18549] ? __fget+0x384/0x560 [ 2618.167554][T18549] ? ksys_dup3+0x3e0/0x3e0 [ 2618.172019][T18549] ? nsecs_to_jiffies+0x30/0x30 [ 2618.176854][T18549] ? tomoyo_file_ioctl+0x23/0x30 [ 2618.181769][T18549] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2618.187984][T18549] ? security_file_ioctl+0x8d/0xc0 [ 2618.193068][T18549] ksys_ioctl+0xab/0xd0 [ 2618.197202][T18549] __x64_sys_ioctl+0x73/0xb0 [ 2618.201775][T18549] do_syscall_64+0xfa/0x760 [ 2618.206269][T18549] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2618.212135][T18549] RIP: 0033:0x4598e9 [ 2618.216014][T18549] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2618.235593][T18549] RSP: 002b:00007f0b10c4fc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 09:38:52 executing program 2: 09:38:52 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000), 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) [ 2618.243975][T18549] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004598e9 [ 2618.251932][T18549] RDX: 0000000000000000 RSI: 000000000000ae01 RDI: 0000000000000003 [ 2618.259878][T18549] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 2618.267821][T18549] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f0b10c506d4 [ 2618.275763][T18549] R13: 00000000004c2841 R14: 00000000004d5ec8 R15: 00000000ffffffff 09:38:52 executing program 4: 09:38:52 executing program 2: 09:38:52 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000), 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) [ 2618.382113][T18549] memory: usage 307192kB, limit 307200kB, failcnt 5479 [ 2618.427043][T18549] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2618.449200][T18549] Memory cgroup stats for /syz0: [ 2618.449359][T18549] anon 275140608 [ 2618.449359][T18549] file 2269184 [ 2618.449359][T18549] kernel_stack 4718592 [ 2618.449359][T18549] slab 12689408 [ 2618.449359][T18549] sock 77824 [ 2618.449359][T18549] shmem 2174976 [ 2618.449359][T18549] file_mapped 0 [ 2618.449359][T18549] file_dirty 135168 [ 2618.449359][T18549] file_writeback 0 [ 2618.449359][T18549] anon_thp 260046848 [ 2618.449359][T18549] inactive_anon 2027520 [ 2618.449359][T18549] active_anon 275070976 [ 2618.449359][T18549] inactive_file 94208 [ 2618.449359][T18549] active_file 102400 [ 2618.449359][T18549] unevictable 0 [ 2618.449359][T18549] slab_reclaimable 2838528 [ 2618.449359][T18549] slab_unreclaimable 9850880 [ 2618.449359][T18549] pgfault 237369 [ 2618.449359][T18549] pgmajfault 0 [ 2618.449359][T18549] workingset_refault 1320 [ 2618.449359][T18549] workingset_activate 0 [ 2618.449359][T18549] workingset_nodereclaim 0 [ 2618.449359][T18549] pgrefill 406 [ 2618.449359][T18549] pgscan 39493 [ 2618.449359][T18549] pgsteal 1516 [ 2618.562854][T18549] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz0,mems_allowed=0-1,oom_memcg=/syz0,task_memcg=/syz0,task=syz-executor.0,pid=18318,uid=0 [ 2618.579237][T18549] Memory cgroup out of memory: Killed process 18318 (syz-executor.0) total-vm:72708kB, anon-rss:4256kB, file-rss:34816kB, shmem-rss:0kB, UID:0 pgtables:139264kB oom_score_adj:1000 [ 2618.621172][T18544] syz-executor.0 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 2618.641653][T18544] CPU: 1 PID: 18544 Comm: syz-executor.0 Not tainted 5.3.0-rc6-next-20190830 #75 [ 2618.650758][T18544] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2618.660887][T18544] Call Trace: [ 2618.664192][T18544] dump_stack+0x172/0x1f0 [ 2618.668528][T18544] dump_header+0x177/0x1152 [ 2618.673019][T18544] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2618.678818][T18544] ? ___ratelimit+0x2c8/0x595 [ 2618.683514][T18544] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2618.689347][T18544] ? lockdep_hardirqs_on+0x418/0x5d0 [ 2618.694633][T18544] ? trace_hardirqs_on+0x67/0x240 [ 2618.699653][T18544] ? pagefault_out_of_memory+0x11c/0x11c [ 2618.705283][T18544] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 2618.711071][T18544] ? ___ratelimit+0x60/0x595 [ 2618.715643][T18544] ? do_raw_spin_unlock+0x57/0x270 [ 2618.720756][T18544] oom_kill_process.cold+0x10/0x15 [ 2618.725880][T18544] out_of_memory+0x334/0x1340 [ 2618.730562][T18544] ? lock_downgrade+0x920/0x920 [ 2618.735421][T18544] ? oom_killer_disable+0x280/0x280 [ 2618.740623][T18544] mem_cgroup_out_of_memory+0x1d8/0x240 [ 2618.746213][T18544] ? mem_cgroup_nr_lru_pages+0x1b0/0x1b0 [ 2618.751828][T18544] ? do_raw_spin_unlock+0x57/0x270 [ 2618.756932][T18544] ? _raw_spin_unlock+0x2d/0x50 [ 2618.761770][T18544] try_charge+0xa2d/0x1440 [ 2618.766170][T18544] ? mem_cgroup_oom_trylock+0x1a0/0x1a0 [ 2618.771690][T18544] ? percpu_ref_tryget_live+0x111/0x290 [ 2618.777231][T18544] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2618.783473][T18544] ? __kasan_check_read+0x11/0x20 [ 2618.788474][T18544] ? get_mem_cgroup_from_mm+0x156/0x320 [ 2618.793996][T18544] mem_cgroup_try_charge+0x136/0x590 [ 2618.799263][T18544] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 2618.805490][T18544] mem_cgroup_try_charge_delay+0x1f/0xa0 [ 2618.811098][T18544] __handle_mm_fault+0x1e34/0x3f20 [ 2618.816197][T18544] ? vmf_insert_mixed_mkwrite+0x40/0x40 [ 2618.821731][T18544] ? __kasan_check_read+0x11/0x20 [ 2618.826732][T18544] handle_mm_fault+0x1b5/0x6c0 [ 2618.831516][T18544] __do_page_fault+0x536/0xdd0 [ 2618.836279][T18544] do_page_fault+0x38/0x590 [ 2618.840774][T18544] page_fault+0x39/0x40 [ 2618.844900][T18544] RIP: 0033:0x41122f [ 2618.848769][T18544] Code: 0f 84 c8 02 00 00 48 83 bd 78 ff ff ff 00 0f 84 f9 04 00 00 48 8b 95 68 ff ff ff 44 89 95 38 ff ff ff 4c 8d ac 10 00 f7 ff ff <49> 89 85 90 06 00 00 49 8d 85 10 03 00 00 49 89 95 98 06 00 00 41 [ 2618.868368][T18544] RSP: 002b:00007ffd393be690 EFLAGS: 00010206 [ 2618.874413][T18544] RAX: 00007f0b10c0f000 RBX: 0000000000020000 RCX: 000000000045993a [ 2618.882354][T18544] RDX: 0000000000021000 RSI: 0000000000021000 RDI: 0000000000000000 [ 2618.890301][T18544] RBP: 00007ffd393be770 R08: ffffffffffffffff R09: 0000000000000000 [ 2618.898258][T18544] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd393be860 [ 2618.906207][T18544] R13: 00007f0b10c2f700 R14: 0000000000000001 R15: 000000000075bfd4 [ 2618.914544][T18544] memory: usage 302964kB, limit 307200kB, failcnt 5479 [ 2618.921777][T18544] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2618.928799][T18544] Memory cgroup stats for /syz0: [ 2618.928912][T18544] anon 270938112 [ 2618.928912][T18544] file 2269184 [ 2618.928912][T18544] kernel_stack 4718592 [ 2618.928912][T18544] slab 12689408 [ 2618.928912][T18544] sock 77824 [ 2618.928912][T18544] shmem 2174976 [ 2618.928912][T18544] file_mapped 0 [ 2618.928912][T18544] file_dirty 135168 [ 2618.928912][T18544] file_writeback 0 [ 2618.928912][T18544] anon_thp 255852544 [ 2618.928912][T18544] inactive_anon 2027520 [ 2618.928912][T18544] active_anon 270868480 [ 2618.928912][T18544] inactive_file 94208 [ 2618.928912][T18544] active_file 102400 [ 2618.928912][T18544] unevictable 0 [ 2618.928912][T18544] slab_reclaimable 2838528 [ 2618.928912][T18544] slab_unreclaimable 9850880 [ 2618.928912][T18544] pgfault 237369 [ 2618.928912][T18544] pgmajfault 0 [ 2618.928912][T18544] workingset_refault 1320 [ 2618.928912][T18544] workingset_activate 0 [ 2618.928912][T18544] workingset_nodereclaim 0 [ 2618.928912][T18544] pgrefill 406 [ 2618.928912][T18544] pgscan 39493 09:38:53 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r1, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r3, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r2) accept4(r3, 0x0, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x7, 0x0) 09:38:53 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000), 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) [ 2618.928912][T18544] pgsteal 1516 [ 2619.025355][T18544] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz0,mems_allowed=0-1,oom_memcg=/syz0,task_memcg=/syz0,task=syz-executor.0,pid=9786,uid=0 [ 2619.050146][T18544] Memory cgroup out of memory: Killed process 9786 (syz-executor.0) total-vm:72840kB, anon-rss:2208kB, file-rss:35800kB, shmem-rss:0kB, UID:0 pgtables:143360kB oom_score_adj:1000 09:38:53 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000002c0)) 09:38:53 executing program 4: 09:38:53 executing program 2: 09:38:53 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:53 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) [ 2619.095342][ T1064] oom_reaper: reaped process 9786 (syz-executor.0), now anon-rss:0kB, file-rss:34840kB, shmem-rss:0kB 09:38:53 executing program 2: 09:38:53 executing program 4: 09:38:53 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:38:53 executing program 4: 09:38:53 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000002c0)) 09:38:53 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r1, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r3, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r2) accept4(r3, 0x0, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x7, 0x0) 09:38:53 executing program 2: 09:38:53 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:53 executing program 4: 09:38:53 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:38:53 executing program 0: openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r0 = eventfd(0x200) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f00000002c0)={r0}) 09:38:54 executing program 4: 09:38:54 executing program 2: 09:38:54 executing program 0: openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r0 = eventfd(0x200) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f00000002c0)={r0}) 09:38:54 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:38:54 executing program 4: 09:38:54 executing program 2: [ 2620.314917][ C1] net_ratelimit: 11 callbacks suppressed [ 2620.314924][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2620.326347][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2620.394846][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2620.400787][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2620.406631][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2620.412384][ C1] protocol 88fb is buggy, dev hsr_slave_1 09:38:54 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r1, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r3, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r2) accept4(r3, 0x0, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x7, 0x0) 09:38:54 executing program 0: openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r0 = eventfd(0x200) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f00000002c0)={r0}) 09:38:54 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:54 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:38:54 executing program 4: 09:38:54 executing program 2: 09:38:55 executing program 4: 09:38:55 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:38:55 executing program 2: 09:38:55 executing program 0: r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = eventfd(0x200) ioctl$KVM_CREATE_IRQCHIP(r0, 0xae60) ioctl$KVM_IRQFD(r0, 0x4020ae76, &(0x7f00000002c0)={r1}) [ 2620.958693][ C0] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 09:38:55 executing program 4: 09:38:55 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r0, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r1) accept4(r2, 0x0, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x7, 0x0) 09:38:55 executing program 2: 09:38:55 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:38:55 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:55 executing program 0: r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = eventfd(0x200) ioctl$KVM_CREATE_IRQCHIP(r0, 0xae60) ioctl$KVM_IRQFD(r0, 0x4020ae76, &(0x7f00000002c0)={r1}) 09:38:55 executing program 4: [ 2621.245907][ C1] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 09:38:55 executing program 2: 09:38:55 executing program 0: r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = eventfd(0x200) ioctl$KVM_CREATE_IRQCHIP(r0, 0xae60) ioctl$KVM_IRQFD(r0, 0x4020ae76, &(0x7f00000002c0)={r1}) 09:38:55 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:38:55 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000040)=""/40, &(0x7f0000001000)=0x28) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r0, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r1) accept4(r2, 0x0, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x7, 0x0) 09:38:55 executing program 4: [ 2621.434871][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2621.434883][ C0] protocol 88fb is buggy, dev hsr_slave_0 09:38:55 executing program 2: 09:38:55 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x200) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000002c0)={r2}) 09:38:55 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:55 executing program 4: 09:38:55 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:38:55 executing program 2: 09:38:55 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, &(0x7f0000001000)) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r0, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r1) accept4(r2, 0x0, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x7, 0x0) 09:38:55 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x200) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000002c0)={r2}) 09:38:55 executing program 4: 09:38:55 executing program 2: 09:38:56 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[]}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:38:56 executing program 2: 09:38:56 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:56 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x200) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000002c0)={r2}) 09:38:56 executing program 4: 09:38:56 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(r0, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r1) accept4(r2, 0x0, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x7, 0x0) 09:38:56 executing program 2: 09:38:56 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[]}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:38:56 executing program 0: openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = eventfd(0x200) ioctl$KVM_CREATE_IRQCHIP(r0, 0xae60) ioctl$KVM_IRQFD(r0, 0x4020ae76, &(0x7f00000002c0)={r1}) 09:38:56 executing program 4: 09:38:56 executing program 2: 09:38:56 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) pipe(0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r1, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r0) accept4(r1, 0x0, 0x0, 0x0) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x7, 0x0) 09:38:56 executing program 0: openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = eventfd(0x200) ioctl$KVM_CREATE_IRQCHIP(r0, 0xae60) ioctl$KVM_IRQFD(r0, 0x4020ae76, &(0x7f00000002c0)={r1}) 09:38:56 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:38:56 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[]}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:38:56 executing program 4: 09:38:56 executing program 2: 09:38:56 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) pipe(0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r1, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r0) accept4(r1, 0x0, 0x0, 0x0) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x7, 0x0) 09:38:56 executing program 0: openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = eventfd(0x200) ioctl$KVM_CREATE_IRQCHIP(r0, 0xae60) ioctl$KVM_IRQFD(r0, 0x4020ae76, &(0x7f00000002c0)={r1}) 09:38:56 executing program 4: 09:38:56 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(0xffffffffffffffff, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:38:56 executing program 2: 09:38:57 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(0xffffffffffffffff, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:38:57 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000002c0)={r2}) 09:38:57 executing program 2: 09:38:57 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) 09:38:57 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) pipe(0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r1, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r0) accept4(r1, 0x0, 0x0, 0x0) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x7, 0x0) 09:38:57 executing program 4: 09:38:57 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(0xffffffffffffffff, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:38:57 executing program 2: 09:38:57 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000002c0)={r2}) 09:38:57 executing program 4: 09:38:57 executing program 2: 09:38:57 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, 0x0, 0x0) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:38:57 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r1) accept4(r2, 0x0, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x7, 0x0) 09:38:57 executing program 4: 09:38:57 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000002c0)={r2}) 09:38:57 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) 09:38:57 executing program 2: 09:38:57 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, 0x0, 0x0) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:38:57 executing program 4: 09:38:57 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r1) accept4(r2, 0x0, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x7, 0x0) 09:38:57 executing program 4: 09:38:57 executing program 2: 09:38:57 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, 0x0, 0x0) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:38:57 executing program 4: 09:38:57 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x200) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000002c0)={r2}) 09:38:57 executing program 2: 09:38:57 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x0, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:38:58 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) 09:38:58 executing program 2: 09:38:58 executing program 4: 09:38:58 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x200) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000002c0)={r2}) 09:38:58 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r1) accept4(r2, 0x0, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x7, 0x0) 09:38:58 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x0, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:38:58 executing program 2: 09:38:58 executing program 4: 09:38:58 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x200) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000002c0)={r2}) 09:38:58 executing program 3: 09:38:58 executing program 4: 09:38:58 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x0, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:38:58 executing program 2: 09:38:58 executing program 3: 09:38:58 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x200) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f00000002c0)={r2}) 09:38:58 executing program 3: 09:38:59 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r1) accept4(r2, 0x0, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x7, 0x0) 09:38:59 executing program 2: 09:38:59 executing program 4: 09:38:59 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:38:59 executing program 3: 09:38:59 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x200) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f00000002c0)={r2}) 09:38:59 executing program 4: 09:38:59 executing program 3: 09:38:59 executing program 2: 09:38:59 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:38:59 executing program 3: 09:38:59 executing program 4: [ 2625.594862][ C0] net_ratelimit: 25 callbacks suppressed [ 2625.594868][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2625.594893][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2625.600635][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2625.606374][ C1] protocol 88fb is buggy, dev hsr_slave_1 09:39:00 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, 0x0, 0x0) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r1) accept4(r2, 0x0, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x7, 0x0) 09:39:00 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x200) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f00000002c0)={r2}) 09:39:00 executing program 2: 09:39:00 executing program 4: 09:39:00 executing program 3: 09:39:00 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:39:00 executing program 4: 09:39:00 executing program 3: 09:39:00 executing program 2: 09:39:00 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(0xffffffffffffffff, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:39:00 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) eventfd(0x200) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_IRQFD(r1, 0x4020ae76, 0x0) 09:39:00 executing program 4: [ 2626.554891][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2626.560727][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2626.634865][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2626.640698][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2626.646585][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2626.652357][ C1] protocol 88fb is buggy, dev hsr_slave_1 09:39:01 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, 0x0, 0x0) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r1) accept4(r2, 0x0, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x7, 0x0) 09:39:01 executing program 2: 09:39:01 executing program 3: 09:39:01 executing program 4: 09:39:01 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) eventfd(0x200) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_IRQFD(r1, 0x4020ae76, 0x0) 09:39:01 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(0xffffffffffffffff, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:39:01 executing program 4: 09:39:01 executing program 3: 09:39:01 executing program 2: 09:39:01 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(0xffffffffffffffff, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:39:01 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) eventfd(0x200) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_IRQFD(r1, 0x4020ae76, 0x0) 09:39:01 executing program 2: 09:39:02 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, 0x0, 0x0) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r1) accept4(r2, 0x0, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x7, 0x0) 09:39:02 executing program 3: 09:39:02 executing program 4: 09:39:02 executing program 2: 09:39:02 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, 0x0) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:39:02 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) eventfd(0x200) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000002c0)) 09:39:02 executing program 4: 09:39:02 executing program 3: 09:39:02 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000200)={0x2000000000012, 0x1, 0x4, 0x1, 0x0, 0xffffffffffffffff, 0x0, [], 0x0, 0xffffffffffffff9c}, 0x3c) socket$rxrpc(0x21, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x5, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x10020000000, 0x0}, 0x2c) 09:39:02 executing program 4: r0 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video37\x00', 0x2, 0x0) ioctl$VIDIOC_QUERYBUF(r0, 0xc0585609, &(0x7f0000000140)={0x0, 0x5, 0x4, 0x0, {0x0, 0x2710}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "22151df4"}, 0x0, 0x0, @fd, 0x4}) 09:39:02 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, 0x0) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:39:02 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) eventfd(0x200) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000002c0)) 09:39:03 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r1) accept4(r2, 0x0, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x7, 0x0) 09:39:03 executing program 3: openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x400, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x02\x00\x1b\x00\x00\x00\x00\x1d\x850\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x85\x00'}) perf_event_open(&(0x7f00000000c0)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x400, 0x2, 0x8001, 0x4, 0x0, 0x6, 0x9, 0x0, 0x1ff, 0x0, 0x7, 0x9, 0x81, 0x4, 0x0, 0x0, 0x3f, 0x1, 0x0, 0x8, 0x4, 0x0, 0x2, 0x8000, 0x8, 0x5, 0x0, 0x5, 0x81, 0x1, 0x0, 0x5, 0x1, @perf_bp={&(0x7f0000000080), 0x9dc212bb339ced71}, 0x2048f, 0x0, 0x3, 0xb369696ad33e4633, 0x0, 0x123, 0x7}, 0x0, 0x3, 0xffffffffffffffff, 0xa) perf_event_open(&(0x7f000001d000)={0x1, 0x51, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000001000)={0x26, 'hash\x00', 0x0, 0x0, 'michael_mic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000412ff8)="3665a1ab415b7ac7", 0x8) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000004c0)={0x10000000, 0x0, &(0x7f0000000440)=[{&(0x7f000077ff7d), 0xf0ff7f}], 0xc}, 0x0) 09:39:03 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, 0x0) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:39:03 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'ip6_vti0\x00'}) 09:39:03 executing program 4: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1fb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0x2b, 0x0, &(0x7f0000000100)="b901000000000000009e40f008001fffffe100004000630677fbac141414e9a33fa1be3e7d2a182fff34b4", 0x0, 0x100, 0x6000000000000000}, 0x28) 09:39:03 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) eventfd(0x200) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000002c0)) 09:39:03 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'ip6_vti0\x00', 0x400}) 09:39:03 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:39:03 executing program 0: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1fb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) 09:39:03 executing program 2: sched_setaffinity(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/netlink\x00m\x10\x1bDv\xe5j@\xca\x98\"X\xc7k\xb9u\x17w\xed*\xb23\xa9#\xcb\x12\x97\xe9U\x18\xd4\x8d\b\xfc\x845j\x18z\r\xd6\xea\xacE\xd3G\xa9Ki(\xf3\xa3\xfa\xf1\x11(b\am\xd21\x91Q\xbe}\xa3\x8b\r\xc2TR\xa9\tm\x1f\x12hf\xc6\xfa!\x8eK\xd9\x90K\xfa\xc1\x1d\xa9i\x17\a\xdb+\x95Z /\xc9\xafk\xb3!\x05\x17\xcb\x05\tX\x9c~\x85O\x97\x8f\xcc\xcc\xe4\xcb=\xdb\xdf\x1a\x81N\x01>\xdb7\xe3\xe3\xae;3\x8fF\x18\xa4Y `nu\xab!\x9dG\xea\x06\xa7\x83\t\x9b<\x10\xad\a\xb5Ia\xb4f\x97\xb7a4!\xe5h\xabk\x7f\xc4\x9d8\xdb>') preadv(r0, &(0x7f0000000940)=[{&(0x7f0000000500)=""/112, 0x70}], 0x1, 0x4c000000) 09:39:03 executing program 3: ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r0 = syz_open_dev$dri(&(0x7f00000001c0)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f00000005c0)) 09:39:03 executing program 4: vmsplice(0xffffffffffffffff, &(0x7f00000026c0)=[{&(0x7f00000016c0)="a6392c5cac4c5f3b3080892c65c38c603f1b5753d539f05d18289adb4a85e90550c3df06b3a66cb0fff0ad2d9e1a2baf9f346035e5a3678a06b8f29dacd5ac4b8b5925741121204ded45e6157019095240876d397c65f0585ea4683ce769d031906305b75da41a400d", 0x69}], 0x1, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)) r1 = syz_open_pts(r0, 0x88d82) write(r1, &(0x7f0000000000), 0xffffff86) 09:39:03 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r1) accept4(r2, 0x0, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x7, 0x0) 09:39:03 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:39:03 executing program 0: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1fb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0x25, 0x0, &(0x7f0000000100)="b901000000000000009e40f008001fffffe100004000630677fbac141414e9a33fa1be3e7d", 0x0, 0x100, 0x6000000000000000}, 0x28) 09:39:03 executing program 2: r0 = syz_open_dev$dri(&(0x7f00000001c0)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_SETCRTC(0xffffffffffffffff, 0x401870c8, 0x0) ioctl$DRM_IOCTL_AGP_FREE(r0, 0x40206435, &(0x7f0000000580)) 09:39:03 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f00000002c0)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000100)={0x2, 0x0, 0x0, 0x0, 'syz0\x00'}) 09:39:03 executing program 4: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) move_mount(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0xffffffffffffffff, 0x0, 0x0) 09:39:04 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x69, 0x0) 09:39:04 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f00000002c0)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, [], [], [], 0x0, 0x0, 0x0, 0x0, "b056c041c01288c436e57cb64572eae5"}) 09:39:04 executing program 2: socketpair(0x1, 0x2000000003, 0x0, &(0x7f00000005c0)={0xffffffffffffffff}) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="11dca5055e0bcfe47bf070") sendmmsg$unix(r0, &(0x7f0000002f40)=[{&(0x7f0000000040)=@abs={0x1}, 0x6e, 0x0}], 0x1, 0x0) 09:39:04 executing program 4: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1fb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0x25, 0x0, &(0x7f0000000100)="b901000000000000009e40f008001fffffe100004000630677fbac141414e9a33fa1be3e7d", 0x0, 0x100, 0x6000000000000000}, 0x28) 09:39:04 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'teql0\x00', 0x102}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'ip6_vti0\x00', 0x400}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f00000006c0)={'bpq0\x00', 0x200}) 09:39:04 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000001200)=""/148, 0xffffff87}], 0x100000c7, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000280)='status\x00') syz_open_dev$radio(&(0x7f00000000c0)='/dev/radio#\x00', 0x1, 0x2) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) pwrite64(r1, 0x0, 0x0, 0x3200) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000240)='bridge_slave_1\x00', 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(0xffffffffffffffff, 0x8937, &(0x7f0000000140)={'veth0\x00', @ifru_settings={0x10001, 0x0, @fr=0x0}}) setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x12, &(0x7f0000000180)={@local, @broadcast, @loopback}, 0x3) mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2, 0x13, 0xffffffffffffffff, 0x0) [ 2630.714877][ C1] net_ratelimit: 14 callbacks suppressed [ 2630.714882][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2630.726782][ C1] protocol 88fb is buggy, dev hsr_slave_1 09:39:04 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r1) accept4(r2, 0x0, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x7, 0x0) 09:39:04 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, 0x0, 0x0, 0x0) 09:39:04 executing program 2: r0 = socket$inet6(0xa, 0x3, 0x6) bind$inet6(r0, &(0x7f0000000180)={0xa, 0x0, 0x0, @ipv4={[], [], @broadcast}}, 0x1c) 09:39:04 executing program 4: r0 = getpgrp(0x0) syz_open_procfs(r0, 0xfffffffffffffffe) 09:39:04 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f00000002c0)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000000)={0x0, 0x0, 0x4, 0x0, [], [], [], 0x0, 0x0, 0x0, 0x0, "b056c041c01288c436e57cb64572eae5"}) 09:39:04 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000001200)=""/148, 0xffffff87}], 0x100000c7, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000280)='status\x00') syz_open_dev$radio(&(0x7f00000000c0)='/dev/radio#\x00', 0x1, 0x2) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) pwrite64(r1, 0x0, 0x0, 0x3200) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000240)='bridge_slave_1\x00', 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r2, 0x8937, &(0x7f0000000140)={'veth0\x00', @ifru_settings={0x10001, 0x0, @fr=0x0}}) setsockopt$inet_mreqsrc(r2, 0x0, 0x12, 0x0, 0x0) mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2, 0x13, r2, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) [ 2630.794855][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2630.800771][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2630.806729][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2630.812480][ C1] protocol 88fb is buggy, dev hsr_slave_1 09:39:05 executing program 4: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000001200)=""/148, 0xffffff87}], 0x100000c7, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000280)='status\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000240)='bridge_slave_1\x00', 0x10) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r1, 0x8937, &(0x7f0000000140)={'veth0\x00', @ifru_settings={0x10001, 0x0, @fr=0x0}}) setsockopt$inet_mreqsrc(r1, 0x0, 0x12, &(0x7f0000000180)={@local, @broadcast, @loopback}, 0x3) mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2, 0x13, r1, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) 09:39:05 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f00000002c0)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000000)={0x0, 0x0, 0x4, 0x0, [], [], [], 0x0, 0x0, 0x0, 0x0, "b056c041c01288c436e57cb64572eae5"}) 09:39:05 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, 0x0, 0x0, 0x0) 09:39:05 executing program 2: pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) writev(r1, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400", 0x6}], 0x1) write$binfmt_elf64(r1, &(0x7f0000000540)=ANY=[@ANYBLOB="5f454c44065b05007311625b1e43f0010bf32b9a993b89725d4d1c31090000173bd22023eb2be30c77a0ba068c2b206431cbfabdf1ba04fb7e92c1dda2de803ddf1eb6e00100db10c8203b9befd204603766"], 0x52) close(r2) socket$netlink(0x10, 0x3, 0x4) splice(r0, 0x0, r2, 0x0, 0x4f20, 0x0) 09:39:05 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f00000002c0)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000000)={0x0, 0x0, 0x4, 0x0, [], [], [], 0x0, 0x0, 0x0, 0x0, "b056c041c01288c436e57cb64572eae5"}) 09:39:05 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, 0x0, 0x0, 0x0) 09:39:05 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r1) accept4(r2, 0x0, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x7, 0x0) 09:39:05 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) capset(0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:39:05 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f00000002c0)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000000)={0x0, 0x0, 0x4, 0x0, [], [], [], 0x0, 0x0, 0x0, 0x0, "b056c041c01288c436e57cb64572eae5"}) 09:39:05 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0), 0x0, 0x0) 09:39:05 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) ioctl$KVM_NMI(r2, 0xae9a) capset(0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:39:05 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000001200)=""/148, 0xffffff87}], 0x100000c7, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000280)='status\x00') syz_open_dev$radio(&(0x7f00000000c0)='/dev/radio#\x00', 0x1, 0x2) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) pwrite64(r1, 0x0, 0x0, 0x3200) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000240)='bridge_slave_1\x00', 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r2, 0x8937, &(0x7f0000000140)={'veth0\x00', @ifru_settings={0x10001, 0x0, @fr=0x0}}) setsockopt$inet_mreqsrc(r2, 0x0, 0x12, 0x0, 0x0) mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2, 0x13, r2, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) 09:39:05 executing program 0: ioctl$SNDRV_CTL_IOCTL_PCM_INFO(0xffffffffffffffff, 0xc1205531, &(0x7f0000000000)={0x0, 0x0, 0x4, 0x0, [], [], [], 0x0, 0x0, 0x0, 0x0, "b056c041c01288c436e57cb64572eae5"}) [ 2631.834851][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2631.834858][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2631.834901][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2631.840744][ C1] protocol 88fb is buggy, dev hsr_slave_1 09:39:06 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000040)='./file0/bus\x00', 0x0) fcntl$lock(r0, 0x0, &(0x7f0000027000)={0x1}) syncfs(r0) sysinfo(&(0x7f0000000000)=""/22) sendmsg(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000380)="af1c2f06e42e6444a24db870545ccd6027bc5b0d316baef7f5fff993521df83fe8349c900f5c312bf93657833a1c9a5e12583ead4743be5c6db902ba23aca50d2bbd776912912e3ffc201470fa05a886427f9316ec86dbad124f161a14e5e9e00205491ef340222ace13b7d3006356d8a315413544709d758e3999cab574e098053df017c7af19749cce0c3aa85bd8c6dc267fcdc65f97afb52b0dc43ace14c2ffa5735f35b8415ec6c85308dd957e107b52f0530621dbc5d36b2c7544862cd9728469accbcfe2", 0xc7}, {&(0x7f0000000480)}], 0x2}, 0x0) r1 = openat(0xffffffffffffffff, &(0x7f0000000140)='./file0\x00', 0x80000, 0x18) setsockopt$ALG_SET_AEAD_AUTHSIZE(r1, 0x117, 0x5, 0x0, 0x3) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000000340)) write$RDMA_USER_CM_CMD_GET_EVENT(0xffffffffffffffff, &(0x7f0000000080)={0xc, 0x8, 0xfa00, {&(0x7f00000001c0)}}, 0x10) r2 = socket$inet(0x10, 0x2, 0x0) ioctl$sock_ifreq(r2, 0x89f1, &(0x7f0000000180)={'ip6gre0\x00\xeej\x01\x0f\'@\x03\xf8', @ifru_flags}) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8916, 0x0) syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x0) 09:39:06 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0), 0x0, 0x0) 09:39:06 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r1) accept4(r2, 0x0, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x7, 0x0) 09:39:06 executing program 0: ioctl$SNDRV_CTL_IOCTL_PCM_INFO(0xffffffffffffffff, 0xc1205531, &(0x7f0000000000)={0x0, 0x0, 0x4, 0x0, [], [], [], 0x0, 0x0, 0x0, 0x0, "b056c041c01288c436e57cb64572eae5"}) 09:39:06 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0), 0x0, 0x0) 09:39:06 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000040)='./file0/bus\x00', 0x0) fcntl$lock(r0, 0x0, &(0x7f0000027000)={0x1}) syncfs(r0) sysinfo(&(0x7f0000000000)=""/22) sendmsg(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000380)="af1c2f06e42e6444a24db870545ccd6027bc5b0d316baef7f5fff993521df83fe8349c900f5c312bf93657833a1c9a5e12583ead4743be5c6db902ba23aca50d2bbd776912912e3ffc201470fa05a886427f9316ec86dbad124f161a14e5e9e00205491ef340222ace13b7d3006356d8a315413544709d758e3999cab574e098053df017c7af19749cce0c3aa85bd8c6dc267fcdc65f97afb52b0dc43ace14c2ffa5735f35b8415ec6c85308dd957e107b52f0530621dbc5d36b2c7544862cd9728469accbcfe2", 0xc7}, {&(0x7f0000000480)}], 0x2}, 0x0) r1 = openat(0xffffffffffffffff, &(0x7f0000000140)='./file0\x00', 0x80000, 0x18) setsockopt$ALG_SET_AEAD_AUTHSIZE(r1, 0x117, 0x5, 0x0, 0x3) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000000340)) write$RDMA_USER_CM_CMD_GET_EVENT(0xffffffffffffffff, &(0x7f0000000080)={0xc, 0x8, 0xfa00, {&(0x7f00000001c0)}}, 0x10) r2 = socket$inet(0x10, 0x2, 0x0) ioctl$sock_ifreq(r2, 0x89f1, &(0x7f0000000180)={'ip6gre0\x00\xeej\x01\x0f\'@\x03\xf8', @ifru_flags}) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8916, 0x0) syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x0) 09:39:06 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r1) accept4(r2, 0x0, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x7, 0x0) 09:39:06 executing program 0: ioctl$SNDRV_CTL_IOCTL_PCM_INFO(0xffffffffffffffff, 0xc1205531, &(0x7f0000000000)={0x0, 0x0, 0x4, 0x0, [], [], [], 0x0, 0x0, 0x0, 0x0, "b056c041c01288c436e57cb64572eae5"}) 09:39:06 executing program 4: r0 = syz_open_dev$vbi(&(0x7f00000001c0)='/dev/vbi#\x00', 0x1, 0x2) r1 = memfd_create(&(0x7f0000000200)='-vboxnet0\x00]\xea\xb0\xe2N\xc6c\x05\x8d\xb5\xc0\n\xad\x0f#+\x17\xd6A\xf4\xdf\x1b\xf9~\x8e\"\r\xff\xbb\xb0\xc3\x86\x97\xaf\xf8\x7f*\xfc\xfd\xe7\xcc\xbc\xddI.\xc3\x9aQ\xc8\x8e8U\xdaX\x06\x92\x1d\xbd\x10\xf9\xe8q\x00\xddr>\xd7\x9f\xf8r\xeeE\xa83K\xf60 \x7f\xcd\xac\x86\x9eT*\xf7\a^L,\x98\xa2(2,\x8c*\xff\x8aA\xa1\x153\x15\b\xcb\xf7\xefw\xa6\xc7c@\xb5\x9b\xdc$`3]\xf9.\xcf\x00'/203, 0x0) ftruncate(r1, 0x1000000) sendfile(r0, r1, 0x0, 0xeefffdef) r2 = syz_open_dev$vbi(&(0x7f00000001c0)='/dev/vbi#\x00', 0x1, 0x2) r3 = memfd_create(&(0x7f0000000200)='-vboxnet0\x00]\xea\xb0\xe2N\xc6c\x05\x8d\xb5\xc0\n\xad\x0f#+\x17\xd6A\xf4\xdf\x1b\xf9~\x8e\"\r\xff\xbb\xb0\xc3\x86\x97\xaf\xf8\x7f*\xfc\xfd\xe7\xcc\xbc\xddI.