[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 91.468217] audit: type=1800 audit(1546043137.523:25): pid=11040 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 91.487408] audit: type=1800 audit(1546043137.523:26): pid=11040 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 91.506834] audit: type=1800 audit(1546043137.553:27): pid=11040 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.116' (ECDSA) to the list of known hosts. 2018/12/29 00:25:53 fuzzer started 2018/12/29 00:25:58 dialing manager at 10.128.0.26:37381 2018/12/29 00:25:58 syscalls: 1 2018/12/29 00:25:58 code coverage: enabled 2018/12/29 00:25:58 comparison tracing: CONFIG_KCOV_ENABLE_COMPARISONS is not enabled 2018/12/29 00:25:58 setuid sandbox: enabled 2018/12/29 00:25:58 namespace sandbox: enabled 2018/12/29 00:25:58 Android sandbox: /sys/fs/selinux/policy does not exist 2018/12/29 00:25:58 fault injection: enabled 2018/12/29 00:25:58 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2018/12/29 00:25:58 net packet injection: enabled 2018/12/29 00:25:58 net device setup: enabled 00:29:18 executing program 0: seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0xffffffffffffff7f}]}) restart_syscall() syzkaller login: [ 313.882663] IPVS: ftp: loaded support on port[0] = 21 [ 315.278223] chnl_net:caif_netlink_parms(): no params data found [ 315.890438] bridge0: port 1(bridge_slave_0) entered blocking state [ 315.897068] bridge0: port 1(bridge_slave_0) entered disabled state [ 315.905539] device bridge_slave_0 entered promiscuous mode [ 315.993697] bridge0: port 2(bridge_slave_1) entered blocking state [ 316.000239] bridge0: port 2(bridge_slave_1) entered disabled state [ 316.008631] device bridge_slave_1 entered promiscuous mode 00:29:22 executing program 1: socket$inet6(0xa, 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x0, 0x48b, &(0x7f0000000000)={0x1, 'syz_tun\x00'}, 0x18) setsockopt$IP_VS_SO_SET_STOPDAEMON(r0, 0x0, 0x48c, &(0x7f0000000040)={0x1, 'bond_slave_0\x00'}, 0x18) [ 316.269953] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 316.456139] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 316.927653] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 316.936411] team0: Port device team_slave_0 added [ 317.046662] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 317.055486] team0: Port device team_slave_1 added [ 317.137948] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 317.293926] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 317.608915] IPVS: ftp: loaded support on port[0] = 21 [ 317.852394] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 317.962134] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 318.481014] ip (11339) used greatest stack depth: 53664 bytes left [ 319.417177] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 319.942718] chnl_net:caif_netlink_parms(): no params data found [ 321.101250] bridge0: port 1(bridge_slave_0) entered blocking state [ 321.108201] bridge0: port 1(bridge_slave_0) entered disabled state [ 321.117487] device bridge_slave_0 entered promiscuous mode 00:29:27 executing program 2: seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0xffffffffffffff7f}]}) r0 = socket$inet6(0xa, 0x3, 0x7) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, 0x0, 0x0) [ 321.331009] bridge0: port 2(bridge_slave_1) entered blocking state [ 321.337709] bridge0: port 2(bridge_slave_1) entered disabled state [ 321.346286] device bridge_slave_1 entered promiscuous mode [ 321.782324] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 321.964312] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 322.357504] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 322.366407] team0: Port device team_slave_0 added [ 322.581319] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 322.590315] team0: Port device team_slave_1 added [ 322.797452] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 322.979890] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 323.199171] IPVS: ftp: loaded support on port[0] = 21 [ 323.564602] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 323.763399] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 325.609925] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 325.939223] chnl_net:caif_netlink_parms(): no params data found [ 326.050223] 8021q: adding VLAN 0 to HW filter on device bond0 [ 326.701630] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 327.107332] bridge0: port 1(bridge_slave_0) entered blocking state [ 327.114088] bridge0: port 1(bridge_slave_0) entered disabled state [ 327.122737] device bridge_slave_0 entered promiscuous mode [ 327.267088] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 327.274005] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 327.282264] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 327.343623] bridge0: port 2(bridge_slave_1) entered blocking state [ 327.350177] bridge0: port 2(bridge_slave_1) entered disabled state [ 327.358752] device bridge_slave_1 entered promiscuous mode [ 327.784423] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 327.790621] 8021q: adding VLAN 0 to HW filter on device team0 [ 327.923793] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 328.072085] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 328.449437] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 328.456836] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 328.466120] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 328.474702] bridge0: port 1(bridge_slave_0) entered blocking state [ 328.481215] bridge0: port 1(bridge_slave_0) entered forwarding state [ 328.553152] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 328.564563] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 328.573506] team0: Port device team_slave_0 added [ 328.744834] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 328.753745] team0: Port device team_slave_1 added [ 328.927092] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 329.112781] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 329.124742] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 329.133754] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 329.142311] bridge0: port 2(bridge_slave_1) entered blocking state [ 329.148830] bridge0: port 2(bridge_slave_1) entered forwarding state [ 329.170316] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 329.755418] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 329.762637] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready 00:29:36 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x5, 0x0) close(r0) [ 330.010603] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 330.253370] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 330.588884] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 330.596143] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 331.366762] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 331.374187] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 331.383490] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 331.417966] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 332.141626] IPVS: ftp: loaded support on port[0] = 21 [ 332.241507] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 332.248832] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 332.258376] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 332.543386] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 333.017949] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 333.025051] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 333.033930] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 333.912545] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 333.919474] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 333.928358] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 334.026626] 8021q: adding VLAN 0 to HW filter on device bond0 [ 334.857001] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 335.634217] chnl_net:caif_netlink_parms(): no params data found [ 335.694113] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 335.700572] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 335.708800] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 336.513114] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 336.519287] 8021q: adding VLAN 0 to HW filter on device team0 [ 337.124714] bridge0: port 1(bridge_slave_0) entered blocking state [ 337.131264] bridge0: port 1(bridge_slave_0) entered disabled state [ 337.139700] device bridge_slave_0 entered promiscuous mode [ 337.343906] bridge0: port 2(bridge_slave_1) entered blocking state [ 337.350460] bridge0: port 2(bridge_slave_1) entered disabled state [ 337.358936] device bridge_slave_1 entered promiscuous mode [ 337.386884] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 337.394188] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 337.403166] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 337.411649] bridge0: port 1(bridge_slave_0) entered blocking state [ 337.418183] bridge0: port 1(bridge_slave_0) entered forwarding state [ 337.472913] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 337.962426] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 338.098486] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 338.217487] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 338.224868] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 338.233968] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 338.242638] bridge0: port 2(bridge_slave_1) entered blocking state [ 338.249143] bridge0: port 2(bridge_slave_1) entered forwarding state [ 338.332315] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 338.900231] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 338.909116] team0: Port device team_slave_0 added [ 339.139126] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 339.147865] team0: Port device team_slave_1 added [ 339.158150] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 339.165288] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 339.417740] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 339.638127] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 339.691523] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 339.969640] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 339.976867] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready 00:29:46 executing program 4: r0 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet_int(r0, 0x0, 0xf, &(0x7f0000d10ffc)=0xfffffffffffffff9, 0x4) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000d24000)=[@in={0x2, 0x0, @multicast1}], 0x10) sendto$inet6(r0, &(0x7f0000000040)="f3", 0x1, 0x20000841, 0x0, 0x0) [ 340.567035] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 340.822029] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 340.849800] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 340.857294] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 340.866511] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 340.936332] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 340.970726] kauditd_printk_skb: 3 callbacks suppressed [ 340.970758] audit: type=1326 audit(1546043387.023:31): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=12138 comm="syz-executor0" exe="/root/syz-executor0" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45a81a code=0xffff0000 [ 341.705884] audit: type=1326 audit(1546043387.763:32): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=12138 comm="syz-executor0" exe="/root/syz-executor0" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45a81a code=0xffff0000 00:29:47 