\xc3\x9aQ\xc8\x8e8U\xdaX\x06\x92\x1d\xbd\x10\xf9\xe8q\x00\xddr>\xd7\x9f\xf8r\xeeE\xa83K\xf60 \x7f\xcd\xac\x86\x9eT*\xf7\a^L,\x98\xa2(2,\x8c*\xff\x8aA\xa1\x153\x15\b\xcb\xf7\xefw\xa6\xc7c@\xb5\x9b\xdc$`3]\xf9.\xcf\x00'/203, 0x0) ftruncate(r3, 0x1000000) sendfile(r2, r3, 0x0, 0xeefffdef) 09:39:06 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x1, 0x0) 09:39:06 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000001200)=""/148, 0xffffff87}], 0x100000c7, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000280)='status\x00') syz_open_dev$radio(&(0x7f00000000c0)='/dev/radio#\x00', 0x1, 0x2) preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) pwrite64(r1, 0x0, 0x0, 0x3200) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000240)='bridge_slave_1\x00', 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(r2, 0x8937, &(0x7f0000000140)={'veth0\x00', @ifru_settings={0x10001, 0x0, @fr=0x0}}) setsockopt$inet_mreqsrc(r2, 0x0, 0x12, 0x0, 0x0) mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2, 0x13, r2, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) 09:39:06 executing program 0: r0 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000000)={0x0, 0x0, 0x4, 0x0, [], [], [], 0x0, 0x0, 0x0, 0x0, "b056c041c01288c436e57cb64572eae5"}) 09:39:06 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r1) accept4(r2, 0x0, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x7, 0x0) 09:39:06 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="11dca50d5e0bcfe47bf070") r1 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000100)=0x10) setsockopt$inet_sctp6_SCTP_RTOINFO(r1, 0x84, 0x7c, &(0x7f0000000240), 0x10) 09:39:06 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x1, 0x0) 09:39:06 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x1, 0x0) 09:39:06 executing program 0: r0 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000000)={0x0, 0x0, 0x4, 0x0, [], [], [], 0x0, 0x0, 0x0, 0x0, "b056c041c01288c436e57cb64572eae5"}) 09:39:06 executing program 0: r0 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000000)={0x0, 0x0, 0x4, 0x0, [], [], [], 0x0, 0x0, 0x0, 0x0, "b056c041c01288c436e57cb64572eae5"}) 09:39:07 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000100)}}], 0x1, 0x0) 09:39:07 executing program 0: syz_open_dev$sndctrl(&(0x7f00000002c0)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(0xffffffffffffffff, 0xc1205531, &(0x7f0000000000)={0x0, 0x0, 0x4, 0x0, [], [], [], 0x0, 0x0, 0x0, 0x0, "b056c041c01288c436e57cb64572eae5"}) 09:39:07 executing program 4: mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getrandom(&(0x7f0000000100)=""/44, 0xfffffffffffffed2, 0x0) r0 = memfd_create(&(0x7f0000000040)='u', 0x0) r1 = dup(r0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execveat(r1, &(0x7f0000000000)='\x00', &(0x7f00000001c0), 0x0, 0x1000) syz_open_procfs(0x0, &(0x7f0000000200)='net/tcp6\x00') bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x9) 09:39:07 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000100)}}], 0x1, 0x0) 09:39:07 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @local, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 09:39:07 executing program 0: syz_open_dev$sndctrl(&(0x7f00000002c0)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(0xffffffffffffffff, 0xc1205531, &(0x7f0000000000)={0x0, 0x0, 0x4, 0x0, [], [], [], 0x0, 0x0, 0x0, 0x0, "b056c041c01288c436e57cb64572eae5"}) 09:39:07 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000100)}}], 0x1, 0x0) 09:39:07 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r1) accept4(r2, 0x0, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x7, 0x0) 09:39:07 executing program 2: timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) 09:39:07 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0)}}], 0x1, 0x0) 09:39:07 executing program 0: syz_open_dev$sndctrl(&(0x7f00000002c0)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(0xffffffffffffffff, 0xc1205531, &(0x7f0000000000)={0x0, 0x0, 0x4, 0x0, [], [], [], 0x0, 0x0, 0x0, 0x0, "b056c041c01288c436e57cb64572eae5"}) 09:39:07 executing program 3: r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet_tcp_int(r1, 0x6, 0x19, &(0x7f0000000000)=0x1, 0x4) 09:39:07 executing program 2: mmap(&(0x7f0000000000/0xddf000)=nil, 0xddf000, 0x0, 0x4032, 0xffffffffffffffff, 0x0) 09:39:07 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f00000002c0)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, 0x0) 09:39:08 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f00000018c0)={0x2, 0x4e20, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000000c0), 0x4) setsockopt$sock_int(r0, 0x1, 0x23, &(0x7f0000000200)=0x1ff, 0x4) sendto$inet(r0, 0x0, 0x0, 0x1000000020000000, &(0x7f0000000080)={0x2, 0x4e20}, 0x10) recvmsg(r0, &(0x7f0000001680)={0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000000600)=""/4096, 0x1000}], 0x1}, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) openat$null(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) ioctl$TIOCGICOUNT(0xffffffffffffffff, 0x545d, 0x0) socket$inet6(0xa, 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) getgid() lchown(0x0, 0x0, 0x0) ioctl$TCSETXF(0xffffffffffffffff, 0x5434, 0x0) ioctl$EXT4_IOC_PRECACHE_EXTENTS(0xffffffffffffffff, 0x6612) 09:39:08 executing program 3: wait4(0x0, 0x0, 0x1000002, 0x0) 09:39:08 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0)}}], 0x1, 0x0) 09:39:08 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000003c0)="a4ab12f728db4b2b4d2f2fba4fad273b1e", 0x11}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffd15}, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 09:39:08 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f00000002c0)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, 0x0) [ 2634.102193][T19283] ptrace attach of "/root/syz-executor.2"[19282] was attempted by "/root/syz-executor.2"[19283] 09:39:08 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r1) accept4(r2, 0x0, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x7, 0x0) 09:39:08 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000000100)=""/144, 0x90) 09:39:08 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f0000000000)) ioctl$TIOCPKT(r1, 0x5420, &(0x7f00000002c0)=0x400000005) read(r1, &(0x7f0000000040)=""/11, 0xb) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000140)) r2 = syz_open_pts(r1, 0x0) ioctl$TCGETS(r1, 0x5401, &(0x7f0000000080)) r3 = dup3(r2, r1, 0x0) ioctl$TCSETA(r3, 0x5406, &(0x7f00000000c0)) 09:39:08 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000000)=0xba27, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x1}}, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000200)) sendmmsg(r0, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc, 0x80, &(0x7f00000003c0)}}], 0x1, 0x0) 09:39:08 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f00000002c0)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, 0x0) [ 2634.496254][ T8171] syz-executor.2 invoked oom-killer: gfp_mask=0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order=0, oom_score_adj=0 [ 2634.539428][ T8171] CPU: 0 PID: 8171 Comm: syz-executor.2 Not tainted 5.3.0-rc6-next-20190830 #75 [ 2634.548725][ T8171] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2634.558775][ T8171] Call Trace: [ 2634.562069][ T8171] dump_stack+0x172/0x1f0 [ 2634.566438][ T8171] dump_header+0x177/0x1152 [ 2634.571002][ T8171] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2634.576918][ T8171] ? ___ratelimit+0x2c8/0x595 [ 2634.581617][ T8171] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2634.581633][ T8171] ? lockdep_hardirqs_on+0x418/0x5d0 [ 2634.592696][ T8171] ? trace_hardirqs_on+0x67/0x240 [ 2634.597712][ T8171] ? pagefault_out_of_memory+0x11c/0x11c [ 2634.597727][ T8171] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 2634.597739][ T8171] ? ___ratelimit+0x60/0x595 [ 2634.597749][ T8171] ? do_raw_spin_unlock+0x57/0x270 [ 2634.597764][ T8171] oom_kill_process.cold+0x10/0x15 [ 2634.597776][ T8171] out_of_memory+0x334/0x1340 [ 2634.597791][ T8171] ? lock_downgrade+0x920/0x920 [ 2634.619051][ T8171] ? mem_cgroup_unmark_under_oom+0x8d/0xb0 [ 2634.619067][ T8171] ? oom_killer_disable+0x280/0x280 [ 2634.619088][ T8171] mem_cgroup_out_of_memory+0x1d8/0x240 [ 2634.619103][ T8171] ? mem_cgroup_nr_lru_pages+0x1b0/0x1b0 [ 2634.629028][ T8171] ? do_raw_spin_unlock+0x57/0x270 [ 2634.661313][ T8171] ? _raw_spin_unlock+0x2d/0x50 [ 2634.666168][ T8171] try_charge+0xf4b/0x1440 [ 2634.670593][ T8171] ? mem_cgroup_oom_trylock+0x1a0/0x1a0 [ 2634.676243][ T8171] ? find_held_lock+0x35/0x130 [ 2634.681005][ T8171] ? get_mem_cgroup_from_mm+0x139/0x320 [ 2634.686588][ T8171] ? lock_downgrade+0x920/0x920 [ 2634.691439][ T8171] ? percpu_ref_tryget_live+0x111/0x290 [ 2634.696987][ T8171] __memcg_kmem_charge_memcg+0x71/0xf0 [ 2634.702472][ T8171] ? memcg_kmem_put_cache+0x50/0x50 [ 2634.707684][ T8171] ? get_mem_cgroup_from_mm+0x156/0x320 [ 2634.707701][ T8171] __memcg_kmem_charge+0x13a/0x3a0 [ 2634.707717][ T8171] __alloc_pages_nodemask+0x4f7/0x900 [ 2634.723921][ T8171] ? stack_trace_consume_entry+0x190/0x190 [ 2634.729726][ T8171] ? __alloc_pages_slowpath+0x2540/0x2540 [ 2634.735625][ T8171] ? copy_page_range+0xef4/0x1ed0 [ 2634.740862][ T8171] ? copy_page_range+0xef4/0x1ed0 [ 2634.745890][ T8171] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 2634.752161][ T8171] alloc_pages_current+0x107/0x210 [ 2634.757441][ T8171] pte_alloc_one+0x1b/0x1a0 [ 2634.761947][ T8171] __pte_alloc+0x20/0x310 [ 2634.766277][ T8171] copy_page_range+0x14da/0x1ed0 [ 2634.771243][ T8171] ? pmd_alloc+0x180/0x180 [ 2634.775657][ T8171] ? __rb_insert_augmented+0x20c/0xd90 [ 2634.781150][ T8171] ? validate_mm_rb+0xa3/0xc0 [ 2634.785997][ T8171] ? __vma_link_rb+0x5ad/0x770 09:39:08 executing program 3: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000700)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x145042, 0x0) r3 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$P9_RREMOVE(r3, &(0x7f0000000280)={0x2}, 0xffffff9a) r4 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r4, 0x4, 0x6100) ftruncate(r4, 0x8200) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xf642e7e) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000a80)={0x0, r3}) r5 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_rx_ring(r5, 0x107, 0x5, &(0x7f0000000000)=@req3={0x6000000, 0x3, 0x6000000, 0x3}, 0x1c) close(r5) getsockopt$sock_int(r5, 0x1, 0x1, &(0x7f0000000000), &(0x7f00000000c0)=0x4) r6 = open(&(0x7f00000001c0)='./file0\x00', 0x10000004100, 0x0) sendfile(r1, r6, 0x0, 0x8000fffffffe) clock_gettime(0x0, 0x0) 09:39:08 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f00000002c0)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, [], [], [], 0x0, 0x0, 0x0, 0x0, "b056c041c01288c436e57cb64572eae5"}) [ 2634.790756][ T8171] dup_mm+0xa67/0x1430 [ 2634.794835][ T8171] ? vm_area_dup+0x170/0x170 [ 2634.799524][ T8171] ? debug_mutex_init+0x2d/0x60 [ 2634.804405][ T8171] copy_process+0x2671/0x6830 [ 2634.809084][ T8171] ? __kasan_check_read+0x11/0x20 [ 2634.814124][ T8171] ? __cleanup_sighand+0x60/0x60 [ 2634.819071][ T8171] ? __might_fault+0x12b/0x1e0 [ 2634.823894][ T8171] ? __might_fault+0x12b/0x1e0 [ 2634.828667][ T8171] _do_fork+0x146/0xfa0 [ 2634.832829][ T8171] ? copy_init_mm+0x20/0x20 [ 2634.837340][ T8171] ? __kasan_check_read+0x11/0x20 [ 2634.842377][ T8171] ? _copy_to_user+0x118/0x160 [ 2634.847169][ T8171] __x64_sys_clone+0x1ab/0x270 [ 2634.851937][ T8171] ? __ia32_sys_vfork+0xd0/0xd0 [ 2634.856808][ T8171] ? do_syscall_64+0x26/0x760 [ 2634.861484][ T8171] ? lockdep_hardirqs_on+0x418/0x5d0 [ 2634.866775][ T8171] ? trace_hardirqs_on+0x67/0x240 [ 2634.871950][ T8171] do_syscall_64+0xfa/0x760 [ 2634.876457][ T8171] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2634.882344][ T8171] RIP: 0033:0x457eba [ 2634.886249][ T8171] Code: f7 d8 64 89 04 25 d4 02 00 00 64 4c 8b 0c 25 10 00 00 00 31 d2 4d 8d 91 d0 02 00 00 31 f6 bf 11 00 20 01 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 0f 87 f5 00 00 00 85 c0 41 89 c5 0f 85 fc 00 00 [ 2634.906081][ T8171] RSP: 002b:00007fffe45fb850 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 2634.914555][ T8171] RAX: ffffffffffffffda RBX: 00007fffe45fb850 RCX: 0000000000457eba [ 2634.922521][ T8171] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 2634.930486][ T8171] RBP: 00007fffe45fb890 R08: 0000000000000001 R09: 000055555649b940 [ 2634.938556][ T8171] R10: 000055555649bc10 R11: 0000000000000246 R12: 0000000000000001 [ 2634.946535][ T8171] R13: 0000000000000000 R14: 0000000000000000 R15: 00007fffe45fb8e0 [ 2634.958305][ T8171] memory: usage 307200kB, limit 307200kB, failcnt 8000 [ 2634.966053][ T8171] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2634.972964][ T8171] Memory cgroup stats for /syz2: [ 2634.973050][ T8171] anon 265998336 [ 2634.973050][ T8171] file 61440 [ 2634.973050][ T8171] kernel_stack 6356992 [ 2634.973050][ T8171] slab 12558336 [ 2634.973050][ T8171] sock 0 [ 2634.973050][ T8171] shmem 94208 [ 2634.973050][ T8171] file_mapped 0 [ 2634.973050][ T8171] file_dirty 0 [ 2634.973050][ T8171] file_writeback 0 [ 2634.973050][ T8171] anon_thp 243269632 [ 2634.973050][ T8171] inactive_anon 135168 [ 2634.973050][ T8171] active_anon 266063872 [ 2634.973050][ T8171] inactive_file 0 [ 2634.973050][ T8171] active_file 57344 [ 2634.973050][ T8171] unevictable 0 [ 2634.973050][ T8171] slab_reclaimable 3108864 [ 2634.973050][ T8171] slab_unreclaimable 9449472 [ 2634.973050][ T8171] pgfault 283272 [ 2634.973050][ T8171] pgmajfault 0 [ 2634.973050][ T8171] workingset_refault 1254 [ 2634.973050][ T8171] workingset_activate 165 [ 2634.973050][ T8171] workingset_nodereclaim 0 [ 2634.973050][ T8171] pgrefill 4642 [ 2634.973050][ T8171] pgscan 64982 [ 2634.973050][ T8171] pgsteal 18446 [ 2635.068503][ T8171] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz2,mems_allowed=0-1,oom_memcg=/syz2,task_memcg=/syz2,task=syz-executor.2,pid=18419,uid=0 09:39:09 executing program 4: 09:39:09 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f00000002c0)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, [], [], [], 0x0, 0x0, 0x0, 0x0, "b056c041c01288c436e57cb64572eae5"}) 09:39:09 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) munmap(&(0x7f000001d000/0x4000)=nil, 0x4000) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x3d, 0x0) write$binfmt_aout(r1, &(0x7f00000000c0)=ANY=[], 0xffffff78) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003b9fdc)) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000180)) ioctl$TCSETA(r1, 0x5406, &(0x7f00000002c0)) r2 = syz_open_pts(r1, 0x0) dup3(r2, r1, 0x0) read(0xffffffffffffffff, 0x0, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") [ 2635.084367][ T8171] Memory cgroup out of memory: Killed process 18419 (syz-executor.2) total-vm:72708kB, anon-rss:4264kB, file-rss:35836kB, shmem-rss:0kB, UID:0 pgtables:147456kB oom_score_adj:0 09:39:09 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f0000000000)) ioctl$TIOCPKT(r1, 0x5420, &(0x7f00000002c0)=0x400000005) read(r1, &(0x7f0000000040)=""/11, 0xb) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000140)) r2 = syz_open_pts(r1, 0x0) ioctl$TCGETS(r1, 0x5401, &(0x7f0000000080)) r3 = dup3(r2, r1, 0x0) ioctl$TCSETA(r3, 0x5406, &(0x7f00000000c0)) 09:39:09 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f00000002c0)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, [], [], [], 0x0, 0x0, 0x0, 0x0, "b056c041c01288c436e57cb64572eae5"}) 09:39:09 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x70, 0x0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r1) accept4(r2, 0x0, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x7, 0x0) 09:39:09 executing program 2: 09:39:09 executing program 4: 09:39:09 executing program 1: 09:39:09 executing program 0: [ 2635.995543][ C0] net_ratelimit: 16 callbacks suppressed [ 2635.995551][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2635.995919][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2636.001378][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2636.007142][ C1] protocol 88fb is buggy, dev hsr_slave_1 09:39:10 executing program 3: 09:39:10 executing program 4: 09:39:10 executing program 0: 09:39:10 executing program 1: 09:39:10 executing program 2: 09:39:10 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x70, 0x0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r1) accept4(r2, 0x0, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x7, 0x0) 09:39:10 executing program 2: 09:39:10 executing program 0: 09:39:10 executing program 4: 09:39:10 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x70, 0x0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r1) accept4(r2, 0x0, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x7, 0x0) 09:39:10 executing program 1: 09:39:10 executing program 3: 09:39:10 executing program 2: 09:39:10 executing program 4: 09:39:10 executing program 0: 09:39:10 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000000, 0x0, 0x0) syz_genetlink_get_family_id$SEG6(0x0) close(r1) accept4(r2, 0x0, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x7, 0x0) 09:39:10 executing program 2: 09:39:10 executing program 4: 09:39:10 executing program 1: 09:39:10 executing program 3: 09:39:10 executing program 0: 09:39:10 executing program 4: 09:39:10 executing program 2: 09:39:10 executing program 1: 09:39:10 executing program 3: 09:39:10 executing program 0: 09:39:10 executing program 4: [ 2637.034866][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2637.040846][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2637.046880][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2637.052743][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2637.058659][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2637.064429][ C1] protocol 88fb is buggy, dev hsr_slave_1 09:39:11 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000000, 0x0, 0x0) syz_genetlink_get_family_id$SEG6(0x0) close(r1) accept4(r2, 0x0, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x7, 0x0) 09:39:11 executing program 2: 09:39:11 executing program 3: 09:39:11 executing program 1: 09:39:11 executing program 4: 09:39:11 executing program 0: 09:39:11 executing program 1: 09:39:11 executing program 3: 09:39:11 executing program 4: 09:39:11 executing program 2: 09:39:11 executing program 0: 09:39:11 executing program 1: 09:39:12 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000000, 0x0, 0x0) syz_genetlink_get_family_id$SEG6(0x0) close(r1) accept4(r2, 0x0, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x7, 0x0) 09:39:12 executing program 3: 09:39:12 executing program 0: 09:39:12 executing program 2: 09:39:12 executing program 4: 09:39:12 executing program 1: 09:39:12 executing program 3: 09:39:12 executing program 2: 09:39:12 executing program 0: 09:39:12 executing program 4: 09:39:12 executing program 1: 09:39:12 executing program 3: 09:39:13 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x70, 0x20000000, &(0x7f0000000100), 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r1) accept4(r2, 0x0, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x7, 0x0) 09:39:13 executing program 2: 09:39:13 executing program 4: 09:39:13 executing program 0: 09:39:13 executing program 1: 09:39:13 executing program 3: 09:39:13 executing program 3: 09:39:13 executing program 4: 09:39:13 executing program 1: 09:39:13 executing program 2: 09:39:13 executing program 0: openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) unlink(&(0x7f0000000100)='./file0\x00') perf_event_open(&(0x7f0000000280)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0xbc, 0x0, 0x400, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x9, 0x0, 0x0, 0xfffffffffffffff8, 0x4000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x8) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(r0, &(0x7f0000000000), 0x10000000d) 09:39:13 executing program 2: socket$inet_tcp(0x2, 0x1, 0x0) r0 = socket$inet6(0xa, 0x22000000002, 0x0) connect$inet6(r0, &(0x7f00000004c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @remote}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x80000db, 0x0) 09:39:14 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x70, 0x20000000, &(0x7f0000000100), 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r1) accept4(r2, 0x0, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x7, 0x0) 09:39:14 executing program 1: r0 = socket(0x1e, 0x5, 0x0) sendmsg(r0, &(0x7f0000db5fc8)={&(0x7f00004aeb5c)=@generic={0x10000001001e, "0200000000000000000000f0ffffcc573c5bf86c483724c71e14dd6a739effea1b48007be61ffe06d79f00000000000000076c3f010039d8f986ff01000000000000af06d5fe32c419d67bcbc7e3ad316a198356edb9b7341c1fd45624281e27800ece70b076c3979ac40000bd767e2e78a1dfd300881a1565b3b16d7436"}, 0x80, 0x0}, 0x0) 09:39:14 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) 09:39:14 executing program 3: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_NET_GET(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xf599ca3667d0ec08}, 0xc, &(0x7f0000000100)={&(0x7f0000000480)={0x298, r2, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x70a53d1f}]}, @TIPC_NLA_NODE={0x38, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x5}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xff}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x2}]}, @TIPC_NLA_NODE={0x8, 0x6, [@TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_NET={0x2c, 0x7, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x80000000}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x7}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x4}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x9}]}, @TIPC_NLA_NET={0x14, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x1e5}, @TIPC_NLA_NET_ID={0x8}]}, @TIPC_NLA_MEDIA={0x54, 0x5, [@TIPC_NLA_MEDIA_PROP={0x34, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x20}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7f}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}]}]}, @TIPC_NLA_LINK={0x80, 0x4, [@TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffffffff25c4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7ff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3f}]}, @TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}]}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_MTU={0x8}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x4}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}]}, @TIPC_NLA_MON={0x2c, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xffffffffffffffff}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x3ff}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x8}]}, @TIPC_NLA_MEDIA={0x54, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}]}]}, @TIPC_NLA_LINK={0xa4, 0x4, [@TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3ff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x65}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x40}, @TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffffffffffffc}]}]}]}, 0x298}, 0x1, 0x0, 0x0, 0x8048070}, 0x4104) pipe(&(0x7f0000000180)) write$binfmt_script(r1, &(0x7f0000000000)=ANY=[], 0x10000039a) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000400)={0x26, 'hash\x00', 0x0, 0x0, 'vmac64(aes-generic)\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000080)="ad56b6cc0400fbab65d8b4ac2ca35c6e", 0x10) splice(r0, 0x0, r4, 0x0, 0x80000001, 0x0) 09:39:14 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(r0, &(0x7f0000000280), 0xffffffb3) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, 0xffffffffffffffff) recvmsg(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x0) bpf$MAP_DELETE_ELEM(0x3, 0x0, 0x0) gettid() 09:39:14 executing program 0: openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) unlink(&(0x7f0000000100)='./file0\x00') perf_event_open(&(0x7f0000000280)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0xbc, 0x0, 0x400, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x9, 0x0, 0x0, 0xfffffffffffffff8, 0x4000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x8) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(r0, &(0x7f0000000000), 0x10000000d) 09:39:14 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x427, 0x0, 0x0, {0x0, r2, {}, {0xffff, 0xffff}}}, 0x24}}, 0x0) 09:39:14 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) 09:39:14 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='io\x00') ioctl$sock_FIOSETOWN(0xffffffffffffffff, 0x8901, 0x0) gettid() write$P9_RLCREATE(0xffffffffffffffff, 0x0, 0xf7b6ccbe803abace) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) write$P9_RWSTAT(0xffffffffffffffff, 0x0, 0xfffffffffffffff7) timer_settime(0x0, 0x0, &(0x7f00000000c0)={{0x0, 0x1c9c380}, {0x0, 0x9}}, 0x0) sendmmsg$sock(0xffffffffffffffff, 0x0, 0x0, 0x0) write$binfmt_elf64(r0, 0x0, 0x0) r1 = gettid() seccomp(0x1, 0x0, &(0x7f0000000180)={0x3, &(0x7f0000000140)=[{0x800, 0x7, 0x0, 0x7}, {0xfffffffffffffff7, 0x1, 0x7, 0x8}, {0x4, 0x76f, 0xca8e, 0xff}]}) tkill(r1, 0x1000000000016) 09:39:14 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x8000000000003, 0x11) sendmsg$kcm(r0, &(0x7f0000000140)={&(0x7f0000003840)=@nl=@unspec={0x40000000, 0x0, 0xaa00000000000000, 0x80fe}, 0x80, 0x0}, 0x0) 09:39:14 executing program 2: r0 = socket$kcm(0x2b, 0x8000000000001, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x0, &(0x7f0000000000), 0x2c) r1 = socket$kcm(0xa, 0x3, 0x88) sendmsg(r1, &(0x7f00000003c0)={&(0x7f0000000000)=@nl=@unspec, 0x80, 0x0}, 0x0) 09:39:14 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) 09:39:15 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x70, 0x20000000, &(0x7f0000000100), 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r1) accept4(r2, 0x0, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x7, 0x0) 09:39:15 executing program 2: socket$kcm(0x2b, 0x1, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000200)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000240)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000003c0)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000400)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup\x00', 0x200002, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000004c0)) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000280)) r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000380)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000440)) r1 = socket$kcm(0x11, 0x2, 0x300) setsockopt$sock_attach_bpf(r1, 0x1, 0x41, &(0x7f0000000000)=r1, 0x4) sendmsg$kcm(r1, &(0x7f0000000640)={&(0x7f0000000040)=@caif=@rfm={0x25, 0x1f, "35b0d04845eddb3bc5582e88086d0216"}, 0x80, 0x0}, 0x0) recvmsg(r1, &(0x7f000000cd00)={0x0, 0x0, 0x0}, 0x2000) 09:39:15 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f00000000c0)='pids.current\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, 0xffffffffffffffff) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r3 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r3) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TUNGETSNDBUF(0xffffffffffffffff, 0x800454d3, 0x0) perf_event_open(&(0x7f0000000280)={0x0, 0x70, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x9, 0x5, 0x0, 0x20, 0x742, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, 0x0, 0x0, 0x0, 0x1, 0x400, 0x4, 0x0, 0x0, 0x0, 0x101, 0x6, @perf_config_ext={0x6, 0x8001}, 0x0, 0x9, 0x0, 0x0, 0xfffffffffffffff8}, 0x0, 0x8, r2, 0x8) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r2, 0x40086602, 0x400007) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r2, &(0x7f0000000040)=ANY=[@ANYPTR64], 0xff39) write$cgroup_pid(r4, &(0x7f0000000000), 0x10000000d) ioctl$TUNSETVNETLE(r1, 0x400454dc, &(0x7f0000000080)=0x1) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001c00)='memory.events\x00', 0x7a05, 0x1700) socket$kcm(0x29, 0x7, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10, 0x4, 0x4, 0x3}, 0x2c) r5 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) openat$cgroup_ro(r5, &(0x7f00000000c0)='pids.current\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000040)) 09:39:15 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) 09:39:15 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r0, 0x0, 0x0, 0x0, &(0x7f0000000080)={0x2, 0x4e21, @remote}, 0x10) 09:39:15 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0xffffff29) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() r2 = dup(r0) setsockopt$inet6_tcp_int(r2, 0x6, 0x1e, &(0x7f00000000c0), 0x2f3) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x4) wait4(0x0, 0x0, 0x0, 0x0) 09:39:15 executing program 0: r0 = socket$inet(0x10, 0x2, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000240)="24000000180007841dfffd946f610500020081001f03fe050400080008000f000400ff7e", 0x24}], 0x1}, 0x0) 09:39:15 executing program 3: bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="b4000000000000006111000000000000386d00000000000095000000000000001023abb32ab7a513d93e25c7bd0346470c720e8902c2449714d09d86cc42c19967f63392784b79526d186a2342f4c3a946dc611f89ebb723a3fb61f8b51deae94dd14d8f4d5f8cf76e53cf820d5bcdf320bd24"], &(0x7f0000000080)='GPL\x00', 0x0, 0x3f7, &(0x7f000000cf3d)=""/195}, 0x48) 09:39:15 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) [ 2641.194840][ C1] net_ratelimit: 13 callbacks suppressed [ 2641.194847][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2641.206371][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2641.212195][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2641.217992][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2641.223804][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2641.229614][ C1] protocol 88fb is buggy, dev hsr_slave_1 09:39:15 executing program 2: r0 = gettid() timer_create(0x0, &(0x7f0000000200)={0x0, 0x32, 0x4, @tid=r0}, &(0x7f0000000240)) 09:39:15 executing program 0: openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) 09:39:15 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e23, 0x0, @ipv4={[], [], @dev}}, 0x1c) 09:39:16 executing program 2: clone(0x20000007fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x5, &(0x7f0000000180)) seccomp(0x1, 0x0, &(0x7f0000001980)={0x1, &(0x7f0000000000)=[{}]}) 09:39:16 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) write$binfmt_elf64(r0, &(0x7f0000000100)=ANY=[@ANYRES32], 0x4) shutdown(r0, 0x1) 09:39:16 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_opts(r0, 0x0, 0xf, 0x0, 0x0) 09:39:16 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f00000000c0)='pids.current\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, 0xffffffffffffffff) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r3 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r3) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TUNGETSNDBUF(0xffffffffffffffff, 0x800454d3, 0x0) perf_event_open(&(0x7f0000000280)={0x0, 0x70, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x9, 0x5, 0x0, 0x20, 0x742, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, 0x0, 0x0, 0x0, 0x1, 0x400, 0x4, 0x0, 0x0, 0x0, 0x101, 0x6, @perf_config_ext={0x6, 0x8001}, 0x0, 0x9, 0x0, 0x0, 0xfffffffffffffff8}, 0x0, 0x8, r2, 0x8) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r2, 0x40086602, 0x400007) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r2, &(0x7f0000000040)=ANY=[@ANYPTR64], 0xff39) write$cgroup_pid(r4, &(0x7f0000000000), 0x10000000d) ioctl$TUNSETVNETLE(r1, 0x400454dc, &(0x7f0000000080)=0x1) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001c00)='memory.events\x00', 0x7a05, 0x1700) socket$kcm(0x29, 0x7, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10, 0x4, 0x4, 0x3}, 0x2c) r5 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) openat$cgroup_ro(r5, &(0x7f00000000c0)='pids.current\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000040)) 09:39:16 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(0xffffffffffffffff) accept4(r2, 0x0, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x7, 0x0) 09:39:16 executing program 2: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) truncate(&(0x7f00000002c0)='./bus\x00', 0x4a00) lseek(r1, 0x0, 0x3) 09:39:16 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_opts(r0, 0x0, 0xf, 0x0, 0x0) 09:39:16 executing program 3: getcwd(&(0x7f0000000000)=""/92, 0x5c) [ 2642.010504][ C1] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 09:39:16 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) 09:39:16 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_opts(r0, 0x0, 0xf, 0x0, 0x0) 09:39:16 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x3d, 0x0) ioctl$TCSETSW(r0, 0x5403, &(0x7f0000000100)) write$binfmt_aout(r0, &(0x7f00000000c0)=ANY=[], 0xffffff78) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0xe84b}) [ 2642.234838][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2642.234853][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2642.240640][ C1] protocol 88fb is buggy, dev hsr_slave_1 09:39:16 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) bind$inet6(r1, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) 09:39:16 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_opts(r0, 0x0, 0xf, 0x0, 0x0) 09:39:16 executing program 2: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) fcntl$setpipe(r1, 0x407, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @local}, 0x10) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f0000001440)={0x0, 0x5}, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x30005, 0x0) 09:39:16 executing program 0: setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0xf, 0x0, 0x0) 09:39:16 executing program 1: r0 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz'}, 0x0, 0x0, 0xfffffffffffffffd) pipe(&(0x7f0000000440)={0xffffffffffffffff}) read(r1, &(0x7f0000000200)=""/250, 0x50c7e3e3) keyctl$get_security(0x11, r0, 0x0, 0x0) 09:39:19 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(0xffffffffffffffff) accept4(r2, 0x0, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x7, 0x0) 09:39:19 executing program 0: setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0xf, 0x0, 0x0) 09:39:19 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) 09:39:19 executing program 3: mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) creat(&(0x7f0000000780)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000080)={&(0x7f0000000000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00'}, 0x10) 09:39:19 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, 0x0, 0x0) 09:39:19 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x0) fadvise64(r0, 0x0, 0x0, 0x0) 09:39:19 executing program 0: setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0xf, 0x0, 0x0) 09:39:19 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)) r1 = syz_open_pts(r0, 0x88d82) write(r1, &(0x7f0000000000), 0xffffff86) 09:39:19 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x80000000004) write(r0, &(0x7f00000000c0)="29000000140005b7ff000000040860eb0101b6ff00159f02c26ed638eeb738256e06a40e07fff0797e", 0x29) 09:39:19 executing program 3: bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x8, 0x4, &(0x7f0000346fc8)=@framed={{}, [@alu={0x8000000201a7f19}]}, &(0x7f0000000100)='GPL\x00'}, 0x48) 09:39:19 executing program 2: request_key(&(0x7f0000000300)='trusted\x00', &(0x7f0000000340)={'syz', 0x3}, 0x0, 0xffffffffffffffff) 09:39:19 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x80000000004) write(r0, &(0x7f00000000c0)="29000000140005b7ff000000040860eb0101b6ff00159f02c26ed638eeb738256e06a40e07fff0797e", 0x29) 09:39:20 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(0xffffffffffffffff) accept4(r2, 0x0, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x7, 0x0) 09:39:20 executing program 3: r0 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$cgroup_type(r0, &(0x7f00000009c0)='threaded\x00', 0xd4b9d4d) r1 = open$dir(&(0x7f0000000280)='./file0\x00', 0x0, 0x0) lseek(r1, 0xfffffffffffffffc, 0x3) 09:39:20 executing program 0: socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0xf, 0x0, 0x0) 09:39:20 executing program 2: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) r1 = inotify_init() inotify_add_watch(r1, &(0x7f0000000100)='./control\x00', 0x81000002) 09:39:20 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x80000000004) write(r0, &(0x7f00000000c0)="29000000140005b7ff000000040860eb0101b6ff00159f02c26ed638eeb738256e06a40e07fff0797e", 0x29) 09:39:20 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) accept4(r1, 0x0, 0x0, 0x0) close(r2) 09:39:20 executing program 0: socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0xf, 0x0, 0x0) 09:39:20 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x80000000004) write(r0, &(0x7f00000000c0)="29000000140005b7ff000000040860eb0101b6ff00159f02c26ed638eeb738256e06a40e07fff0797e", 0x29) 09:39:20 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x32a) connect$inet(r0, &(0x7f0000000140)={0x2, 0x0, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000100), 0x618) 09:39:20 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) accept4(r1, 0x0, 0x0, 0x0) close(r2) 09:39:20 executing program 1: write(0xffffffffffffffff, &(0x7f00000000c0)="29000000140005b7ff000000040860eb0101b6ff00159f02c26ed638eeb738256e06a40e07fff0797e", 0x29) 09:39:20 executing program 0: socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0xf, 0x0, 0x0) [ 2646.394851][ C0] net_ratelimit: 16 callbacks suppressed [ 2646.394858][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2646.394886][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2646.400577][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2646.510956][ T26] audit: type=1804 audit(1567849160.618:227): pid=19690 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir055735298/syzkaller.uYph84/3168/file0" dev="sda1" ino=18285 res=1 [ 2646.662367][ T26] audit: type=1804 audit(1567849160.768:228): pid=19695 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir055735298/syzkaller.uYph84/3168/file0" dev="sda1" ino=18285 res=1 09:39:20 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r1) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x7, 0x0) 09:39:20 executing program 2: r0 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x13, &(0x7f0000000100)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) 09:39:20 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) accept4(r1, 0x0, 0x0, 0x0) close(r2) 09:39:20 executing program 1: write(0xffffffffffffffff, &(0x7f00000000c0)="29000000140005b7ff000000040860eb0101b6ff00159f02c26ed638eeb738256e06a40e07fff0797e", 0x29) 09:39:20 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, 0x0, 0x0) 09:39:20 executing program 3: clock_adjtime(0x0, &(0x7f0000000140)) 09:39:21 executing program 3: bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="b4000000000000006111000000000000386d00000000000095000000000000001023abb32ab7a513d93e25c7bd0346470c720e8902c2449714d09d86cc42c19967f63392784b79526d186a2342f4c3a946dc611f89ebb723a3fb61f8b51deae94dd14d8f4d5f8cf76e53cf820d5bcdf320bd24"], &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195}, 0x48) 09:39:21 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x7}, 0x4) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @local, 0x3}, 0x1c) sendmmsg(r1, &(0x7f0000007e00), 0x40000000000025d, 0x0) 09:39:21 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, 0x0, 0x0) 09:39:21 executing program 1: write(0xffffffffffffffff, &(0x7f00000000c0)="29000000140005b7ff000000040860eb0101b6ff00159f02c26ed638eeb738256e06a40e07fff0797e", 0x29) 09:39:21 