executing program 0: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="020797e3020000000000000000000000"], 0x10}}, 0x0) [ 341.910718] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 341.917911] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 341.927164] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready 00:29:48 executing program 0: r0 = socket(0x2, 0x6, 0xffffffff) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00') sendmsg$TIPC_CMD_SET_NETID(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80010}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r1, 0x630, 0x70bd2a, 0x25dfdbfd, {{}, 0x0, 0x800b, 0x0, {0x8, 0x2, 0x101}}, ["", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)={0x20, 0x1d, 0x1, 0x0, 0x0, {0x1000002}, [@typed={0xc, 0x19, @u64}]}, 0x20}}, 0x0) [ 342.223705] 8021q: adding VLAN 0 to HW filter on device bond0 [ 342.314690] netlink: 'syz-executor0': attribute type 25 has an invalid length. [ 342.378780] netlink: 'syz-executor0': attribute type 25 has an invalid length. 00:29:48 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcs\x00', 0x2, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x03\x00', 0x19, 0x1, 0x238, [0x200003c0, 0x0, 0x0, 0x200003f0, 0x20000420], 0x0, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000fa00000000000000000000000000000000feffffff01000000030000000000000008006966623000000000000000000000000064756d6d79300000000000000000000069705f76746930000000000000000000697036746e000000000000aaaaaaaaaabb0000000000000180c20000000000000000000000f000000070010000a801000069700000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000cb5a4715ba9c2e20000000000000000000000000000000000000000000000000002f00000000000000000000000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa000000000000000000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a3100000000000000040000000000000000000000000000000000000000736e6174000000000000000000000000000022000000000000000000000000001000000000000000aaaaaaaaaa000000000000000000000000000000000000000000000000"]}, 0x2ab) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x1, 0x0) ioctl$KVM_CREATE_PIT2(r2, 0x4040ae77, &(0x7f0000000040)={0x7}) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KDGETLED(r2, 0x4b31, &(0x7f0000000080)) [ 342.625323] kernel msg: ebtables bug: please report to author: Wrong len argument [ 342.692226] kernel msg: ebtables bug: please report to author: Wrong len argument [ 342.907557] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 342.914749] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 342.923421] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready 00:29:49 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000000000a, 0x0) ioctl$SNDRV_TIMER_IOCTL_GINFO(r0, 0xc0f85403, &(0x7f0000000040)={{0x0, 0x2, 0x1, 0x3, 0x1f}, 0x6, 0x8000, 'id0\x00', 'timer0\x00', 0x0, 0x180000000000000, 0x6, 0x7ff, 0x6}) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="0a5c1f023c126285719070") close(r0) signalfd(r0, &(0x7f0000000180)={0xee}, 0x8) 00:29:49 executing program 0: r0 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) timer_create(0x1, &(0x7f0000000080)={0x0, 0x17, 0x2, @tid=r0}, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) tkill(r0, 0x1000000000016) write$P9_RLERRORu(r2, &(0x7f0000000040)=ANY=[@ANYBLOB='\r'], 0x1) [ 343.322414] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 343.337622] IPVS: ftp: loaded support on port[0] = 21 00:29:49 executing program 0: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000340)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-net\x00', 0x2, 0x0) r2 = dup(r1) ioctl$VHOST_SET_OWNER(r2, 0xaf01, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000127c0)={'team0\x00'}) ioctl$VHOST_SET_VRING_ENDIAN(r1, 0x4008af12, &(0x7f00000001c0)) socketpair$unix(0x1, 0x100000000000005, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af25, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) close(r0) ioctl$VIDIOC_G_TUNER(r2, 0xc054561d, &(0x7f0000000000)={0x8784, "3b993cf9bbfa987641299edb74c308b4af7857b47b2ebd4cb97414da985cecac", 0x7, 0x100, 0x800, 0x8, 0x2, 0x2, 0x1, 0x9}) [ 343.748843] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 343.930051] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 343.937365] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 343.946123] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready 00:29:50 executing program 0: r0 = gettid() exit(0x0) sched_getaffinity(r0, 0x8, &(0x7f0000000000)) [ 344.493361] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 344.500689] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 344.508810] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 00:29:51 executing program 0: r0 = syz_open_dev$cec(&(0x7f0000000040)='/dev/cec#\x00', 0x2, 0x2) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffff9c, 0x84, 0x75, &(0x7f0000000100)={0x0, 0x3}, &(0x7f0000000140)=0x8) setsockopt$inet_sctp_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000000180)={r1, 0x1}, 0x8) r2 = socket$inet6(0xa, 0x1, 0x0) write$P9_RATTACH(r0, &(0x7f00000001c0)={0x14, 0x69, 0x1, {0x0, 0x0, 0x8}}, 0x14) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, r2, 0x0) r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000080)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r0, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@dev={0xac, 0x14, 0x14, 0x29}, @rand_addr, @initdev={0xac, 0x1e, 0x586, 0x0}}, 0xc) setsockopt$IP_VS_SO_SET_TIMEOUT(r4, 0x0, 0x48a, &(0x7f00000000c0)={0x0, 0xfffffffffffffff8}, 0xfffffffffffffe1a) sendto$unix(r0, &(0x7f0000000200)="a47ce821515f93e3c8ed759fb6c6c783c0cab31610a12ab1d5b089f874dedc6c6aaf83699b1a1f76af712d7a420eb0277d6f21ac1b6a95e07b2ace08a978783a20fb2e29c01d113f7721ebac3fb17c12bed9c79b5e0b77a20913d50dcc153e6aae1d8ddc", 0x64, 0x8000, 0x0, 0x0) close(r2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r5, 0x6, 0x1d, &(0x7f0000000280)={0x9, 0x1, 0x4, 0x2, 0x80000000}, 0x14) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) dup3(r2, r3, 0x0) [ 345.281149] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 345.287407] 8021q: adding VLAN 0 to HW filter on device team0 [ 346.072656] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 346.079916] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 346.088772] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 346.097128] bridge0: port 1(bridge_slave_0) entered blocking state [ 346.103681] bridge0: port 1(bridge_slave_0) entered forwarding state [ 346.154782] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 346.862939] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 346.870196] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 346.879096] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 346.887626] bridge0: port 2(bridge_slave_1) entered blocking state [ 346.894180] bridge0: port 2(bridge_slave_1) entered forwarding state [ 347.443392] chnl_net:caif_netlink_parms(): no params data found [ 347.759264] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 347.766478] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 348.643660] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 348.785660] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 348.793017] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 348.922766] bridge0: port 1(bridge_slave_0) entered blocking state [ 348.929332] bridge0: port 1(bridge_slave_0) entered disabled state [ 348.937864] device bridge_slave_0 entered promiscuous mode [ 349.178610] bridge0: port 2(bridge_slave_1) entered blocking state [ 349.185280] bridge0: port 2(bridge_slave_1) entered disabled state [ 349.193745] device bridge_slave_1 entered promiscuous mode [ 349.677042] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 349.684328] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 349.694441] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 349.748685] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 349.849786] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 350.097308] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 350.432520] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 350.614204] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 350.621356] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 350.630846] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 350.752567] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 350.761465] team0: Port device team_slave_0 added [ 351.065417] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 351.074390] team0: Port device team_slave_1 added [ 351.334566] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 351.393545] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 351.412291] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 351.421120] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 351.586244] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 351.713280] IPVS: stopping master sync thread 12555 ... [ 351.806005] IPVS: sync thread started: state = MASTER, mcast_ifn = syz_tun, syncid = 0, id = 0 00:29:57 executing program 1: socket$inet6(0xa, 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x0, 0x48b, &(0x7f0000000000)={0x1, 'syz_tun\x00'}, 0x18) setsockopt$IP_VS_SO_SET_STOPDAEMON(r0, 0x0, 0x48c, &(0x7f0000000040)={0x1, 'bond_slave_0\x00'}, 0x18) [ 352.040698] IPVS: stopping master sync thread 12560 ... [ 352.294802] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 352.301902] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 352.310716] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 352.470751] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 352.648023] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 352.961323] 8021q: adding VLAN 0 to HW filter on device bond0 [ 353.412068] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 353.952347] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 353.958702] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 353.966605] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 354.240177] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 354.429861] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 354.436141] 8021q: adding VLAN 0 to HW filter on device team0 [ 354.579119] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 354.923434] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 354.930660] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 354.939485] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 354.947781] bridge0: port 1(bridge_slave_0) entered blocking state [ 354.954463] bridge0: port 1(bridge_slave_0) entered forwarding state [ 355.032755] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 355.453084] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 355.460404] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 355.469370] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 355.477725] bridge0: port 2(bridge_slave_1) entered blocking state [ 355.484270] bridge0: port 2(bridge_slave_1) entered forwarding state [ 355.787956] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 356.019502] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 356.026696] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 356.472345] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 356.479408] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 356.605157] audit: type=1326 audit(1546043402.663:33): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=12783 comm="syz-executor2" exe="/root/syz-executor2" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45a81a code=0xffff0000 [ 356.902535] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 