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) sendmsg$TIPC_NL_MEDIA_GET(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) 09:39:21 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r1) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x7, 0x0) 09:39:21 executing program 3: 09:39:21 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, 0x0, 0x0) 09:39:21 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) write(r0, &(0x7f00000000c0)="29000000140005b7ff000000040860eb0101b6ff00159f02c26ed638eeb738256e06a40e07fff0797e", 0x29) 09:39:21 executing program 3: 09:39:21 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r1) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x7, 0x0) 09:39:21 executing program 0: 09:39:21 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) write(r0, &(0x7f00000000c0)="29000000140005b7ff000000040860eb0101b6ff00159f02c26ed638eeb738256e06a40e07fff0797e", 0x29) [ 2647.434869][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2647.440703][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2647.446565][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2647.452355][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2647.458198][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2647.463950][ C1] protocol 88fb is buggy, dev hsr_slave_1 09:39:21 executing program 2: 09:39:21 executing program 3: 09:39:21 executing program 0: 09:39:22 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) sendmsg$TIPC_NL_MEDIA_GET(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) 09:39:22 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) write(r0, &(0x7f00000000c0)="29000000140005b7ff000000040860eb0101b6ff00159f02c26ed638eeb738256e06a40e07fff0797e", 0x29) 09:39:22 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r1) accept4(r2, 0x0, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x7, 0x0) 09:39:22 executing program 0: 09:39:22 executing program 3: 09:39:22 executing program 2: 09:39:22 executing program 3: 09:39:22 executing program 2: 09:39:22 executing program 0: 09:39:22 executing program 1: socket$netlink(0x10, 0x3, 0x80000000004) write(0xffffffffffffffff, &(0x7f00000000c0)="29000000140005b7ff000000040860eb0101b6ff00159f02c26ed638eeb738256e06a40e07fff0797e", 0x29) 09:39:22 executing program 3: 09:39:22 executing program 1: socket$netlink(0x10, 0x3, 0x80000000004) write(0xffffffffffffffff, &(0x7f00000000c0)="29000000140005b7ff000000040860eb0101b6ff00159f02c26ed638eeb738256e06a40e07fff0797e", 0x29) [ 2648.474852][ C1] protocol 88fb is buggy, dev hsr_slave_0 09:39:23 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) sendmsg$TIPC_NL_MEDIA_GET(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) 09:39:23 executing program 2: 09:39:23 executing program 0: 09:39:23 executing program 3: 09:39:23 executing program 1: socket$netlink(0x10, 0x3, 0x80000000004) write(0xffffffffffffffff, &(0x7f00000000c0)="29000000140005b7ff000000040860eb0101b6ff00159f02c26ed638eeb738256e06a40e07fff0797e", 0x29) 09:39:23 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r1) accept4(r2, 0x0, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x7, 0x0) 09:39:23 executing program 0: 09:39:23 executing program 2: 09:39:23 executing program 3: 09:39:23 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x80000000004) write(r0, 0x0, 0x0) 09:39:23 executing program 0: 09:39:23 executing program 3: 09:39:23 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) 09:39:23 executing program 2: 09:39:23 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x80000000004) write(r0, 0x0, 0x0) 09:39:23 executing program 3: 09:39:23 executing program 0: 09:39:23 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r1) accept4(r2, 0x0, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x7, 0x0) 09:39:23 executing program 3: 09:39:24 executing program 0: 09:39:24 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x80000000004) write(r0, 0x0, 0x0) 09:39:24 executing program 2: 09:39:24 executing program 3: 09:39:24 executing program 2: 09:39:24 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) 09:39:24 executing program 0: 09:39:24 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x80000000004) write(r0, &(0x7f00000000c0), 0x0) 09:39:24 executing program 3: 09:39:24 executing program 2: 09:39:24 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) pipe(&(0x7f00000002c0)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r1, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r0) accept4(r1, 0x0, 0x0, 0x0) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x7, 0x0) 09:39:24 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x80000000004) write(r0, &(0x7f00000000c0), 0x0) 09:39:24 executing program 3: 09:39:24 executing program 0: 09:39:25 executing program 2: 09:39:25 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x80000000004) write(r0, &(0x7f00000000c0), 0x0) 09:39:25 executing program 2: 09:39:25 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) 09:39:25 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x8, 0x4, &(0x7f0000346fc8)=@framed={{}, [@alu={0x8000000201a7f19, 0x0, 0x201a7fa6, 0x0, 0x1}], {0x95, 0x0, 0x0, 0x7300}}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [0xff5ffe5f]}, 0x48) 09:39:25 executing program 3: bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x8, 0x4, &(0x7f0000346fc8)=@framed={{}, [@alu={0x8000000201a7f19, 0x0, 0x201a7fa6, 0x0, 0x1, 0x90}]}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [0xff5ffe5f]}, 0x48) 09:39:25 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x80000000004) write(r0, &(0x7f00000000c0)="29000000140005b7ff000000040860eb0101b6ff00", 0x15) 09:39:25 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x8, 0x4, &(0x7f0000346fc8)=@framed={{}, [@alu={0x8000000201a7f19, 0x0, 0x201a7fa6, 0x0, 0x1}], {0x95, 0x0, 0x0, 0xff00}}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [0xff5ffe5f]}, 0x48) 09:39:25 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) pipe(&(0x7f00000002c0)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r1, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r0) accept4(r1, 0x0, 0x0, 0x0) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x7, 0x0) [ 2651.594855][ C1] net_ratelimit: 13 callbacks suppressed [ 2651.594862][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2651.606380][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2651.606462][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2651.617861][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2651.623646][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2651.629431][ C1] protocol 88fb is buggy, dev hsr_slave_1 09:39:25 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="a4ab12f728db4b2b4d2f2f3ff7ad273b1e89e46f905080af4c90ccb170e60b3a8bf56db763e3062d037dca291318d0a17270bbce74b46f4db2a92ba0c9fb228bc105af", 0x43}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, r0, 0x0, 0x0) 09:39:25 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x80000000004) write(r0, &(0x7f00000000c0)="29000000140005b7ff000000040860eb0101b6ff00", 0x15) 09:39:25 executing program 3: 09:39:25 executing program 0: 09:39:26 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x80000000004) write(r0, &(0x7f00000000c0)="29000000140005b7ff000000040860eb0101b6ff00", 0x15) 09:39:26 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0xf33fdb43eb5e5745, 0x64, 0x0, 0x344) capset(&(0x7f0000000000)={0x19980330}, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:39:26 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) 09:39:26 executing program 3: syz_mount_image$ext4(&(0x7f0000000040)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000015c0)={[], [{@smackfsroot={'smackfsroot', 0x3d, ',mime_typervboxnet0/'}}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/null\x00'}}]}) 09:39:26 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x80000000004) write(r0, &(0x7f00000000c0)="29000000140005b7ff000000040860eb0101b6ff00159f02c26ed638eeb738", 0x1f) 09:39:26 executing program 0: r0 = socket(0x11, 0x80a, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000300)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 09:39:26 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) pipe(&(0x7f00000002c0)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r1, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r0) accept4(r1, 0x0, 0x0, 0x0) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x7, 0x0) 09:39:26 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x80000000004) write(r0, &(0x7f00000000c0)="29000000140005b7ff000000040860eb0101b6ff00159f02c26ed638eeb738", 0x1f) [ 2652.634921][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2652.640726][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2652.644858][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2652.652228][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2652.673785][T19947] EXT4-fs (loop3): VFS: Can't find ext4 filesystem [ 2652.712196][T19946] overlayfs: conflicting lowerdir path [ 2652.772095][T19947] EXT4-fs (loop3): VFS: Can't find ext4 filesystem [ 2652.829942][T19946] overlayfs: conflicting lowerdir path 09:39:28 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x80000000004) write(r0, &(0x7f00000000c0)="29000000140005b7ff000000040860eb0101b6ff00159f02c26ed638eeb738", 0x1f) 09:39:28 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) 09:39:28 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="a4ab12f728db4b2b4d2f2f3ff7ad273b1e89e46f905080af4c90ccb170e60b3a8bf56db763e3062d037dca291318d0a17270bbce74b46f4db2a92ba0c9fb228bc105af", 0x43}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, r0, 0x0, 0x0) 09:39:28 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r0, &(0x7f00000000c0)=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @initdev={0xfe, 0x88, [], 0x0, 0x0}}}, 0x24) sendmmsg(r0, &(0x7f0000005c00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="18000000000000001001000001000000770000f200000000a6e217b91c3b0d873722b41a118fd58fa1f0a39ad9582203daa32c9831699acc52f141eeca2bd12d2f6fb54e5bff40e062a43f80b1babfd076d2502892250deee2728316e63e589ddf142e89365bd48cf76602c6f6aa76bc37284732bd1e191ddd3c9f310f827c195f3c4957c67a08466517ba136c8c9e01000000f8ffffffffffffff3e26b5ca26bb434dbd0e5085c294e577bb081876e63e7c2834533925db8b54b33da7b947aefca1f9cc9c648d58d4f944264fcace71d5c798cd3c13d7083a7eb4c526e072873bd24ccc7d0fd2a3cab38e4eff542520858c940fbb95979a564d73a7af107fd5ddaa491838873914a46743ce2805683beb4559864317c0a1da26d420a0b10248c92d090f4f9093679791a2840f2851324acdf44a807e6da1bc25d265303004e8ead128a3d61c0063233501cfdf76d99dbc46b9c00203a9161b8a444001c386475c432c7a6e898885429063954ea0bdf9ab71e1322f3485d99ab38a3231ea08584795647ddb75c593933e824acdab292482735cd91572d0bc3f95b61e039183f5ed7cb75f"], 0x18}}], 0x1, 0x4048000) 09:39:28 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r1) accept4(r2, 0x0, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x0, 0x0) 09:39:28 executing program 3: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) write(r0, 0x0, 0x0) 09:39:29 executing program 3: r0 = socket$inet6(0xa, 0x140000080806, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20}, 0x1c) listen(r0, 0x10001) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f0000002200)={0x1, 0x5a60c7b5}, 0x8) sendmmsg(r1, &(0x7f0000003d40), 0x4000000000002be, 0x0) close(r1) 09:39:29 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x80000000004) write(r0, &(0x7f00000000c0)="29000000140005b7ff000000040860eb0101b6ff00159f02c26ed638eeb738256e06a40e", 0x24) 09:39:29 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) 09:39:29 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f0000000040)='./file0/file0\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[@ANYBLOB='./file0/file0'], &(0x7f00000001c0)='./file0/file0\x00', 0x0, 0x201000, 0x0) umount2(&(0x7f0000000200)='./file0/file0\x00', 0x0) 09:39:29 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x80000000004) write(r0, &(0x7f00000000c0)="29000000140005b7ff000000040860eb0101b6ff00159f02c26ed638eeb738256e06a40e", 0x24) 09:39:29 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) connect$inet6(0xffffffffffffffff, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(0xffffffffffffffff, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(0xffffffffffffffff) r2 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(0xffffffffffffffff) 09:39:29 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_REGISTER_COALESCED_MMIO(0xffffffffffffffff, 0x4010ae67, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0xfefd, 0x0, 0x0, 0xfffffffffffffd9c) ioctl$TCSETSW(0xffffffffffffffff, 0x5403, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff7}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:39:29 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) connect$inet6(0xffffffffffffffff, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(0xffffffffffffffff, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(0xffffffffffffffff) r2 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(0xffffffffffffffff) [ 2656.794853][ C1] net_ratelimit: 16 callbacks suppressed [ 2656.794879][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2656.800607][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2656.812013][ C1] protocol 88fb is buggy, dev hsr_slave_1 09:39:31 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="a4ab12f728db4b2b4d2f2f3ff7ad273b1e89e46f905080af4c90ccb170e60b3a8bf56db763e3062d037dca291318d0a17270bbce74b46f4db2a92ba0c9fb228bc105af", 0x43}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, r0, 0x0, 0x0) 09:39:31 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x80000000004) write(r0, &(0x7f00000000c0)="29000000140005b7ff000000040860eb0101b6ff00159f02c26ed638eeb738256e06a40e", 0x24) 09:39:31 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) connect$inet6(0xffffffffffffffff, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(0xffffffffffffffff, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(0xffffffffffffffff) r2 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(0xffffffffffffffff) 09:39:31 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1804000000000000000000000000080018100000", @ANYBLOB="000000000000000095000000"], &(0x7f0000000080)='\x00\x00\x00\x00\x00\x00\x00\xeb\xff\xff(1\x18\xc7\xc1\xde\xdc(,J\\\xc4hM=\xf4\x04\xd0\xe9\'rT\x8dm\x1a?\x1a\b\x93\x82\xbf\xfe\x83\xcb4tX{$\x9f\xbfHY\x1e;\xd0\xcf\xdb&\x12G\xfd\xd7\xe71\xd8K\x9b\xc9\x04C\xf5$\xd0\x93k\x12u\x9eMM\x03\x00\x00\x00\xc8\x83\x16\x9c2)\xaa\x9fh\xa4\xd2\x0f\x98.\x06t^\xc0\xcd\x95\x81*\xece1\x9e*3\xfa\xb5=\xd2\x1e-\xd3]}\xa7\xbfDZn\xd4\x82\x19\xfb\x1bjE\xc3D\xd8\xd56G\xd9\xc3\x90\xf5\xb9\xdc\x98\xb8\x8f=\xdf\xf0,e\x1dl\xe0\xc5\x80\a\xb1\xad\xbf\xc5\x88!j\xce\x00\x00\x00\x00\x00\x00', 0x4, 0x90, &(0x7f0000000200)=""/144, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) 09:39:31 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r1) accept4(r2, 0x0, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x0, 0x0) 09:39:31 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000140)="11dca50d5e0bcfe47bf070") r1 = gettid() prctl$PR_SET_PTRACER(0x59616d61, r1) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="a4ab12f728db4b2b4d2f2f3ff7ad273b1e89e46f905080af4c90ccb170e60b3a8bf56db763e3062d037dca291318d0a17270bbce74b47888318b04aeb1747555ba16ea10e6ddb915ceb6397e514f", 0x4e}], 0x4, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x38) ptrace$cont(0x18, r2, 0x0, 0x0) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) [ 2657.834871][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2657.840781][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2657.846581][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2657.852354][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2657.858157][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2657.863958][ C1] protocol 88fb is buggy, dev hsr_slave_1 09:39:32 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) 09:39:32 executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, 0x0, 0x0) 09:39:32 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x80000000004) write(r0, &(0x7f00000000c0)="29000000140005b7ff000000040860eb0101b6ff00159f02c26ed638eeb738256e06a40e07fff0", 0x27) 09:39:32 executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, 0x0, 0x0) 09:39:32 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x80000000004) write(r0, &(0x7f00000000c0)="29000000140005b7ff000000040860eb0101b6ff00159f02c26ed638eeb738256e06a40e07fff0", 0x27) 09:39:32 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) [ 2658.874848][ C1] protocol 88fb is buggy, dev hsr_slave_0 09:39:35 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="a4ab12f728db4b2b4d2f2f3ff7ad273b1e89e46f905080af4c90ccb170e60b3a8bf56db763e3062d037dca291318d0a17270bbce74b46f4db2a92ba0c9fb228bc105af", 0x43}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, r0, 0x0, 0x0) 09:39:35 executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, 0x0, 0x0) 09:39:35 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x80000000004) write(r0, &(0x7f00000000c0)="29000000140005b7ff000000040860eb0101b6ff00159f02c26ed638eeb738256e06a40e07fff0", 0x27) 09:39:35 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) 09:39:35 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x70, 0x20000000, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_genetlink_get_family_id$SEG6(0x0) close(r1) accept4(r2, 0x0, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x0, 0x0) 09:39:35 executing program 3: r0 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20ncci\x00', 0x0, 0x0) fsconfig$FSCONFIG_SET_FLAG(r0, 0x0, 0x0, 0x0, 0x0) 09:39:35 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x80000000004) write(r0, &(0x7f00000000c0)="29000000140005b7ff000000040860eb0101b6ff00159f02c26ed638eeb738256e06a40e07fff079", 0x28) 09:39:35 executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) lchown(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) 09:39:35 executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, 0x0, 0x0) 09:39:35 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) 09:39:35 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x80000000004) write(r0, &(0x7f00000000c0)="29000000140005b7ff000000040860eb0101b6ff00159f02c26ed638eeb738256e06a40e07fff079", 0x28) 09:39:35 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000040)='./file0/bus\x00', 0x0) fcntl$lock(r0, 0x7, &(0x7f0000027000)) sysinfo(&(0x7f0000000000)=""/22) sendmsg(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000380)}, {&(0x7f0000000480)="94ce341377863385cf378e7e2f5bfc8901455406be09e7695cee96779383219406a46b8b73be2b729a94cb0ef871301d15451d3f8676a6d78d5bc6897e0dfe05138df57bd0313929de67ffbc43de813feb90890fec5a50145c8e9ae3b2893e000a66f6e9c81a536e19cf1ea7ce5a3ce6f85d8e208bf54c998899097102bf802be83ec994aa91fb61d57e998b695a58543f47c97d3ba76576c42785051c1907155689368f862c3e6be6b59c1237dfe336a4520e0b9a5c4b94970fe5c4c46b86a5407e477a2c8ecf7a6a961de07180d975a4ccd382", 0xd4}, {&(0x7f0000000580)="5a8773cbca1a7d0e7ae8c6eb21ef", 0xe}], 0x3}, 0x0) r1 = openat(0xffffffffffffffff, &(0x7f0000000140)='./file0\x00', 0x80000, 0x18) setsockopt$ALG_SET_AEAD_AUTHSIZE(r1, 0x117, 0x5, 0x0, 0x3) write$RDMA_USER_CM_CMD_GET_EVENT(0xffffffffffffffff, &(0x7f0000000080)={0xc, 0x8, 0xfa00, {&(0x7f00000001c0)}}, 0x10) r2 = socket$inet(0x10, 0x2, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$sock_ifreq(r2, 0x89f1, &(0x7f0000000180)={'ip6gre0\x00\xeej\x01\x0f\'@\x03\xf8', @ifru_flags}) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8916, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) [ 2661.994851][ C1] net_ratelimit: 12 callbacks suppressed [ 2662.000835][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2662.006598][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2662.012394][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2662.018169][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2662.023954][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2662.029711][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2663.034881][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2663.034892][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2663.034956][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2663.040790][ C0] protocol 88fb is buggy, dev hsr_slave_1 09:39:38 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="a4ab12f728db4b2b4d2f2f3ff7ad273b1e89e46f905080af4c90ccb170e60b3a8bf56db763e3062d037dca291318d0a17270bbce74b46f4db2a92ba0c9fb228bc105af", 0x43}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) 09:39:38 executing program 0: getsockopt$bt_BT_DEFER_SETUP(0xffffffffffffffff, 0x112, 0x7, 0x0, 0x0) 09:39:38 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) 09:39:38 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x80000000004) write(r0, &(0x7f00000000c0)="29000000140005b7ff000000040860eb0101b6ff00159f02c26ed638eeb738256e06a40e07fff079", 0x28) 09:39:38 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000040)='./file0/bus\x00', 0x0) fcntl$lock(r0, 0x7, &(0x7f0000027000)) sysinfo(&(0x7f0000000000)=""/22) sendmsg(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000380)}, {&(0x7f0000000480)="94ce341377863385cf378e7e2f5bfc8901455406be09e7695cee96779383219406a46b8b73be2b729a94cb0ef871301d15451d3f8676a6d78d5bc6897e0dfe05138df57bd0313929de67ffbc43de813feb90890fec5a50145c8e9ae3b2893e000a66f6e9c81a536e19cf1ea7ce5a3ce6f85d8e208bf54c998899097102bf802be83ec994aa91fb61d57e998b695a58543f47c97d3ba76576c42785051c1907155689368f862c3e6be6b59c1237dfe336a4520e0b9a5c4b94970fe5c4c46b86a5407e477a2c8ecf7a6a961de07180d975a4ccd382", 0xd4}, {&(0x7f0000000580)="5a8773cbca1a7d0e7ae8c6eb21ef", 0xe}], 0x3}, 0x0) r1 = openat(0xffffffffffffffff, &(0x7f0000000140)='./file0\x00', 0x80000, 0x18) setsockopt$ALG_SET_AEAD_AUTHSIZE(r1, 0x117, 0x5, 0x0, 0x3) write$RDMA_USER_CM_CMD_GET_EVENT(0xffffffffffffffff, &(0x7f0000000080)={0xc, 0x8, 0xfa00, {&(0x7f00000001c0)}}, 0x10) r2 = socket$inet(0x10, 0x2, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x0, 0x0) ioctl$sock_ifreq(r2, 0x89f1, &(0x7f0000000180)={'ip6gre0\x00\xeej\x01\x0f\'@\x03\xf8', @ifru_flags}) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8916, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) 09:39:38 executing program 5: sysinfo(&(0x7f0000000000)=""/22) sendmsg(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000005c0)}, 0x0) r0 = socket$inet(0x10, 0x2, 0x0) ioctl$sock_ifreq(r0, 0x89f1, &(0x7f0000000180)={'ip6gre0\x00\xeej\x01\x0f\'@\x03\xf8', @ifru_flags}) 09:39:38 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) 09:39:38 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$SIOCAX25ADDFWD(0xffffffffffffffff, 0x89ea, &(0x7f0000000040)={@null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}}) capset(0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:39:38 executing program 0: getsockopt$bt_BT_DEFER_SETUP(0xffffffffffffffff, 0x112, 0x7, 0x0, 0x0) 09:39:38 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x101001, 0x0) r1 = socket$kcm(0x29, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') close(r0) 09:39:38 executing program 5: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, 0x0, 0x0, 0x200007fb, &(0x7f00000008c0)={0x2, 0x0, @local}, 0x10) recvmsg(r0, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) 09:39:38 executing program 5: [ 2664.956720][T20121] debugfs: Directory '20121-4' with parent 'kvm' already present! 09:39:41 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="a4ab12f728db4b2b4d2f2f3ff7ad273b1e89e46f905080af4c90ccb170e60b3a8bf56db763e3062d037dca291318d0a17270bbce74b46f4db2a92ba0c9fb228bc105af", 0x43}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) 09:39:41 executing program 0: getsockopt$bt_BT_DEFER_SETUP(0xffffffffffffffff, 0x112, 0x7, 0x0, 0x0) 09:39:41 executing program 1: 09:39:41 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") bind$inet6(0xffffffffffffffff, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(0xffffffffffffffff, 0x80000000000000bd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r1, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r1) r2 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r1) 09:39:41 executing program 5: 09:39:41 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f0000000100)) ptrace(0x10, r0) ptrace$getregset(0x4204, r0, 0x2, &(0x7f0000000000)={&(0x7f0000000c00)=""/224, 0xe0}) 09:39:41 executing program 1: r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000005940)='/dev/mixer\x00', 0x0, 0x0) ioctl$DRM_IOCTL_DMA(r0, 0xc0406429, &(0x7f0000005c00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 09:39:41 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1f7, 0x0, 0x0, 0xfffffffffffffee1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x11b000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$SIOCAX25ADDFWD(0xffffffffffffffff, 0x89ea, &(0x7f0000000040)={@null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 09:39:41 executing program 5: 09:39:41 executing program 5: 09:39:41 executing program 0: syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_DEFER_SETUP(0xffffffffffffffff, 0x112, 0x7, 0x0, 0x0) [ 2667.194845][ C1] net_ratelimit: 16 callbacks suppressed [ 2667.194852][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2667.194856][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2667.194895][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2667.200646][ C1] protocol 88fb is buggy, dev hsr_slave_1 09:39:41 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") bind$inet6(0xffffffffffffffff, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(0xffffffffffffffff, 0x80000000000000bd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r1, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r1) r2 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r1) [ 2668.072920][T20170] debugfs: Directory '20170-4' with parent 'kvm' already present! [ 2668.234876][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2668.240835][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2668.246668][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2668.252431][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2668.258255][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2668.264050][ C1] protocol 88fb is buggy, dev hsr_slave_1 09:39:44 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="a4ab12f728db4b2b4d2f2f3ff7ad273b1e89e46f905080af4c90ccb170e60b3a8bf56db763e3062d037dca291318d0a17270bbce74b46f4db2a92ba0c9fb228bc105af", 0x43}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) 09:39:44 executing program 1: 09:39:44 executing program 5: 09:39:44 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") bind$inet6(0xffffffffffffffff, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(0xffffffffffffffff, 0x80000000000000bd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r1, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r1) r2 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r1) 09:39:44 executing program 0: syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_DEFER_SETUP(0xffffffffffffffff, 0x112, 0x7, 0x0, 0x0) 09:39:44 executing program 3: 09:39:44 executing program 3: 09:39:44 executing program 5: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee68, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0x801c581f, 0x0) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syz_tun\x00', 0x0}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) bind$packet(r0, &(0x7f0000000080)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @local}, 0x14) 09:39:44 executing program 1: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$sock_TIOCOUTQ(r0, 0x5411, &(0x7f0000000040)) 09:39:44 executing program 0: syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_DEFER_SETUP(0xffffffffffffffff, 0x112, 0x7, 0x0, 0x0) 09:39:44 executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r0, 0x80000000000000bd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r1, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r1) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r1) 09:39:44 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000300)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0x10000026f) read(r0, &(0x7f0000000200)=""/250, 0x50c7e3e3) [ 2672.394864][ C1] net_ratelimit: 13 callbacks suppressed [ 2672.400630][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2672.406396][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2672.412184][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2672.417966][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2672.423792][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2672.429546][ C1] protocol 88fb is buggy, dev hsr_slave_1 09:39:47 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="a4ab12f728db4b2b4d2f2f3ff7ad273b1e89e46f905080af4c90ccb170e60b3a8bf56db763e3062d037dca291318d0a17270bbce74b46f4db2a92ba0c9fb228bc105af", 0x43}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, r0, 0x0, 0x0) 09:39:47 executing program 1: sched_setaffinity(0x0, 0x73595853f5659be6, &(0x7f0000000340)=0x809) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/netlink\x00m\x10\x1bDv\xe5j@\xca\x98\"X\xc7k\xb9u\x17w\xed*\xb23\xa9#\xcb\x12\x97\xe9U\x18\xd4\x8d\b\xfc\x845j\x18z\r\xd6\xea\xacE\xd3G\xa9Ki(\xf3\xa3\xfa\xf1\x11(b\am\xd21\x91Q\xbe}\xa3\x8b\r\xc2TR\xa9\tm\x1f\x12hf\xc6\xfa!\x8eK\xd9\x90K\xfa\xc1\x1d\xa9i\x17\a\xdb+\x95Z /\xc9\xafk\xb3!\x05\x17\xcb\x05\tX\x9c~\x85O\x97\x8f\xcc\xcc\xe4\xcb=\xdb\xdf\x1a\x81N\x01>\xdb7\xe3\xe3\xae;3\x8fF\x18\xa4Y `nu\xab!\x9dG\xea\x06\xa7\x83\t\x9b<\x10\xad\a\xb5Ia\xb4f\x97\xb7a4!\xe5h\xabk\x7f\xc4\x9d8\xdb>') preadv(r0, &(0x7f0000000940)=[{&(0x7f0000000500)=""/112, 0x70}], 0x1, 0x4c000000) 09:39:47 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmmsg(r0, &(0x7f0000000480), 0x2e9, 0xffd8) mmap$perf(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 09:39:47 executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r0, 0x80000000000000bd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r1, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r1) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r1) 09:39:47 executing program 5: clone(0x800007fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="13d50f34"], 0x4}}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000001a40)=[{{0x0, 0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000002c0)}], 0x3}}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000001b00)=ANY=[@ANYBLOB="eabe9f303b222957eecbc62428a82d2759621c4e25aca1877c7e5255f910c28f5e87a648b9546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39ac079b906da58a5d1ab04e9d752a92806db0c8541ab3234dedb663fc73c7fe3c32325c4541008239fb1aace0ec8aaeca96b1", @ANYRESHEX, @ANYPTR64, @ANYRES32, @ANYBLOB="0a1da9ee18cff6bc6a83095a16d8e35857b4bc2097af31ac7986a65cad647484f90c9fd46fef259ad171921ffcec605b1e5398c51a4bd95b0e2492f55ac2cddab500c32ec94bbca707914c339a47abae0bdae27c10cd74e98587787e4038c04a4b627b17e13dbcd3f8f5c96d5ac62040f4e1cd7e6716249e8f76346f92a216d694999b59692eed8ee95fe63da028952afc20b543340c03a83f8307f2"], 0x0, 0x124}, 0x20) tkill(r0, 0x3b) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 09:39:47 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1fb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0x31, 0x0, &(0x7f0000000100)="b901000000000000009e40f008001fffffe100004000630677fbac141414e9a33fa1be3e7d2a182fff34b480fa33e8bcce", 0x0, 0x100, 0x6000000000000000}, 0x28) 09:39:47 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f00000002c0)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0x4b47, 0x0) 09:39:47 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") mknod$loop(0x0, 0xa000, 0x0) 09:39:47 executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r0, 0x80000000000000bd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r1, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r1) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r1) [ 2673.434847][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2673.434851][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2673.434888][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2673.440657][ C0] protocol 88fb is buggy, dev hsr_slave_1 09:39:47 executing program 5: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1fb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0x34, 0x0, &(0x7f0000000100)="b901000000000000009e40f008001fffffe100004000630677fbac141414e9a33fa1be3e7d2a182fff34b480fa33e8bcce55846e", 0x0, 0x100, 0x6000000000000000}, 0x28) 09:39:47 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000001000)={0x26, 'hash\x00', 0x0, 0x0, 'michael_mic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000412ff8)="3665a1ab415b7ac7", 0x8) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000004c0)={0x10000000, 0x0, &(0x7f0000000440)=[{&(0x7f000077ff7d), 0xf0ff7f}], 0xc}, 0x0) 09:39:47 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmmsg(r0, &(0x7f0000000480), 0x2e9, 0xffd8) mmap$perf(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 09:39:50 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) r3 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000002c0)={r3, r1, 0x0, 0x0, 0x0}, 0x30) 09:39:50 executing program 4: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r0, 0x80000000000000bd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r1, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r1) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r1) 09:39:50 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="a4ab12f728db4b2b4d2f2f3ff7ad273b1e89e46f905080af4c90ccb170e60b3a8bf56db763e3062d037dca291318d0a17270bbce74b46f4db2a92ba0c9fb228bc105af", 0x43}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, r0, 0x0, 0x0) 09:39:50 executing program 3: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xfffffffe) preadv(r0, &(0x7f0000000240)=[{&(0x7f0000000080)=""/117, 0x75}], 0x1, 0x0) 09:39:50 executing program 1: io_setup(0x2, &(0x7f00000004c0)=0x0) r1 = socket$key(0xf, 0x3, 0x2) io_submit(r0, 0x1, &(0x7f0000000440)=[&(0x7f0000000180)={0x0, 0x0, 0x4, 0x8, 0x0, r1, &(0x7f0000000140)="73844ae89d", 0x5}]) 09:39:50 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmmsg(r0, &(0x7f0000000480), 0x2e9, 0xffd8) mmap$perf(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 09:39:50 executing program 4: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r0, 0x80000000000000bd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r1, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r1) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r1) 09:39:50 executing program 3: openat$usbmon(0xffffffffffffff9c, &(0x7f0000000140)='/dev/usbmon0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee68, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet6(0xa, 0x3, 0x88) openat$full(0xffffffffffffff9c, 0x0, 0x800, 0x0) r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee67, 0x401, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xdfffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000200)) perf_event_open(0x0, 0x0, 0xffffffffffffffff, r0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, 0x0, 0x0) getpid() perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffff9c, 0x0) openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) setsockopt$inet6_MRT6_ADD_MFC_PROXY(r1, 0x29, 0xd2, &(0x7f0000000480)={{0xa, 0x0, 0x1, @rand_addr="b015d2c9e964e064c0086e5006663b87", 0x1}, {0xa, 0x0, 0x400, @rand_addr="533428461f4b78c688a09785281a4779"}, 0x4, [0x7be3, 0x11, 0x7, 0x4, 0x64bc, 0x800, 0x384, 0x80000001]}, 0x5c) perf_event_open(&(0x7f00000002c0)={0x8000000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet_SIOCRTMSG(r2, 0x890d, &(0x7f0000000340)={0x0, {0x2, 0x4e20, @multicast2}, {0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x2, 0x4e22, @remote}, 0x8, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)='bcsf0\x00', 0x8}) sendto$inet(r2, 0x0, 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000440)='veth1\x00\x06\x00\xd6\x01\x00', 0x10) r3 = dup2(r2, r2) sendmsg$alg(r3, &(0x7f0000001100)={0x0, 0x0, &(0x7f00000010c0)=[{&(0x7f0000000000)="a7ce", 0x2}], 0x1}, 0x0) socket(0x0, 0xa, 0xfffffffffffffffb) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, 0x0, 0x0) ioctl$PPPIOCGUNIT(0xffffffffffffffff, 0x80047456, &(0x7f0000000500)) sendto$inet(r2, &(0x7f0000000000), 0xffffff45, 0x0, 0x0, 0xfffffffffffffdb9) setsockopt$inet_buf(r3, 0x0, 0x0, &(0x7f0000000240), 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6e, &(0x7f0000000000)=0x4, 0x16a) 09:39:50 executing program 5: creat(&(0x7f0000000000)='./bus\x00', 0x0) utimensat(0xffffffffffffff9c, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)={{}, {0x0, 0x7530}}, 0x0) 09:39:50 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000700)='F', 0x1, 0xfffffffffffffffe) keyctl$setperm(0x5, r1, 0x0) keyctl$get_security(0x11, r1, 0x0, 0x0) 09:39:50 executing program 4: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r0, 0x80000000000000bd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r1, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r1) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r1) 09:39:50 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000700)='F', 0x1, 0xfffffffffffffffe) keyctl$setperm(0x5, r1, 0x0) keyctl$get_security(0x11, r1, 0x0, 0x0) 09:39:50 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1124, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x20}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0800a1695e1dcfe87b1071") 09:39:50 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1fb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0x5a, 0x0, &(0x7f0000000100)="b90a000000000000009e40f008001fffffe100004000630677fbac141414e9a33fa1be3e7d2a182fff34b480fa33e8bcce55846e545c961e846be47f7684825d94f4396b4dd7dab3c8399dd78efa98fcb3684a74d6a616c67293", 0x0, 0x100, 0x6000000000000000}, 0x28) [ 2677.594860][ C1] net_ratelimit: 16 callbacks suppressed [ 2677.594899][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2677.600614][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2677.600652][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2678.634855][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2678.640763][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2678.646509][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2678.652220][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2678.657962][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2678.663679][ C1] protocol 88fb is buggy, dev hsr_slave_1 09:39:53 executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r0, 0x80000000000000bd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r1, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r1) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r1) 09:39:53 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="a4ab12f728db4b2b4d2f2f3ff7ad273b1e89e46f905080af4c90ccb170e60b3a8bf56db763e3062d037dca291318d0a17270bbce74b46f4db2a92ba0c9fb228bc105af", 0x43}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, r0, 0x0, 0x0) 09:39:53 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000700)='F', 0x1, 0xfffffffffffffffe) keyctl$setperm(0x5, r1, 0x0) keyctl$get_security(0x11, r1, 0x0, 0x0) 09:39:53 executing program 0: openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(r0, &(0x7f0000000000), 0x10000000d) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) 09:39:53 executing program 5: r0 = socket$kcm(0x10, 0x400000003, 0x10) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000200)="2e0000002b008163e45ae08700000000080f0000000000bc4cc91b4dd66d1c958c00"/46, 0x2e}], 0x1}, 0x0) 09:39:53 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1fb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0x5a, 0x0, &(0x7f0000000100)="b90a000000000000009e40f008001fffffe100004000630677fbac141414e9a33fa1be3e7d2a182fff34b480fa33e8bcce55846e545c961e846be47f7684825d94f4396b4dd7dab3c8399dd78efa98fcb3684a74d6a616c67293", 0x0, 0x100, 0x6000000000000000}, 0x28) 09:39:53 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000700)='F', 0x1, 0xfffffffffffffffe) keyctl$setperm(0x5, r1, 0x0) keyctl$get_security(0x11, r1, 0x0, 0x0) 09:39:53 executing program 5: prctl$PR_SET_TIMERSLACK(0x1d, 0xfffffffffffff5e6) prctl$PR_GET_TIMERSLACK(0x1e) 09:39:53 executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r0, 0x80000000000000bd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r1, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r1) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r1) 09:39:53 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000700)='F', 0x1, 0xfffffffffffffffe) keyctl$get_security(0x11, r1, 0x0, 0x0) 09:39:53 executing program 5: clone(0x84007bf7, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() mknod(&(0x7f0000000100)='./file0\x00', 0x1142, 0x0) execve(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) ptrace(0x10, r0) creat(&(0x7f0000000200)='./file0\x00', 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) ptrace(0x11, r0) [ 2679.674831][ C1] protocol 88fb is buggy, dev hsr_slave_0 09:39:53 executing program 0: openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(r0, &(0x7f0000000000), 0x10000000d) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) 09:39:53 executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r0, 0x80000000000000bd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r1, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r1) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r1) 09:39:56 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="a4ab12f728db4b2b4d2f2f3ff7ad273b1e89e46f905080af4c90ccb170e60b3a8bf56db763e3062d037dca291318d0a17270bbce74b46f4db2a92ba0c9fb228bc105af", 0x43}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, r0, 0x0, 0x0) 09:39:56 executing program 3: prctl$PR_SET_TIMERSLACK(0x1d, 0xfffffffffffffc29) prctl$PR_GET_TIMERSLACK(0x1e) 09:39:56 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000700)='F', 0x1, 0xfffffffffffffffe) keyctl$get_security(0x11, r1, 0x0, 0x0) 09:39:56 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) 09:39:56 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000180)={@mcast1, 0x0, 0x0, 0x3, 0x5}, 0x20) 09:39:56 executing program 5: r0 = socket$inet6(0xa, 0x802, 0x0) sendto$inet6(r0, 0x0, 0x34000, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4}, 0x1c) 09:39:56 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_VERSION(r0, 0xc0406400, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0xa3, &(0x7f0000000340)=""/163, 0x0, 0x0}) 09:39:56 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000700)='F', 0x1, 0xfffffffffffffffe) keyctl$get_security(0x11, r1, 0x0, 0x0) 09:39:56 executing program 0: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) r0 = memfd_create(&(0x7f0000001540)='}\xbf*x\x89-vO\xd3JUk\x88O\xc4N\xa2\rqI\r\xb3\xd9Q(\n\x1a\x9f/X\x1d9\x03\xc2\x16\xaf\x9d\xffl\xdcC\xeb\xa6\x96\x12$\xd15[z\x85\xf4\x1e\xcc\xfc\xf64\x00\x00\x00\x00\x00\x00\x00Pw\x1bN[\x81\x92\x15P\xc5\x0e\x06\x17\b\xaf\nu\xd8D9z\x9eR\bjh\xce\xa9j\xda\xf8B\x84\x8d\x12.