356.909687] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 356.918899] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 356.928138] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 357.270653] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 357.278028] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 357.287346] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 357.389387] audit: type=1326 audit(1546043403.443:34): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=12783 comm="syz-executor2" exe="/root/syz-executor2" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45a81a code=0xffff0000 00:30:03 executing program 2: perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000240)={{{@in=@multicast1, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0xa}}, {{@in=@remote, 0x0, 0xff}, 0x0, @in6=@dev}}, 0xe8) r1 = socket$key(0xf, 0x3, 0x2) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000001c0), 0xfa) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="020b0001020000000000400000000000"], 0x10}}, 0x0) sendmsg$key(r1, &(0x7f00000040c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000140)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) stat(0x0, 0x0) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000b00)={{{@in=@multicast1, @in6=@remote}, {0x4}, {}, 0x41c3, 0x0, 0x0, 0x1}, {{@in6=@local}, 0x0, @in6, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x100000000}}, 0xe8) [ 357.726774] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 357.733933] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 357.742819] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 358.119493] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 358.126594] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 358.135379] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 358.826669] 8021q: adding VLAN 0 to HW filter on device bond0 [ 359.166100] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 359.500276] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 359.506760] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 359.514717] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 359.800912] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 359.863032] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 359.869190] 8021q: adding VLAN 0 to HW filter on device team0 [ 360.259631] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 360.267188] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 360.276236] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 360.284658] bridge0: port 1(bridge_slave_0) entered blocking state [ 360.291193] bridge0: port 1(bridge_slave_0) entered forwarding state [ 360.320185] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 360.520067] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 360.619161] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 360.627238] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 360.636103] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 360.644708] bridge0: port 2(bridge_slave_1) entered blocking state [ 360.651204] bridge0: port 2(bridge_slave_1) entered forwarding state [ 360.961299] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 360.968459] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready 00:30:07 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x5, 0x0) close(r0) [ 361.297937] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 361.305228] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 361.497666] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 361.504895] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 361.514133] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 361.523640] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 361.717325] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 361.724629] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 361.734719] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 361.938620] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 361.945933] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 361.954686] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 362.144011] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 362.150937] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 362.159675] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 363.291025] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 363.700225] 8021q: adding VLAN 0 to HW filter on device batadv0 00:30:10 executing program 4: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x8, 0x3, &(0x7f0000000040)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x8, 0x27}}, &(0x7f0000000240)='GPL\x00\x83\xff\x13\x0f_\xb0\x0e][dCT\xb6\xe2wp\xc5\xa6$\x1e\x8d\xef\xd6S>*\xe1\x06\xbee\\lRcI!l0\xbb\x1f\x80\xfbE\x0e\xc0\xd5\xbe', 0x1, 0x99, &(0x7f0000000440)=""/153}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000680)={r0, 0x0, 0xe, 0x0, &(0x7f0000000500)="0757fa098d3ccec967844f02c1e8", 0x0, 0xa1d}, 0x28) 00:30:10 executing program 0: r0 = socket$inet(0x2b, 0x801, 0x0) setsockopt$IP_VS_SO_SET_FLUSH(r0, 0x0, 0x485, 0x0, 0x0) sendmsg$inet_sctp(r0, &(0x7f0000000300)={&(0x7f0000000100)=@in={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1a}}, 0x10, 0x0}, 0x20000081) setsockopt$inet_mreqsrc(r0, 0x0, 0x26, 0x0, 0x0) getsockopt$EBT_SO_GET_INIT_INFO(r0, 0x0, 0x82, &(0x7f0000000000)={'nat\x00'}, &(0x7f0000000080)=0x78) r1 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x400, 0x402000) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000180)='nbd\x00') sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x420020}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x28, r2, 0x8, 0x70bd25, 0x25dfdbfc, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x80) 00:30:10 executing program 5: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x8, 0x0) ioctl$VIDIOC_RESERVED(r0, 0x5601, 0x0) r1 = dup2(r0, r0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00') sendmsg$TIPC_CMD_GET_NETID(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r2, 0x420, 0x70bd2c, 0x25dfdbfb, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x80) ioctl$TCSETSW(r1, 0x5403, &(0x7f0000000180)={0x456, 0x3, 0x8, 0x8, 0x17, 0x0, 0x1, 0x7, 0x80, 0x1ff, 0x5, 0x9}) getsockopt$bt_BT_RCVMTU(r1, 0x112, 0xd, &(0x7f00000001c0)=0x8, &(0x7f0000000200)=0x2) lsetxattr$security_ima(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='security.ima\x00', &(0x7f00000002c0)=@v1={0x2, "f26f0af1a65b"}, 0x7, 0x1) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f0000000300)="b7a052e7cfc75596170b9f76c2132733ed62e1c9d335a1b5ebdbb5fb17bf0504aad1b485cd2ce8e4b6d43be91b1c28edcc7670ac19328349ede9a04d6a9b4b8e3949147d1248224e946625e9dd461170823543bb537a82cfd29bcbe74ef276fafb7f9466c5c8ffedde7c7a9d13d5cd6a7f85b1259a808956c3ac76d79e6a8dedc0b4b30373df8beb5173daf905c9f42bc431d2d108f52ad96d9dcb2b97ff214ca91c8e533dd41c8d451fd6ac77d7ff7051a6f7d3f9d46dc6da22ea7c8735e0bcc0cd1db0fd3162c9bf150dd58b6e0fa255bf8d3d5b596c1f48d5a906a5196b19a21687da922b8c25cdb722a12fa91a33ed97b8d1e4529ee6a50ea1c1a4cf3b72") ioctl$sock_bt_bnep_BNEPCONNDEL(r1, 0x400442c9, &(0x7f0000000400)={0x2, @random="f9e17beb9f10"}) sendmsg$TIPC_CMD_SHOW_PORTS(r1, &(0x7f0000000500)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x80402000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x1c, r2, 0x8, 0x70bd25, 0x25dfdbfe, {}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r1, 0x810c5701, &(0x7f0000000540)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r4, 0x84, 0x7, &(0x7f00000006c0)={0xeb}, 0x4) ioctl$BLKROGET(r1, 0x125e, &(0x7f0000000700)) r5 = getpgrp(0x0) ioprio_get$pid(0x2, r5) ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f0000000740)=0x6) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40042409, 0x0) renameat2(r1, &(0x7f0000000780)='./file0\x00', r1, &(0x7f00000007c0)='./file0\x00', 0x3) ioctl$VIDIOC_G_EXT_CTRLS(r1, 0xc0205647, &(0x7f0000000880)={0x9d0000, 0x9588, 0x3, [], &(0x7f0000000840)={0x9f0b6f, 0x9, [], @p_u8=&(0x7f0000000800)=0x5}}) fsetxattr$trusted_overlay_opaque(r3, &(0x7f00000008c0)='trusted.overlay.opaque\x00', &(0x7f0000000900)='y\x00', 0x2, 0x3) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f0000000940)={0x0}, &(0x7f0000000980)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f00000009c0)={r6, @in={{0x2, 0x4e22, @multicast2}}, 0x80000000, 0xffffffffffffff00, 0x3, 0x2, 0x10}, 0x98) ioctl$sock_bt_bnep_BNEPGETSUPPFEAT(r1, 0x800442d4, &(0x7f0000000a80)=0xea5) r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000b00)='IPVS\x00') sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000bc0)={&(0x7f0000000ac0), 0xc, &(0x7f0000000b80)={&(0x7f0000000b40)={0x1c, r7, 0x710, 0x70bd2d, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x7ff}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20004000}, 0x4000) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r1, 0x800442d3, &(0x7f0000000c00)={0x9, 0xffffffff80000001, 0x0, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xf}, 'syzkaller1\x00'}) openat$null(0xffffffffffffff9c, &(0x7f0000000c40)='/dev/null\x00', 0x40, 0x0) 00:30:10 executing program 2: ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000000)={0xffffffffffffff9c}) sendmsg$kcm(r0, 0x0, 0x0) r1 = socket$kcm(0x2, 0xa, 0x300) perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x7, 0xffffffffffffffff, 0x2) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x2400, 0x5b0) bpf$MAP_CREATE(0x0, 0x0, 0x0) r2 = socket$kcm(0xa, 0x0, 0x11) sendmsg$kcm(r2, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)}, 0x0) recvmsg(r0, &(0x7f0000001d00)={&(0x7f00000011c0)=@xdp, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001300)=""/46, 0x2e}, {&(0x7f0000001740)=""/83, 0x53}, {&(0x7f0000001940)=""/165, 0xa5}], 0x3, 0x0, 0x0, 0x6}, 0x0) sendmsg(r1, &(0x7f0000001d40)={&(0x7f00000017c0)=@can, 0x80, 0x0}, 0x3e) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x20}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080), 0x2c) r3 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000280)={&(0x7f0000000040)='./file0\x00', 0x0, 0x10}, 0x10) close(r3) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000380)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;<\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xc6\x0f\xd7\x14\x0f\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4N') r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000580)={'nr0\x01\x00\x00\x00t\xca\x1bq\x032-x\x00', 0x802}) ioctl$TUNSETVNETLE(r4, 0x400454dc, &(0x7f00000000c0)=0x1) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000480)) bpf$MAP_CREATE(0x0, &(0x7f0000346fd4)={0x0, 0x0, 0x0, 0x24}, 0x2c) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(r4, 0x800454e0, 0x0) write$cgroup_int(r4, &(0x7f00000002c0), 0x12) socket$kcm(0x2, 0x0, 0x2) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) 00:30:10 executing program 1: r0 = open(&(0x7f00000003c0)='./bus\x00', 0x40000000141048, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) fsetxattr$security_evm(0xffffffffffffff9c, 0x0, &(0x7f0000004680)=@md5={0x1, "0634a3e7a35bf48a6f8dfe1f0b8031c1"}, 0x11, 0x0) madvise(&(0x7f0000004000/0x2000)=nil, 0x2000, 0x9) 00:30:10 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r0, 0x0, 0x0, 0x110001) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000040)={0x0, r1}) [ 364.130490] syz-executor2 uses obsolete (PF_INET,SOCK_PACKET) 00:30:10 executing program 4: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x8, 0x3, &(0x7f0000000040)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x8, 