\xeb\x95\x9a\n\xb2M\xc7\xd1\x87N\xc5Os?T\"\xfc\fc\x92\xbb>\xa3l\x9a\xc9\'\x14\xd5+\xb1\xa6\xf5\x9e\xd1\xea%\xd8l\xae\xd6\\dZ\x17/\xe7$(\x8ax\xdc\xc4\xb7\xa4\x9b\x92\xd8\x16Lz\x9e\xfc\xf8\xf1\xdc\xb9+F~%\x16e\x81\x1b\x11vw1:\xdd]\xb9\xe8\x99\xea\xd1O\x83\xf3WA\xad\xaa\xdc\r~[I\x9f\xac\x03\xf9\xe2\x12Je\xe9$\xd2\x00\xef\r\x9dQ2\xa1T4\xb4\x116RO+\x0e\x98\x8b\x1b\xc1\x81\xf0U\x93\xd1\xf7\xbb}N\'\xea\x8f\xbbdd\xda\xb5\x7f\xff\xef\xfd\xd5\x9b\x01?\xad \xa8\xe3l\x86\"\x94M\xd5\xfa]\x9f\x1d\xad\xf9y\xfc\x03=$Z\x00Oa#`qHd\xcc\x8f\x80\xa1\xed\x81 \x85\xe7\x1f\x99\xbe\xe8\xe5\xcey\n\xab\x8b\xa0yM\xba\xcf7}\x8eVQ\xe6d.S\x9e\xb1\x98\xd9\xc8;\xcc\xd5\xf2)\xf7Zh)\xffF\xb8\xc7\xd2%\xe9\xc7\x05\xefq\\\x97]\xd7\x1b\xdf\"o\xca\xd4\xe0\xd5\x125\xefz1\xcc\xe1nZ\xbe\x16\xa1\x8f\xc8)9\xb8\xc6\xc2\xdd8.*U\xe0\xc5\x04\x00\xd9\xfd{ZT\xf2\xe4\xb9\x95x\xa5\xbd\x04\x0f\x8eky\xd8\x8e\xd77\xd7\x0fp\n\x11\x13)\x9b\xf3D\xb2\x88*(\x02{\xb2`:\x01\x00\x00\x00\x00\x00\x00\xee\xff\xff\xffV2\xaa\x82', 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='smaps\x00') sendfile(r0, r1, 0x0, 0x40d5) readv(r1, &(0x7f0000000080)=[{&(0x7f00000001c0)=""/4096, 0xffffffae}], 0x1) ioctl$KDGKBSENT(r1, 0x4b48, &(0x7f0000000040)={0x8, 0x2}) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000002dc0)='/dev/nullb0\x00', 0x80c002000004002, 0x0) ioctl$BLKFLSBUF(r2, 0x1261, &(0x7f00000000c0)=0x5) 09:39:56 executing program 5: r0 = syz_open_dev$loop(&(0x7f00000005c0)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x2000005) 09:39:56 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) 09:39:56 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) keyctl$setperm(0x5, 0x0, 0x0) keyctl$get_security(0x11, 0x0, 0x0, 0x0) [ 2682.804875][ C1] net_ratelimit: 14 callbacks suppressed [ 2682.804883][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2682.816380][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2682.822173][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2682.827951][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2682.833768][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2682.839574][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2683.834849][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2683.834864][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2683.840715][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2683.846537][ C0] protocol 88fb is buggy, dev hsr_slave_1 09:39:59 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="a4ab12f728db4b2b4d2f2f3ff7ad273b1e89e46f905080af4c90ccb170e60b3a8bf56db763e3062d037dca291318d0a17270bbce74b46f4db2a92ba0c9fb228bc105af", 0x43}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, r0, 0x0, 0x0) 09:39:59 executing program 3: r0 = socket$kcm(0x29, 0x2, 0x0) recvmmsg(r0, &(0x7f0000005300)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40, 0x0) 09:39:59 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) keyctl$setperm(0x5, 0x0, 0x0) keyctl$get_security(0x11, 0x0, 0x0, 0x0) 09:39:59 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) 09:39:59 executing program 5: semop(0x0, &(0x7f0000000080)=[{0x0, 0x6}, {}], 0x2) semctl$GETNCNT(0x0, 0x0, 0xe, 0x0) 09:39:59 executing program 0: r0 = syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0x0, 0x2) ioctl$VIDIOC_G_CTRL(r0, 0xc008561b, &(0x7f00000000c0)) 09:39:59 executing program 5: pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r0, &(0x7f0000000340), 0x41395527) fcntl$setpipe(r0, 0x407, 0x0) 09:39:59 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) keyctl$setperm(0x5, 0x0, 0x0) keyctl$get_security(0x11, 0x0, 0x0, 0x0) 09:39:59 executing program 0: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x40, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) lgetxattr(&(0x7f0000000300)='./file0\x00', 0x0, &(0x7f0000000540)=""/50, 0x32) ioctl$FS_IOC_MEASURE_VERITY(r1, 0xc0046686, &(0x7f0000000100)={0x2, 0x3, "7fe917"}) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) recvmmsg(r2, &(0x7f0000008880), 0x400000000000249, 0x44000102, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast1}, 0x18) uname(0x0) socket$vsock_stream(0x28, 0x1, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) removexattr(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)=@random={'security.', '/trusted\x00'}) fcntl$setpipe(r4, 0x407, 0x0) write(r4, &(0x7f0000000340), 0x41395527) clock_gettime(0x0, &(0x7f0000000380)={0x0, 0x0}) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000480)={0x3, 0x0, 0xffff, 0x9, r0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r5+30000000}, 0x0) accept4$packet(r3, &(0x7f0000000500)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0, 0x1c0000) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r1, 0x0, 0x487, &(0x7f0000000440), &(0x7f00000004c0)=0x30) ioctl$RTC_PLL_SET(r3, 0x40207012, &(0x7f00000005c0)={0x0, 0x5, 0x0, 0x2, 0x9}) 09:39:59 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000040)=0x400100000001, 0xb4) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() socket$inet6(0xa, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10010000000035) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 09:39:59 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) 09:39:59 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) r0 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000700)='F', 0x1, 0xfffffffffffffffe) keyctl$setperm(0x5, r0, 0x0) keyctl$get_security(0x11, r0, 0x0, 0x0) [ 2685.972730][T20460] syz-executor.0 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 2685.983368][T20460] CPU: 1 PID: 20460 Comm: syz-executor.0 Not tainted 5.3.0-rc6-next-20190830 #75 [ 2685.992470][T20460] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2686.002515][T20460] Call Trace: [ 2686.005829][T20460] dump_stack+0x172/0x1f0 [ 2686.010160][T20460] dump_header+0x177/0x1152 [ 2686.014658][T20460] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2686.020444][T20460] ? ___ratelimit+0x2c8/0x595 [ 2686.020458][T20460] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2686.020471][T20460] ? lockdep_hardirqs_on+0x418/0x5d0 [ 2686.020487][T20460] ? trace_hardirqs_on+0x67/0x240 [ 2686.041313][T20460] ? pagefault_out_of_memory+0x11c/0x11c [ 2686.046933][T20460] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 2686.046946][T20460] ? ___ratelimit+0x60/0x595 [ 2686.046957][T20460] ? do_raw_spin_unlock+0x57/0x270 [ 2686.046973][T20460] oom_kill_process.cold+0x10/0x15 [ 2686.046987][T20460] out_of_memory+0x334/0x1340 [ 2686.046999][T20460] ? lock_downgrade+0x920/0x920 [ 2686.047016][T20460] ? mem_cgroup_unmark_under_oom+0x8d/0xb0 [ 2686.047030][T20460] ? oom_killer_disable+0x280/0x280 [ 2686.047051][T20460] mem_cgroup_out_of_memory+0x1d8/0x240 [ 2686.047064][T20460] ? mem_cgroup_nr_lru_pages+0x1b0/0x1b0 [ 2686.047079][T20460] ? do_raw_spin_unlock+0x57/0x270 [ 2686.047098][T20460] ? _raw_spin_unlock+0x2d/0x50 [ 2686.067645][T20460] try_charge+0xf4b/0x1440 [ 2686.067667][T20460] ? mem_cgroup_oom_trylock+0x1a0/0x1a0 [ 2686.067679][T20460] ? percpu_ref_tryget_live+0x111/0x290 [ 2686.067696][T20460] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2686.067711][T20460] ? __kasan_check_read+0x11/0x20 [ 2686.067726][T20460] ? get_mem_cgroup_from_mm+0x156/0x320 [ 2686.067741][T20460] mem_cgroup_try_charge+0x136/0x590 [ 2686.146706][T20460] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 2686.152947][T20460] mem_cgroup_try_charge_delay+0x1f/0xa0 [ 2686.158593][T20460] wp_page_copy+0x41e/0x1590 [ 2686.163185][T20460] ? find_held_lock+0x35/0x130 [ 2686.167965][T20460] ? pmd_pfn+0x1d0/0x1d0 [ 2686.172204][T20460] ? lock_downgrade+0x920/0x920 [ 2686.177046][T20460] ? vm_normal_page+0x15d/0x3c0 [ 2686.181886][T20460] ? __pte_alloc_kernel+0x210/0x210 [ 2686.187090][T20460] ? __kasan_check_read+0x11/0x20 [ 2686.192102][T20460] ? do_raw_spin_unlock+0x57/0x270 [ 2686.197230][T20460] do_wp_page+0x499/0x14d0 [ 2686.201642][T20460] ? do_raw_spin_lock+0x12a/0x2e0 [ 2686.206676][T20460] ? rwlock_bug.part.0+0x90/0x90 [ 2686.211619][T20460] ? finish_mkwrite_fault+0x570/0x570 [ 2686.216981][T20460] ? add_mm_counter_fast.part.0+0x40/0x40 [ 2686.222701][T20460] __handle_mm_fault+0x22f1/0x3f20 [ 2686.227846][T20460] ? vmf_insert_mixed_mkwrite+0x40/0x40 [ 2686.233432][T20460] ? __kasan_check_read+0x11/0x20 [ 2686.238453][T20460] handle_mm_fault+0x1b5/0x6c0 [ 2686.243223][T20460] __do_page_fault+0x536/0xdd0 [ 2686.248026][T20460] do_page_fault+0x38/0x590 [ 2686.252534][T20460] page_fault+0x39/0x40 [ 2686.256687][T20460] RIP: 0010:copy_user_enhanced_fast_string+0xe/0x20 [ 2686.263274][T20460] Code: 89 d1 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 31 c0 0f 1f 00 c3 0f 1f 80 00 00 00 00 0f 1f 00 83 fa 40 0f 82 70 ff ff ff 89 d1 a4 31 c0 0f 1f 00 c3 66 2e 0f 1f 84 00 00 00 00 00 89 d1 f3 a4 [ 2686.282876][T20460] RSP: 0018:ffff88800e81fab8 EFLAGS: 00010206 [ 2686.288931][T20460] RAX: 0000000000000001 RBX: 0000000000001000 RCX: 0000000000000500 [ 2686.296889][T20460] RDX: 0000000000001000 RSI: ffff88808dba7b00 RDI: 000000002052a000 [ 2686.304853][T20460] RBP: ffff88800e81faf0 R08: ffffed1011b75000 R09: 0000000000000000 [ 2686.312813][T20460] R10: ffffed1011b74fff R11: ffff88808dba7fff R12: 0000000020529500 [ 2686.312840][T20460] R13: ffff88808dba7000 R14: 000000002052a500 R15: 00007ffffffff000 [ 2686.312884][T20460] ? copyout+0x12d/0x150 [ 2686.333007][T20460] copy_page_to_iter+0x3de/0xda0 [ 2686.333018][T20460] ? kill_fasync+0x323/0x4a0 [ 2686.333042][T20460] pipe_to_user+0xb4/0x170 [ 2686.333058][T20460] __splice_from_pipe+0x397/0x7d0 [ 2686.333073][T20460] ? iter_to_pipe+0x560/0x560 [ 2686.356617][T20460] do_vmsplice.part.0+0x249/0x2b0 [ 2686.361676][T20460] ? __splice_from_pipe+0x7d0/0x7d0 [ 2686.366864][T20460] ? import_iovec+0x12b/0x200 [ 2686.371553][T20460] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2686.377786][T20460] __do_sys_vmsplice+0x1bc/0x210 [ 2686.382717][T20460] ? do_vmsplice.part.0+0x2b0/0x2b0 [ 2686.387920][T20460] ? __kasan_check_read+0x11/0x20 [ 2686.392932][T20460] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 2686.399146][T20460] ? put_timespec64+0xda/0x140 [ 2686.403902][T20460] ? nsecs_to_jiffies+0x30/0x30 [ 2686.408752][T20460] ? trace_hardirqs_on_thunk+0x1a/0x20 [ 2686.414194][T20460] ? trace_hardirqs_on_thunk+0x1a/0x20 [ 2686.419628][T20460] ? do_syscall_64+0x26/0x760 [ 2686.424376][T20460] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2686.430414][T20460] ? do_syscall_64+0x26/0x760 [ 2686.435081][T20460] __x64_sys_vmsplice+0x97/0xf0 [ 2686.439927][T20460] do_syscall_64+0xfa/0x760 [ 2686.444411][T20460] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2686.450288][T20460] RIP: 0033:0x4598e9 [ 2686.454215][T20460] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2686.473798][T20460] RSP: 002b:00007f0b10becc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000116 [ 2686.482193][T20460] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000004598e9 [ 2686.490163][T20460] RDX: 0000000000000001 RSI: 0000000020000000 RDI: 0000000000000007 [ 2686.498106][T20460] RBP: 000000000075c118 R08: 0000000000000000 R09: 0000000000000000 [ 2686.506048][T20460] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f0b10bed6d4 [ 2686.513993][T20460] R13: 00000000004c90c8 R14: 00000000004e0338 R15: 00000000ffffffff [ 2686.523290][T20460] memory: usage 307200kB, limit 307200kB, failcnt 5513 [ 2686.530188][T20460] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2686.537052][T20460] Memory cgroup stats for /syz0: [ 2686.537396][T20460] anon 276271104 [ 2686.537396][T20460] file 2269184 [ 2686.537396][T20460] kernel_stack 4849664 [ 2686.537396][T20460] slab 11542528 [ 2686.537396][T20460] sock 77824 [ 2686.537396][T20460] shmem 2174976 [ 2686.537396][T20460] file_mapped 0 [ 2686.537396][T20460] file_dirty 135168 [ 2686.537396][T20460] file_writeback 0 [ 2686.537396][T20460] anon_thp 260046848 [ 2686.537396][T20460] inactive_anon 2027520 [ 2686.537396][T20460] active_anon 276271104 [ 2686.537396][T20460] inactive_file 94208 [ 2686.537396][T20460] active_file 102400 [ 2686.537396][T20460] unevictable 0 [ 2686.537396][T20460] slab_reclaimable 2568192 [ 2686.537396][T20460] slab_unreclaimable 8974336 [ 2686.537396][T20460] pgfault 244464 [ 2686.537396][T20460] pgmajfault 0 [ 2686.537396][T20460] workingset_refault 1320 [ 2686.537396][T20460] workingset_activate 0 [ 2686.537396][T20460] workingset_nodereclaim 0 [ 2686.537396][T20460] pgrefill 406 [ 2686.537396][T20460] pgscan 39493 [ 2686.537396][T20460] pgsteal 1516 [ 2686.633108][T20460] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz0,mems_allowed=0-1,oom_memcg=/syz0,task_memcg=/syz0,task=syz-executor.0,pid=20438,uid=0 [ 2686.649874][T20460] Memory cgroup out of memory: Killed process 20438 (syz-executor.0) total-vm:73104kB, anon-rss:7376kB, file-rss:35808kB, shmem-rss:0kB, UID:0 pgtables:159744kB oom_score_adj:1000 [ 2686.673209][ T1064] oom_reaper: reaped process 20438 (syz-executor.0), now anon-rss:0kB, file-rss:34848kB, shmem-rss:0kB [ 2687.994878][ C1] net_ratelimit: 16 callbacks suppressed [ 2687.994912][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2688.000628][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2688.012070][ C1] protocol 88fb is buggy, dev hsr_slave_1 09:40:02 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="a4ab12f728db4b2b4d2f2f3ff7ad273b1e89e46f905080af4c90ccb170e60b3a8bf56db763e3062d037dca291318d0a17270bbce74b46f4db2a92ba0c9fb228bc105af", 0x43}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, r0, 0x0, 0x0) 09:40:02 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) r0 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000700)='F', 0x1, 0xfffffffffffffffe) keyctl$setperm(0x5, r0, 0x0) keyctl$get_security(0x11, r0, 0x0, 0x0) 09:40:02 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) 09:40:02 executing program 3: r0 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r0, 0x28, 0x2, &(0x7f0000000000)=0x20, 0x8) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)) r3 = getpid() sched_setscheduler(r3, 0x0, &(0x7f0000000380)) r4 = getpgid(r3) ioctl$sock_FIOSETOWN(r2, 0x8901, &(0x7f00000000c0)=r4) r5 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r5, 0x0, 0x0) getpgid(0xffffffffffffffff) r6 = socket$inet6(0xa, 0x3, 0x0) connect$inet6(r6, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000440)}, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) writev(r6, &(0x7f0000000400), 0x0) 09:40:02 executing program 5: r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) fallocate(r0, 0x0, 0xc478, 0x5) fallocate(r0, 0x3, 0x0, 0x7ff) 09:40:02 executing program 0: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x40, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) lgetxattr(&(0x7f0000000300)='./file0\x00', 0x0, &(0x7f0000000540)=""/50, 0x32) ioctl$FS_IOC_MEASURE_VERITY(r1, 0xc0046686, &(0x7f0000000100)={0x2, 0x3, "7fe917"}) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) recvmmsg(r2, &(0x7f0000008880), 0x400000000000249, 0x44000102, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast1}, 0x18) uname(0x0) socket$vsock_stream(0x28, 0x1, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) removexattr(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)=@random={'security.', '/trusted\x00'}) fcntl$setpipe(r4, 0x407, 0x0) write(r4, &(0x7f0000000340), 0x41395527) clock_gettime(0x0, &(0x7f0000000380)={0x0, 0x0}) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000480)={0x3, 0x0, 0xffff, 0x9, r0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r5+30000000}, 0x0) accept4$packet(r3, &(0x7f0000000500)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0, 0x1c0000) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r1, 0x0, 0x487, &(0x7f0000000440), &(0x7f00000004c0)=0x30) ioctl$RTC_PLL_SET(r3, 0x40207012, &(0x7f00000005c0)={0x0, 0x5, 0x0, 0x2, 0x9}) 09:40:02 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) r0 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000700)='F', 0x1, 0xfffffffffffffffe) keyctl$setperm(0x5, r0, 0x0) keyctl$get_security(0x11, r0, 0x0, 0x0) 09:40:02 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="2800000010005fba00000100f30000a89c8aeeb1", @ANYRES32=0x0, @ANYBLOB="030000000000000008001b0000000000"], 0x28}}, 0x0) 09:40:02 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) 09:40:02 executing program 3: socket$kcm(0x11, 0xa, 0x300) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x10, 0x3, 0x0) socket$kcm(0x29, 0x2, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x1000000000000002, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r0, 0x161) sendmsg$kcm(r1, &(0x7f0000003d00)={&(0x7f0000000380)=@in={0x2, 0x4e23, @multicast1}, 0x80, 0x0}, 0xfd00) write$cgroup_subtree(r1, 0x0, 0x0) [ 2688.878572][T20502] syz-executor.0 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 2688.889012][T20502] CPU: 1 PID: 20502 Comm: syz-executor.0 Not tainted 5.3.0-rc6-next-20190830 #75 [ 2688.898101][T20502] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2688.899550][T20501] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 2688.908144][T20502] Call Trace: [ 2688.908165][T20502] dump_stack+0x172/0x1f0 [ 2688.908184][T20502] dump_header+0x177/0x1152 [ 2688.908200][T20502] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2688.908211][T20502] ? ___ratelimit+0x2c8/0x595 [ 2688.908221][T20502] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2688.908238][T20502] ? lockdep_hardirqs_on+0x418/0x5d0 [ 2688.949050][T20502] ? trace_hardirqs_on+0x67/0x240 [ 2688.954190][T20502] ? pagefault_out_of_memory+0x11c/0x11c [ 2688.959816][T20502] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 2688.965618][T20502] ? ___ratelimit+0x60/0x595 [ 2688.970198][T20502] ? do_raw_spin_unlock+0x57/0x270 [ 2688.975343][T20502] oom_kill_process.cold+0x10/0x15 [ 2688.979139][T20501] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 2688.980454][T20502] out_of_memory+0x334/0x1340 [ 2688.980469][T20502] ? lock_downgrade+0x920/0x920 [ 2688.980487][T20502] ? mem_cgroup_unmark_under_oom+0x8d/0xb0 [ 2688.980503][T20502] ? oom_killer_disable+0x280/0x280 [ 2688.992336][T20502] mem_cgroup_out_of_memory+0x1d8/0x240 [ 2689.003161][T20502] ? mem_cgroup_nr_lru_pages+0x1b0/0x1b0 [ 2689.003179][T20502] ? do_raw_spin_unlock+0x57/0x270 [ 2689.003195][T20502] ? _raw_spin_unlock+0x2d/0x50 [ 2689.003209][T20502] try_charge+0xf4b/0x1440 [ 2689.003230][T20502] ? mem_cgroup_oom_trylock+0x1a0/0x1a0 [ 2689.019603][T20502] ? percpu_ref_tryget_live+0x111/0x290 [ 2689.019625][T20502] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2689.029541][T20502] ? __kasan_check_read+0x11/0x20 [ 2689.029560][T20502] ? get_mem_cgroup_from_mm+0x156/0x320 [ 2689.029576][T20502] mem_cgroup_try_charge+0x136/0x590 [ 2689.029590][T20502] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 2689.029606][T20502] mem_cgroup_try_charge_delay+0x1f/0xa0 [ 2689.078876][T20502] wp_page_copy+0x41e/0x1590 [ 2689.083469][T20502] ? find_held_lock+0x35/0x130 [ 2689.088336][T20502] ? pmd_pfn+0x1d0/0x1d0 [ 2689.092580][T20502] ? lock_downgrade+0x920/0x920 [ 2689.097426][T20502] ? vm_normal_page+0x15d/0x3c0 [ 2689.102289][T20502] ? __pte_alloc_kernel+0x210/0x210 [ 2689.107498][T20502] ? __kasan_check_read+0x11/0x20 [ 2689.107512][T20502] ? do_raw_spin_unlock+0x57/0x270 [ 2689.107529][T20502] do_wp_page+0x499/0x14d0 [ 2689.107544][T20502] ? do_raw_spin_lock+0x12a/0x2e0 [ 2689.117643][T20502] ? rwlock_bug.part.0+0x90/0x90 [ 2689.117657][T20502] ? finish_mkwrite_fault+0x570/0x570 [ 2689.117670][T20502] ? add_mm_counter_fast.part.0+0x40/0x40 [ 2689.117691][T20502] __handle_mm_fault+0x22f1/0x3f20 [ 2689.117709][T20502] ? vmf_insert_mixed_mkwrite+0x40/0x40 [ 2689.117734][T20502] ? __kasan_check_read+0x11/0x20 [ 2689.117753][T20502] handle_mm_fault+0x1b5/0x6c0 [ 2689.117770][T20502] __do_page_fault+0x536/0xdd0 [ 2689.117808][T20502] do_page_fault+0x38/0x590 [ 2689.172920][T20502] page_fault+0x39/0x40 09:40:03 executing program 1: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000700)='F', 0x1, 0xfffffffffffffffe) keyctl$setperm(0x5, r0, 0x0) keyctl$get_security(0x11, r0, 0x0, 0x0) 09:40:03 executing program 1: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000700)='F', 0x1, 0xfffffffffffffffe) keyctl$setperm(0x5, r0, 0x0) keyctl$get_security(0x11, r0, 0x0, 0x0) [ 2689.177071][T20502] RIP: 0010:copy_user_enhanced_fast_string+0xe/0x20 [ 2689.183661][T20502] Code: 89 d1 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 31 c0 0f 1f 00 c3 0f 1f 80 00 00 00 00 0f 1f 00 83 fa 40 0f 82 70 ff ff ff 89 d1 a4 31 c0 0f 1f 00 c3 66 2e 0f 1f 84 00 00 00 00 00 89 d1 f3 a4 [ 2689.203254][T20502] RSP: 0018:ffff888014567ab8 EFLAGS: 00010206 [ 2689.209323][T20502] RAX: 0000000000000001 RBX: 0000000000001000 RCX: 0000000000000500 [ 2689.217289][T20502] RDX: 0000000000001000 RSI: ffff888094e19b00 RDI: 0000000020516000 [ 2689.225254][T20502] RBP: ffff888014567af0 R08: ffffed10129c3400 R09: 0000000000000000 [ 2689.233217][T20502] R10: ffffed10129c33ff R11: ffff888094e19fff R12: 0000000020515500 [ 2689.241175][T20502] R13: ffff888094e19000 R14: 0000000020516500 R15: 00007ffffffff000 [ 2689.249157][T20502] ? copyout+0x12d/0x150 [ 2689.253394][T20502] copy_page_to_iter+0x3de/0xda0 [ 2689.258320][T20502] ? kill_fasync+0x323/0x4a0 [ 2689.262915][T20502] pipe_to_user+0xb4/0x170 [ 2689.267330][T20502] __splice_from_pipe+0x397/0x7d0 [ 2689.272351][T20502] ? iter_to_pipe+0x560/0x560 [ 2689.277034][T20502] do_vmsplice.part.0+0x249/0x2b0 [ 2689.282053][T20502] ? __splice_from_pipe+0x7d0/0x7d0 [ 2689.287238][T20502] ? import_iovec+0x12b/0x200 [ 2689.291922][T20502] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2689.298160][T20502] __do_sys_vmsplice+0x1bc/0x210 [ 2689.303091][T20502] ? do_vmsplice.part.0+0x2b0/0x2b0 [ 2689.308292][T20502] ? __kasan_check_read+0x11/0x20 [ 2689.313315][T20502] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 2689.319572][T20502] ? put_timespec64+0xda/0x140 [ 2689.324326][T20502] ? nsecs_to_jiffies+0x30/0x30 [ 2689.329175][T20502] ? trace_hardirqs_on_thunk+0x1a/0x20 [ 2689.334621][T20502] ? trace_hardirqs_on_thunk+0x1a/0x20 [ 2689.340106][T20502] ? do_syscall_64+0x26/0x760 [ 2689.344779][T20502] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2689.350839][T20502] ? do_syscall_64+0x26/0x760 [ 2689.355532][T20502] __x64_sys_vmsplice+0x97/0xf0 [ 2689.355549][T20502] do_syscall_64+0xfa/0x760 [ 2689.355567][T20502] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2689.355577][T20502] RIP: 0033:0x4598e9 [ 2689.355588][T20502] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2689.355595][T20502] RSP: 002b:00007f0b10becc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000116 [ 2689.355606][T20502] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000004598e9 [ 2689.355613][T20502] RDX: 0000000000000001 RSI: 0000000020000000 RDI: 0000000000000007 [ 2689.355620][T20502] RBP: 000000000075c118 R08: 0000000000000000 R09: 0000000000000000 [ 2689.355627][T20502] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f0b10bed6d4 [ 2689.355634][T20502] R13: 00000000004c90c8 R14: 00000000004e0338 R15: 00000000ffffffff [ 2689.355807][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2689.370925][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2689.371028][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2689.459968][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2689.465815][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2689.471581][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2689.477514][T20502] memory: usage 306876kB, limit 307200kB, failcnt 5546 [ 2689.484353][T20502] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2689.491228][T20502] Memory cgroup stats for /syz0: [ 2689.491324][T20502] anon 276176896 [ 2689.491324][T20502] file 2269184 [ 2689.491324][T20502] kernel_stack 4849664 [ 2689.491324][T20502] slab 11341824 [ 2689.491324][T20502] sock 77824 [ 2689.491324][T20502] shmem 2174976 [ 2689.491324][T20502] file_mapped 0 [ 2689.491324][T20502] file_dirty 135168 [ 2689.491324][T20502] file_writeback 0 [ 2689.491324][T20502] anon_thp 260046848 [ 2689.491324][T20502] inactive_anon 2027520 [ 2689.491324][T20502] active_anon 276176896 [ 2689.491324][T20502] inactive_file 94208 [ 2689.491324][T20502] active_file 102400 [ 2689.491324][T20502] unevictable 0 [ 2689.491324][T20502] slab_reclaimable 2568192 [ 2689.491324][T20502] slab_unreclaimable 8773632 [ 2689.491324][T20502] pgfault 244827 [ 2689.491324][T20502] pgmajfault 0 [ 2689.491324][T20502] workingset_refault 1320 [ 2689.491324][T20502] workingset_activate 0 [ 2689.491324][T20502] workingset_nodereclaim 0 [ 2689.491324][T20502] pgrefill 406 [ 2689.491324][T20502] pgscan 39493 [ 2689.491324][T20502] pgsteal 1516 [ 2689.586986][T20502] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz0,mems_allowed=0-1,oom_memcg=/syz0,task_memcg=/syz0,task=syz-executor.0,pid=20479,uid=0 [ 2689.587097][T20502] Memory cgroup out of memory: Killed process 20479 (syz-executor.0) total-vm:73104kB, anon-rss:7360kB, file-rss:35824kB, shmem-rss:0kB, UID:0 pgtables:159744kB oom_score_adj:1000 [ 2689.625190][T20501] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 2689.625831][ T1064] oom_reaper: reaped process 20479 (syz-executor.0), now anon-rss:0kB, file-rss:34864kB, shmem-rss:0kB 09:40:05 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="a4ab12f728db4b2b4d2f2f3ff7ad273b1e89e46f905080af4c90ccb170e60b3a8bf56db763e3062d037dca291318d0a17270bbce74b46f4db2a92ba0c9fb228bc105af", 0x43}], 0x4, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, r0, 0x0, 0x0) 09:40:05 executing program 1: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000700)='F', 0x1, 0xfffffffffffffffe) keyctl$setperm(0x5, r0, 0x0) keyctl$get_security(0x11, r0, 0x0, 0x0) 09:40:05 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)) r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) 09:40:05 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0xfffffd1e, 0x0, 0x229}}], 0x0, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip6_tables_targets\x00') perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(r0, &(0x7f00000017c0), 0x33d, 0x0) 09:40:05 executing program 0: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x40, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) lgetxattr(&(0x7f0000000300)='./file0\x00', 0x0, &(0x7f0000000540)=""/50, 0x32) ioctl$FS_IOC_MEASURE_VERITY(r1, 0xc0046686, &(0x7f0000000100)={0x2, 0x3, "7fe917"}) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) recvmmsg(r2, &(0x7f0000008880), 0x400000000000249, 0x44000102, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast1}, 0x18) uname(0x0) socket$vsock_stream(0x28, 0x1, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) removexattr(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)=@random={'security.', '/trusted\x00'}) fcntl$setpipe(r4, 0x407, 0x0) write(r4, &(0x7f0000000340), 0x41395527) clock_gettime(0x0, &(0x7f0000000380)={0x0, 0x0}) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000480)={0x3, 0x0, 0xffff, 0x9, r0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r5+30000000}, 0x0) accept4$packet(r3, &(0x7f0000000500)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0, 0x1c0000) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r1, 0x0, 0x487, &(0x7f0000000440), &(0x7f00000004c0)=0x30) ioctl$RTC_PLL_SET(r3, 0x40207012, &(0x7f00000005c0)={0x0, 0x5, 0x0, 0x2, 0x9}) 09:40:05 executing program 5: openat$zero(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/zero\x00', 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0xfffffd1e, 0x0, 0x229}}], 0x0, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip6_tables_targets\x00') geteuid() stat(&(0x7f0000000280)='./file0\x00', &(0x7f0000000300)) bpf$MAP_CREATE(0x0, 0x0, 0x6bc4cccda6332264) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) preadv(r0, &(0x7f00000017c0), 0x33d, 0x0) 09:40:05 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="a4ab12f728db4b2b4d2f2f3ff7ad273b1e89e46f905080af4c90ccb170e60b3a8bf56db763e3062d037dca291318d0a17270bbce74b46f4db2a92ba0c9fb228bc105af", 0x43}], 0x4, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, r0, 0x0, 0x0) 09:40:05 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)) r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) 09:40:05 executing program 1: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000700)='F', 0x1, 0xfffffffffffffffe) keyctl$setperm(0x5, r1, 0x0) keyctl$get_security(0x11, r1, 0x0, 0x0) 09:40:05 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0xfffffd1e, 0x0, 0x229}}], 0x0, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip6_tables_targets\x00') perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(r0, &(0x7f00000017c0), 0x33d, 0x0) 09:40:05 executing program 5: openat$zero(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/zero\x00', 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0xfffffd1e, 0x0, 0x229}}], 0x0, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip6_tables_targets\x00') geteuid() stat(&(0x7f0000000280)='./file0\x00', &(0x7f0000000300)) bpf$MAP_CREATE(0x0, 0x0, 0x6bc4cccda6332264) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) preadv(r0, &(0x7f00000017c0), 0x33d, 0x0) [ 2691.949692][T20548] syz-executor.0 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 2691.959993][T20548] CPU: 1 PID: 20548 Comm: syz-executor.0 Not tainted 5.3.0-rc6-next-20190830 #75 [ 2691.960001][T20548] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2691.960006][T20548] Call Trace: [ 2691.960024][T20548] dump_stack+0x172/0x1f0 [ 2691.960043][T20548] dump_header+0x177/0x1152 [ 2691.960062][T20548] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 09:40:06 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="a4ab12f728db4b2b4d2f2f3ff7ad273b1e89e46f905080af4c90ccb170e60b3a8bf56db763e3062d037dca291318d0a17270bbce74b46f4db2a92ba0c9fb228bc105af", 0x43}], 0x4, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, r0, 0x0, 0x0) [ 2691.997016][T20548] ? ___ratelimit+0x2c8/0x595 [ 2692.001689][T20548] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2692.007515][T20548] ? lockdep_hardirqs_on+0x418/0x5d0 [ 2692.012793][T20548] ? trace_hardirqs_on+0x67/0x240 [ 2692.017808][T20548] ? pagefault_out_of_memory+0x11c/0x11c [ 2692.023428][T20548] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 2692.023444][T20548] ? ___ratelimit+0x60/0x595 [ 2692.033801][T20548] ? do_raw_spin_unlock+0x57/0x270 [ 2692.038924][T20548] oom_kill_process.cold+0x10/0x15 [ 2692.044036][T20548] out_of_memory+0x334/0x1340 09:40:06 executing program 1: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000700)='F', 0x1, 0xfffffffffffffffe) keyctl$setperm(0x5, r1, 0x0) keyctl$get_security(0x11, r1, 0x0, 0x0) [ 2692.048707][T20548] ? lock_downgrade+0x920/0x920 [ 2692.053580][T20548] ? mem_cgroup_unmark_under_oom+0x8d/0xb0 [ 2692.059395][T20548] ? oom_killer_disable+0x280/0x280 [ 2692.064603][T20548] mem_cgroup_out_of_memory+0x1d8/0x240 [ 2692.070163][T20548] ? mem_cgroup_nr_lru_pages+0x1b0/0x1b0 [ 2692.075819][T20548] ? do_raw_spin_unlock+0x57/0x270 [ 2692.080929][T20548] ? _raw_spin_unlock+0x2d/0x50 [ 2692.085778][T20548] try_charge+0xf4b/0x1440 [ 2692.090196][T20548] ? mem_cgroup_oom_trylock+0x1a0/0x1a0 [ 2692.095736][T20548] ? percpu_ref_tryget_live+0x111/0x290 [ 2692.101288][T20548] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2692.107523][T20548] ? __kasan_check_read+0x11/0x20 [ 2692.112541][T20548] ? get_mem_cgroup_from_mm+0x156/0x320 [ 2692.118076][T20548] mem_cgroup_try_charge+0x136/0x590 [ 2692.123356][T20548] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 2692.129600][T20548] mem_cgroup_try_charge_delay+0x1f/0xa0 [ 2692.135261][T20548] wp_page_copy+0x41e/0x1590 [ 2692.135275][T20548] ? find_held_lock+0x35/0x130 [ 2692.135309][T20548] ? pmd_pfn+0x1d0/0x1d0 [ 2692.135325][T20548] ? lock_downgrade+0x920/0x920 [ 2692.135337][T20548] ? vm_normal_page+0x15d/0x3c0 [ 2692.135352][T20548] ? __pte_alloc_kernel+0x210/0x210 [ 2692.135367][T20548] ? __kasan_check_read+0x11/0x20 [ 2692.135382][T20548] ? do_raw_spin_unlock+0x57/0x270 [ 2692.173842][T20548] do_wp_page+0x499/0x14d0 [ 2692.178270][T20548] ? do_raw_spin_lock+0x12a/0x2e0 [ 2692.183308][T20548] ? rwlock_bug.part.0+0x90/0x90 [ 2692.188240][T20548] ? finish_mkwrite_fault+0x570/0x570 [ 2692.193616][T20548] ? add_mm_counter_fast.part.0+0x40/0x40 [ 2692.199347][T20548] __handle_mm_fault+0x22f1/0x3f20 [ 2692.204460][T20548] ? vmf_insert_mixed_mkwrite+0x40/0x40 [ 2692.210010][T20548] ? __kasan_check_read+0x11/0x20 [ 2692.215028][T20548] handle_mm_fault+0x1b5/0x6c0 [ 2692.215048][T20548] __do_page_fault+0x536/0xdd0 [ 2692.215069][T20548] do_page_fault+0x38/0x590 [ 2692.215084][T20548] page_fault+0x39/0x40 [ 2692.215099][T20548] RIP: 0010:copy_user_enhanced_fast_string+0xe/0x20 [ 2692.215111][T20548] Code: 89 d1 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 31 c0 0f 1f 00 c3 0f 1f 80 00 00 00 00 0f 1f 00 83 fa 40 0f 82 70 ff ff ff 89 d1 a4 31 c0 0f 1f 00 c3 66 2e 0f 1f 84 00 00 00 00 00 89 d1 f3 a4 [ 2692.215118][T20548] RSP: 0018:ffff88805da6fab8 EFLAGS: 00010206 [ 2692.215128][T20548] RAX: 0000000000000001 RBX: 0000000000001000 RCX: 0000000000000500 [ 2692.215135][T20548] RDX: 0000000000001000 RSI: ffff88809bc1db00 RDI: 0000000020563000 [ 2692.215142][T20548] RBP: ffff88805da6faf0 R08: ffffed1013783c00 R09: 0000000000000000 [ 2692.215149][T20548] R10: ffffed1013783bff R11: ffff88809bc1dfff R12: 0000000020562500 [ 2692.215157][T20548] R13: ffff88809bc1d000 R14: 0000000020563500 R15: 00007ffffffff000 [ 2692.215186][T20548] ? copyout+0x12d/0x150 [ 2692.309512][T20548] copy_page_to_iter+0x3de/0xda0 [ 2692.314439][T20548] ? kill_fasync+0x323/0x4a0 [ 2692.319043][T20548] pipe_to_user+0xb4/0x170 [ 2692.323468][T20548] __splice_from_pipe+0x397/0x7d0 [ 2692.328486][T20548] ? iter_to_pipe+0x560/0x560 [ 2692.333164][T20548] do_vmsplice.part.0+0x249/0x2b0 [ 2692.338181][T20548] ? __splice_from_pipe+0x7d0/0x7d0 [ 2692.343371][T20548] ? import_iovec+0x12b/0x200 09:40:06 executing program 5: openat$zero(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/zero\x00', 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0xfffffd1e, 0x0, 0x229}}], 0x0, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip6_tables_targets\x00') geteuid() stat(&(0x7f0000000280)='./file0\x00', &(0x7f0000000300)) bpf$MAP_CREATE(0x0, 0x0, 0x6bc4cccda6332264) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) preadv(r0, &(0x7f00000017c0), 0x33d, 0x0) [ 2692.348056][T20548] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2692.354298][T20548] __do_sys_vmsplice+0x1bc/0x210 [ 2692.359229][T20548] ? do_vmsplice.part.0+0x2b0/0x2b0 [ 2692.364421][T20548] ? __kasan_check_read+0x11/0x20 [ 2692.369466][T20548] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 2692.375710][T20548] ? put_timespec64+0xda/0x140 [ 2692.380470][T20548] ? nsecs_to_jiffies+0x30/0x30 [ 2692.385322][T20548] ? trace_hardirqs_on_thunk+0x1a/0x20 [ 2692.390777][T20548] ? trace_hardirqs_on_thunk+0x1a/0x20 [ 2692.396228][T20548] ? do_syscall_64+0x26/0x760 09:40:06 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0xfffffd1e, 0x0, 0x229}}], 0x0, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip6_tables_targets\x00') perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(r0, &(0x7f00000017c0), 0x33d, 0x0) 09:40:06 executing program 1: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000700)='F', 0x1, 0xfffffffffffffffe) keyctl$setperm(0x5, r1, 0x0) keyctl$get_security(0x11, r1, 0x0, 0x0) [ 2692.400900][T20548] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2692.406959][T20548] ? do_syscall_64+0x26/0x760 [ 2692.411631][T20548] __x64_sys_vmsplice+0x97/0xf0 [ 2692.416472][T20548] do_syscall_64+0xfa/0x760 [ 2692.420969][T20548] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2692.426848][T20548] RIP: 0033:0x4598e9 [ 2692.430732][T20548] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2692.450331][T20548] RSP: 002b:00007f0b10becc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000116 [ 2692.450343][T20548] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000004598e9 [ 2692.450350][T20548] RDX: 0000000000000001 RSI: 0000000020000000 RDI: 