0x27}}, &(0x7f0000000240)='GPL\x00\x83\xff\x13\x0f_\xb0\x0e][dCT\xb6\xe2wp\xc5\xa6$\x1e\x8d\xef\xd6S>*\xe1\x06\xbee\\lRcI!l0\xbb\x1f\x80\xfbE\x0e\xc0\xd5\xbe', 0x1, 0x99, &(0x7f0000000440)=""/153}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000680)={r0, 0x0, 0xe, 0x0, &(0x7f0000000500)="0757fa098d3ccec967844f02c1e8", 0x0, 0xa1d}, 0x28) 00:30:10 executing program 1: r0 = open(&(0x7f00000003c0)='./bus\x00', 0x40000000141048, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) fsetxattr$security_evm(0xffffffffffffff9c, 0x0, &(0x7f0000004680)=@md5={0x1, "0634a3e7a35bf48a6f8dfe1f0b8031c1"}, 0x11, 0x0) madvise(&(0x7f0000004000/0x2000)=nil, 0x2000, 0x9) [ 364.255459] hrtimer: interrupt took 34192 ns 00:30:10 executing program 0: r0 = open(&(0x7f00000003c0)='./bus\x00', 0x40000000141048, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) madvise(&(0x7f0000004000/0x2000)=nil, 0x2000, 0x9) 00:30:10 executing program 3: socketpair(0x1, 0x1, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x89f1, &(0x7f0000000080)='ip6tnl0\x00') 00:30:10 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4004ae86, 0x0) 00:30:10 executing program 4: clone(0x2002102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000640)=@nat={'Xat\x00\x00\x00\x00\x00\x00\x03\b\x01\x00', 0x19, 0x3, 0x90, [0x20001600, 0x0, 0x0, 0x20001860, 0x20001890], 0x0, 0x0, &(0x7f0000001600)=[{}, {0x0, '\x00', 0x2}, {0x0, '\x00', 0x2}]}, 0x108) 00:30:10 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x5, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x2c) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x8936, &(0x7f0000000000)) 00:30:10 executing program 3: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0xc, 0xe, &(0x7f00000008c0)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000"], 0x0}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x1800000000000000, 0x54, 0x0, &(0x7f00000000c0)="b90703e6681b00000000000000ead5dc57ee41dea43e63a377fb8a977c3f1d1700040000d80648a2ac141411e0000001e1977d486a72d7363417ef6c909047dc183aea9747b34b3cbaa8ad830be27f3c1c54e771", 0x0, 0x40}, 0x28) [ 364.855927] kernel msg: ebtables bug: please report to author: Valid hook without chain [ 364.866464] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/l1tf.html for details. [ 364.935286] kernel msg: ebtables bug: please report to author: Valid hook without chain [ 365.616325] IPVS: ftp: loaded support on port[0] = 21 [ 366.458531] chnl_net:caif_netlink_parms(): no params data found [ 366.811520] bridge0: port 1(bridge_slave_0) entered blocking state [ 366.818036] bridge0: port 1(bridge_slave_0) entered disabled state [ 366.826155] device bridge_slave_0 entered promiscuous mode [ 366.878679] bridge0: port 2(bridge_slave_1) entered blocking state [ 366.885431] bridge0: port 2(bridge_slave_1) entered disabled state [ 366.893774] device bridge_slave_1 entered promiscuous mode [ 367.054694] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 367.109903] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 367.267194] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 367.276178] team0: Port device team_slave_0 added [ 367.330104] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 367.339055] team0: Port device team_slave_1 added [ 367.389195] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 367.442807] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 367.660330] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 367.715059] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 368.279633] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 370.318533] 8021q: adding VLAN 0 to HW filter on device bond0 [ 370.541322] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 370.729784] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 370.736320] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 370.744336] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 370.936725] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 370.942870] 8021q: adding VLAN 0 to HW filter on device team0 [ 371.131823] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 371.139283] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 371.148155] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 371.156526] bridge0: port 1(bridge_slave_0) entered blocking state [ 371.163071] bridge0: port 1(bridge_slave_0) entered forwarding state [ 371.172040] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 371.345717] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 371.353269] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 371.362228] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 371.370686] bridge0: port 2(bridge_slave_1) entered blocking state [ 371.377328] bridge0: port 2(bridge_slave_1) entered forwarding state [ 371.558369] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 371.565516] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 371.762189] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 371.769128] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 371.962668] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 371.969647] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 371.978845] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 371.988275] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 372.175655] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 372.182853] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 372.192159] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 372.377745] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 372.384714] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 372.393313] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 372.587900] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 372.594789] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 372.603524] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 