0000000000000007 [ 2692.450357][T20548] RBP: 000000000075c118 R08: 0000000000000000 R09: 0000000000000000 [ 2692.450365][T20548] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f0b10bed6d4 [ 2692.450372][T20548] R13: 00000000004c90c8 R14: 00000000004e0338 R15: 00000000ffffffff [ 2692.450830][T20548] memory: usage 307200kB, limit 307200kB, failcnt 5567 [ 2692.505568][T20548] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2692.512402][T20548] Memory cgroup stats for /syz0: [ 2692.512512][T20548] anon 276447232 [ 2692.512512][T20548] file 2269184 [ 2692.512512][T20548] kernel_stack 4849664 [ 2692.512512][T20548] slab 11341824 [ 2692.512512][T20548] sock 77824 [ 2692.512512][T20548] shmem 2174976 [ 2692.512512][T20548] file_mapped 0 [ 2692.512512][T20548] file_dirty 135168 [ 2692.512512][T20548] file_writeback 0 [ 2692.512512][T20548] anon_thp 260046848 [ 2692.512512][T20548] inactive_anon 2027520 [ 2692.512512][T20548] active_anon 276447232 [ 2692.512512][T20548] inactive_file 94208 [ 2692.512512][T20548] active_file 102400 [ 2692.512512][T20548] unevictable 0 [ 2692.512512][T20548] slab_reclaimable 2568192 [ 2692.512512][T20548] slab_unreclaimable 8773632 [ 2692.512512][T20548] pgfault 245289 [ 2692.512512][T20548] pgmajfault 0 [ 2692.512512][T20548] workingset_refault 1320 [ 2692.512512][T20548] workingset_activate 0 [ 2692.512512][T20548] workingset_nodereclaim 0 [ 2692.512512][T20548] pgrefill 406 [ 2692.512512][T20548] pgscan 39493 [ 2692.512512][T20548] pgsteal 1516 [ 2692.608228][T20548] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz0,mems_allowed=0-1,oom_memcg=/syz0,task_memcg=/syz0,task=syz-executor.0,pid=20528,uid=0 [ 2692.608345][T20548] Memory cgroup out of memory: Killed process 20528 (syz-executor.0) total-vm:73104kB, anon-rss:7624kB, file-rss:35824kB, shmem-rss:0kB, UID:0 pgtables:159744kB oom_score_adj:1000 [ 2692.614835][ T1064] oom_reaper: reaped process 20528 (syz-executor.0), now anon-rss:0kB, file-rss:34864kB, shmem-rss:0kB 09:40:06 executing program 0: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x40, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) lgetxattr(&(0x7f0000000300)='./file0\x00', 0x0, &(0x7f0000000540)=""/50, 0x32) ioctl$FS_IOC_MEASURE_VERITY(r1, 0xc0046686, &(0x7f0000000100)={0x2, 0x3, "7fe917"}) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) recvmmsg(r2, &(0x7f0000008880), 0x400000000000249, 0x44000102, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast1}, 0x18) uname(0x0) socket$vsock_stream(0x28, 0x1, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) removexattr(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)=@random={'security.', '/trusted\x00'}) fcntl$setpipe(r4, 0x407, 0x0) write(r4, &(0x7f0000000340), 0x41395527) clock_gettime(0x0, &(0x7f0000000380)={0x0, 0x0}) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000480)={0x3, 0x0, 0xffff, 0x9, r0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r5+30000000}, 0x0) accept4$packet(r3, &(0x7f0000000500)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0, 0x1c0000) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r1, 0x0, 0x487, &(0x7f0000000440), &(0x7f00000004c0)=0x30) ioctl$RTC_PLL_SET(r3, 0x40207012, &(0x7f00000005c0)={0x0, 0x5, 0x0, 0x2, 0x9}) 09:40:06 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, r0, 0x0, 0x0) 09:40:06 executing program 1: socketpair$unix(0x1, 0x1, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000700)='F', 0x1, 0xfffffffffffffffe) keyctl$setperm(0x5, r0, 0x0) keyctl$get_security(0x11, r0, 0x0, 0x0) 09:40:06 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)) r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) 09:40:06 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000040)=0x2, 0x4) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f00000005c0), 0xfffffffffffffee0, 0x0, 0x0, 0xb6) 09:40:06 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_buf(r0, 0x6, 0x1f, 0x0, &(0x7f00000002c0)) 09:40:07 executing program 1: socketpair$unix(0x1, 0x1, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000700)='F', 0x1, 0xfffffffffffffffe) keyctl$setperm(0x5, r0, 0x0) keyctl$get_security(0x11, r0, 0x0, 0x0) [ 2693.008177][T20588] syz-executor.0 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 2693.018588][T20588] CPU: 1 PID: 20588 Comm: syz-executor.0 Not tainted 5.3.0-rc6-next-20190830 #75 [ 2693.027690][T20588] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2693.037744][T20588] Call Trace: [ 2693.041035][T20588] dump_stack+0x172/0x1f0 [ 2693.045363][T20588] dump_header+0x177/0x1152 [ 2693.049864][T20588] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 09:40:07 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, r0, 0x0, 0x0) [ 2693.055660][T20588] ? ___ratelimit+0x2c8/0x595 [ 2693.060341][T20588] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2693.066156][T20588] ? lockdep_hardirqs_on+0x418/0x5d0 [ 2693.071440][T20588] ? trace_hardirqs_on+0x67/0x240 [ 2693.076464][T20588] ? pagefault_out_of_memory+0x11c/0x11c [ 2693.082091][T20588] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 2693.087889][T20588] ? ___ratelimit+0x60/0x595 [ 2693.092516][T20588] ? do_raw_spin_unlock+0x57/0x270 [ 2693.097645][T20588] oom_kill_process.cold+0x10/0x15 [ 2693.102785][T20588] out_of_memory+0x334/0x1340 09:40:07 executing program 5: clock_getres(0x0, 0x0) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) 09:40:07 executing program 1: socketpair$unix(0x1, 0x1, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000700)='F', 0x1, 0xfffffffffffffffe) keyctl$setperm(0x5, r0, 0x0) keyctl$get_security(0x11, r0, 0x0, 0x0) [ 2693.107452][T20588] ? lock_downgrade+0x920/0x920 [ 2693.112293][T20588] ? mem_cgroup_unmark_under_oom+0x8d/0xb0 [ 2693.118176][T20588] ? oom_killer_disable+0x280/0x280 [ 2693.123375][T20588] mem_cgroup_out_of_memory+0x1d8/0x240 [ 2693.128934][T20588] ? mem_cgroup_nr_lru_pages+0x1b0/0x1b0 [ 2693.134616][T20588] ? do_raw_spin_unlock+0x57/0x270 [ 2693.139745][T20588] ? _raw_spin_unlock+0x2d/0x50 [ 2693.144604][T20588] try_charge+0xf4b/0x1440 [ 2693.149032][T20588] ? mem_cgroup_oom_trylock+0x1a0/0x1a0 [ 2693.154559][T20588] ? percpu_ref_tryget_live+0x111/0x290 [ 2693.154577][T20588] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2693.154592][T20588] ? __kasan_check_read+0x11/0x20 [ 2693.154611][T20588] ? get_mem_cgroup_from_mm+0x156/0x320 [ 2693.154626][T20588] mem_cgroup_try_charge+0x136/0x590 [ 2693.154643][T20588] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 2693.188401][T20588] mem_cgroup_try_charge_delay+0x1f/0xa0 [ 2693.194055][T20588] wp_page_copy+0x41e/0x1590 [ 2693.194076][T20588] ? find_held_lock+0x35/0x130 [ 2693.203469][T20588] ? pmd_pfn+0x1d0/0x1d0 09:40:07 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0b") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) [ 2693.207824][T20588] ? lock_downgrade+0x920/0x920 [ 2693.212685][T20588] ? vm_normal_page+0x15d/0x3c0 [ 2693.217569][T20588] ? __pte_alloc_kernel+0x210/0x210 [ 2693.222763][T20588] ? __kasan_check_read+0x11/0x20 [ 2693.227768][T20588] ? do_raw_spin_unlock+0x57/0x270 [ 2693.227784][T20588] do_wp_page+0x499/0x14d0 [ 2693.227794][T20588] ? do_raw_spin_lock+0x12a/0x2e0 [ 2693.227807][T20588] ? rwlock_bug.part.0+0x90/0x90 [ 2693.227821][T20588] ? finish_mkwrite_fault+0x570/0x570 [ 2693.227833][T20588] ? add_mm_counter_fast.part.0+0x40/0x40 [ 2693.227853][T20588] __handle_mm_fault+0x22f1/0x3f20 [ 2693.227871][T20588] ? vmf_insert_mixed_mkwrite+0x40/0x40 [ 2693.227895][T20588] ? __kasan_check_read+0x11/0x20 [ 2693.227915][T20588] handle_mm_fault+0x1b5/0x6c0 [ 2693.227933][T20588] __do_page_fault+0x536/0xdd0 [ 2693.227953][T20588] do_page_fault+0x38/0x590 [ 2693.227972][T20588] page_fault+0x39/0x40 [ 2693.269044][T20588] RIP: 0010:copy_user_enhanced_fast_string+0xe/0x20 09:40:07 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000700)='F', 0x1, 0xfffffffffffffffe) keyctl$setperm(0x5, r0, 0x0) keyctl$get_security(0x11, r0, 0x0, 0x0) [ 2693.269057][T20588] Code: 89 d1 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 31 c0 0f 1f 00 c3 0f 1f 80 00 00 00 00 0f 1f 00 83 fa 40 0f 82 70 ff ff ff 89 d1 a4 31 c0 0f 1f 00 c3 66 2e 0f 1f 84 00 00 00 00 00 89 d1 f3 a4 [ 2693.269064][T20588] RSP: 0018:ffff88805d39fab8 EFLAGS: 00010206 [ 2693.269075][T20588] RAX: 0000000000000001 RBX: 0000000000001000 RCX: 0000000000000500 [ 2693.269082][T20588] RDX: 0000000000001000 RSI: ffff8880561f2b00 RDI: 000000002056b000 [ 2693.269090][T20588] RBP: ffff88805d39faf0 R08: ffffed100ac3e600 R09: 0000000000000000 [ 2693.269101][T20588] R10: ffffed100ac3e5ff R11: ffff8880561f2fff R12: 000000002056a500 [ 2693.318501][T20588] R13: ffff8880561f2000 R14: 000000002056b500 R15: 00007ffffffff000 [ 2693.318533][T20588] ? copyout+0x12d/0x150 [ 2693.318550][T20588] copy_page_to_iter+0x3de/0xda0 [ 2693.318562][T20588] ? kill_fasync+0x323/0x4a0 [ 2693.318585][T20588] pipe_to_user+0xb4/0x170 [ 2693.318604][T20588] __splice_from_pipe+0x397/0x7d0 [ 2693.318618][T20588] ? iter_to_pipe+0x560/0x560 [ 2693.318642][T20588] do_vmsplice.part.0+0x249/0x2b0 [ 2693.318657][T20588] ? __splice_from_pipe+0x7d0/0x7d0 [ 2693.318669][T20588] ? import_iovec+0x12b/0x200 [ 2693.318704][T20588] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2693.318722][T20588] __do_sys_vmsplice+0x1bc/0x210 [ 2693.388133][T20588] ? do_vmsplice.part.0+0x2b0/0x2b0 [ 2693.388150][T20588] ? __kasan_check_read+0x11/0x20 [ 2693.388169][T20588] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 2693.388183][T20588] ? put_timespec64+0xda/0x140 [ 2693.388197][T20588] ? nsecs_to_jiffies+0x30/0x30 [ 2693.388219][T20588] ? trace_hardirqs_on_thunk+0x1a/0x20 [ 2693.388231][T20588] ? trace_hardirqs_on_thunk+0x1a/0x20 [ 2693.388244][T20588] ? do_syscall_64+0x26/0x760 [ 2693.388257][T20588] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2693.388269][T20588] ? do_syscall_64+0x26/0x760 [ 2693.388290][T20588] __x64_sys_vmsplice+0x97/0xf0 [ 2693.407772][T20588] do_syscall_64+0xfa/0x760 [ 2693.407790][T20588] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2693.407799][T20588] RIP: 0033:0x4598e9 [ 2693.407811][T20588] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2693.407818][T20588] RSP: 002b:00007f0b10c0dc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000116 [ 2693.407831][T20588] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000004598e9 [ 2693.407838][T20588] RDX: 0000000000000001 RSI: 0000000020000000 RDI: 0000000000000007 [ 2693.407845][T20588] RBP: 000000000075c070 R08: 0000000000000000 R09: 0000000000000000 [ 2693.407852][T20588] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f0b10c0e6d4 [ 2693.407859][T20588] R13: 00000000004c90c8 R14: 00000000004e0338 R15: 00000000ffffffff [ 2693.408093][T20588] memory: usage 306684kB, limit 307200kB, failcnt 5607 [ 2693.450617][T20588] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2693.450622][T20588] Memory cgroup stats for /syz0: [ 2693.450718][T20588] anon 276447232 [ 2693.450718][T20588] file 2269184 [ 2693.450718][T20588] kernel_stack 4849664 [ 2693.450718][T20588] slab 10850304 [ 2693.450718][T20588] sock 77824 [ 2693.450718][T20588] shmem 2174976 [ 2693.450718][T20588] file_mapped 0 [ 2693.450718][T20588] file_dirty 135168 [ 2693.450718][T20588] file_writeback 0 [ 2693.450718][T20588] anon_thp 260046848 [ 2693.450718][T20588] inactive_anon 2027520 [ 2693.450718][T20588] active_anon 276447232 [ 2693.450718][T20588] inactive_file 94208 [ 2693.450718][T20588] active_file 102400 [ 2693.450718][T20588] unevictable 0 [ 2693.450718][T20588] slab_reclaimable 2568192 [ 2693.450718][T20588] slab_unreclaimable 8282112 [ 2693.450718][T20588] pgfault 245751 [ 2693.450718][T20588] pgmajfault 0 [ 2693.450718][T20588] workingset_refault 1320 [ 2693.450718][T20588] workingset_activate 0 [ 2693.450718][T20588] workingset_nodereclaim 0 [ 2693.450718][T20588] pgrefill 406 [ 2693.450718][T20588] pgscan 39493 [ 2693.450718][T20588] pgsteal 1516 [ 2693.510318][T20588] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz0,mems_allowed=0-1,oom_memcg=/syz0,task_memcg=/syz0,task=syz-executor.0,pid=20574,uid=0 [ 2693.510427][T20588] Memory cgroup out of memory: Killed process 20574 (syz-executor.0) total-vm:72972kB, anon-rss:7616kB, file-rss:35824kB, shmem-rss:0kB, UID:0 pgtables:159744kB oom_score_adj:1000 [ 2693.514439][ T1064] oom_reaper: reaped process 20574 (syz-executor.0), now anon-rss:0kB, file-rss:34864kB, shmem-rss:0kB [ 2693.526976][ C1] net_ratelimit: 14 callbacks suppressed [ 2693.526982][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2693.527031][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2693.598435][T20615] syz-executor.2 invoked oom-killer: gfp_mask=0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order=3, oom_score_adj=0 [ 2693.668718][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2693.712763][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2693.741710][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2693.741743][ C1] protocol 88fb is buggy, dev hsr_slave_1 09:40:07 executing program 0: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x40, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) lgetxattr(&(0x7f0000000300)='./file0\x00', 0x0, &(0x7f0000000540)=""/50, 0x32) ioctl$FS_IOC_MEASURE_VERITY(r1, 0xc0046686, &(0x7f0000000100)={0x2, 0x3, "7fe917"}) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) recvmmsg(r2, &(0x7f0000008880), 0x400000000000249, 0x44000102, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast1}, 0x18) uname(0x0) socket$vsock_stream(0x28, 0x1, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) removexattr(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)=@random={'security.', '/trusted\x00'}) fcntl$setpipe(r4, 0x407, 0x0) write(r4, &(0x7f0000000340), 0x41395527) clock_gettime(0x0, &(0x7f0000000380)={0x0, 0x0}) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000480)={0x3, 0x0, 0xffff, 0x9, r0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r5+30000000}, 0x0) accept4$packet(r3, &(0x7f0000000500)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0, 0x1c0000) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r1, 0x0, 0x487, &(0x7f0000000440), &(0x7f00000004c0)=0x30) 09:40:07 executing program 5: pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfffffc8f) splice(r0, 0x0, r2, 0x0, 0x100000000000a, 0x0) 09:40:07 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000700)='F', 0x1, 0xfffffffffffffffe) keyctl$setperm(0x5, r0, 0x0) keyctl$get_security(0x11, r0, 0x0, 0x0) 09:40:07 executing program 3: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) splice(r0, 0x0, r1, 0x0, 0x100000000ffe0, 0x0) [ 2693.859124][T20615] CPU: 0 PID: 20615 Comm: syz-executor.2 Not tainted 5.3.0-rc6-next-20190830 #75 [ 2693.868351][T20615] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2693.878390][T20615] Call Trace: [ 2693.881677][T20615] dump_stack+0x172/0x1f0 [ 2693.886008][T20615] dump_header+0x177/0x1152 [ 2693.890507][T20615] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2693.896300][T20615] ? ___ratelimit+0x2c8/0x595 [ 2693.900975][T20615] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2693.906778][T20615] ? lockdep_hardirqs_on+0x418/0x5d0 [ 2693.912065][T20615] ? trace_hardirqs_on+0x67/0x240 [ 2693.917113][T20615] ? pagefault_out_of_memory+0x11c/0x11c [ 2693.922756][T20615] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 2693.928592][T20615] ? ___ratelimit+0x60/0x595 [ 2693.933189][T20615] ? do_raw_spin_unlock+0x57/0x270 [ 2693.938296][T20615] oom_kill_process.cold+0x10/0x15 [ 2693.943397][T20615] out_of_memory+0x334/0x1340 [ 2693.948074][T20615] ? lock_downgrade+0x920/0x920 [ 2693.952905][T20615] ? mem_cgroup_unmark_under_oom+0x8d/0xb0 [ 2693.958689][T20615] ? oom_killer_disable+0x280/0x280 [ 2693.963870][T20615] mem_cgroup_out_of_memory+0x1d8/0x240 [ 2693.969391][T20615] ? mem_cgroup_nr_lru_pages+0x1b0/0x1b0 [ 2693.975020][T20615] ? do_raw_spin_unlock+0x57/0x270 [ 2693.980103][T20615] ? _raw_spin_unlock+0x2d/0x50 [ 2693.984943][T20615] try_charge+0xf4b/0x1440 [ 2693.989338][T20615] ? mem_cgroup_oom_trylock+0x1a0/0x1a0 [ 2693.994856][T20615] ? find_held_lock+0x35/0x130 [ 2693.999598][T20615] ? get_mem_cgroup_from_mm+0x139/0x320 [ 2694.005128][T20615] ? lock_downgrade+0x920/0x920 [ 2694.009950][T20615] ? percpu_ref_tryget_live+0x111/0x290 [ 2694.015474][T20615] __memcg_kmem_charge_memcg+0x71/0xf0 [ 2694.020908][T20615] ? memcg_kmem_put_cache+0x50/0x50 [ 2694.026084][T20615] ? get_mem_cgroup_from_mm+0x156/0x320 [ 2694.031611][T20615] __memcg_kmem_charge+0x13a/0x3a0 [ 2694.036704][T20615] __alloc_pages_nodemask+0x4f7/0x900 [ 2694.042048][T20615] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 2694.047568][T20615] ? __alloc_pages_slowpath+0x2540/0x2540 [ 2694.053258][T20615] ? percpu_ref_put_many+0xb6/0x190 [ 2694.058430][T20615] ? lockdep_hardirqs_on+0x418/0x5d0 [ 2694.063692][T20615] ? trace_hardirqs_on+0x67/0x240 [ 2694.068732][T20615] copy_process+0x3f8/0x6830 [ 2694.073332][T20615] ? __kasan_check_read+0x11/0x20 [ 2694.078328][T20615] ? __lock_acquire+0x16f2/0x4a00 [ 2694.083332][T20615] ? __cleanup_sighand+0x60/0x60 [ 2694.088242][T20615] ? __might_fault+0x12b/0x1e0 [ 2694.092980][T20615] ? __might_fault+0x12b/0x1e0 [ 2694.097818][T20615] _do_fork+0x146/0xfa0 [ 2694.101951][T20615] ? copy_init_mm+0x20/0x20 [ 2694.106430][T20615] ? __kasan_check_read+0x11/0x20 [ 2694.111428][T20615] ? _copy_to_user+0x118/0x160 [ 2694.116194][T20615] __x64_sys_clone+0x1ab/0x270 [ 2694.120953][T20615] ? __ia32_sys_vfork+0xd0/0xd0 [ 2694.125784][T20615] ? do_syscall_64+0x26/0x760 [ 2694.130431][T20615] ? lockdep_hardirqs_on+0x418/0x5d0 [ 2694.135690][T20615] ? trace_hardirqs_on+0x67/0x240 [ 2694.140688][T20615] do_syscall_64+0xfa/0x760 [ 2694.145167][T20615] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2694.151031][T20615] RIP: 0033:0x4598e9 [ 2694.154907][T20615] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2694.174652][T20615] RSP: 002b:00007fba9b18bc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 2694.183040][T20615] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000004598e9 [ 2694.191017][T20615] RDX: 9999999999999999 RSI: 0000000000000000 RDI: 2000000002800100 [ 2694.198964][T20615] RBP: 000000000075bf20 R08: ffffffffffffffff R09: 0000000000000000 09:40:08 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000700)='F', 0x1, 0xfffffffffffffffe) keyctl$setperm(0x5, r0, 0x0) keyctl$get_security(0x11, r0, 0x0, 0x0) 09:40:08 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0b") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) [ 2694.206914][T20615] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fba9b18c6d4 [ 2694.214857][T20615] R13: 00000000004bfd7f R14: 00000000004d1b78 R15: 00000000ffffffff [ 2694.234888][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2694.240681][ C0] protocol 88fb is buggy, dev hsr_slave_1 09:40:08 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000700)='F', 0x1, 0xfffffffffffffffe) keyctl$setperm(0x5, r1, 0x0) keyctl$get_security(0x11, r1, 0x0, 0x0) [ 2694.289632][T20615] memory: usage 307196kB, limit 307200kB, failcnt 8055 [ 2694.299167][T20615] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2694.317840][T20615] Memory cgroup stats for /syz2: [ 2694.317931][T20615] anon 266248192 [ 2694.317931][T20615] file 61440 [ 2694.317931][T20615] kernel_stack 6422528 [ 2694.317931][T20615] slab 11878400 [ 2694.317931][T20615] sock 0 [ 2694.317931][T20615] shmem 94208 [ 2694.317931][T20615] file_mapped 0 [ 2694.317931][T20615] file_dirty 0 [ 2694.317931][T20615] file_writeback 0 [ 2694.317931][T20615] anon_thp 243269632 [ 2694.317931][T20615] inactive_anon 135168 [ 2694.317931][T20615] active_anon 266313728 [ 2694.317931][T20615] inactive_file 0 [ 2694.317931][T20615] active_file 57344 [ 2694.317931][T20615] unevictable 0 [ 2694.317931][T20615] slab_reclaimable 2568192 [ 2694.317931][T20615] slab_unreclaimable 9310208 [ 2694.317931][T20615] pgfault 286440 [ 2694.317931][T20615] pgmajfault 0 [ 2694.317931][T20615] workingset_refault 1254 [ 2694.317931][T20615] workingset_activate 165 [ 2694.317931][T20615] workingset_nodereclaim 0 [ 2694.317931][T20615] pgrefill 4742 [ 2694.317931][T20615] pgscan 65081 [ 2694.317931][T20615] pgsteal 18479 [ 2694.328963][T20615] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz2,mems_allowed=0-1,oom_memcg=/syz2,task_memcg=/syz2,task=syz-executor.2,pid=28720,uid=0 [ 2694.460531][T20615] Memory cgroup out of memory: Killed process 28720 (syz-executor.2) total-vm:72708kB, anon-rss:2216kB, file-rss:35804kB, shmem-rss:0kB, UID:0 pgtables:143360kB oom_score_adj:0 [ 2694.484907][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2694.490673][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2694.504188][T20614] syz-executor.2 invoked oom-killer: gfp_mask=0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order=3, oom_score_adj=0 [ 2694.518100][T20614] CPU: 0 PID: 20614 Comm: syz-executor.2 Not tainted 5.3.0-rc6-next-20190830 #75 [ 2694.527194][T20614] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2694.527199][T20614] Call Trace: [ 2694.527217][T20614] dump_stack+0x172/0x1f0 [ 2694.527235][T20614] dump_header+0x177/0x1152 [ 2694.527249][T20614] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2694.527259][T20614] ? ___ratelimit+0x2c8/0x595 [ 2694.527271][T20614] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2694.527284][T20614] ? lockdep_hardirqs_on+0x418/0x5d0 [ 2694.527296][T20614] ? trace_hardirqs_on+0x67/0x240 [ 2694.527311][T20614] ? pagefault_out_of_memory+0x11c/0x11c [ 2694.581477][T20614] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 2694.587323][T20614] ? ___ratelimit+0x60/0x595 [ 2694.591919][T20614] ? do_raw_spin_unlock+0x57/0x270 [ 2694.597008][T20614] oom_kill_process.cold+0x10/0x15 [ 2694.602119][T20614] out_of_memory+0x334/0x1340 [ 2694.606781][T20614] ? lock_downgrade+0x920/0x920 [ 2694.611617][T20614] ? oom_killer_disable+0x280/0x280 [ 2694.616815][T20614] mem_cgroup_out_of_memory+0x1d8/0x240 [ 2694.622377][T20614] ? mem_cgroup_nr_lru_pages+0x1b0/0x1b0 [ 2694.628002][T20614] ? do_raw_spin_unlock+0x57/0x270 [ 2694.633104][T20614] ? _raw_spin_unlock+0x2d/0x50 [ 2694.637957][T20614] try_charge+0xa2d/0x1440 [ 2694.642379][T20614] ? mem_cgroup_oom_trylock+0x1a0/0x1a0 [ 2694.647905][T20614] ? find_held_lock+0x35/0x130 [ 2694.647919][T20614] ? get_mem_cgroup_from_mm+0x139/0x320 [ 2694.647940][T20614] ? lock_downgrade+0x920/0x920 [ 2694.663067][T20614] ? percpu_ref_tryget_live+0x111/0x290 [ 2694.668615][T20614] __memcg_kmem_charge_memcg+0x71/0xf0 [ 2694.674092][T20614] ? memcg_kmem_put_cache+0x50/0x50 [ 2694.679287][T20614] ? get_mem_cgroup_from_mm+0x156/0x320 [ 2694.679304][T20614] __memcg_kmem_charge+0x13a/0x3a0 [ 2694.679320][T20614] __alloc_pages_nodemask+0x4f7/0x900 [ 2694.679334][T20614] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 2694.679347][T20614] ? __alloc_pages_slowpath+0x2540/0x2540 [ 2694.679361][T20614] ? percpu_ref_put_many+0xb6/0x190 [ 2694.711695][T20614] ? lockdep_hardirqs_on+0x418/0x5d0 [ 2694.716969][T20614] ? trace_hardirqs_on+0x67/0x240 [ 2694.721987][T20614] ? __kasan_check_read+0x11/0x20 [ 2694.727007][T20614] copy_process+0x3f8/0x6830 [ 2694.731585][T20614] ? psi_memstall_leave+0x12e/0x180 [ 2694.736776][T20614] ? __cleanup_sighand+0x60/0x60 [ 2694.736792][T20614] ? __kasan_check_read+0x11/0x20 [ 2694.746688][T20614] ? __lock_acquire+0x8a0/0x4a00 [ 2694.751628][T20614] ? _raw_spin_unlock_irq+0x5e/0x90 [ 2694.756825][T20614] _do_fork+0x146/0xfa0 [ 2694.760975][T20614] ? copy_init_mm+0x20/0x20 [ 2694.765475][T20614] ? lock_downgrade+0x920/0x920 [ 2694.770347][T20614] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2694.776591][T20614] __x64_sys_clone+0x1ab/0x270 [ 2694.781354][T20614] ? __ia32_sys_vfork+0xd0/0xd0 [ 2694.786194][T20614] ? __blkcg_punt_bio_submit+0x1e0/0x1e0 [ 2694.791819][T20614] ? mem_cgroup_handle_over_high+0x21b/0x2a0 [ 2694.797795][T20614] ? do_syscall_64+0x26/0x760 [ 2694.802464][T20614] ? lockdep_hardirqs_on+0x418/0x5d0 [ 2694.807728][T20614] ? trace_hardirqs_on+0x67/0x240 [ 2694.812741][T20614] do_syscall_64+0xfa/0x760 [ 2694.817223][T20614] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2694.823088][T20614] RIP: 0033:0x45c2b9 [ 2694.826959][T20614] Code: ff 48 85 f6 0f 84 27 8e fb ff 48 83 ee 10 48 89 4e 08 48 89 3e 48 89 d7 4c 89 c2 4d 89 c8 4c 8b 54 24 08 b8 38 00 00 00 0f 05 <48> 85 c0 0f 8c fe 8d fb ff 74 01 c3 31 ed 48 f7 c7 00 00 01 00 75 [ 2694.846533][T20614] RSP: 002b:00007fffe45fb5b8 EFLAGS: 00000202 ORIG_RAX: 0000000000000038 [ 2694.854927][T20614] RAX: ffffffffffffffda RBX: 00007fba9b16b700 RCX: 000000000045c2b9 [ 2694.862870][T20614] RDX: 00007fba9b16b9d0 RSI: 00007fba9b16adb0 RDI: 00000000003d0f00 [ 2694.870814][T20614] RBP: 00007fffe45fb7d0 R08: 00007fba9b16b700 R09: 00007fba9b16b700 [ 2694.878765][T20614] R10: 00007fba9b16b9d0 R11: 0000000000000202 R12: 0000000000000000 [ 2694.886717][T20614] R13: 00007fffe45fb66f R14: 00007fba9b16b9c0 R15: 000000000075bfd4 [ 2694.948700][T20614] memory: usage 304856kB, limit 307200kB, failcnt 8055 [ 2694.957716][T20614] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2694.964677][T20614] Memory cgroup stats for /syz2: [ 2694.970293][T20614] anon 264159232 [ 2694.970293][T20614] file 61440 [ 2694.970293][T20614] kernel_stack 6422528 [ 2694.970293][T20614] slab 11878400 [ 2694.970293][T20614] sock 0 [ 2694.970293][T20614] shmem 94208 [ 2694.970293][T20614] file_mapped 0 [ 2694.970293][T20614] file_dirty 0 [ 2694.970293][T20614] file_writeback 0 [ 2694.970293][T20614] anon_thp 241172480 [ 2694.970293][T20614] inactive_anon 135168 [ 2694.970293][T20614] active_anon 264224768 [ 2694.970293][T20614] inactive_file 0 [ 2694.970293][T20614] active_file 57344 [ 2694.970293][T20614] unevictable 0 [ 2694.970293][T20614] slab_reclaimable 2568192 [ 2694.970293][T20614] slab_unreclaimable 9310208 [ 2694.970293][T20614] pgfault 286440 [ 2694.970293][T20614] pgmajfault 0 [ 2694.970293][T20614] workingset_refault 1254 09:40:09 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, r0, 0x0, 0x0) 09:40:09 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000700)='F', 0x1, 0xfffffffffffffffe) keyctl$setperm(0x5, r1, 0x0) keyctl$get_security(0x11, r1, 0x0, 0x0) 09:40:09 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0b") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) 09:40:09 executing program 3: openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap$perf(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x10, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0xfffffd1e, 0x0, 0x229}}], 0x0, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip6_tables_targets\x00') pselect6(0x0, 0x0, &(0x7f0000000040)={0x3, 0x0, 0x0, 0x101, 0x0, 0x200}, &(0x7f0000000080)={0x0, 0x0, 0x2, 0x0, 0x0, 0x8, 0xe108}, 0x0, &(0x7f0000000180)={0x0}) setreuid(0x0, 0x0) stat(&(0x7f0000000280)='./file0\x00', &(0x7f0000000300)) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) set_thread_area(0x0) preadv(r0, &(0x7f00000017c0), 0x33d, 0x0) 09:40:09 executing program 5: 09:40:09 executing program 0: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x40, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) lgetxattr(&(0x7f0000000300)='./file0\x00', 0x0, &(0x7f0000000540)=""/50, 0x32) ioctl$FS_IOC_MEASURE_VERITY(r1, 0xc0046686, &(0x7f0000000100)={0x2, 0x3, "7fe917"}) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) recvmmsg(r2, &(0x7f0000008880), 0x400000000000249, 0x44000102, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast1}, 0x18) uname(0x0) socket$vsock_stream(0x28, 0x1, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) removexattr(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)=@random={'security.', '/trusted\x00'}) fcntl$setpipe(r4, 0x407, 0x0) write(r4, &(0x7f0000000340), 0x41395527) clock_gettime(0x0, &(0x7f0000000380)={0x0, 0x0}) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000480)={0x3, 0x0, 0xffff, 0x9, r0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r5+30000000}, 0x0) accept4$packet(r3, &(0x7f0000000500)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0, 0x1c0000) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 2694.970293][T20614] workingset_activate 165 [ 2694.970293][T20614] workingset_nodereclaim 0 [ 2694.970293][T20614] pgrefill 4742 [ 2694.970293][T20614] pgscan 65081 [ 2694.970293][T20614] pgsteal 18479 [ 2695.066114][T20614] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz2,mems_allowed=0-1,oom_memcg=/syz2,task_memcg=/syz2,task=syz-executor.2,pid=28087,uid=0 [ 2695.081703][T20614] Memory cgroup out of memory: Killed process 28087 (syz-executor.2) total-vm:72708kB, anon-rss:2216kB, file-rss:35804kB, shmem-rss:0kB, UID:0 pgtables:143360kB oom_score_adj:0 09:40:09 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(&(0x7f0000000040)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa30xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000700)='F', 0x1, 0xfffffffffffffffe) keyctl$setperm(0x5, r1, 0x0) keyctl$get_security(0x11, r1, 0x0, 0x0) 09:40:09 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47b") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) 09:40:09 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = add_key$user(0x0, &(0x7f0000000040)={'syz'}, &(0x7f0000000700)='F', 0x1, 0xfffffffffffffffe) keyctl$setperm(0x5, r1, 0x0) keyctl$get_security(0x11, r1, 0x0, 0x0) [ 2695.310017][T20677] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. 09:40:09 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = add_key$user(0x0, &(0x7f0000000040)={'syz'}, &(0x7f0000000700)='F', 0x1, 0xfffffffffffffffe) keyctl$setperm(0x5, r1, 0x0) keyctl$get_security(0x11, r1, 0x0, 0x0) [ 2695.452389][T20678] syz-executor.0 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 2695.462661][T20678] CPU: 1 PID: 20678 Comm: syz-executor.0 Not tainted 5.3.0-rc6-next-20190830 #75 [ 2695.471773][T20678] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2695.481818][T20678] Call Trace: [ 2695.485105][T20678] dump_stack+0x172/0x1f0 [ 2695.489441][T20678] dump_header+0x177/0x1152 [ 2695.493939][T20678] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2695.499746][T20678] ? ___ratelimit+0x2c8/0x595 [ 2695.504425][T20678] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2695.510234][T20678] ? lockdep_hardirqs_on+0x418/0x5d0 [ 2695.515509][T20678] ? trace_hardirqs_on+0x67/0x240 [ 2695.520531][T20678] ? pagefault_out_of_memory+0x11c/0x11c [ 2695.526153][T20678] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 2695.531955][T20678] ? ___ratelimit+0x60/0x595 [ 2695.536541][T20678] ? do_raw_spin_unlock+0x57/0x270 [ 2695.541650][T20678] oom_kill_process.cold+0x10/0x15 [ 2695.546779][T20678] out_of_memory+0x334/0x1340 09:40:09 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47b") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) [ 2695.551459][T20678] ? lock_downgrade+0x920/0x920 [ 2695.556318][T20678] ? mem_cgroup_unmark_under_oom+0x8d/0xb0 [ 2695.562116][T20678] ? oom_killer_disable+0x280/0x280 [ 2695.567320][T20678] mem_cgroup_out_of_memory+0x1d8/0x240 [ 2695.572863][T20678] ? mem_cgroup_nr_lru_pages+0x1b0/0x1b0 [ 2695.578489][T20678] ? do_raw_spin_unlock+0x57/0x270 [ 2695.583594][T20678] ? _raw_spin_unlock+0x2d/0x50 [ 2695.588447][T20678] try_charge+0xf4b/0x1440 [ 2695.592868][T20678] ? mem_cgroup_oom_trylock+0x1a0/0x1a0 [ 2695.598405][T20678] ? percpu_ref_tryget_live+0x111/0x290 [ 2695.603945][T20678] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2695.610184][T20678] ? __kasan_check_read+0x11/0x20 [ 2695.615234][T20678] ? get_mem_cgroup_from_mm+0x156/0x320 [ 2695.620791][T20678] mem_cgroup_try_charge+0x136/0x590 [ 2695.626067][T20678] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 2695.632302][T20678] mem_cgroup_try_charge_delay+0x1f/0xa0 [ 2695.637940][T20678] wp_page_copy+0x41e/0x1590 [ 2695.642527][T20678] ? find_held_lock+0x35/0x130 [ 2695.642546][T20678] ? pmd_pfn+0x1d0/0x1d0 [ 2695.642561][T20678] ? lock_downgrade+0x920/0x920 [ 2695.656350][T20678] ? vm_normal_page+0x15d/0x3c0 [ 2695.661197][T20678] ? __pte_alloc_kernel+0x210/0x210 [ 2695.666384][T20678] ? __kasan_check_read+0x11/0x20 [ 2695.666396][T20678] ? do_raw_spin_unlock+0x57/0x270 [ 2695.666412][T20678] do_wp_page+0x499/0x14d0 [ 2695.666440][T20678] ? do_raw_spin_lock+0x12a/0x2e0 [ 2695.666453][T20678] ? rwlock_bug.part.0+0x90/0x90 [ 2695.666467][T20678] ? finish_mkwrite_fault+0x570/0x570 [ 2695.666480][T20678] ? add_mm_counter_fast.part.0+0x40/0x40 [ 2695.666502][T20678] __handle_mm_fault+0x22f1/0x3f20 [ 2695.666522][T20678] ? vmf_insert_mixed_mkwrite+0x40/0x40 [ 2695.712575][T20678] ? __kasan_check_read+0x11/0x20 [ 2695.717602][T20678] handle_mm_fault+0x1b5/0x6c0 [ 2695.722370][T20678] __do_page_fault+0x536/0xdd0 [ 2695.727173][T20678] do_page_fault+0x38/0x590 [ 2695.731674][T20678] page_fault+0x39/0x40 [ 2695.735826][T20678] RIP: 0010:copy_user_enhanced_fast_string+0xe/0x20 [ 2695.742410][T20678] Code: 89 d1 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 31 c0 0f 1f 00 c3 0f 1f 80 00 00 00 00 0f 1f 00 83 fa 40 0f 82 70 ff ff ff 89 d1 a4 31 c0 0f 1f 00 c3 66 2e 0f 1f 84 00 00 00 00 00 89 d1 f3 a4 [ 2695.762001][T20678] RSP: 0018:ffff88805350fab8 EFLAGS: 00010206 [ 2695.768054][T20678] RAX: 0000000000000001 RBX: 0000000000001000 RCX: 0000000000000500 [ 2695.776014][T20678] RDX: 0000000000001000 RSI: ffff88808ee0db00 RDI: 00000000205de000 [ 2695.783977][T20678] RBP: ffff88805350faf0 R08: ffffed1011dc1c00 R09: 0000000000000000 [ 2695.791946][T20678] R10: ffffed1011dc1bff R11: ffff88808ee0dfff R12: 00000000205dd500 [ 2695.799907][T20678] R13: ffff88808ee0d000 R14: 00000000205de500 R15: 00007ffffffff000 [ 2695.807892][T20678] ? copyout+0x12d/0x150 [ 2695.812137][T20678] copy_page_to_iter+0x3de/0xda0 [ 2695.817065][T20678] ? kill_fasync+0x323/0x4a0 [ 2695.821672][T20678] pipe_to_user+0xb4/0x170 [ 2695.826089][T20678] __splice_from_pipe+0x397/0x7d0 [ 2695.831106][T20678] ? iter_to_pipe+0x560/0x560 [ 2695.835784][T20678] do_vmsplice.part.0+0x249/0x2b0 [ 2695.840801][T20678] ? __splice_from_pipe+0x7d0/0x7d0 [ 2695.845986][T20678] ? import_iovec+0x12b/0x200 [ 2695.850683][T20678] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2695.856923][T20678] __do_sys_vmsplice+0x1bc/0x210 [ 2695.861870][T20678] ? do_vmsplice.part.0+0x2b0/0x2b0 [ 2695.867062][T20678] ? __kasan_check_read+0x11/0x20 [ 2695.872084][T20678] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 2695.878317][T20678] ? put_timespec64+0xda/0x140 [ 2695.883085][T20678] ? nsecs_to_jiffies+0x30/0x30 [ 2695.887956][T20678] ? trace_hardirqs_on_thunk+0x1a/0x20 [ 2695.893414][T20678] ? trace_hardirqs_on_thunk+0x1a/0x20 [ 2695.898867][T20678] ? do_syscall_64+0x26/0x760 [ 2695.903535][T20678] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2695.909682][T20678] ? do_syscall_64+0x26/0x760 [ 2695.914383][T20678] __x64_sys_vmsplice+0x97/0xf0 [ 2695.919227][T20678] do_syscall_64+0xfa/0x760 [ 2695.923726][T20678] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2695.929605][T20678] RIP: 0033:0x4598e9 [ 2695.933488][T20678] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2695.953064][T20678] RSP: 002b:00007f0b10becc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000116 [ 2695.961458][T20678] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000004598e9 [ 2695.969404][T20678] RDX: 0000000000000001 RSI: 0000000020000000 RDI: 0000000000000007 [ 2695.977384][T20678] RBP: 000000000075c118 R08: 0000000000000000 R09: 0000000000000000 [ 2695.985329][T20678] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f0b10bed6d4 [ 2695.993273][T20678] R13: 00000000004c90c8 R14: 00000000004e0338 R15: 00000000ffffffff [ 2696.001772][T20678] memory: usage 307200kB, limit 307200kB, failcnt 5655 [ 2696.008647][T20678] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2696.015508][T20678] Memory cgroup stats for /syz0: [ 2696.015603][T20678] anon 276987904 [ 2696.015603][T20678] file 2269184 [ 2696.015603][T20678] kernel_stack 4849664 [ 2696.015603][T20678] slab 10850304 [ 2696.015603][T20678] sock 77824 [ 2696.015603][T20678] shmem 2174976 [ 2696.015603][T20678] file_mapped 0 [ 2696.015603][T20678] file_dirty 135168 [ 2696.015603][T20678] file_writeback 0 [ 2696.015603][T20678] anon_thp 260046848 [ 2696.015603][T20678] inactive_anon 2027520 [ 2696.015603][T20678] active_anon 276987904 [ 2696.015603][T20678] inactive_file 94208 [ 2696.015603][T20678] active_file 102400 [ 2696.015603][T20678] unevictable 0 [ 2696.015603][T20678] slab_reclaimable 2568192 [ 2696.015603][T20678] slab_unreclaimable 8282112 [ 2696.015603][T20678] pgfault 246411 [ 2696.015603][T20678] pgmajfault 0 [ 2696.015603][T20678] workingset_refault 1320 [ 2696.015603][T20678] workingset_activate 0 [ 2696.015603][T20678] workingset_nodereclaim 0 [ 2696.015603][T20678] pgrefill 406 [ 2696.015603][T20678] pgscan 39493 [ 2696.015603][T20678] pgsteal 1516 [ 2696.111400][T20678] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz0,mems_allowed=0-1,oom_memcg=/syz0,task_memcg=/syz0,task=syz-executor.0,pid=20660,uid=0 [ 2696.127523][T20678] Memory cgroup out of memory: Killed process 20660 (syz-executor.0) total-vm:72972kB, anon-rss:8092kB, file-rss:34816kB, shmem-rss:0kB, UID:0 pgtables:159744kB oom_score_adj:1000 [ 2696.150147][ T1064] oom_reaper: reaped process 20660 (syz-executor.0), now anon-rss:0kB, file-rss:33856kB, shmem-rss:0kB 09:40:12 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="a4ab12f728db4b2b4d2f2f3ff7ad273b1e89e46f905080af4c90ccb170e60b3a8bf56db763e3062d037dca291318d0a17270bbce74b46f4db2a92ba0c9fb228bc105af", 0x43}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, r0, 0x0, 0x0) 09:40:12 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = add_key$user(0x0, &(0x7f0000000040)={'syz'}, &(0x7f0000000700)='F', 0x1, 0xfffffffffffffffe) keyctl$setperm(0x5, r1, 0x0) keyctl$get_security(0x11, r1, 0x0, 0x0) 09:40:12 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47b") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) 09:40:12 executing program 0: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x40, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) lgetxattr(&(0x7f0000000300)='./file0\x00', 0x0, &(0x7f0000000540)=""/50, 0x32) ioctl$FS_IOC_MEASURE_VERITY(r1, 0xc0046686, &(0x7f0000000100)={0x2, 0x3, "7fe917"}) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) recvmmsg(r2, &(0x7f0000008880), 0x400000000000249, 0x44000102, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast1}, 0x18) uname(0x0) socket$vsock_stream(0x28, 0x1, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) removexattr(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)=@random={'security.', '/trusted\x00'}) fcntl$setpipe(r4, 0x407, 0x0) write(r4, &(0x7f0000000340), 0x41395527) clock_gettime(0x0, &(0x7f0000000380)={0x0, 0x0}) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000480)={0x3, 0x0, 0xffff, 0x9, r0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r5+30000000}, 0x0) accept4$packet(r3, &(0x7f0000000500)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0, 0x1c0000) 09:40:12 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = epoll_create1(0x0) fcntl$lock(r1, 0x7, &(0x7f0000000000)={0x0, 0x0, 0x10000000}) fcntl$lock(0xffffffffffffffff, 0x100000000000007, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x666}) fcntl$lock(r1, 0x7, &(0x7f0000000140)) 09:40:12 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(&(0x7f0000000040)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa30xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = add_key$user(&(0x7f0000000000)='user\x00', 0x0, &(0x7f0000000700)='F', 0x1, 0xfffffffffffffffe) keyctl$setperm(0x5, r1, 0x0) keyctl$get_security(0x11, r1, 0x0, 0x0) 09:40:12 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="a4ab12f728db4b2b4d2f2f3ff7ad273b1e89e46f905080af4c90ccb170e60b3a8bf56db763e3062d037dca291318d0a17270bbce74b46f4db2a92ba0c9fb228bc105af", 0x43}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, r0, 0x0, 0x0) 09:40:12 executing program 3: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(&(0x7f0000000040)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa30xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = add_key$user(&(0x7f0000000000)='user\x00', 0x0, &(0x7f0000000700)='F', 0x1, 0xfffffffffffffffe) keyctl$setperm(0x5, r1, 0x0) keyctl$get_security(0x11, r1, 0x0, 0x0) [ 2698.534595][T20732] syz-executor.2 invoked oom-killer: gfp_mask=0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order=3, oom_score_adj=0 [ 2698.612149][T20732] CPU: 0 PID: 20732 Comm: syz-executor.2 Not tainted 5.3.0-rc6-next-20190830 #75 [ 2698.621368][T20732] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2698.631409][T20732] Call Trace: [ 2698.634692][T20732] dump_stack+0x172/0x1f0 [ 2698.639043][T20732] dump_header+0x177/0x1152 [ 2698.643553][T20732] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2698.649348][T20732] ? ___ratelimit+0x2c8/0x595 [ 2698.654058][T20732] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2698.659859][T20732] ? lockdep_hardirqs_on+0x418/0x5d0 [ 2698.665138][T20732] ? trace_hardirqs_on+0x67/0x240 [ 2698.670165][T20732] ? pagefault_out_of_memory+0x11c/0x11c [ 2698.675799][T20732] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 2698.681610][T20732] ? ___ratelimit+0x60/0x595 [ 2698.686196][T20732] ? do_raw_spin_unlock+0x57/0x270 [ 2698.691317][T20732] oom_kill_process.cold+0x10/0x15 [ 2698.696431][T20732] out_of_memory+0x334/0x1340 [ 2698.701099][T20732] ? lock_downgrade+0x920/0x920 [ 2698.705947][T20732] ? mem_cgroup_unmark_under_oom+0x8d/0xb0 [ 2698.711742][T20732] ? oom_killer_disable+0x280/0x280 [ 2698.716943][T20732] mem_cgroup_out_of_memory+0x1d8/0x240 [ 2698.722659][T20732] ? mem_cgroup_nr_lru_pages+0x1b0/0x1b0 [ 2698.728287][T20732] ? do_raw_spin_unlock+0x57/0x270 [ 2698.733392][T20732] ? _raw_spin_unlock+0x2d/0x50 [ 2698.738241][T20732] try_charge+0xf4b/0x1440 [ 2698.742655][T20732] ? mem_cgroup_oom_trylock+0x1a0/0x1a0 [ 2698.748215][T20732] ? find_held_lock+0x35/0x130 [ 2698.752990][T20732] ? get_mem_cgroup_from_mm+0x139/0x320 [ 2698.758538][T20732] ? lock_downgrade+0x920/0x920 [ 2698.763393][T20732] ? percpu_ref_tryget_live+0x111/0x290 [ 2698.768936][T20732] __memcg_kmem_charge_memcg+0x71/0xf0 [ 2698.774386][T20732] ? memcg_kmem_put_cache+0x50/0x50 [ 2698.779590][T20732] ? get_mem_cgroup_from_mm+0x156/0x320 [ 2698.785132][T20732] __memcg_kmem_charge+0x13a/0x3a0 [ 2698.790243][T20732] __alloc_pages_nodemask+0x4f7/0x900 [ 2698.795637][T20732] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 2698.801185][T20732] ? __alloc_pages_slowpath+0x2540/0x2540 [ 2698.806899][T20732] ? percpu_ref_put_many+0xb6/0x190 09:40:12 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = add_key$user(&(0x7f0000000000)='user\x00', 0x0, &(0x7f0000000700)='F', 0x1, 0xfffffffffffffffe) keyctl$setperm(0x5, r1, 0x0) keyctl$get_security(0x11, r1, 0x0, 0x0) [ 2698.812115][T20732] ? lockdep_hardirqs_on+0x418/0x5d0 [ 2698.817390][T20732] ? trace_hardirqs_on+0x67/0x240 [ 2698.822405][T20732] copy_process+0x3f8/0x6830 [ 2698.826991][T20732] ? __kasan_check_read+0x11/0x20 [ 2698.832006][T20732] ? __lock_acquire+0x16f2/0x4a00 [ 2698.832027][T20732] ? __cleanup_sighand+0x60/0x60 [ 2698.832040][T20732] ? __might_fault+0x12b/0x1e0 [ 2698.832055][T20732] ? __might_fault+0x12b/0x1e0 [ 2698.841970][T20732] _do_fork+0x146/0xfa0 [ 2698.841987][T20732] ? copy_init_mm+0x20/0x20 09:40:12 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$setperm(0x5, r1, 0x0) keyctl$get_security(0x11, r1, 0x0, 0x0) [ 2698.842007][T20732] ? __kasan_check_read+0x11/0x20 [ 2698.842021][T20732] ? _copy_to_user+0x118/0x160 [ 2698.869901][T20732] __x64_sys_clone+0x1ab/0x270 [ 2698.874660][T20732] ? __ia32_sys_vfork+0xd0/0xd0 [ 2698.879511][T20732] ? do_syscall_64+0x26/0x760 [ 2698.884189][T20732] ? lockdep_hardirqs_on+0x418/0x5d0 [ 2698.889482][T20732] ? trace_hardirqs_on+0x67/0x240 [ 2698.894502][T20732] do_syscall_64+0xfa/0x760 [ 2698.899016][T20732] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2698.904898][T20732] RIP: 0033:0x4598e9 09:40:13 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$setperm(0x5, r1, 0x0) keyctl$get_security(0x11, r1, 0x0, 0x0) [ 2698.908797][T20732] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2698.928388][T20732] RSP: 002b:00007fba9b18bc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 2698.936811][T20732] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000004598e9 [ 2698.944773][T20732] RDX: 9999999999999999 RSI: 0000000000000000 RDI: 2000000002800100 [ 2698.952755][T20732] RBP: 000000000075bf20 R08: ffffffffffffffff R09: 0000000000000000 [ 2698.960724][T20732] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fba9b18c6d4 [ 2698.968707][T20732] R13: 00000000004bfd7f R14: 00000000004d1b78 R15: 00000000ffffffff [ 2698.986198][ C1] net_ratelimit: 18 callbacks suppressed [ 2698.986204][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2698.997376][T20732] memory: usage 307200kB, limit 307200kB, failcnt 8083 [ 2698.997625][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2699.004501][T20732] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2699.017049][T20732] Memory cgroup stats for /syz2: [ 2699.017143][T20732] anon 266199040 [ 2699.017143][T20732] file 61440 [ 2699.017143][T20732] kernel_stack 6422528 [ 2699.017143][T20732] slab 11878400 [ 2699.017143][T20732] sock 0 [ 2699.017143][T20732] shmem 94208 [ 2699.017143][T20732] file_mapped 0 [ 2699.017143][T20732] file_dirty 0 [ 2699.017143][T20732] file_writeback 0 [ 2699.017143][T20732] anon_thp 243269632 [ 2699.017143][T20732] inactive_anon 135168 [ 2699.017143][T20732] active_anon 266264576 [ 2699.017143][T20732] inactive_file 0 [ 2699.017143][T20732] active_file 57344 [ 2699.017143][T20732] unevictable 0 [ 2699.017143][T20732] slab_reclaimable 2568192 [ 2699.017143][T20732] slab_unreclaimable 9310208 [ 2699.017143][T20732] pgfault 286671 [ 2699.017143][T20732] pgmajfault 0 [ 2699.017143][T20732] workingset_refault 1254 [ 2699.017143][T20732] workingset_activate 165 [ 2699.017143][T20732] workingset_nodereclaim 0 [ 2699.017143][T20732] pgrefill 4940 [ 2699.017143][T20732] pgscan 65280 [ 2699.017143][T20732] pgsteal 18479 [ 2699.119713][T20732] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz2,mems_allowed=0-1,oom_memcg=/syz2,task_memcg=/syz2,task=syz-executor.2,pid=30586,uid=0 09:40:13 executing program 0: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x40, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) lgetxattr(&(0x7f0000000300)='./file0\x00', 0x0, &(0x7f0000000540)=""/50, 0x32) ioctl$FS_IOC_MEASURE_VERITY(r1, 0xc0046686, &(0x7f0000000100)={0x2, 0x3, "7fe917"}) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) recvmmsg(r2, &(0x7f0000008880), 0x400000000000249, 0x44000102, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast1}, 0x18) uname(0x0) socket$vsock_stream(0x28, 0x1, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) removexattr(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)=@random={'security.', '/trusted\x00'}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) clock_gettime(0x0, &(0x7f0000000380)={0x0, 0x0}) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000480)={0x3, 0x0, 0xffff, 0x9, r0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) 09:40:13 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$setperm(0x5, r1, 0x0) keyctl$get_security(0x11, r1, 0x0, 0x0) 09:40:13 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(&(0x7f0000000040)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa3\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa30xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000700), 0x0, 0xfffffffffffffffe) keyctl$setperm(0x5, r1, 0x0) keyctl$get_security(0x11, r1, 0x0, 0x0) [ 2699.290045][T20730] syz-executor.2 invoked oom-killer: gfp_mask=0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order=3, oom_score_adj=0 09:40:13 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000700), 0x0, 0xfffffffffffffffe) keyctl$setperm(0x5, r1, 0x0) keyctl$get_security(0x11, r1, 0x0, 0x0) [ 2699.344285][T20730] CPU: 0 PID: 20730 Comm: syz-executor.2 Not tainted 5.3.0-rc6-next-20190830 #75 [ 2699.353397][T20730] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2699.363446][T20730] Call Trace: [ 2699.366730][T20730] dump_stack+0x172/0x1f0 [ 2699.371055][T20730] dump_header+0x177/0x1152 [ 2699.375552][T20730] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2699.381364][T20730] ? ___ratelimit+0x2c8/0x595 [ 2699.386030][T20730] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2699.391823][T20730] ? lockdep_hardirqs_on+0x418/0x5d0 [ 2699.391840][T20730] ? trace_hardirqs_on+0x67/0x240 [ 2699.402095][T20730] ? pagefault_out_of_memory+0x11c/0x11c [ 2699.402121][T20730] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 2699.402149][T20730] ? ___ratelimit+0x60/0x595 [ 2699.418103][T20730] ? do_raw_spin_unlock+0x57/0x270 [ 2699.423215][T20730] oom_kill_process.cold+0x10/0x15 [ 2699.428320][T20730] out_of_memory+0x334/0x1340 [ 2699.432986][T20730] ? lock_downgrade+0x920/0x920 [ 2699.437830][T20730] ? oom_killer_disable+0x280/0x280 [ 2699.443058][T20730] mem_cgroup_out_of_memory+0x1d8/0x240 [ 2699.448593][T20730] ? mem_cgroup_nr_lru_pages+0x1b0/0x1b0 [ 2699.454253][T20730] ? do_raw_spin_unlock+0x57/0x270 [ 2699.459371][T20730] ? _raw_spin_unlock+0x2d/0x50 [ 2699.464223][T20730] try_charge+0xa2d/0x1440 [ 2699.464245][T20730] ? mem_cgroup_oom_trylock+0x1a0/0x1a0 [ 2699.464260][T20730] ? find_held_lock+0x35/0x130 [ 2699.474178][T20730] ? get_mem_cgroup_from_mm+0x139/0x320 [ 2699.474197][T20730] ? lock_downgrade+0x920/0x920 [ 2699.474212][T20730] ? percpu_ref_tryget_live+0x111/0x290 [ 2699.494828][T20730] __memcg_kmem_charge_memcg+0x71/0xf0 [ 2699.500316][T20730] ? memcg_kmem_put_cache+0x50/0x50 [ 2699.505508][T20730] ? get_mem_cgroup_from_mm+0x156/0x320 [ 2699.511048][T20730] __memcg_kmem_charge+0x13a/0x3a0 [ 2699.516166][T20730] __alloc_pages_nodemask+0x4f7/0x900 [ 2699.521564][T20730] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 2699.527114][T20730] ? __alloc_pages_slowpath+0x2540/0x2540 [ 2699.532835][T20730] ? percpu_ref_put_many+0xb6/0x190 [ 2699.538029][T20730] ? lockdep_hardirqs_on+0x418/0x5d0 [ 2699.543314][T20730] ? trace_hardirqs_on+0x67/0x240 [ 2699.548338][T20730] copy_process+0x3f8/0x6830 [ 2699.552917][T20730] ? psi_memstall_leave+0x12e/0x180 [ 2699.558121][T20730] ? __cleanup_sighand+0x60/0x60 [ 2699.563052][T20730] ? __kasan_check_read+0x11/0x20 [ 2699.568066][T20730] ? __lock_acquire+0x8a0/0x4a00 [ 2699.573005][T20730] ? _raw_spin_unlock_irq+0x5e/0x90 [ 2699.578203][T20730] _do_fork+0x146/0xfa0 [ 2699.582352][T20730] ? copy_init_mm+0x20/0x20 [ 2699.586856][T20730] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2699.593091][T20730] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2699.599355][T20730] ? debug_smp_processor_id+0x3c/0x214 [ 2699.604826][T20730] ? rcu_lockdep_current_cpu_online+0xe3/0x130 [ 2699.610976][T20730] __x64_sys_clone+0x1ab/0x270 [ 2699.615730][T20730] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 2699.621700][T20730] ? __ia32_sys_vfork+0xd0/0xd0 [ 2699.626538][T20730] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 2699.632774][T20730] ? do_syscall_64+0x26/0x760 [ 2699.637440][T20730] ? lockdep_hardirqs_on+0x418/0x5d0 [ 2699.642714][T20730] ? trace_hardirqs_on+0x67/0x240 [ 2699.647758][T20730] do_syscall_64+0xfa/0x760 [ 2699.652255][T20730] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2699.658133][T20730] RIP: 0033:0x45c2b9 [ 2699.662021][T20730] Code: ff 48 85 f6 0f 84 27 8e fb ff 48 83 ee 10 48 89 4e 08 48 89 3e 48 89 d7 4c 89 c2 4d 89 c8 4c 8b 54 24 08 b8 38 00 00 00 0f 05 <48> 85 c0 0f 8c fe 8d fb ff 74 01 c3 31 ed 48 f7 c7 00 00 01 00 75 [ 2699.681612][T20730] RSP: 002b:00007fffe45fb5b8 EFLAGS: 00000202 ORIG_RAX: 0000000000000038 [ 2699.690009][T20730] RAX: ffffffffffffffda RBX: 00007fba9b16b700 RCX: 000000000045c2b9 [ 2699.697992][T20730] RDX: 00007fba9b16b9d0 RSI: 00007fba9b16adb0 RDI: 00000000003d0f00 [ 2699.705962][T20730] RBP: 00007fffe45fb7d0 R08: 00007fba9b16b700 R09: 00007fba9b16b700 [ 2699.713921][T20730] R10: 00007fba9b16b9d0 R11: 0000000000000202 R12: 0000000000000000 [ 2699.721877][T20730] R13: 00007fffe45fb66f R14: 00007fba9b16b9c0 R15: 000000000075bfd4 [ 2699.751018][T20730] memory: usage 304864kB, limit 307200kB, failcnt 8083 [ 2699.761920][T20730] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2699.779452][T20730] Memory cgroup stats for /syz2: [ 2699.779544][T20730] anon 264134656 [ 2699.779544][T20730] file 61440 [ 2699.779544][T20730] kernel_stack 6422528 [ 2699.779544][T20730] slab 12013568 [ 2699.779544][T20730] sock 0 [ 2699.779544][T20730] shmem 94208 [ 2699.779544][T20730] file_mapped 0 [ 2699.779544][T20730] file_dirty 0 [ 2699.779544][T20730] file_writeback 0 [ 2699.779544][T20730] anon_thp 241172480 [ 2699.779544][T20730] inactive_anon 135168 [ 2699.779544][T20730] active_anon 264200192 [ 2699.779544][T20730] inactive_file 0 [ 2699.779544][T20730] active_file 57344 [ 2699.779544][T20730] unevictable 0 [ 2699.779544][T20730] slab_reclaimable 2568192 [ 2699.779544][T20730] slab_unreclaimable 9445376 [ 2699.779544][T20730] pgfault 286671 [ 2699.779544][T20730] pgmajfault 0 [ 2699.779544][T20730] workingset_refault 1254 [ 2699.779544][T20730] workingset_activate 165 [ 2699.779544][T20730] workingset_nodereclaim 0 [ 2699.779544][T20730] pgrefill 4940 [ 2699.779544][T20730] pgscan 65280 [ 2699.779544][T20730] pgsteal 18479 [ 2699.875925][T20730] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz2,mems_allowed=0-1,oom_memcg=/syz2,task_memcg=/syz2,task=syz-executor.2,pid=29753,uid=0 09:40:14 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="a4ab12f728db4b2b4d2f2f3ff7ad273b1e89e46f905080af4c90ccb170e60b3a8bf56db763e3062d037dca291318d0a17270bbce74b46f4db2a92ba0c9fb228bc105af", 0x43}], 0x4, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(0x0, 0x38) ptrace$cont(0x18, 0x0, 0x0, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) 09:40:14 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000700), 0x0, 0xfffffffffffffffe) keyctl$setperm(0x5, r1, 0x0) keyctl$get_security(0x11, r1, 0x0, 0x0) 09:40:14 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf0") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) 09:40:14 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(&(0x7f0000000040)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa30xffffffffffffffff}) removexattr(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)=@random={'security.', '/trusted\x00'}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) clock_gettime(0x0, &(0x7f0000000380)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000480)={0x3, 0x0, 0xffff, 0x9, r0}) 09:40:14 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000700)='F', 0x1, 0xfffffffffffffffe) keyctl$setperm(0x5, 0x0, 0x0) keyctl$get_security(0x11, r1, 0x0, 0x0) 09:40:14 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="a4ab12f728db4b2b4d2f2f3ff7ad273b1e89e46f905080af4c90ccb170e60b3a8bf56db763e3062d037dca291318d0a17270bbce74b46f4db2a92ba0c9fb228bc105af", 0x43}], 0x4, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(0x0, 0x38) ptrace$cont(0x18, 0x0, 0x0, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, 0x0, 0x0, 0x0) 09:40:14 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) [ 2700.154862][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2700.160770][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2700.166660][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2700.172443][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2700.178300][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2700.184065][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2700.280335][T20795] syz-executor.2 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=0 [ 2700.330747][T20795] CPU: 0 PID: 20795 Comm: syz-executor.2 Not tainted 5.3.0-rc6-next-20190830 #75 [ 2700.339862][T20795] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2700.349919][T20795] Call Trace: [ 2700.353223][T20795] dump_stack+0x172/0x1f0 [ 2700.357581][T20795] dump_header+0x177/0x1152 [ 2700.362089][T20795] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2700.367880][T20795] ? ___ratelimit+0x2c8/0x595 [ 2700.372553][T20795] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 09:40:14 executing program 3: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(&(0x7f0000000040)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa30xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000700)='F', 0x1, 0xfffffffffffffffe) keyctl$setperm(0x5, 0x0, 0x0) keyctl$get_security(0x11, r1, 0x0, 0x0) [ 2700.378347][T20795] ? lockdep_hardirqs_on+0x418/0x5d0 [ 2700.383633][T20795] ? trace_hardirqs_on+0x67/0x240 [ 2700.388656][T20795] ? pagefault_out_of_memory+0x11c/0x11c [ 2700.394285][T20795] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 2700.400091][T20795] ? ___ratelimit+0x60/0x595 [ 2700.404668][T20795] ? do_raw_spin_unlock+0x57/0x270 [ 2700.404684][T20795] oom_kill_process.cold+0x10/0x15 [ 2700.414875][T20795] out_of_memory+0x334/0x1340 [ 2700.419579][T20795] ? lock_downgrade+0x920/0x920 [ 2700.424435][T20795] ? mem_cgroup_unmark_under_oom+0x8d/0xb0 [ 2700.430253][T20795] ? oom_killer_disable+0x280/0x280 [ 2700.435459][T20795] mem_cgroup_out_of_memory+0x1d8/0x240 [ 2700.441024][T20795] ? mem_cgroup_nr_lru_pages+0x1b0/0x1b0 [ 2700.446648][T20795] ? do_raw_spin_unlock+0x57/0x270 [ 2700.451758][T20795] ? _raw_spin_unlock+0x2d/0x50 [ 2700.456609][T20795] try_charge+0xf4b/0x1440 [ 2700.461027][T20795] ? mem_cgroup_oom_trylock+0x1a0/0x1a0 [ 2700.466575][T20795] ? percpu_ref_tryget_live+0x111/0x290 [ 2700.472114][T20795] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2700.478346][T20795] ? __kasan_check_read+0x11/0x20 [ 2700.483369][T20795] ? get_mem_cgroup_from_mm+0x156/0x320 [ 2700.488907][T20795] mem_cgroup_try_charge+0x136/0x590 [ 2700.494186][T20795] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 2700.500446][T20795] mem_cgroup_try_charge_delay+0x1f/0xa0 [ 2700.506077][T20795] __handle_mm_fault+0x1e34/0x3f20 [ 2700.511187][T20795] ? vmf_insert_mixed_mkwrite+0x40/0x40 [ 2700.516722][T20795] ? __kasan_check_read+0x11/0x20 [ 2700.521736][T20795] handle_mm_fault+0x1b5/0x6c0 [ 2700.526499][T20795] __do_page_fault+0x536/0xdd0 09:40:14 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000700)='F', 0x1, 0xfffffffffffffffe) keyctl$setperm(0x5, 0x0, 0x0) keyctl$get_security(0x11, r1, 0x0, 0x0) [ 2700.531262][T20795] do_page_fault+0x38/0x590 [ 2700.535764][T20795] page_fault+0x39/0x40 [ 2700.539915][T20795] RIP: 0033:0x41122f [ 2700.543797][T20795] Code: 0f 84 c8 02 00 00 48 83 bd 78 ff ff ff 00 0f 84 f9 04 00 00 48 8b 95 68 ff ff ff 44 89 95 38 ff ff ff 4c 8d ac 10 00 f7 ff ff <49> 89 85 90 06 00 00 49 8d 85 10 03 00 00 49 89 95 98 06 00 00 41 [ 2700.563399][T20795] RSP: 002b:00007fffe45fb600 EFLAGS: 00010206 [ 2700.569465][T20795] RAX: 00007fba9b16c000 RBX: 0000000000020000 RCX: 000000000045993a 09:40:14 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_buf(r0, 0x6, 0xb, 0x0, &(0x7f0000001100)) 09:40:14 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) [ 2700.577419][T20795] RDX: 0000000000021000 RSI: 0000000000021000 RDI: 0000000000000000 [ 2700.577427][T20795] RBP: 00007fffe45fb6e0 R08: ffffffffffffffff R09: 0000000000000000 [ 2700.577434][T20795] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fffe45fb7d0 [ 2700.577440][T20795] R13: 00007fba9b18c700 R14: 0000000000000000 R15: 000000000075bf2c [ 2700.577727][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2700.615188][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2700.667387][T20795] memory: usage 307200kB, limit 307200kB, failcnt 8121 [ 2700.681744][T20795] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2700.698176][T20795] Memory cgroup stats for /syz2: [ 2700.698269][T20795] anon 266170368 [ 2700.698269][T20795] file 61440 [ 2700.698269][T20795] kernel_stack 6422528 [ 2700.698269][T20795] slab 12013568 [ 2700.698269][T20795] sock 0 [ 2700.698269][T20795] shmem 94208 [ 2700.698269][T20795] file_mapped 0 [ 2700.698269][T20795] file_dirty 0 [ 2700.698269][T20795] file_writeback 0 [ 2700.698269][T20795] anon_thp 243269632 [ 2700.698269][T20795] inactive_anon 135168 [ 2700.698269][T20795] active_anon 266235904 [ 2700.698269][T20795] inactive_file 0 [ 2700.698269][T20795] active_file 57344 [ 2700.698269][T20795] unevictable 0 [ 2700.698269][T20795] slab_reclaimable 2568192 [ 2700.698269][T20795] slab_unreclaimable 9445376 [ 2700.698269][T20795] pgfault 286836 09:40:14 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(&(0x7f0000000040)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa30xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000700)='F', 0x1, 0xfffffffffffffffe) keyctl$setperm(0x5, r1, 0x0) keyctl$get_security(0x11, 0x0, 0x0, 0x0) 09:40:15 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) [ 2700.867085][T20795] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz2,mems_allowed=0-1,oom_memcg=/syz2,task_memcg=/syz2,task=syz-executor.2,pid=29727,uid=0 [ 2700.905834][T20795] Memory cgroup out of memory: Killed process 29727 (syz-executor.2) total-vm:72708kB, anon-rss:2216kB, file-rss:35800kB, shmem-rss:0kB, UID:0 pgtables:143360kB oom_score_adj:0 09:40:15 executing program 0: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x40, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) lgetxattr(&(0x7f0000000300)='./file0\x00', 0x0, &(0x7f0000000540)=""/50, 0x32) ioctl$FS_IOC_MEASURE_VERITY(r1, 0xc0046686, &(0x7f0000000100)={0x2, 0x3, "7fe917"}) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) recvmmsg(r2, &(0x7f0000008880), 0x400000000000249, 0x44000102, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast1}, 0x18) uname(0x0) socket$vsock_stream(0x28, 0x1, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) removexattr(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)=@random={'security.', '/trusted\x00'}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) clock_gettime(0x0, &(0x7f0000000380)) 09:40:15 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000700)='F', 0x1, 0xfffffffffffffffe) keyctl$setperm(0x5, r1, 0x0) keyctl$get_security(0x11, 0x0, 0x0, 0x0) 09:40:15 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="a4ab12f728db4b2b4d2f2f3ff7ad273b1e89e46f905080af4c90ccb170e60b3a8bf56db763e3062d037dca291318d0a17270bbce74b46f4db2a92ba0c9fb228bc105af", 0x43}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, r0, 0x0, 0x0) 09:40:15 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) [ 2701.160310][T20843] syz-executor.2 invoked oom-killer: gfp_mask=0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order=0, oom_score_adj=0 [ 2701.230665][T20843] CPU: 0 PID: 20843 Comm: syz-executor.2 Not tainted 5.3.0-rc6-next-20190830 #75 [ 2701.239897][T20843] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2701.249940][T20843] Call Trace: [ 2701.253224][T20843] dump_stack+0x172/0x1f0 [ 2701.257546][T20843] dump_header+0x177/0x1152 [ 2701.262047][T20843] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2701.267843][T20843] ? ___ratelimit+0x2c8/0x595 [ 2701.272514][T20843] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2701.278321][T20843] ? lockdep_hardirqs_on+0x418/0x5d0 [ 2701.283599][T20843] ? trace_hardirqs_on+0x67/0x240 [ 2701.288617][T20843] ? pagefault_out_of_memory+0x11c/0x11c [ 2701.294239][T20843] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 2701.300030][T20843] ? ___ratelimit+0x60/0x595 [ 2701.304629][T20843] ? do_raw_spin_unlock+0x57/0x270 [ 2701.304644][T20843] oom_kill_process.cold+0x10/0x15 [ 2701.314815][T20843] out_of_memory+0x334/0x1340 [ 2701.319490][T20843] ? lock_downgrade+0x920/0x920 [ 2701.324335][T20843] ? mem_cgroup_unmark_under_oom+0x8d/0xb0 [ 2701.330137][T20843] ? oom_killer_disable+0x280/0x280 [ 2701.335333][T20843] mem_cgroup_out_of_memory+0x1d8/0x240 [ 2701.340979][T20843] ? mem_cgroup_nr_lru_pages+0x1b0/0x1b0 [ 2701.346609][T20843] ? do_raw_spin_unlock+0x57/0x270 [ 2701.351717][T20843] ? _raw_spin_unlock+0x2d/0x50 [ 2701.356562][T20843] try_charge+0xf4b/0x1440 [ 2701.360980][T20843] ? mem_cgroup_oom_trylock+0x1a0/0x1a0 [ 2701.366514][T20843] ? find_held_lock+0x35/0x130 [ 2701.371315][T20843] ? get_mem_cgroup_from_mm+0x139/0x320 [ 2701.376883][T20843] ? lock_downgrade+0x920/0x920 [ 2701.381724][T20843] ? percpu_ref_tryget_live+0x111/0x290 [ 2701.387264][T20843] __memcg_kmem_charge_memcg+0x71/0xf0 [ 2701.392711][T20843] ? memcg_kmem_put_cache+0x50/0x50 [ 2701.397900][T20843] ? get_mem_cgroup_from_mm+0x156/0x320 [ 2701.403443][T20843] __memcg_kmem_charge+0x13a/0x3a0 [ 2701.408551][T20843] __alloc_pages_nodemask+0x4f7/0x900 [ 2701.413924][T20843] ? __alloc_pages_slowpath+0x2540/0x2540 [ 2701.419641][T20843] ? __kasan_check_read+0x11/0x20 [ 2701.424665][T20843] ? mark_lock+0xc2/0x1220 [ 2701.429090][T20843] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 2701.435336][T20843] alloc_pages_current+0x107/0x210 [ 2701.440448][T20843] pte_alloc_one+0x1b/0x1a0 [ 2701.444952][T20843] __handle_mm_fault+0x34d7/0x3f20 [ 2701.450062][T20843] ? vmf_insert_mixed_mkwrite+0x40/0x40 [ 2701.455614][T20843] ? __kasan_check_read+0x11/0x20 [ 2701.460638][T20843] handle_mm_fault+0x1b5/0x6c0 [ 2701.465396][T20843] __do_page_fault+0x536/0xdd0 [ 2701.470148][T20843] ? page_fault+0x16/0x40 [ 2701.474526][T20843] do_page_fault+0x38/0x590 [ 2701.479023][T20843] page_fault+0x39/0x40 [ 2701.483180][T20843] RIP: 0033:0x457eba [ 2701.487069][T20843] Code: Bad RIP value. [ 2701.491137][T20843] RSP: 002b:00007fffe45fb850 EFLAGS: 00010246 [ 2701.497246][T20843] RAX: 0000000000000000 RBX: 00007fffe45fb850 RCX: 0000000000457eba [ 2701.505275][T20843] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 2701.513223][T20843] RBP: 00007fffe45fb890 R08: 0000000000000001 R09: 000055555649b940 [ 2701.521175][T20843] R10: 000055555649bc10 R11: 0000000000000246 R12: 0000000000000001 [ 2701.529119][T20843] R13: 0000000000000000 R14: 0000000000000000 R15: 00007fffe45fb8e0 [ 2701.549156][T20843] memory: usage 307200kB, limit 307200kB, failcnt 8163 [ 2701.556301][T20843] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2701.563151][T20843] Memory cgroup stats for /syz2: [ 2701.563262][T20843] anon 266158080 [ 2701.563262][T20843] file 61440 [ 2701.563262][T20843] kernel_stack 6422528 [ 2701.563262][T20843] slab 12013568 [ 2701.563262][T20843] sock 0 [ 2701.563262][T20843] shmem 94208 [ 2701.563262][T20843] file_mapped 0 [ 2701.563262][T20843] file_dirty 0 [ 2701.563262][T20843] file_writeback 0 [ 2701.563262][T20843] anon_thp 243269632 [ 2701.563262][T20843] inactive_anon 135168 [ 2701.563262][T20843] active_anon 266223616 [ 2701.563262][T20843] inactive_file 0 [ 2701.563262][T20843] active_file 57344 [ 2701.563262][T20843] unevictable 0 [ 2701.563262][T20843] slab_reclaimable 2568192 [ 2701.563262][T20843] slab_unreclaimable 9445376 [ 2701.563262][T20843] pgfault 286869 [ 2701.563262][T20843] pgmajfault 0 [ 2701.563262][T20843] workingset_refault 1254 [ 2701.563262][T20843] workingset_activate 165 [ 2701.563262][T20843] workingset_nodereclaim 0 [ 2701.563262][T20843] pgrefill 5172 [ 2701.563262][T20843] pgscan 65577 [ 2701.563262][T20843] pgsteal 18479 [ 2701.658275][T20843] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz2,mems_allowed=0-1,oom_memcg=/syz2,task_memcg=/syz2,task=syz-executor.2,pid=28629,uid=0 09:40:15 executing program 3: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(&(0x7f0000000040)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa30xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000700)='F', 0x1, 0xfffffffffffffffe) keyctl$setperm(0x5, r1, 0x0) keyctl$get_security(0x11, 0x0, 0x0, 0x0) 09:40:15 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(&(0x7f0000000040)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa3 0a 46 ff ff c7 44 24 30 00 00 00 00 e8 9d 4d ff ff 49 89 c6 48 [ 2702.085382][ T8171] RSP: 002b:00007fffe45fb8a0 EFLAGS: 00010246 [ 2702.091446][ T8171] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000457eba [ 2702.099420][ T8171] RDX: 0000000000000000 RSI: 0000000000007b18 RDI: 00000000004bf16a [ 2702.107382][ T8171] RBP: 0000000000007b18 R08: 0000000000000001 R09: 000055555649b940 09:40:16 executing program 1: clock_getres(0x0, 0x0) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) [ 2702.115346][ T8171] R10: 000055555649bc10 R11: 0000000000000246 R12: 0000000000000000 [ 2702.123311][ T8171] R13: 00007fffe45fb8d0 R14: 0000000000000000 R15: 00007fffe45fb8e0 09:40:16 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, 0x0, 0x0) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) [ 2702.190233][ T8171] memory: usage 304696kB, limit 307200kB, failcnt 8163 [ 2702.205023][ T8171] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2702.219596][ T8171] Memory cgroup stats for /syz2: [ 2702.219678][ T8171] anon 264052736 [ 2702.219678][ T8171] file 61440 [ 2702.219678][ T8171] kernel_stack 6356992 [ 2702.219678][ T8171] slab 12013568 [ 2702.219678][ T8171] sock 0 [ 2702.219678][ T8171] shmem 94208 [ 2702.219678][ T8171] file_mapped 0 [ 2702.219678][ T8171] file_dirty 0 [ 2702.219678][ T8171] file_writeback 0 [ 2702.219678][ T8171] anon_thp 241172480 [ 2702.219678][ T8171] inactive_anon 135168 [ 2702.219678][ T8171] active_anon 264048640 [ 2702.219678][ T8171] inactive_file 0 [ 2702.219678][ T8171] active_file 57344 [ 2702.219678][ T8171] unevictable 0 [ 2702.219678][ T8171] slab_reclaimable 2568192 [ 2702.219678][ T8171] slab_unreclaimable 9445376 [ 2702.219678][ T8171] pgfault 286935 09:40:16 executing program 1: clock_getres(0x0, 0x0) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) 09:40:16 executing program 0: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x40, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) lgetxattr(&(0x7f0000000300)='./file0\x00', 0x0, &(0x7f0000000540)=""/50, 0x32) ioctl$FS_IOC_MEASURE_VERITY(r1, 0xc0046686, &(0x7f0000000100)={0x2, 0x3, "7fe917"}) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) recvmmsg(r2, &(0x7f0000008880), 0x400000000000249, 0x44000102, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast1}, 0x18) uname(0x0) socket$vsock_stream(0x28, 0x1, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) removexattr(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)=@random={'security.', '/trusted\x00'}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) 09:40:16 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(&(0x7f0000000040)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa30xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) 09:40:17 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, 0x0, 0x0) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) 09:40:17 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="a4ab12f728db4b2b4d2f2f3ff7ad273b1e89e46f905080af4c90ccb170e60b3a8bf56db763e3062d037dca291318d0a17270bbce74b46f4db2a92ba0c9fb228bc105af", 0x43}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, r0, 0x0, 0x0) 09:40:17 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(&(0x7f0000000040)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa30xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) 09:40:17 executing program 2: clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="a4ab12f728db4b2b4d2f2f3ff7ad273b1e89e46f905080af4c90ccb170e60b3a8bf56db763e3062d037dca291318d0a17270bbce74b46f4db2a92ba0c9fb228bc105af", 0x43}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, r0, 0x0, 0x0) 09:40:17 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x0, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) [ 2703.129790][T20925] ptrace attach of "/root/syz-executor.2"[20923] was attempted by "/root/syz-executor.2"[20925] 09:40:17 executing program 0: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x40, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) lgetxattr(&(0x7f0000000300)='./file0\x00', 0x0, &(0x7f0000000540)=""/50, 0x32) ioctl$FS_IOC_MEASURE_VERITY(r1, 0xc0046686, &(0x7f0000000100)={0x2, 0x3, "7fe917"}) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) recvmmsg(r2, &(0x7f0000008880), 0x400000000000249, 0x44000102, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast1}, 0x18) uname(0x0) socket$vsock_stream(0x28, 0x1, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) removexattr(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)=@random={'security.', '/trusted\x00'}) fcntl$setpipe(r3, 0x407, 0x0) 09:40:17 executing program 1: clock_getres(0x0, 0x0) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) 09:40:17 executing program 3: r0 = socket$kcm(0xa, 0x5, 0x0) sendmsg(r0, &(0x7f0000000100)={&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80, &(0x7f0000000580)=[{&(0x7f00000000c0)="a0", 0x1}], 0x1}, 0x0) 09:40:17 executing program 2: clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="a4ab12f728db4b2b4d2f2f3ff7ad273b1e89e46f905080af4c90ccb170e60b3a8bf56db763e3062d037dca291318d0a17270bbce74b46f4db2a92ba0c9fb228bc105af", 0x43}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, r0, 0x0, 0x0) 09:40:17 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x0, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) 09:40:17 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(&(0x7f0000000040)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa3\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa30xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) 09:40:19 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x0) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) 09:40:19 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="a4ab12f728db4b2b4d2f2f3ff7ad273b1e89e46f905080af4c90ccb170e60b3a8bf56db763e3062d037dca291318d0a17270bbce74b46f4db2a92ba0c9fb228bc105af", 0x43}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, r0, 0x0, 0x0) 09:40:19 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000180)="2e0000001d008103e00f80ecdb4cb9d90163190405000000000000fb12000100ac14141840d819a9060015000000", 0x2e}], 0x1}, 0x0) 09:40:19 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(&(0x7f0000000040)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa30xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) 09:40:19 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x0) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) 09:40:19 executing program 3: openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(0xffffffffffffffff, 0x89e0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x89a0, &(0x7f0000000040)='&@[\x00') socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000000c0)="2e00000027000500d25a80648c63940d0124fc00100002400a000000053582c137153e370900018000f01700d1bd", 0x2e}], 0x1}, 0x0) 09:40:19 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="a4ab12f728db4b2b4d2f2f3ff7ad273b1e89e46f905080af4c90ccb170e60b3a8bf56db763e3062d037dca291318d0a17270bbce74b46f4db2a92ba0c9fb228bc105af", 0x43}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, r0, 0x0, 0x0) 09:40:19 executing program 1: clock_getres(0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) [ 2705.486710][ T8171] syz-executor.2 invoked oom-killer: gfp_mask=0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order=0, oom_score_adj=0 [ 2705.500917][T21047] netlink: 'syz-executor.3': attribute type 2 has an invalid length. [ 2705.548462][T21047] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2705.569350][ T8171] CPU: 0 PID: 8171 Comm: syz-executor.2 Not tainted 5.3.0-rc6-next-20190830 #75 [ 2705.578366][ T8171] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2705.588455][ T8171] Call Trace: [ 2705.591745][ T8171] dump_stack+0x172/0x1f0 [ 2705.596103][ T8171] dump_header+0x177/0x1152 [ 2705.600609][ T8171] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2705.606402][ T8171] ? ___ratelimit+0x2c8/0x595 [ 2705.611070][ T8171] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2705.616865][ T8171] ? lockdep_hardirqs_on+0x418/0x5d0 [ 2705.622138][ T8171] ? trace_hardirqs_on+0x67/0x240 [ 2705.627156][ T8171] ? pagefault_out_of_memory+0x11c/0x11c [ 2705.632773][ T8171] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 2705.638584][ T8171] ? ___ratelimit+0x60/0x595 [ 2705.643158][ T8171] ? do_raw_spin_unlock+0x57/0x270 [ 2705.648276][ T8171] oom_kill_process.cold+0x10/0x15 [ 2705.653376][ T8171] out_of_memory+0x334/0x1340 [ 2705.658036][ T8171] ? lock_downgrade+0x920/0x920 [ 2705.662875][ T8171] ? mem_cgroup_unmark_under_oom+0x8d/0xb0 [ 2705.668679][ T8171] ? oom_killer_disable+0x280/0x280 [ 2705.673875][ T8171] mem_cgroup_out_of_memory+0x1d8/0x240 [ 2705.679406][ T8171] ? mem_cgroup_nr_lru_pages+0x1b0/0x1b0 [ 2705.685053][ T8171] ? do_raw_spin_unlock+0x57/0x270 [ 2705.690180][ T8171] ? _raw_spin_unlock+0x2d/0x50 [ 2705.695053][ T8171] try_charge+0xf4b/0x1440 [ 2705.699480][ T8171] ? mem_cgroup_oom_trylock+0x1a0/0x1a0 [ 2705.705017][ T8171] ? find_held_lock+0x35/0x130 [ 2705.709768][ T8171] ? get_mem_cgroup_from_mm+0x139/0x320 [ 2705.715314][ T8171] ? lock_downgrade+0x920/0x920 [ 2705.720151][ T8171] ? percpu_ref_tryget_live+0x111/0x290 [ 2705.720169][ T8171] __memcg_kmem_charge_memcg+0x71/0xf0 [ 2705.720184][ T8171] ? memcg_kmem_put_cache+0x50/0x50 [ 2705.731146][ T8171] ? get_mem_cgroup_from_mm+0x156/0x320 [ 2705.731161][ T8171] __memcg_kmem_charge+0x13a/0x3a0 [ 2705.731177][ T8171] __alloc_pages_nodemask+0x4f7/0x900 [ 2705.752321][ T8171] ? __alloc_pages_slowpath+0x2540/0x2540 [ 2705.758034][ T8171] ? mmu_notifier_invalidate_range_start+0x95/0x110 [ 2705.764605][ T8171] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 2705.770969][ T8171] alloc_pages_current+0x107/0x210 [ 2705.776064][ T8171] get_zeroed_page+0x14/0x50 [ 2705.780623][ T8171] __pud_alloc+0x3b/0x250 [ 2705.784922][ T8171] pud_alloc+0xde/0x150 [ 2705.789047][ T8171] copy_page_range+0x37a/0x1ed0 [ 2705.793867][ T8171] ? anon_vma_fork+0x371/0x4a0 [ 2705.798611][ T8171] ? lock_downgrade+0x920/0x920 [ 2705.803459][ T8171] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 2705.809149][ T8171] ? pmd_alloc+0x180/0x180 [ 2705.813536][ T8171] ? validate_mm_rb+0xa3/0xc0 [ 2705.818224][ T8171] ? __vma_link_rb+0x5ad/0x770 [ 2705.822976][ T8171] ? anon_vma_fork+0xd4/0x4a0 [ 2705.827625][ T8171] dup_mm+0xa67/0x1430 [ 2705.831688][ T8171] ? vm_area_dup+0x170/0x170 [ 2705.836257][ T8171] ? debug_mutex_init+0x2d/0x60 [ 2705.841079][ T8171] copy_process+0x2671/0x6830 [ 2705.845728][ T8171] ? __kasan_check_read+0x11/0x20 [ 2705.850748][ T8171] ? __cleanup_sighand+0x60/0x60 [ 2705.855663][ T8171] ? __might_fault+0x12b/0x1e0 [ 2705.860403][ T8171] ? __might_fault+0x12b/0x1e0 [ 2705.865151][ T8171] _do_fork+0x146/0xfa0 [ 2705.869296][ T8171] ? copy_init_mm+0x20/0x20 [ 2705.873772][ T8171] ? __kasan_check_read+0x11/0x20 [ 2705.878768][ T8171] ? _copy_to_user+0x118/0x160 [ 2705.883506][ T8171] __x64_sys_clone+0x1ab/0x270 [ 2705.888239][ T8171] ? __ia32_sys_vfork+0xd0/0xd0 [ 2705.893061][ T8171] ? do_syscall_64+0x26/0x760 [ 2705.897715][ T8171] ? lockdep_hardirqs_on+0x418/0x5d0 [ 2705.902978][ T8171] ? trace_hardirqs_on+0x67/0x240 [ 2705.907989][ T8171] do_syscall_64+0xfa/0x760 [ 2705.912465][ T8171] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2705.918323][ T8171] RIP: 0033:0x457eba [ 2705.922186][ T8171] Code: f7 d8 64 89 04 25 d4 02 00 00 64 4c 8b 0c 25 10 00 00 00 31 d2 4d 8d 91 d0 02 00 00 31 f6 bf 11 00 20 01 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 0f 87 f5 00 00 00 85 c0 41 89 c5 0f 85 fc 00 00 [ 2705.941758][ T8171] RSP: 002b:00007fffe45fb850 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 2705.950135][ T8171] RAX: ffffffffffffffda RBX: 00007fffe45fb850 RCX: 0000000000457eba [ 2705.958116][ T8171] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 2705.966065][ T8171] RBP: 00007fffe45fb890 R08: 0000000000000001 R09: 000055555649b940 [ 2705.974024][ T8171] R10: 000055555649bc10 R11: 0000000000000246 R12: 0000000000000001 [ 2705.981962][ T8171] R13: 0000000000000000 R14: 0000000000000000 R15: 00007fffe45fb8e0 [ 2705.992498][ T8171] memory: usage 307200kB, limit 307200kB, failcnt 8213 [ 2705.999523][ T8171] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2706.006506][ T8171] Memory cgroup stats for /syz2: [ 2706.006619][ T8171] anon 264597504 [ 2706.006619][ T8171] file 61440 [ 2706.006619][ T8171] kernel_stack 6619136 [ 2706.006619][ T8171] slab 12423168 [ 2706.006619][ T8171] sock 0 [ 2706.006619][ T8171] shmem 94208 [ 2706.006619][ T8171] file_mapped 0 [ 2706.006619][ T8171] file_dirty 0 [ 2706.006619][ T8171] file_writeback 0 [ 2706.006619][ T8171] anon_thp 241172480 [ 2706.006619][ T8171] inactive_anon 135168 [ 2706.006619][ T8171] active_anon 264663040 [ 2706.006619][ T8171] inactive_file 0 [ 2706.006619][ T8171] active_file 57344 [ 2706.006619][ T8171] unevictable 0 [ 2706.006619][ T8171] slab_reclaimable 2838528 [ 2706.006619][ T8171] slab_unreclaimable 9584640 [ 2706.006619][ T8171] pgfault 287628 [ 2706.006619][ T8171] pgmajfault 0 [ 2706.006619][ T8171] workingset_refault 1254 [ 2706.006619][ T8171] workingset_activate 165 [ 2706.006619][ T8171] workingset_nodereclaim 0 [ 2706.006619][ T8171] pgrefill 5272 [ 2706.006619][ T8171] pgscan 65676 [ 2706.006619][ T8171] pgsteal 18479 [ 2706.101439][ T8171] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz2,mems_allowed=0-1,oom_memcg=/syz2,task_memcg=/syz2,task=syz-executor.2,pid=10939,uid=0 [ 2706.113334][T21047] netlink: 'syz-executor.3': attribute type 2 has an invalid length. [ 2706.117805][ T8171] Memory cgroup out of memory: Killed process 10939 (syz-executor.2) total-vm:72840kB, anon-rss:2224kB, file-rss:35788kB, shmem-rss:0kB, UID:0 pgtables:143360kB oom_score_adj:0 [ 2706.130007][T21047] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 09:40:20 executing program 0: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x40, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) lgetxattr(&(0x7f0000000300)='./file0\x00', 0x0, &(0x7f0000000540)=""/50, 0x32) ioctl$FS_IOC_MEASURE_VERITY(r1, 0xc0046686, &(0x7f0000000100)={0x2, 0x3, "7fe917"}) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) recvmmsg(r2, &(0x7f0000008880), 0x400000000000249, 0x44000102, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast1}, 0x18) uname(0x0) socket$vsock_stream(0x28, 0x1, 0x0) 09:40:20 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x0, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) 09:40:20 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(&(0x7f0000000040)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa30xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) 09:40:20 executing program 3: r0 = socket$kcm(0x11, 0x2, 0x0) setsockopt$sock_attach_bpf(r0, 0x107, 0x14, &(0x7f0000000000), 0x4) openat$cgroup(0xffffffffffffffff, 0x0, 0x200002, 0x0) sendmsg$kcm(r0, &(0x7f0000000040)={&(0x7f0000000100)=@caif=@rfm={0x25, 0x5, "8de06f55c742ae7c2bb7ed7767c245f6"}, 0x80, 0x0, 0x0, 0x0, 0x0, 0xe}, 0x0) 09:40:20 executing program 1: clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) 09:40:20 executing program 3: gettid() perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3e, 0x0, 0x37, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) openat$cgroup_type(0xffffffffffffffff, 0x0, 0x2, 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000180)='cpu.weight\x00', 0x2, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00', 0x200002, 0x0) r1 = openat$cgroup_subtree(r0, &(0x7f0000000080)='cgroup.subtree_control\x00', 0x2, 0x0) openat$cgroup(0xffffffffffffffff, &(0x7f00000001c0)='syz0\x00', 0x200002, 0x0) write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x2d, 'pids'}]}, 0x6) write$cgroup_subtree(r1, &(0x7f00000000c0)={[{0x0, 'pids'}]}, 0x6) 09:40:20 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x0, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) 09:40:20 executing program 1: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) 09:40:20 executing program 3: 09:40:20 executing program 1: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) 09:40:21 executing program 0: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x40, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) lgetxattr(&(0x7f0000000300)='./file0\x00', 0x0, &(0x7f0000000540)=""/50, 0x32) ioctl$FS_IOC_MEASURE_VERITY(r1, 0xc0046686, &(0x7f0000000100)={0x2, 0x3, "7fe917"}) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) recvmmsg(r2, &(0x7f0000008880), 0x400000000000249, 0x44000102, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast1}, 0x18) uname(0x0) 09:40:21 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(&(0x7f0000000040)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa30xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) 09:40:23 executing program 3: 09:40:23 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(&(0x7f0000000040)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa30xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) 09:40:23 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) 09:40:23 executing program 3: 09:40:23 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) 09:40:23 executing program 1: clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) [ 2710.554856][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2710.560751][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2710.566533][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2710.572277][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2710.578070][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2710.583843][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2710.954856][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2710.960625][ C0] protocol 88fb is buggy, dev hsr_slave_1 09:40:26 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, r0, 0x0, 0x0) 09:40:26 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(&(0x7f0000000040)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa30xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) 09:40:26 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) 09:40:26 executing program 0: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x40, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) lgetxattr(&(0x7f0000000300)='./file0\x00', 0x0, &(0x7f0000000540)=""/50, 0x32) ioctl$FS_IOC_MEASURE_VERITY(r1, 0xc0046686, &(0x7f0000000100)={0x2, 0x3, "7fe917"}) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast1}, 0x18) 09:40:26 executing program 3: 09:40:26 executing program 1: clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) 09:40:26 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, 0x0, 0x0) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) 09:40:26 executing program 0: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x40, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) lgetxattr(&(0x7f0000000300)='./file0\x00', 0x0, &(0x7f0000000540)=""/50, 0x32) ioctl$FS_IOC_MEASURE_VERITY(r1, 0xc0046686, &(0x7f0000000100)={0x2, 0x3, "7fe917"}) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast1}, 0x18) 09:40:26 executing program 3: 09:40:26 executing program 1: clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) [ 2714.714900][ C1] net_ratelimit: 12 callbacks suppressed [ 2714.720583][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2714.726318][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2714.732056][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2714.737791][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2714.743568][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2714.749285][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2715.114827][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2715.120677][ C0] protocol 88fb is buggy, dev hsr_slave_1 09:40:29 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, r0, 0x0, 0x0) 09:40:29 executing program 0: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x40, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) lgetxattr(&(0x7f0000000300)='./file0\x00', 0x0, &(0x7f0000000540)=""/50, 0x32) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast1}, 0x18) 09:40:29 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, 0x0, 0x0) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) 09:40:29 executing program 1: clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) 09:40:29 executing program 3: 09:40:29 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(&(0x7f0000000040)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa3\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa30xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) 09:40:32 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x0, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) 09:40:32 executing program 0: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x40, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast1}, 0x18) 09:40:32 executing program 1: clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) 09:40:32 executing program 1: clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) [ 2719.754859][ C1] net_ratelimit: 18 callbacks suppressed [ 2719.754866][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2719.766406][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2720.954910][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2720.960743][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2720.966586][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2720.972338][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2720.978135][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2720.983896][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2721.354858][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2721.360748][ C0] protocol 88fb is buggy, dev hsr_slave_1 09:40:35 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x0, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) 09:40:35 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, 0x0) ioctl$TCSETSF(0xffffffffffffffff, 0x5412, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$KDGKBMETA(r0, 0x4b62, &(0x7f0000003200)) r1 = socket$packet(0x11, 0x0, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000002180)=0xfc, 0x4) openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'veth1_to_team\x00', 0x410}) memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) r2 = accept4(r1, &(0x7f0000000080)=@nfc_llcp, &(0x7f0000000180)=0x80, 0xdb6deb2b218b4757) accept4$alg(r2, 0x0, 0x0, 0x80000) r3 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCADDRT(r3, 0x890b, &(0x7f0000000100)={0x750, {0x2, 0x4e21, @empty}, {0x2, 0x0, @local}, {0x2, 0x4e21, @broadcast}, 0x0, 0x4000000000, 0x80000000000, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0xfffffffffffff801}) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_udp(0x2, 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x400002, 0x120) unshare(0x60000000) 09:40:35 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, r0, 0x0, 0x0) 09:40:35 executing program 0: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x40, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast1}, 0x18) 09:40:35 executing program 1: clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x0) 09:40:35 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(&(0x7f0000000040)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa30xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x0) 09:40:35 executing program 0: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x40, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast1}, 0x18) [ 2721.633827][T21277] IPVS: ftp: loaded support on port[0] = 21 09:40:35 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(0xffffffffffffffff, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) 09:40:35 executing program 1: clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x0) 09:40:35 executing program 0: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x40, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) getpid() r0 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast1}, 0x18) 09:40:36 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(0xffffffffffffffff, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) [ 2721.927790][T21302] IPVS: ftp: loaded support on port[0] = 21 09:40:36 executing program 1: perf_event_open(&(0x7f0000000100)={0x2000000005, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000180)='setgroups\x00') writev(r0, &(0x7f0000000040)=[{&(0x7f0000000000)='+', 0x1}], 0x1) ioctl$MON_IOCX_GETX(0xffffffffffffffff, 0xc0109207, 0x0) 09:40:36 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, 0x0) ioctl$TCSETSF(0xffffffffffffffff, 0x5412, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$KDGKBMETA(r0, 0x4b62, &(0x7f0000003200)) r1 = socket$packet(0x11, 0x0, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000002180)=0xfc, 0x4) openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'veth1_to_team\x00', 0x410}) memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) r2 = accept4(r1, &(0x7f0000000080)=@nfc_llcp, &(0x7f0000000180)=0x80, 0xdb6deb2b218b4757) accept4$alg(r2, 0x0, 0x0, 0x80000) r3 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCADDRT(r3, 0x890b, &(0x7f0000000100)={0x750, {0x2, 0x4e21, @empty}, {0x2, 0x0, @local}, {0x2, 0x4e21, @broadcast}, 0x0, 0x4000000000, 0x80000000000, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0xfffffffffffff801}) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_udp(0x2, 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x400002, 0x120) unshare(0x60000000) [ 2722.262710][T21322] IPVS: ftp: loaded support on port[0] = 21 09:40:38 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(0xffffffffffffffff, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14}, 0x14}}, 0x0) close(r2) 09:40:38 executing program 0: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x40, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast1}, 0x18) 09:40:38 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, r0, 0x0, 0x0) 09:40:38 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) recvmmsg(r0, &(0x7f0000003540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) r2 = fcntl$dupfd(r0, 0x0, r1) bind$bt_rfcomm(r2, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x3}}, 0xa) write$P9_RXATTRWALK(r2, &(0x7f00000000c0)={0xfffffdf9, 0x9}, 0xf) 09:40:38 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000005c0)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, 0xffffffffffffffff) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000300)) fcntl$setstatus(r0, 0x4, 0x46000) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) fgetxattr(r2, &(0x7f0000000000)=@known='system.posix_acl_default\x00', 0x0, 0x0) sendfile(r0, r0, 0x0, 0x2000005) 09:40:38 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(&(0x7f0000000040)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa3\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa3\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa3\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa3\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa3\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa3\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa3 44 89 04 25 d4 02 00 00 45 85 f6 0f 85 7f 00 00 00 48 85 db 74 [ 2740.686489][ T9920] RSP: 002b:00007ffd393be8e0 EFLAGS: 00010246 [ 2740.692543][ T9920] RAX: 0000000000000001 RBX: 00007ffd393be8e0 RCX: 0000000000457eba [ 2740.700499][ T9920] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 2740.708457][ T9920] RBP: 00007ffd393be920 R08: 0000000000000001 R09: 0000555556485940 [ 2740.716400][ T9920] R10: 0000555556485c10 R11: 0000000000000246 R12: 0000000000000001 [ 2740.724340][ T9920] R13: 0000000000005fc1 R14: 0000000000000000 R15: 00007ffd393be970 [ 2740.733908][ T9920] memory: usage 307200kB, limit 307200kB, failcnt 5683 [ 2740.740932][ C1] net_ratelimit: 18 callbacks suppressed [ 2740.740939][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2740.740986][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2740.758984][ T9920] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2740.766171][ T9920] Memory cgroup stats for /syz0: [ 2740.766233][ T9920] anon 277508096 [ 2740.766233][ T9920] file 2269184 [ 2740.766233][ T9920] kernel_stack 4849664 [ 2740.766233][ T9920] slab 9637888 [ 2740.766233][ T9920] sock 77824 [ 2740.766233][ T9920] shmem 2174976 [ 2740.766233][ T9920] file_mapped 0 [ 2740.766233][ T9920] file_dirty 135168 [ 2740.766233][ T9920] file_writeback 0 [ 2740.766233][ T9920] anon_thp 262144000 [ 2740.766233][ T9920] inactive_anon 2027520 [ 2740.766233][ T9920] active_anon 277438464 [ 2740.766233][ T9920] inactive_file 94208 [ 2740.766233][ T9920] active_file 102400 [ 2740.766233][ T9920] unevictable 0 [ 2740.766233][ T9920] slab_reclaimable 2162688 [ 2740.766233][ T9920] slab_unreclaimable 7475200 [ 2740.766233][ T9920] pgfault 249117 [ 2740.766233][ T9920] pgmajfault 0 [ 2740.766233][ T9920] workingset_refault 1320 [ 2740.766233][ T9920] workingset_activate 0 [ 2740.766233][ T9920] workingset_nodereclaim 0 [ 2740.766233][ T9920] pgrefill 406 [ 2740.766233][ T9920] pgscan 39493 [ 2740.766233][ T9920] pgsteal 1516 [ 2740.878787][ T9920] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz0,mems_allowed=0-1,oom_memcg=/syz0,task_memcg=/syz0,task=syz-executor.0,pid=9692,uid=0 [ 2740.900418][ T9920] Memory cgroup out of memory: Killed process 9692 (syz-executor.0) total-vm:72708kB, anon-rss:2200kB, file-rss:35808kB, shmem-rss:0kB, UID:0 pgtables:143360kB oom_score_adj:1000 [ 2740.929249][T21561] syz-executor.0 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=0 [ 2740.944857][T21561] CPU: 1 PID: 21561 Comm: syz-executor.0 Not tainted 5.3.0-rc6-next-20190830 #75 [ 2740.954139][T21561] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2740.964173][T21561] Call Trace: [ 2740.967445][T21561] dump_stack+0x172/0x1f0 [ 2740.971773][T21561] dump_header+0x177/0x1152 [ 2740.976273][T21561] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2740.982083][T21561] ? ___ratelimit+0x2c8/0x595 [ 2740.986735][T21561] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2740.992542][T21561] ? lockdep_hardirqs_on+0x418/0x5d0 [ 2740.997824][T21561] ? trace_hardirqs_on+0x67/0x240 [ 2741.002831][T21561] ? pagefault_out_of_memory+0x11c/0x11c [ 2741.008441][T21561] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 2741.014219][T21561] ? ___ratelimit+0x60/0x595 [ 2741.018884][T21561] ? do_raw_spin_unlock+0x57/0x270 [ 2741.023998][T21561] oom_kill_process.cold+0x10/0x15 [ 2741.029120][T21561] out_of_memory+0x334/0x1340 [ 2741.033827][T21561] ? lock_downgrade+0x920/0x920 [ 2741.038687][T21561] ? oom_killer_disable+0x280/0x280 [ 2741.043876][T21561] mem_cgroup_out_of_memory+0x1d8/0x240 [ 2741.049418][T21561] ? mem_cgroup_nr_lru_pages+0x1b0/0x1b0 [ 2741.055033][T21561] ? do_raw_spin_unlock+0x57/0x270 [ 2741.060123][T21561] ? _raw_spin_unlock+0x2d/0x50 [ 2741.064959][T21561] try_charge+0xa2d/0x1440 [ 2741.069413][T21561] ? mem_cgroup_oom_trylock+0x1a0/0x1a0 [ 2741.074943][T21561] ? percpu_ref_tryget_live+0x111/0x290 [ 2741.080511][T21561] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2741.086737][T21561] ? __kasan_check_read+0x11/0x20 [ 2741.091748][T21561] ? get_mem_cgroup_from_mm+0x156/0x320 [ 2741.097275][T21561] mem_cgroup_try_charge+0x136/0x590 [ 2741.102562][T21561] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 2741.108777][T21561] mem_cgroup_try_charge_delay+0x1f/0xa0 [ 2741.114407][T21561] wp_page_copy+0x41e/0x1590 [ 2741.118987][T21561] ? find_held_lock+0x35/0x130 [ 2741.123735][T21561] ? pmd_pfn+0x1d0/0x1d0 [ 2741.127966][T21561] ? lock_downgrade+0x920/0x920 [ 2741.132804][T21561] ? swp_swapcount+0x540/0x540 [ 2741.137553][T21561] ? __kasan_check_read+0x11/0x20 [ 2741.142573][T21561] ? do_raw_spin_unlock+0x57/0x270 [ 2741.147674][T21561] do_wp_page+0x499/0x14d0 [ 2741.152117][T21561] ? finish_mkwrite_fault+0x570/0x570 [ 2741.157481][T21561] __handle_mm_fault+0x22f1/0x3f20 [ 2741.162590][T21561] ? vmf_insert_mixed_mkwrite+0x40/0x40 [ 2741.168129][T21561] ? __kasan_check_read+0x11/0x20 [ 2741.173138][T21561] handle_mm_fault+0x1b5/0x6c0 [ 2741.177892][T21561] __do_page_fault+0x536/0xdd0 [ 2741.182669][T21561] do_page_fault+0x38/0x590 [ 2741.187165][T21561] page_fault+0x39/0x40 [ 2741.191303][T21561] RIP: 0010:__put_user_4+0x1c/0x30 [ 2741.196417][T21561] Code: 1f 00 c3 90 66 2e 0f 1f 84 00 00 00 00 00 65 48 8b 1c 25 40 fe 01 00 48 8b 9b 58 14 00 00 48 83 eb 03 48 39 d9 73 3f 0f 1f 00 <89> 01 31 c0 0f 1f 00 c3 66 90 66 2e 0f 1f 84 00 00 00 00 00 65 48 [ 2741.216006][T21561] RSP: 0018:ffff8880547c7f30 EFLAGS: 00010293 [ 2741.222052][T21561] RAX: 0000000000005fc1 RBX: 00007fffffffeffd RCX: 0000555556485c10 [ 2741.230011][T21561] RDX: dffffc0000000000 RSI: 1ffff1100e0b953c RDI: ffff8880705ca6f0 [ 2741.237972][T21561] RBP: ffff8880547c7f48 R08: 0000000000000001 R09: ffff8880705ca9d8 [ 2741.245923][T21561] R10: fffffbfff138aef8 R11: ffffffff89c577c7 R12: 0000000000000000 [ 2741.253868][T21561] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2741.261831][T21561] ? schedule_tail+0xd8/0x130 [ 2741.266531][T21561] ret_from_fork+0x8/0x30 [ 2741.270830][T21561] RIP: 0033:0x457eba [ 2741.274722][T21561] Code: Bad RIP value. [ 2741.278772][T21561] RSP: 002b:00007ffd393be8e0 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 2741.287164][T21561] RAX: 0000000000000000 RBX: 00007ffd393be8e0 RCX: 0000000000457eba [ 2741.295121][T21561] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 2741.303073][T21561] RBP: 00007ffd393be920 R08: 0000000000000001 R09: 0000555556485940 [ 2741.311017][T21561] R10: 0000555556485c10 R11: 0000000000000246 R12: 0000000000000001 [ 2741.318964][T21561] R13: 0000000000000000 R14: 0000000000000000 R15: 00007ffd393be970 [ 2741.327321][T21561] memory: usage 305000kB, limit 307200kB, failcnt 5683 [ 2741.334166][T21561] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2741.341052][T21561] Memory cgroup stats for /syz0: [ 2741.341146][T21561] anon 275333120 [ 2741.341146][T21561] file 2269184 [ 2741.341146][T21561] kernel_stack 4784128 [ 2741.341146][T21561] slab 9637888 [ 2741.341146][T21561] sock 77824 [ 2741.341146][T21561] shmem 2174976 [ 2741.341146][T21561] file_mapped 0 [ 2741.341146][T21561] file_dirty 135168 [ 2741.341146][T21561] file_writeback 0 [ 2741.341146][T21561] anon_thp 260046848 [ 2741.341146][T21561] inactive_anon 2027520 [ 2741.341146][T21561] active_anon 275263488 [ 2741.341146][T21561] inactive_file 94208 [ 2741.341146][T21561] active_file 102400 [ 2741.341146][T21561] unevictable 0 [ 2741.341146][T21561] slab_reclaimable 2162688 [ 2741.341146][T21561] slab_unreclaimable 7475200 [ 2741.341146][T21561] pgfault 249117 [ 2741.341146][T21561] pgmajfault 0 [ 2741.341146][T21561] workingset_refault 1320 [ 2741.341146][T21561] workingset_activate 0 [ 2741.341146][T21561] workingset_nodereclaim 0 [ 2741.341146][T21561] pgrefill 406 [ 2741.341146][T21561] pgscan 39493 [ 2741.341146][T21561] pgsteal 1516 [ 2741.436851][T21561] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz0,mems_allowed=0-1,oom_memcg=/syz0,task_memcg=/syz0,task=syz-executor.0,pid=9540,uid=0 [ 2741.452250][T21561] Memory cgroup out of memory: Killed process 9540 (syz-executor.0) total-vm:72708kB, anon-rss:2200kB, file-rss:35808kB, shmem-rss:0kB, UID:0 pgtables:143360kB oom_score_adj:1000 [ 2741.754874][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2741.760733][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2741.766521][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2741.772269][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2741.778067][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2741.783804][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2742.154833][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2742.160746][ C0] protocol 88fb is buggy, dev hsr_slave_1 09:40:57 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="a4ab12f728db4b2b4d2f2f3ff7ad273b1e89e46f905080af4c90ccb170e60b3a8bf5", 0x22}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, r0, 0x0, 0x0) 09:40:57 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(&(0x7f0000000040)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa3 3d 00 f0 ff ff 0f 87 f5 00 00 00 85 c0 41 89 c5 0f 85 fc 00 00 [ 2743.560116][ T9920] RSP: 002b:00007ffd393be8e0 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 2743.568544][ T9920] RAX: ffffffffffffffda RBX: 00007ffd393be8e0 RCX: 0000000000457eba 09:40:57 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(&(0x7f0000000040)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa3 3d 00 f0 ff ff 0f 87 f5 00 00 00 85 c0 41 89 c5 0f 85 fc 00 00 [ 2744.370122][ T9920] RSP: 002b:00007ffd393be8e0 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 2744.378526][ T9920] RAX: ffffffffffffffda RBX: 00007ffd393be8e0 RCX: 0000000000457eba [ 2744.386473][ T9920] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 2744.394417][ T9920] RBP: 00007ffd393be920 R08: 0000000000000001 R09: 0000555556485940 09:40:58 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(&(0x7f0000000040)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa3\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa3\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa3\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa30xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) statx(0xffffffffffffffff, 0x0, 0x1000, 0x0, 0x0) 09:41:06 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000140)="11dca50d5e0bcfe47bf070") r1 = gettid() prctl$PR_SET_PTRACER(0x59616d61, r1) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="a4ab12f728db4b2b4d2f2f3ff7ad273b1e89e46f905080af4c90ccb170e60b3a8bf56db763e3062d037dca291318d0a17270bbce74b47888318b04aeb1747555ba16ea10e6ddb915ceb6397e514f3482ca3c4a1d3b9b3c08eaba13", 0x5b}], 0x4, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x38) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 09:41:06 executing program 0: clone(0x42067fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0xe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) 09:41:06 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x10) r1 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000000)="140000002b008151e00f80ecdb4cb90414486516", 0x14}], 0x1}, 0x0) 09:41:06 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) close(r2) [ 2752.554848][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2752.560729][ C0] protocol 88fb is buggy, dev hsr_slave_1 09:41:09 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="a4ab12f728db4b2b4d2f2f3ff7ad273b1e89e46f905080af4c90ccb170e60b3a8bf56db763e3062d037dca291318d0a17270bb", 0x33}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, r0, 0x0, 0x0) 09:41:09 executing program 0: clone(0x42067fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0xe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) 09:41:09 executing program 3: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_STATUS(r0, 0x84, 0xd, 0x0, &(0x7f0000000140)) 09:41:09 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(&(0x7f0000000040)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa3 3d 00 f0 ff ff 0f 87 f5 00 00 00 85 c0 41 89 c5 0f 85 fc 00 00 [ 2756.054177][ T9920] RSP: 002b:00007ffd393be8e0 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 2756.062573][ T9920] RAX: ffffffffffffffda RBX: 00007ffd393be8e0 RCX: 0000000000457eba [ 2756.070539][ T9920] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 2756.078495][ T9920] RBP: 00007ffd393be920 R08: 0000000000000001 R09: 0000555556485940 09:41:10 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(&(0x7f0000000040)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa3\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa3\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa3 89 05 61 0a 66 00 49 8b 89 c8 02 00 00 49 8b 91 c0 02 00 00 48 [ 2757.056285][T21794] RSP: 002b:00007ffd393be8d8 EFLAGS: 00010246 [ 2757.062937][T21794] RAX: 0000555556485c00 RBX: 00007ffd393be8e0 RCX: 0000000000714ea0 [ 2757.070909][T21794] RDX: 000000000040f880 RSI: 0000000000714e90 RDI: 0000555556485c20 [ 2757.078867][T21794] RBP: 00007ffd393be920 R08: 0000000000000001 R09: 0000555556485940 [ 2757.086822][T21794] R10: 0000555556485c10 R11: 0000000000000202 R12: 0000000000000001 [ 2757.086830][T21794] R13: 0000000000000000 R14: 0000000000000000 R15: 00007ffd393be970 [ 2757.096138][T21794] memory: usage 307200kB, limit 307200kB, failcnt 5753 [ 2757.110561][T21794] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2757.117783][T21794] Memory cgroup stats for /syz0: [ 2757.117870][T21794] anon 276021248 [ 2757.117870][T21794] file 2269184 [ 2757.117870][T21794] kernel_stack 4980736 [ 2757.117870][T21794] slab 9908224 [ 2757.117870][T21794] sock 77824 [ 2757.117870][T21794] shmem 2174976 [ 2757.117870][T21794] file_mapped 0 [ 2757.117870][T21794] file_dirty 135168 [ 2757.117870][T21794] file_writeback 0 [ 2757.117870][T21794] anon_thp 260046848 [ 2757.117870][T21794] inactive_anon 2027520 [ 2757.117870][T21794] active_anon 276021248 [ 2757.117870][T21794] inactive_file 94208 [ 2757.117870][T21794] active_file 102400 [ 2757.117870][T21794] unevictable 0 [ 2757.117870][T21794] slab_reclaimable 2297856 [ 2757.117870][T21794] slab_unreclaimable 7610368 [ 2757.117870][T21794] pgfault 250041 [ 2757.117870][T21794] pgmajfault 0 [ 2757.117870][T21794] workingset_refault 1320 [ 2757.117870][T21794] workingset_activate 0 [ 2757.117870][T21794] workingset_nodereclaim 0 [ 2757.117870][T21794] pgrefill 1107 [ 2757.117870][T21794] pgscan 40194 [ 2757.117870][T21794] pgsteal 1516 [ 2757.117884][T21794] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz0,mems_allowed=0-1,oom_memcg=/syz0,task_memcg=/syz0,task=syz-executor.0,pid=9402,uid=0 [ 2757.215329][T21794] Memory cgroup out of memory: Killed process 9402 (syz-executor.0) total-vm:72708kB, anon-rss:2200kB, file-rss:35808kB, shmem-rss:0kB, UID:0 pgtables:143360kB oom_score_adj:1000 [ 2757.250178][ T9920] syz-executor.0 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=0 [ 2757.256109][ T1064] oom_reaper: reaped process 9402 (syz-executor.0), now anon-rss:0kB, file-rss:34848kB, shmem-rss:0kB [ 2757.277768][ T9920] CPU: 0 PID: 9920 Comm: syz-executor.0 Not tainted 5.3.0-rc6-next-20190830 #75 [ 2757.286774][ T9920] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2757.296806][ T9920] Call Trace: [ 2757.296828][ T9920] dump_stack+0x172/0x1f0 [ 2757.296847][ T9920] dump_header+0x177/0x1152 [ 2757.296861][ T9920] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2757.296876][ T9920] ? ___ratelimit+0x2c8/0x595 [ 2757.314850][ T9920] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2757.314867][ T9920] ? lockdep_hardirqs_on+0x418/0x5d0 [ 2757.314880][ T9920] ? trace_hardirqs_on+0x67/0x240 [ 2757.314894][ T9920] ? pagefault_out_of_memory+0x11c/0x11c [ 2757.314910][ T9920] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 2757.347114][ T9920] ? ___ratelimit+0x60/0x595 [ 2757.351686][ T9920] ? do_raw_spin_unlock+0x57/0x270 [ 2757.356768][ T9920] oom_kill_process.cold+0x10/0x15 [ 2757.362056][ T9920] out_of_memory+0x334/0x1340 [ 2757.366705][ T9920] ? lock_downgrade+0x920/0x920 [ 2757.371530][ T9920] ? oom_killer_disable+0x280/0x280 [ 2757.376706][ T9920] mem_cgroup_out_of_memory+0x1d8/0x240 [ 2757.382244][ T9920] ? mem_cgroup_nr_lru_pages+0x1b0/0x1b0 [ 2757.387856][ T9920] ? do_raw_spin_unlock+0x57/0x270 [ 2757.392937][ T9920] ? _raw_spin_unlock+0x2d/0x50 [ 2757.397761][ T9920] try_charge+0xa2d/0x1440 [ 2757.402158][ T9920] ? mem_cgroup_oom_trylock+0x1a0/0x1a0 [ 2757.407686][ T9920] ? percpu_ref_tryget_live+0x111/0x290 [ 2757.413241][ T9920] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2757.419467][ T9920] ? __kasan_check_read+0x11/0x20 [ 2757.424496][ T9920] ? get_mem_cgroup_from_mm+0x156/0x320 [ 2757.430035][ T9920] mem_cgroup_try_charge+0x136/0x590 [ 2757.435303][ T9920] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 2757.441514][ T9920] mem_cgroup_try_charge_delay+0x1f/0xa0 [ 2757.447135][ T9920] wp_page_copy+0x41e/0x1590 [ 2757.451701][ T9920] ? find_held_lock+0x35/0x130 [ 2757.456455][ T9920] ? pmd_pfn+0x1d0/0x1d0 [ 2757.461077][ T9920] ? lock_downgrade+0x920/0x920 [ 2757.465915][ T9920] ? swp_swapcount+0x540/0x540 [ 2757.470650][ T9920] ? __kasan_check_read+0x11/0x20 [ 2757.475642][ T9920] ? do_raw_spin_unlock+0x57/0x270 [ 2757.480724][ T9920] do_wp_page+0x499/0x14d0 [ 2757.485114][ T9920] ? finish_mkwrite_fault+0x570/0x570 [ 2757.490460][ T9920] __handle_mm_fault+0x22f1/0x3f20 [ 2757.495542][ T9920] ? vmf_insert_mixed_mkwrite+0x40/0x40 [ 2757.501062][ T9920] ? __kasan_check_read+0x11/0x20 [ 2757.506078][ T9920] handle_mm_fault+0x1b5/0x6c0 [ 2757.510817][ T9920] __do_page_fault+0x536/0xdd0 [ 2757.515578][ T9920] do_page_fault+0x38/0x590 [ 2757.520106][ T9920] page_fault+0x39/0x40 [ 2757.524243][ T9920] RIP: 0033:0x45801a [ 2757.528108][ T9920] Code: 48 85 db 74 b6 41 bc ca 00 00 00 eb 0c 0f 1f 00 48 8b 5b 08 48 85 db 74 a2 48 8b 3b 48 8b 47 10 48 85 c0 74 05 ff d0 48 8b 3b ff 4f 28 0f 94 c0 84 c0 74 db 8b 47 2c 85 c0 74 d4 45 31 d2 ba [ 2757.547694][ T9920] RSP: 002b:00007ffd393be8e0 EFLAGS: 00010246 [ 2757.553734][ T9920] RAX: 0000000000000000 RBX: 00007ffd393be8e0 RCX: 0000000000457eba [ 2757.561678][ T9920] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000a74fc8 [ 2757.569628][ T9920] RBP: 00007ffd393be920 R08: 0000000000000001 R09: 0000555556485940 [ 2757.577580][ T9920] R10: 0000555556485c10 R11: 0000000000000246 R12: 00000000000000ca [ 2757.585526][ T9920] R13: 0000000000005feb R14: 0000000000000000 R15: 00007ffd393be970 [ 2757.594975][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2757.596859][ T9920] memory: usage 304824kB, limit 307200kB, failcnt 5753 [ 2757.600740][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2757.607748][ T9920] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2757.620294][ T9920] Memory cgroup stats for /syz0: [ 2757.620376][ T9920] anon 273854464 [ 2757.620376][ T9920] file 2269184 [ 2757.620376][ T9920] kernel_stack 4915200 [ 2757.620376][ T9920] slab 9908224 [ 2757.620376][ T9920] sock 77824 [ 2757.620376][ T9920] shmem 2174976 [ 2757.620376][ T9920] file_mapped 0 [ 2757.620376][ T9920] file_dirty 135168 [ 2757.620376][ T9920] file_writeback 0 [ 2757.620376][ T9920] anon_thp 257949696 [ 2757.620376][ T9920] inactive_anon 2027520 [ 2757.620376][ T9920] active_anon 273854464 [ 2757.620376][ T9920] inactive_file 94208 [ 2757.620376][ T9920] active_file 102400 [ 2757.620376][ T9920] unevictable 0 [ 2757.620376][ T9920] slab_reclaimable 2297856 [ 2757.620376][ T9920] slab_unreclaimable 7610368 [ 2757.620376][ T9920] pgfault 250107 [ 2757.620376][ T9920] pgmajfault 0 [ 2757.620376][ T9920] workingset_refault 1320 [ 2757.620376][ T9920] workingset_activate 0 [ 2757.620376][ T9920] workingset_nodereclaim 0 [ 2757.620376][ T9920] pgrefill 1107 [ 2757.620376][ T9920] pgscan 40194 [ 2757.620376][ T9920] pgsteal 1516 [ 2757.716449][ T9920] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz0,mems_allowed=0-1,oom_memcg=/syz0,task_memcg=/syz0,task=syz-executor.0,pid=9317,uid=0 [ 2757.732757][ T9920] Memory cgroup out of memory: Killed process 9317 (syz-executor.0) total-vm:72840kB, anon-rss:2208kB, file-rss:35800kB, shmem-rss:0kB, UID:0 pgtables:143360kB oom_score_adj:1000 [ 2757.830232][T21800] device nr0 entered promiscuous mode 09:41:12 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="a4ab12f728db4b2b4d2f2f3ff7ad273b1e89e46f905080af4c90ccb170e60b3a8bf56db763e3062d037dca291318d0a17270bbce74b46f4db2a92b", 0x3b}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, r0, 0x0, 0x0) 09:41:12 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000140)="11dca50d5e0bcfe47bf070") r1 = gettid() prctl$PR_SET_PTRACER(0x59616d61, r1) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="a4ab12f728db4b2b4d2f2f3ff7ad273b1e89e46f905080af4c90ccb170e60b3a8bf56db763e3062d037dca291318d0a17270bbce74b47888318b04aeb1747555ba16ea10e6ddb915ceb6397e514f3482ca3c4a1d3b9b3c08eaba13", 0x5b}], 0x4, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x38) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 09:41:12 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r1, 0x80000000000000bd) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, 0x0}}], 0x4000000000000c7, 0x0, 0x0) close(r2) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) close(r2) 09:41:12 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(&(0x7f0000000040)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa3\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa3\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa3\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa3\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa30x0) ioctl$RTC_WIE_OFF(0xffffffffffffffff, 0x7010) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000400)={{{@in6=@mcast1, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x2, 0xa0, 0x20, 0x67, 0x0, r2}, {0x0, 0x6, 0x0, 0x8, 0x9, 0x0, 0x0, 0x6}, {0x1, 0x7, 0x7}, 0x8433, 0x6e6bb4, 0x2, 0x1, 0x1}, {{@in6=@initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x4d6}, 0x0, @in=@multicast1, 0x0, 0x3, 0x1, 0x0, 0x0, 0x401, 0x3}}, 0xe8) setsockopt$netlink_NETLINK_CAP_ACK(r1, 0x10e, 0xa, &(0x7f0000000000)=0x8, 0x4) ioctl$KDENABIO(r1, 0x4b36) bind(r1, &(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x2, 0x4, 0x3, {0xa, 0x4e21, 0x0, @initdev={0xfe, 0x88, [], 0x1, 0x0}}}}, 0x80) perf_event_open(&(0x7f0000000080)={0x0, 0x70, 0x2, 0x20, 0x800000, 0x5, 0x0, 0x2, 0x400, 0x10, 0xfffffffffffffffd, 0x3, 0x2, 0xd8, 0x0, 0x5, 0x800, 0x0, 0x4000000000000, 0x0, 0xac4, 0x9, 0x100000001, 0x0, 0x1, 0x90189efc00000000, 0x0, 0x7, 0x8, 0x2, 0xfffffffffffffff8, 0x7, 0x3dbd, 0x81b9, 0x0, 0x800, 0x1, 0xea1f, 0x0, 0x101, 0xbc0eeb1d3bda44e5, @perf_bp={&(0x7f0000000000), 0x3}, 0x0, 0x1, 0x8, 0x1, 0x92, 0x6, 0x26}, r0, 0x9, r1, 0xa) fcntl$getown(0xffffffffffffffff, 0x9) r3 = open(&(0x7f0000000040)='./bus\x00', 0x8001141042, 0x0) ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0x0) r4 = creat(&(0x7f0000000340)='./file0\x00', 0x100000000) getsockopt$inet_mreqn(r4, 0x0, 0x0, 0x0, 0x0) ioctl$RTC_WIE_OFF(r4, 0x7010) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000000400)={{{@in6=@mcast1, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x2, 0xa0, 0x20, 0x67}, {0x0, 0x6, 0x0, 0x8, 0x9, 0x0, 0x0, 0x6}, {0x1, 0x7, 0x7}, 0x8433, 0x6e6bb4, 0x2, 0x1, 0x1}, {{@in6=@initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x4d6}, 0x0, @in=@multicast1, 0x3500, 0x3, 0x1, 0x0, 0x0, 0x401, 0x3}}, 0xe8) setsockopt$netlink_NETLINK_CAP_ACK(r4, 0x10e, 0xa, &(0x7f0000000000)=0x8, 0x4) ioctl$KDENABIO(r4, 0x4b36) ioctl$RNDCLEARPOOL(r4, 0x5206, &(0x7f0000000140)=0x800) ftruncate(r3, 0x2007fff) 09:41:22 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(&(0x7f0000000040)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa30x0}, &(0x7f0000000100)=0xc) r1 = perf_event_open(0x0, r0, 0x0, 0xffffffffffffffff, 0x0) fremovexattr(r1, &(0x7f0000000140)=@random={'user.', '\\\'GPL(\x00'}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@textreal={0x8, &(0x7f0000000080)="f2a6bad004b00fee0f090f3036f30f1a970000660f3806581e0f08bad004b0beeef30f2af8baa100b000ee", 0x2b}], 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f0000000040)=0x96d1, 0x4) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000340)=ANY=[@ANYBLOB="1300000036ffff0180000006003950"], 0xf) r6 = dup(r5) write$FUSE_BMAP(0xffffffffffffffff, &(0x7f0000000000)={0x18}, 0x18) write$FUSE_ENTRY(r6, &(0x7f0000000280)={0x90}, 0x90) r7 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000d00)='/dev/hwrng\x00', 0xe0540, 0x0) pipe2(0x0, 0x80800) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r8, 0x0, 0x0) r9 = dup(r8) write$FUSE_BMAP(r9, &(0x7f0000000000)={0x18}, 0x18) write$FUSE_ENTRY(r9, &(0x7f0000000280)={0x90}, 0x90) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f0000000e80)={&(0x7f0000000400), 0xc, &(0x7f0000000e40)={&(0x7f0000000ec0)=ANY=[@ANYRES16=0x0, @ANYRES32, @ANYBLOB='\b\x00', @ANYRES32=r7, @ANYBLOB="08000100", @ANYBLOB, @ANYBLOB], 0x7}}, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f00000002c0)={[0x0, 0x0, 0x40000004, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) keyctl$revoke(0x3, 0x0) keyctl$instantiate_iov(0x14, 0x0, 0x0, 0x0, 0x0) keyctl$setperm(0x5, 0x0, 0x4000500) 09:41:22 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000140)="11dca50d5e0bcfe47bf070") r1 = gettid() prctl$PR_SET_PTRACER(0x59616d61, r1) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="a4ab12f728db4b2b4d2f2f3ff7ad273b1e89e46f905080af4c90ccb170e60b3a8bf56db763e3062d037dca291318d0a17270bbce74b47888318b04aeb1747555ba16ea10e6ddb915ceb6397e514f3482ca3c4a1d3b9b3c08eaba13", 0x5b}], 0x4, 0x0) tkill(r2, 0x38) ptrace$cont(0x18, r2, 0x0, 0x0) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 09:41:22 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000140)="11dca50d5e0bcfe47bf070") r1 = gettid() prctl$PR_SET_PTRACER(0x59616d61, r1) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="a4ab12f728db4b2b4d2f2f3ff7ad273b1e89e46f905080af4c90ccb170e60b3a8bf56db763e3062d037dca291318d0a17270bbce74b47888318b04aeb1747555ba16ea10e6ddb915ceb6397e514f3482ca3c4a1d3b9b3c08eaba13", 0x5b}], 0x4, 0x0) tkill(r2, 0x38) ptrace$cont(0x18, r2, 0x0, 0x0) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 09:41:22 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000140)="11dca50d5e0bcfe47bf070") r1 = gettid() prctl$PR_SET_PTRACER(0x59616d61, r1) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x38) ptrace$cont(0x18, r2, 0x0, 0x0) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) [ 2768.768415][T21977] syz-executor.0 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 2768.785358][T21977] CPU: 1 PID: 21977 Comm: syz-executor.0 Not tainted 5.3.0-rc6-next-20190830 #75 [ 2768.794552][T21977] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2768.804605][T21977] Call Trace: [ 2768.807934][T21977] dump_stack+0x172/0x1f0 [ 2768.812262][T21977] dump_header+0x177/0x1152 [ 2768.816809][T21977] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2768.822652][T21977] ? ___ratelimit+0x2c8/0x595 [ 2768.827300][T21977] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2768.833085][T21977] ? lockdep_hardirqs_on+0x418/0x5d0 [ 2768.838393][T21977] ? trace_hardirqs_on+0x67/0x240 [ 2768.843408][T21977] ? pagefault_out_of_memory+0x11c/0x11c [ 2768.849030][T21977] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 2768.854823][T21977] ? ___ratelimit+0x60/0x595 [ 2768.859397][T21977] ? do_raw_spin_unlock+0x57/0x270 [ 2768.864490][T21977] oom_kill_process.cold+0x10/0x15 [ 2768.869588][T21977] out_of_memory+0x334/0x1340 [ 2768.874239][T21977] ? lock_downgrade+0x920/0x920 [ 2768.879092][T21977] ? mem_cgroup_unmark_under_oom+0x8d/0xb0 [ 2768.884887][T21977] ? oom_killer_disable+0x280/0x280 [ 2768.890075][T21977] mem_cgroup_out_of_memory+0x1d8/0x240 [ 2768.895632][T21977] ? mem_cgroup_nr_lru_pages+0x1b0/0x1b0 [ 2768.901258][T21977] ? do_raw_spin_unlock+0x57/0x270 [ 2768.906357][T21977] ? _raw_spin_unlock+0x2d/0x50 [ 2768.911189][T21977] try_charge+0xf4b/0x1440 [ 2768.915601][T21977] ? mem_cgroup_oom_trylock+0x1a0/0x1a0 [ 2768.921147][T21977] ? percpu_ref_tryget_live+0x111/0x290 [ 2768.926678][T21977] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2768.932901][T21977] ? __kasan_check_read+0x11/0x20 [ 2768.937923][T21977] ? get_mem_cgroup_from_mm+0x156/0x320 [ 2768.943451][T21977] mem_cgroup_try_charge+0x136/0x590 [ 2768.948721][T21977] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 2768.954945][T21977] mem_cgroup_try_charge_delay+0x1f/0xa0 [ 2768.960566][T21977] __handle_mm_fault+0x1e34/0x3f20 [ 2768.965671][T21977] ? vmf_insert_mixed_mkwrite+0x40/0x40 [ 2768.971349][T21977] ? __kasan_check_read+0x11/0x20 [ 2768.976372][T21977] handle_mm_fault+0x1b5/0x6c0 [ 2768.981152][T21977] __do_page_fault+0x536/0xdd0 [ 2768.985918][T21977] do_page_fault+0x38/0x590 [ 2768.990415][T21977] page_fault+0x39/0x40 [ 2768.994656][T21977] RIP: 0033:0x41122f [ 2768.998534][T21977] Code: 0f 84 c8 02 00 00 48 83 bd 78 ff ff ff 00 0f 84 f9 04 00 00 48 8b 95 68 ff ff ff 44 89 95 38 ff ff ff 4c 8d ac 10 00 f7 ff ff <49> 89 85 90 06 00 00 49 8d 85 10 03 00 00 49 89 95 98 06 00 00 41 [ 2769.018156][T21977] RSP: 002b:00007ffd393be690 EFLAGS: 00010206 [ 2769.024207][T21977] RAX: 00007f0b10bed000 RBX: 0000000000020000 RCX: 000000000045993a [ 2769.032175][T21977] RDX: 0000000000021000 RSI: 0000000000021000 RDI: 0000000000000000 [ 2769.040128][T21977] RBP: 00007ffd393be770 R08: ffffffffffffffff R09: 0000000000000000 [ 2769.048073][T21977] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd393be860 [ 2769.056030][T21977] R13: 00007f0b10c0d700 R14: 0000000000000002 R15: 000000000075c07c [ 2769.064113][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2769.069877][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2769.075732][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2769.081514][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2769.087368][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2769.093123][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2769.099234][T21977] memory: usage 307200kB, limit 307200kB, failcnt 5816 [ 2769.106134][T21977] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2769.112968][T21977] Memory cgroup stats for /syz0: [ 2769.113035][T21977] anon 273874944 [ 2769.113035][T21977] file 2269184 [ 2769.113035][T21977] kernel_stack 4980736 [ 2769.113035][T21977] slab 12283904 [ 2769.113035][T21977] sock 77824 [ 2769.113035][T21977] shmem 2174976 [ 2769.113035][T21977] file_mapped 0 [ 2769.113035][T21977] file_dirty 135168 [ 2769.113035][T21977] file_writeback 0 [ 2769.113035][T21977] anon_thp 257949696 [ 2769.113035][T21977] inactive_anon 2027520 [ 2769.113035][T21977] active_anon 273805312 [ 2769.113035][T21977] inactive_file 94208 [ 2769.113035][T21977] active_file 102400 [ 2769.113035][T21977] unevictable 0 [ 2769.113035][T21977] slab_reclaimable 2568192 [ 2769.113035][T21977] slab_unreclaimable 9715712 [ 2769.113035][T21977] pgfault 250965 [ 2769.113035][T21977] pgmajfault 0 [ 2769.113035][T21977] workingset_refault 1320 [ 2769.113035][T21977] workingset_activate 0 [ 2769.113035][T21977] workingset_nodereclaim 0 [ 2769.113035][T21977] pgrefill 1107 [ 2769.113035][T21977] pgscan 40194 [ 2769.113035][T21977] pgsteal 1516 [ 2769.209567][T21977] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz0,mems_allowed=0-1,oom_memcg=/syz0,task_memcg=/syz0,task=syz-executor.0,pid=21977,uid=0 [ 2769.226286][T21977] Memory cgroup out of memory: Killed process 21977 (syz-executor.0) total-vm:72844kB, anon-rss:2212kB, file-rss:35856kB, shmem-rss:0kB, UID:0 pgtables:147456kB oom_score_adj:1000 [ 2769.245383][ T1064] [ 2769.247710][ T1064] ============================================ [ 2769.253871][ T1064] WARNING: possible recursive locking detected [ 2769.259995][ T1064] 5.3.0-rc6-next-20190830 #75 Not tainted [ 2769.265680][ T1064] -------------------------------------------- [ 2769.271800][ T1064] oom_reaper/1064 is trying to acquire lock: [ 2769.277741][ T1064] ffffffff8904ff60 (mmu_notifier_invalidate_range_start){+.+.}, at: __mmu_notifier_invalidate_range_end+0x0/0x360 [ 2769.289687][ T1064] [ 2769.289687][ T1064] but task is already holding lock: [ 2769.297020][ T1064] ffffffff8904ff60 (mmu_notifier_invalidate_range_start){+.+.}, at: __oom_reap_task_mm+0x196/0x490 [ 2769.307661][ T1064] [ 2769.307661][ T1064] other info that might help us debug this: [ 2769.315685][ T1064] Possible unsafe locking scenario: [ 2769.315685][ T1064] [ 2769.323130][ T1064] CPU0 [ 2769.326384][ T1064] ---- [ 2769.329634][ T1064] lock(mmu_notifier_invalidate_range_start); [ 2769.335841][ T1064] lock(mmu_notifier_invalidate_range_start); [ 2769.341975][ T1064] [ 2769.341975][ T1064] *** DEADLOCK *** [ 2769.341975][ T1064] [ 2769.350087][ T1064] May be due to missing lock nesting notation [ 2769.350087][ T1064] [ 2769.358408][ T1064] 2 locks held by oom_reaper/1064: [ 2769.363496][ T1064] #0: ffff888064702510 (&mm->mmap_sem#2){++++}, at: oom_reaper+0x3a7/0x1320 [ 2769.372232][ T1064] #1: ffffffff8904ff60 (mmu_notifier_invalidate_range_start){+.+.}, at: __oom_reap_task_mm+0x196/0x490 [ 2769.383310][ T1064] [ 2769.383310][ T1064] stack backtrace: [ 2769.389173][ T1064] CPU: 1 PID: 1064 Comm: oom_reaper Not tainted 5.3.0-rc6-next-20190830 #75 [ 2769.397944][ T1064] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2769.407974][ T1064] Call Trace: [ 2769.411246][ T1064] dump_stack+0x172/0x1f0 [ 2769.415558][ T1064] __lock_acquire.cold+0x15d/0x385 [ 2769.420657][ T1064] ? mark_held_locks+0xf0/0xf0 [ 2769.425398][ T1064] ? unmap_page_range+0x1df4/0x2380 [ 2769.430575][ T1064] lock_acquire+0x190/0x410 [ 2769.435080][ T1064] ? __mmu_notifier_invalidate_range_start+0x210/0x210 [ 2769.441926][ T1064] __mmu_notifier_invalidate_range_end+0x3c/0x360 [ 2769.448312][ T1064] ? __mmu_notifier_invalidate_range_start+0x210/0x210 [ 2769.455135][ T1064] ? __mmu_notifier_invalidate_range_start+0x1a5/0x210 [ 2769.462054][ T1064] __oom_reap_task_mm+0x3fa/0x490 [ 2769.467056][ T1064] ? process_shares_mm+0x130/0x130 [ 2769.472148][ T1064] ? oom_reaper+0x3a7/0x1320 [ 2769.476836][ T1064] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2769.483054][ T1064] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 2769.489012][ T1064] ? __kasan_check_read+0x11/0x20 [ 2769.494010][ T1064] ? do_raw_spin_unlock+0x57/0x270 [ 2769.499098][ T1064] oom_reaper+0x2b2/0x1320 [ 2769.503494][ T1064] ? __oom_reap_task_mm+0x490/0x490 [ 2769.508667][ T1064] ? trace_hardirqs_on+0x67/0x240 [ 2769.513672][ T1064] ? finish_wait+0x260/0x260 [ 2769.518241][ T1064] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 2769.524460][ T1064] ? __kthread_parkme+0x108/0x1c0 [ 2769.529472][ T1064] ? __kasan_check_read+0x11/0x20 [ 2769.534571][ T1064] kthread+0x361/0x430 [ 2769.538609][ T1064] ? __oom_reap_task_mm+0x490/0x490 [ 2769.543779][ T1064] ? kthread_cancel_delayed_work_sync+0x20/0x20 [ 2769.549988][ T1064] ret_from_fork+0x24/0x30 [ 2769.556284][ T1064] oom_reaper: reaped process 21977 (syz-executor.0), now anon-rss:0kB, file-rss:34896kB, shmem-rss:4kB [ 2769.573854][T21977] kobject: 'kvm' (00000000409f5fab): kobject_uevent_env [ 2769.580857][T21977] kobject: 'kvm' (00000000409f5fab): fill_kobj_path: path = '/devices/virtual/misc/kvm' [ 2769.611812][ T3890] kobject: 'loop0' (00000000d6c60d43): kobject_uevent_env [ 2769.619261][ T3890] kobject: 'loop0' (00000000d6c60d43): fill_kobj_path: path = '/devices/virtual/block/loop0' 09:41:24 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="a4ab12f728db4b2b4d2f2f3ff7ad273b1e89e46f905080af4c90ccb170e60b3a8bf56db763e3062d037dca291318d0a17270bbce74b46f4db2a92ba0c9fb22", 0x3f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, r0, 0x0, 0x0) 09:41:24 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(&(0x7f0000000040)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa30x0}, &(0x7f0000000100)=0xc) r1 = perf_event_open(0x0, r0, 0x0, 0xffffffffffffffff, 0x0) fremovexattr(r1, &(0x7f0000000140)=@random={'user.', '\\\'GPL(\x00'}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@textreal={0x8, &(0x7f0000000080)="f2a6bad004b00fee0f090f3036f30f1a970000660f3806581e0f08bad004b0beeef30f2af8baa100b000ee", 0x2b}], 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f0000000040)=0x96d1, 0x4) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000340)=ANY=[@ANYBLOB="1300000036ffff0180000006003950"], 0xf) r6 = dup(r5) write$FUSE_BMAP(0xffffffffffffffff, &(0x7f0000000000)={0x18}, 0x18) write$FUSE_ENTRY(r6, &(0x7f0000000280)={0x90}, 0x90) r7 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000d00)='/dev/hwrng\x00', 0xe0540, 0x0) pipe2(0x0, 0x80800) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r8, 0x0, 0x0) r9 = dup(r8) write$FUSE_BMAP(r9, &(0x7f0000000000)={0x18}, 0x18) write$FUSE_ENTRY(r9, &(0x7f0000000280)={0x90}, 0x90) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f0000000e80)={&(0x7f0000000400), 0xc, &(0x7f0000000e40)={&(0x7f0000000ec0)=ANY=[@ANYRES16=0x0, @ANYRES32, @ANYBLOB='\b\x00', @ANYRES32=r7, @ANYBLOB="08000100", @ANYBLOB, @ANYBLOB], 0x7}}, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f00000002c0)={[0x0, 0x0, 0x40000004, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) keyctl$revoke(0x3, 0x0) keyctl$instantiate_iov(0x14, 0x0, 0x0, 0x0, 0x0) keyctl$setperm(0x5, 0x0, 0x4000500) 09:41:24 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() r2 = fcntl$dupfd(r0, 0x0, r0) getsockopt$ARPT_SO_GET_ENTRIES(r2, 0x0, 0x61, 0x0, &(0x7f0000000000)) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x39) fcntl$setstatus(r0, 0x4, 0x2000) ioctl(0xffffffffffffffff, 0x0, 0x0) 09:41:24 executing program 3: sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000000c0)={0x0}, &(0x7f0000000100)=0xc) r1 = perf_event_open(0x0, r0, 0x0, 0xffffffffffffffff, 0x0) fremovexattr(r1, &(0x7f0000000140)=@random={'user.', '\\\'GPL(\x00'}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@textreal={0x8, &(0x7f0000000080)="f2a6bad004b00fee0f090f3036f30f1a970000660f3806581e0f08bad004b0beeef30f2af8baa100b000ee", 0x2b}], 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f0000000040)=0x96d1, 0x4) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000340)=ANY=[@ANYBLOB="1300000036ffff0180000006003950"], 0xf) r6 = dup(r5) write$FUSE_BMAP(0xffffffffffffffff, &(0x7f0000000000)={0x18}, 0x18) write$FUSE_ENTRY(r6, &(0x7f0000000280)={0x90}, 0x90) r7 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000d00)='/dev/hwrng\x00', 0xe0540, 0x0) pipe2(0x0, 0x80800) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r8, 0x0, 0x0) r9 = dup(r8) write$FUSE_BMAP(r9, &(0x7f0000000000)={0x18}, 0x18) write$FUSE_ENTRY(r9, &(0x7f0000000280)={0x90}, 0x90) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f0000000e80)={&(0x7f0000000400), 0xc, &(0x7f0000000e40)={&(0x7f0000000ec0)=ANY=[@ANYRES16=0x0, @ANYRES32, @ANYBLOB='\b\x00', @ANYRES32=r7, @ANYBLOB="08000100", @ANYBLOB, @ANYBLOB], 0x7}}, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f00000002c0)={[0x0, 0x0, 0x40000004, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) keyctl$revoke(0x3, 0x0) keyctl$instantiate_iov(0x14, 0x0, 0x0, 0x0, 0x0) keyctl$setperm(0x5, 0x0, 0x4000500) [ 2770.652537][ T3890] kobject: 'loop4' (00000000813b0397): kobject_uevent_env [ 2770.661139][ T3890] kobject: 'loop4' (00000000813b0397): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 2770.672878][ T3890] kobject: 'loop3' (00000000db31cb6a): kobject_uevent_env [ 2770.724950][ T3890] kobject: 'loop3' (00000000db31cb6a): fill_kobj_path: path = '/devices/virtual/block/loop3' [ 2770.776938][T21995] syz-executor.0 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 2770.847057][T21996] kobject: 'kvm' (00000000409f5fab): kobject_uevent_env [ 2770.860020][T21995] CPU: 1 PID: 21995 Comm: syz-executor.0 Not tainted 5.3.0-rc6-next-20190830 #75 [ 2770.869220][T21995] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2770.879257][T21995] Call Trace: [ 2770.882533][T21995] dump_stack+0x172/0x1f0 [ 2770.886863][T21995] dump_header+0x177/0x1152 [ 2770.891353][T21995] ? ___ratelimit+0xf8/0x595 09:41:25 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(&(0x7f0000000040)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa3 89 85 90 06 00 00 49 8d 85 10 03 00 00 49 89 95 98 06 00 00 41 [ 2771.110879][T21992] kobject: 'kvm' (00000000409f5fab): kobject_uevent_env [ 2771.117993][T21995] RSP: 002b:00007ffd393be690 EFLAGS: 00010206 [ 2771.118002][T21995] RAX: 00007f0b10c0f000 RBX: 0000000000020000 RCX: 000000000045993a [ 2771.118009][T21995] RDX: 0000000000021000 RSI: 0000000000021000 RDI: 0000000000000000 [ 2771.118015][T21995] RBP: 00007ffd393be770 R08: ffffffffffffffff R09: 0000000000000000 [ 2771.118021][T21995] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd393be860 [ 2771.118027][T21995] R13: 00007f0b10c2f700 R14: 0000000000000001 R15: 000000000075bfd4 [ 2771.121814][T21995] memory: usage 307200kB, limit 307200kB, failcnt 5836 [ 2771.159021][T21992] kobject: 'kvm' (00000000409f5fab): fill_kobj_path: path = '/devices/virtual/misc/kvm' [ 2771.178158][T21995] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 09:41:25 executing program 3: sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000000c0)={0x0}, &(0x7f0000000100)=0xc) r1 = perf_event_open(0x0, r0, 0x0, 0xffffffffffffffff, 0x0) fremovexattr(r1, &(0x7f0000000140)=@random={'user.', '\\\'GPL(\x00'}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@textreal={0x8, &(0x7f0000000080)="f2a6bad004b00fee0f090f3036f30f1a970000660f3806581e0f08bad004b0beeef30f2af8baa100b000ee", 0x2b}], 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f0000000040)=0x96d1, 0x4) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000340)=ANY=[@ANYBLOB="1300000036ffff0180000006003950"], 0xf) r6 = dup(r5) write$FUSE_BMAP(0xffffffffffffffff, &(0x7f0000000000)={0x18}, 0x18) write$FUSE_ENTRY(r6, &(0x7f0000000280)={0x90}, 0x90) r7 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000d00)='/dev/hwrng\x00', 0xe0540, 0x0) pipe2(0x0, 0x80800) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r8, 0x0, 0x0) r9 = dup(r8) write$FUSE_BMAP(r9, &(0x7f0000000000)={0x18}, 0x18) write$FUSE_ENTRY(r9, &(0x7f0000000280)={0x90}, 0x90) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f0000000e80)={&(0x7f0000000400), 0xc, &(0x7f0000000e40)={&(0x7f0000000ec0)=ANY=[@ANYRES16=0x0, @ANYRES32, @ANYBLOB='\b\x00', @ANYRES32=r7, @ANYBLOB="08000100", @ANYBLOB, @ANYBLOB], 0x7}}, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f00000002c0)={[0x0, 0x0, 0x40000004, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) keyctl$revoke(0x3, 0x0) keyctl$instantiate_iov(0x14, 0x0, 0x0, 0x0, 0x0) keyctl$setperm(0x5, 0x0, 0x4000500) [ 2771.214123][T21995] Memory cgroup stats for /syz0: [ 2771.214232][T21995] anon 273793024 [ 2771.214232][T21995] file 2269184 [ 2771.214232][T21995] kernel_stack 4980736 [ 2771.214232][T21995] slab 12439552 [ 2771.214232][T21995] sock 77824 [ 2771.214232][T21995] shmem 2174976 [ 2771.214232][T21995] file_mapped 0 [ 2771.214232][T21995] file_dirty 135168 [ 2771.214232][T21995] file_writeback 0 [ 2771.214232][T21995] anon_thp 257949696 [ 2771.214232][T21995] inactive_anon 2027520 [ 2771.214232][T21995] active_anon 273797120 [ 2771.214232][T21995] inactive_file 94208 [ 2771.214232][T21995] active_file 102400 [ 2771.214232][T21995] unevictable 0 [ 2771.214232][T21995] slab_reclaimable 2568192 [ 2771.214232][T21995] slab_unreclaimable 9871360 [ 2771.214232][T21995] pgfault 251031 [ 2771.214232][T21995] pgmajfault 0 [ 2771.214232][T21995] workingset_refault 1320 [ 2771.214232][T21995] workingset_activate 0 [ 2771.214232][T21995] workingset_nodereclaim 0 [ 2771.214232][T21995] pgrefill 1107 [ 2771.214232][T21995] pgscan 40194 [ 2771.214232][T21995] pgsteal 1516 [ 2771.259030][ T3890] kobject: 'loop3' (00000000db31cb6a): kobject_uevent_env 09:41:25 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(&(0x7f0000000040)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa30x0}, &(0x7f0000000100)=0xc) r1 = perf_event_open(0x0, r0, 0x0, 0xffffffffffffffff, 0x0) fremovexattr(r1, &(0x7f0000000140)=@random={'user.', '\\\'GPL(\x00'}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@textreal={0x8, &(0x7f0000000080)="f2a6bad004b00fee0f090f3036f30f1a970000660f3806581e0f08bad004b0beeef30f2af8baa100b000ee", 0x2b}], 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f0000000040)=0x96d1, 0x4) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000340)=ANY=[@ANYBLOB="1300000036ffff0180000006003950"], 0xf) r6 = dup(r5) write$FUSE_BMAP(0xffffffffffffffff, &(0x7f0000000000)={0x18}, 0x18) write$FUSE_ENTRY(r6, &(0x7f0000000280)={0x90}, 0x90) r7 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000d00)='/dev/hwrng\x00', 0xe0540, 0x0) pipe2(0x0, 0x80800) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r8, 0x0, 0x0) r9 = dup(r8) write$FUSE_BMAP(r9, &(0x7f0000000000)={0x18}, 0x18) write$FUSE_ENTRY(r9, &(0x7f0000000280)={0x90}, 0x90) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f0000000e80)={&(0x7f0000000400), 0xc, &(0x7f0000000e40)={&(0x7f0000000ec0)=ANY=[@ANYRES16=0x0, @ANYRES32, @ANYBLOB='\b\x00', @ANYRES32=r7, @ANYBLOB="08000100", @ANYBLOB, @ANYBLOB], 0x7}}, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f00000002c0)={[0x0, 0x0, 0x40000004, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) keyctl$revoke(0x3, 0x0) keyctl$instantiate_iov(0x14, 0x0, 0x0, 0x0, 0x0) keyctl$setperm(0x5, 0x0, 0x4000500) [ 2771.618624][T21998] oom_kill_process.cold+0x10/0x15 [ 2771.623709][T21998] out_of_memory+0x334/0x1340 [ 2771.628367][T21998] ? lock_downgrade+0x920/0x920 [ 2771.633211][T21998] ? oom_killer_disable+0x280/0x280 [ 2771.638408][T21998] ? __kasan_check_read+0x11/0x20 [ 2771.642202][ T3890] kobject: 'loop3' (00000000db31cb6a): kobject_uevent_env [ 2771.643425][T21998] mem_cgroup_out_of_memory+0x1d8/0x240 [ 2771.655140][ T3890] kobject: 'loop3' (00000000db31cb6a): fill_kobj_path: path = '/devices/virtual/block/loop3' [ 2771.656017][T21998] ? mem_cgroup_nr_lru_pages+0x1b0/0x1b0 [ 2771.671742][T21998] ? do_raw_spin_unlock+0x57/0x270 [ 2771.676866][T21998] ? _raw_spin_unlock+0x2d/0x50 [ 2771.681687][T21998] try_charge+0xa2d/0x1440 [ 2771.686088][T21998] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 2771.692355][T21998] ? mem_cgroup_oom_trylock+0x1a0/0x1a0 [ 2771.697903][T21998] ? __kasan_check_read+0x11/0x20 [ 2771.702913][T21998] ? cache_grow_begin+0x122/0xd20 [ 2771.707921][T21998] ? __kasan_check_read+0x11/0x20 [ 2771.712947][T21998] __memcg_kmem_charge_memcg+0x71/0xf0 [ 2771.718399][T21998] ? memcg_kmem_put_cache+0x50/0x50 [ 2771.723581][T21998] ? cache_grow_begin+0x70b/0xd20 [ 2771.726558][T22026] kobject: 'kvm' (00000000409f5fab): kobject_uevent_env [ 2771.728600][T21998] cache_grow_begin+0x629/0xd20 [ 2771.728614][T21998] ? __sanitizer_cov_trace_cmp2+0x11/0x20 [ 2771.728625][T21998] ? mempolicy_slab_node+0x139/0x390 [ 2771.728639][T21998] fallback_alloc+0x1fd/0x2d0 [ 2771.736679][T22026] kobject: 'kvm' (00000000409f5fab): fill_kobj_path: path = '/devices/virtual/misc/kvm' [ 2771.740398][T21998] ____cache_alloc_node+0x1bc/0x1d0 09:41:25 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$inet6(0xa, 0x80002, 0x88) bind$inet6(r0, &(0x7f00000001c0)={0xa, 0x10010000004e20}, 0x1c) openat$tun(0xffffffffffffff9c, &(0x7f0000001680)='/dev/net/tun\x00', 0x2040, 0x0) socket(0xa3bfad5392917cba, 0x4, 0x100000000) pipe2(&(0x7f0000000a40)={0xffffffffffffffff, 0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x80000) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @loopback}, @rand_addr="da480026f377153de4730013eeba74e9", @remote, 0x100000001, 0x10001, 0xcc, 0x400, 0x7, 0x43, r2}) pipe2(&(0x7f0000000a40), 0x2000000000083ffc) r3 = syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') preadv(r3, &(0x7f0000000280)=[{&(0x7f0000000180)=""/198, 0xc6}, {&(0x7f0000000080)=""/9, 0x9}, {&(0x7f0000000400)=""/242, 0xf2}, {&(0x7f0000000500)=""/4096, 0x1000}, {&(0x7f00000000c0)=""/121, 0x79}], 0x5, 0x0) [ 2771.740413][T21998] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 2771.740424][T21998] kmem_cache_alloc+0x1ef/0x710 [ 2771.740442][T21998] alloc_inode+0x16f/0x1e0 [ 2771.769029][T22024] kobject: 'kvm' (00000000409f5fab): kobject_uevent_env [ 2771.770968][T21998] new_inode_pseudo+0x19/0xf0 [ 2771.770981][T21998] new_inode+0x1f/0x40 [ 2771.771016][T21998] debugfs_get_inode+0x1a/0x130 [ 2771.777374][T22024] kobject: 'kvm' (00000000409f5fab): fill_kobj_path: path = '/devices/virtual/misc/kvm' [ 2771.782060][T21998] __debugfs_create_file+0xb7/0x3f0 [ 2771.782074][T21998] debugfs_create_file+0x5a/0x70 [ 2771.782089][T21998] kvm_dev_ioctl+0xa04/0x1650 [ 2771.831482][T21998] ? kvm_debugfs_release+0x90/0x90 [ 2771.836585][T21998] ? kvm_debugfs_release+0x90/0x90 [ 2771.841685][T21998] do_vfs_ioctl+0xdb6/0x13e0 [ 2771.846275][T21998] ? ioctl_preallocate+0x210/0x210 [ 2771.851376][T21998] ? __fget+0x384/0x560 [ 2771.855533][T21998] ? ksys_dup3+0x3e0/0x3e0 [ 2771.859930][T21998] ? nsecs_to_jiffies+0x30/0x30 [ 2771.864807][T21998] ? tomoyo_file_ioctl+0x23/0x30 [ 2771.869736][T21998] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2771.875964][T21998] ? security_file_ioctl+0x8d/0xc0 [ 2771.881054][T21998] ksys_ioctl+0xab/0xd0 [ 2771.885182][T21998] __x64_sys_ioctl+0x73/0xb0 [ 2771.889744][T21998] do_syscall_64+0xfa/0x760 [ 2771.894229][T21998] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2771.900101][T21998] RIP: 0033:0x4598e9 [ 2771.903967][T21998] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2771.923542][T21998] RSP: 002b:00007f0b10c4fc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2771.931922][T21998] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004598e9 [ 2771.939862][T21998] RDX: 0000000000000000 RSI: 000000000000ae01 RDI: 0000000000000004 [ 2771.947800][T21998] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 2771.955741][T21998] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f0b10c506d4 [ 2771.963684][T21998] R13: 00000000004c2841 R14: 00000000004d5ec8 R15: 00000000ffffffff 09:41:26 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000140)="11dca50d5e0bcfe47bf070") r1 = gettid() prctl$PR_SET_PTRACER(0x59616d61, r1) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x38) ptrace$cont(0x18, r2, 0x0, 0x0) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) [ 2771.980697][ T3890] kobject: 'loop5' (00000000ebd9afa5): kobject_uevent_env [ 2771.991985][T21998] memory: usage 306936kB, limit 307200kB, failcnt 5836 [ 2771.994720][ T3890] kobject: 'loop5' (00000000ebd9afa5): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 2771.999122][T21998] swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 2772.015998][T21998] Memory cgroup stats for /syz0: [ 2772.016084][T21998] anon 273690624 [ 2772.016084][T21998] file 2269184 [ 2772.016084][T21998] kernel_stack 4980736 [ 2772.016084][T21998] slab 12574720 [ 2772.016084][T21998] sock 77824 [ 2772.016084][T21998] shmem 2174976 [ 2772.016084][T21998] file_mapped 0 [ 2772.016084][T21998] file_dirty 135168 [ 2772.016084][T21998] file_writeback 0 [ 2772.016084][T21998] anon_thp 257949696 [ 2772.016084][T21998] inactive_anon 2027520 [ 2772.016084][T21998] active_anon 273694720 [ 2772.016084][T21998] inactive_file 94208 [ 2772.016084][T21998] active_file 102400 [ 2772.016084][T21998] unevictable 0 [ 2772.016084][T21998] slab_reclaimable 2568192 [ 2772.016084][T21998] slab_unreclaimable 10006528 [ 2772.016084][T21998] pgfault 251064 [ 2772.016084][T21998] pgmajfault 0 [ 2772.016084][T21998] workingset_refault 1320 [ 2772.016084][T21998] workingset_activate 0 [ 2772.016084][T21998] workingset_nodereclaim 0 [ 2772.016084][T21998] pgrefill 1107 [ 2772.016084][T21998] pgscan 40194 [ 2772.016084][T21998] pgsteal 1516 [ 2772.036966][ T3890] kobject: 'loop1' (00000000a8668f71): kobject_uevent_env [ 2772.119312][T21998] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz0,mems_allowed=0-1,oom_memcg=/syz0,task_memcg=/syz0,task=syz-executor.0,pid=9094,uid=0 [ 2772.131105][ T3890] kobject: 'loop1' (00000000a8668f71): fill_kobj_path: path = '/devices/virtual/block/loop1' [ 2772.137085][T21998] Memory cgroup out of memory: Killed process 9094 (syz-executor.0) total-vm:72840kB, anon-rss:2208kB, file-rss:35800kB, shmem-rss:0kB, UID:0 pgtables:143360kB oom_score_adj:1000 [ 2772.162705][ C1] net_ratelimit: 12 callbacks suppressed [ 2772.162710][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2772.162748][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2772.192153][T21998] kobject: 'kvm' (00000000409f5fab): kobject_uevent_env [ 2772.199217][T21998] kobject: 'kvm' (00000000409f5fab): fill_kobj_path: path = '/devices/virtual/misc/kvm' [ 2772.226273][T21998] kobject: 'kvm' (00000000409f5fab): kobject_uevent_env [ 2772.233307][T21998] kobject: 'kvm' (00000000409f5fab): fill_kobj_path: path = '/devices/virtual/misc/kvm' [ 2772.259845][ T3890] kobject: 'loop0' (00000000d6c60d43): kobject_uevent_env [ 2772.267737][ T3890] kobject: 'loop0' (00000000d6c60d43): fill_kobj_path: path = '/devices/virtual/block/loop0' [ 2773.194839][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2773.200712][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2773.206449][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2773.212178][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2773.217914][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2773.223620][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2773.354829][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2773.360696][ C0] protocol 88fb is buggy, dev hsr_slave_1 09:41:27 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="a4ab12f728db4b2b4d2f2f3ff7ad273b1e89e46f905080af4c90ccb170e60b3a8bf56db763e3062d037dca291318d0a17270bbce74b46f4db2a92ba0c9fb22", 0x3f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, r0, 0x0, 0x0) 09:41:27 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$inet6(0xa, 0x80002, 0x88) bind$inet6(r0, &(0x7f00000001c0)={0xa, 0x10010000004e20}, 0x1c) openat$tun(0xffffffffffffff9c, &(0x7f0000001680)='/dev/net/tun\x00', 0x2040, 0x0) socket(0xa3bfad5392917cba, 0x4, 0x100000000) pipe2(&(0x7f0000000a40)={0xffffffffffffffff, 0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x80000) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @loopback}, @rand_addr="da480026f377153de4730013eeba74e9", @remote, 0x100000001, 0x10001, 0xcc, 0x400, 0x7, 0x43, r2}) pipe2(&(0x7f0000000a40), 0x2000000000083ffc) r3 = syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') preadv(r3, &(0x7f0000000280)=[{&(0x7f0000000180)=""/198, 0xc6}, {&(0x7f0000000080)=""/9, 0x9}, {&(0x7f0000000400)=""/242, 0xf2}, {&(0x7f0000000500)=""/4096, 0x1000}, {&(0x7f00000000c0)=""/121, 0x79}], 0x5, 0x0) 09:41:27 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(&(0x7f0000000040)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa30x0}, &(0x7f0000000100)=0xc) r1 = perf_event_open(0x0, r0, 0x0, 0xffffffffffffffff, 0x0) fremovexattr(r1, &(0x7f0000000140)=@random={'user.', '\\\'GPL(\x00'}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@textreal={0x8, &(0x7f0000000080)="f2a6bad004b00fee0f090f3036f30f1a970000660f3806581e0f08bad004b0beeef30f2af8baa100b000ee", 0x2b}], 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f0000000040)=0x96d1, 0x4) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000340)=ANY=[@ANYBLOB="1300000036ffff0180000006003950"], 0xf) r6 = dup(r5) write$FUSE_BMAP(0xffffffffffffffff, &(0x7f0000000000)={0x18}, 0x18) write$FUSE_ENTRY(r6, &(0x7f0000000280)={0x90}, 0x90) r7 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000d00)='/dev/hwrng\x00', 0xe0540, 0x0) pipe2(0x0, 0x80800) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r8, 0x0, 0x0) r9 = dup(r8) write$FUSE_BMAP(r9, &(0x7f0000000000)={0x18}, 0x18) write$FUSE_ENTRY(r9, &(0x7f0000000280)={0x90}, 0x90) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f0000000e80)={&(0x7f0000000400), 0xc, &(0x7f0000000e40)={&(0x7f0000000ec0)=ANY=[@ANYRES16=0x0, @ANYRES32, @ANYBLOB='\b\x00', @ANYRES32=r7, @ANYBLOB="08000100", @ANYBLOB, @ANYBLOB], 0x7}}, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f00000002c0)={[0x0, 0x0, 0x40000004, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) keyctl$revoke(0x3, 0x0) keyctl$instantiate_iov(0x14, 0x0, 0x0, 0x0, 0x0) keyctl$setperm(0x5, 0x0, 0x4000500) 09:41:27 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$inet6(0xa, 0x80002, 0x88) bind$inet6(r0, &(0x7f00000001c0)={0xa, 0x10010000004e20}, 0x1c) openat$tun(0xffffffffffffff9c, &(0x7f0000001680)='/dev/net/tun\x00', 0x2040, 0x0) socket(0xa3bfad5392917cba, 0x4, 0x100000000) pipe2(&(0x7f0000000a40)={0xffffffffffffffff, 0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x80000) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @loopback}, @rand_addr="da480026f377153de4730013eeba74e9", @remote, 0x100000001, 0x10001, 0xcc, 0x400, 0x7, 0x43, r2}) pipe2(&(0x7f0000000a40), 0x2000000000083ffc) r3 = syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') preadv(r3, &(0x7f0000000280)=[{&(0x7f0000000180)=""/198, 0xc6}, {&(0x7f0000000080)=""/9, 0x9}, {&(0x7f0000000400)=""/242, 0xf2}, {&(0x7f0000000500)=""/4096, 0x1000}, {&(0x7f00000000c0)=""/121, 0x79}], 0x5, 0x0) [ 2773.781924][T22041] kobject: 'kvm' (00000000409f5fab): kobject_uevent_env [ 2773.789940][T22041] kobject: 'kvm' (00000000409f5fab): fill_kobj_path: path = '/devices/virtual/misc/kvm' 09:41:28 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(&(0x7f0000000040)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa30xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x80000) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @loopback}, @rand_addr="da480026f377153de4730013eeba74e9", @remote, 0x100000001, 0x10001, 0xcc, 0x400, 0x7, 0x43, r2}) pipe2(&(0x7f0000000a40), 0x2000000000083ffc) r3 = syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') preadv(r3, &(0x7f0000000280)=[{&(0x7f0000000180)=""/198, 0xc6}, {&(0x7f0000000080)=""/9, 0x9}, {&(0x7f0000000400)=""/242, 0xf2}, {&(0x7f0000000500)=""/4096, 0x1000}, {&(0x7f00000000c0)=""/121, 0x79}], 0x5, 0x0) 09:41:28 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(&(0x7f0000000040)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa30xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x80000) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @loopback}, @rand_addr="da480026f377153de4730013eeba74e9", @remote, 0x100000001, 0x10001, 0xcc, 0x400, 0x7, 0x43, r2}) pipe2(&(0x7f0000000a40), 0x2000000000083ffc) preadv(0xffffffffffffffff, &(0x7f0000000280)=[{&(0x7f0000000180)=""/198, 0xc6}, {&(0x7f0000000080)=""/9, 0x9}, {&(0x7f0000000400)=""/242, 0xf2}, {&(0x7f0000000500)=""/4096, 0x1000}, {&(0x7f00000000c0)=""/121, 0x79}], 0x5, 0x0) [ 2774.139700][T22040] kobject: 'kvm' (00000000409f5fab): fill_kobj_path: path = '/devices/virtual/misc/kvm' 09:41:28 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000140)=0x32, 0x4) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000240)=0xa3, 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) [ 2774.168810][ T3890] kobject: 'loop3' (00000000db31cb6a): kobject_uevent_env [ 2774.187157][ T3890] kobject: 'loop3' (00000000db31cb6a): fill_kobj_path: path = '/devices/virtual/block/loop3' [ 2774.220802][ T3890] kobject: 'loop0' (00000000d6c60d43): kobject_uevent_env [ 2774.251383][ T3890] kobject: 'loop0' (00000000d6c60d43): fill_kobj_path: path = '/devices/virtual/block/loop0' [ 2774.264267][ T3890] kobject: 'loop5' (00000000ebd9afa5): kobject_uevent_env [ 2774.273218][ T3890] kobject: 'loop5' (00000000ebd9afa5): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 2774.359045][ T3890] kobject: 'loop0' (00000000d6c60d43): kobject_uevent_env [ 2774.367268][ T3890] kobject: 'loop0' (00000000d6c60d43): fill_kobj_path: path = '/devices/virtual/block/loop0' 09:41:29 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000140)="11dca50d5e0bcfe47bf070") r1 = gettid() prctl$PR_SET_PTRACER(0x59616d61, r1) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x38) ptrace$cont(0x18, r2, 0x0, 0x0) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) [ 2775.042439][ T3890] kobject: 'loop1' (00000000a8668f71): kobject_uevent_env [ 2775.049932][ T3890] kobject: 'loop1' (00000000a8668f71): fill_kobj_path: path = '/devices/virtual/block/loop1' 09:41:30 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="a4ab12f728db4b2b4d2f2f3ff7ad273b1e89e46f905080af4c90ccb170e60b3a8bf56db763e3062d037dca291318d0a17270bbce74b46f4db2a92ba0c9fb228bc1", 0x41}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, r0, 0x0, 0x0) 09:41:30 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(&(0x7f0000000040)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa30xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x80000) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @loopback}, @rand_addr="da480026f377153de4730013eeba74e9", @remote, 0x100000001, 0x10001, 0xcc, 0x400, 0x7, 0x43, r2}) pipe2(&(0x7f0000000a40), 0x2000000000083ffc) preadv(0xffffffffffffffff, &(0x7f0000000280)=[{&(0x7f0000000180)=""/198, 0xc6}, {&(0x7f0000000080)=""/9, 0x9}, {&(0x7f0000000400)=""/242, 0xf2}, {&(0x7f0000000500)=""/4096, 0x1000}, {&(0x7f00000000c0)=""/121, 0x79}], 0x5, 0x0) 09:41:30 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000140)=0x32, 0x4) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000240)=0xa3, 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 09:41:30 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$inet6(0xa, 0x80002, 0x88) bind$inet6(r0, &(0x7f00000001c0)={0xa, 0x10010000004e20}, 0x1c) openat$tun(0xffffffffffffff9c, &(0x7f0000001680)='/dev/net/tun\x00', 0x2040, 0x0) socket(0xa3bfad5392917cba, 0x4, 0x100000000) pipe2(&(0x7f0000000a40)={0xffffffffffffffff, 0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x80000) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @loopback}, @rand_addr="da480026f377153de4730013eeba74e9", @remote, 0x100000001, 0x10001, 0xcc, 0x400, 0x7, 0x43, r2}) pipe2(&(0x7f0000000a40), 0x2000000000083ffc) preadv(0xffffffffffffffff, &(0x7f0000000280)=[{&(0x7f0000000180)=""/198, 0xc6}, {&(0x7f0000000080)=""/9, 0x9}, {&(0x7f0000000400)=""/242, 0xf2}, {&(0x7f0000000500)=""/4096, 0x1000}, {&(0x7f00000000c0)=""/121, 0x79}], 0x5, 0x0) 09:41:31 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(&(0x7f0000000040)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa30xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x80000) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @loopback}, @rand_addr="da480026f377153de4730013eeba74e9", @remote, 0x100000001, 0x10001, 0xcc, 0x400, 0x7, 0x43, r2}) r3 = syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') preadv(r3, &(0x7f0000000280)=[{&(0x7f0000000180)=""/198, 0xc6}, {&(0x7f0000000080)=""/9, 0x9}, {&(0x7f0000000400)=""/242, 0xf2}, {&(0x7f0000000500)=""/4096, 0x1000}, {&(0x7f00000000c0)=""/121, 0x79}], 0x5, 0x0) 09:41:31 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000140)=0x32, 0x4) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000240)=0xa3, 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 09:41:31 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) r0 = memfd_create(&(0x7f0000000040)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='cpuret.memory_pressure\x00\x8bEY\xd0\x1b\x05\xa2\bG\xdb\xd8\xee\x04=\x17\xae\x89\xbdA\x8a\x1d,v[v1r%\xd8w\x8f\xe7\xcc\n\x93\x06:\xef~\xa7yv\v\xdb\xc62e\xe3\x00%\xa4-\xdb\x8a1\x9c\x89\xf3\xbd\x8aW\xd9\xa3