373.552645] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 374.108959] 8021q: adding VLAN 0 to HW filter on device batadv0 00:30:20 executing program 3: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x6) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ptrace$cont(0x7, r0, 0x0, 0x0) 00:30:20 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000029000)={0xffffffffffffffff}) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) nanosleep(&(0x7f0000000180)={0x0, r1+10000000}, &(0x7f00000001c0)) r2 = gettid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f000087fff8)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f0000008ff8)=0x3f) fcntl$setsig(r3, 0xa, 0x12) fcntl$setownex(r3, 0xf, &(0x7f0000704000)={0x0, r2}) recvmsg(r4, &(0x7f000095cfc8)={0x0, 0x0, 0x0}, 0x0) dup2(r0, r4) r5 = gettid() tkill(r5, 0x16) 00:30:20 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_AUTO_ASCONF(0xffffffffffffffff, 0x84, 0x1e, &(0x7f0000000100), &(0x7f0000000140)=0x4) socket$bt_bnep(0x1f, 0x3, 0x4) fanotify_init(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) readahead(r0, 0xe561, 0x1429) listen(r1, 0x20000000) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0) setsockopt$inet6_int(r3, 0x29, 0x33, &(0x7f0000000040)=0x100000000001f, 0x87) sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) 00:30:20 executing program 1: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x88) fcntl$getown(0xffffffffffffffff, 0x9) ioctl$sock_inet_SIOCSARP(0xffffffffffffffff, 0x8955, &(0x7f0000000180)={{0x2, 0x4e21, @rand_addr=0x2}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @rand_addr=0x50000000}, 'tunl0\x00'}) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x4e21, 0x0, @ipv4={[], [], @remote}}, 0x1c) sendmmsg(r0, &(0x7f00000016c0), 0x3ffffffffffffed, 0xa00) syz_open_procfs(0x0, &(0x7f0000005880)='attr/keycreate\x00') 00:30:20 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f0000000000)=0x3ff, 0x4) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0xfffffefffffffffa, &(0x7f000006ffe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) 00:30:20 executing program 4: r0 = openat$cgroup_subtree(0xffffffffffffffff, 0x0, 0x2, 0x0) dup2(0xffffffffffffffff, r0) openat$vsock(0xffffffffffffff9c, 0x0, 0x682000, 0x0) accept$unix(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000180)=0x6e) dup2(0xffffffffffffffff, 0xffffffffffffffff) r1 = open(0x0, 0x0, 0x54) ioctl$sock_SIOCOUTQNSD(0xffffffffffffffff, 0x894b, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$loop(&(0x7f00000004c0)='/dev/loop#\x00', 0x0, 0x100082) r3 = memfd_create(&(0x7f0000000380)='\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00v\x8e\x05\xf7\xc1U\xad}\xc6\x94|W>Zi$Nv8,\n\xa6=W^\xa3Y\x7f\x8b\x17(\'~\xf7k0TM{\xa9-\xcf\x97\x8f\x1f\x81\xdc\x1b\x7f\x8f{4Q\xda\xda\x02\xec\xb4\xf1\xdd\xcc\x8bRA\xda\x89Efn\x00s\xc2Zb\x01\x00M\xbe\xa3z\xab\xd3\xeb\x98\x88\xc4\xc6)A\x9fP\x93zhH\xe0\xd2\x81\xdb\xeeV\x8cM\xe9\xa06\xc2o\x19\"\xf6Iq\xd4\xdf\x97\xfb\xab\x04\xe8\xceI8\xb3\x1d\xcf%\x9bK\xc6\t\x01\xe1\x86a\xfa\xb8\xfb)\x88\xcd+\xc2`\xc2\xf5r5>k\xb0\xa0\x02\xfc\x16MO\x18\x9b\x06\x80b\xd1\x01\x00\x00\x00\x00\x00\x00\x00@\f\fL\xa5{Tk\x940\x17.\xa56.\xe0\x14\x1b=\xf0j\xd25\xe8\x15\xd8\x9e\xea\xd3\xd9G4\t\xc0\x9c.\'\xa9R3z$\xf2\x01\x88\xc0\x13\x12<\xc01j3\xd8\xb4CE7s\xe4\xa0\x9e\xdd\x801\x12M\xee\x13\xce\x9cu(\x8f.\xc83\xc7\xe6j\xf5\xb1\x9a\x00\x00\x00\x00\x00\x00\x00', 0x0) fsetxattr$security_smack_entry(0xffffffffffffffff, 0x0, 0x0, 0x0, 0xffffffffffffffff) timerfd_gettime(0xffffffffffffffff, &(0x7f00000002c0)) pwritev(r3, &(0x7f0000000340)=[{&(0x7f00000001c0)='\'', 0x1}], 0x1, 0x81806) ioctl$LOOP_CHANGE_FD(r2, 0x4c00, r3) sendfile(r2, r3, &(0x7f0000000240), 0x20000102000007) add_key$keyring(&(0x7f0000000500)='keyring\x00', &(0x7f0000000540)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000200), 0x0) getresgid(&(0x7f0000000740), 0x0, &(0x7f0000000840)) setresgid(0x0, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) creat(0x0, 0x0) [ 374.498068] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. 00:30:20 executing program 3: r0 = socket$inet6(0xa, 0x100800000000002, 0x0) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @ipv4={[], [], @local}}, 0x1c) 00:30:20 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0a5c1f023c126285719070") ioctl$sock_SIOCGIFCONF(r0, 0x8912, &(0x7f0000000040)) 00:30:21 executing program 2: pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) fcntl$getflags(r0, 0x40b) 00:30:21 executing program 1: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x88) fcntl$getown(0xffffffffffffffff, 0x9) ioctl$sock_inet_SIOCSARP(0xffffffffffffffff, 0x8955, &(0x7f0000000180)={{0x2, 0x4e21, @rand_addr=0x2}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @rand_addr=0x50000000}, 'tunl0\x00'}) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x4e21, 0x0, @ipv4={[], [], @remote}}, 0x1c) sendmmsg(r0, &(0x7f00000016c0), 0x3ffffffffffffed, 0xa00) syz_open_procfs(0x0, &(0x7f0000005880)='attr/keycreate\x00') 00:30:21 executing program 3: r0 = socket$inet6(0xa, 0x3, 0x6) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @local, 0x4}, 0x1c) sendmmsg(r0, &(0x7f0000007e00), 0x400000000000105, 0x0) 00:30:21 executing program 4: pipe(&(0x7f0000000740)={0xffffffffffffffff, 0xffffffffffffffff}) openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000100)='/proc/thread-self/attr/current\x00', 0x2, 0x0) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) write(r1, &(0x7f00000001c0), 0xfffffef3) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) read(r0, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000400)='net/igmp6\x003H\x0e\xdd\\/\xc2B\xd0\x0ej\xdf\xa8\x80V\xb2\xba\x8eMK\xeb\r\r\x94\xb5Ps\xe9A\xad\xd6q$\x0ftx\xeb\x13\x12\xa9go\xac\x1e\x82\x8f\x18\vz;\xbe\xa4\xe1\xbd\x0f=\x85\xf8\xbf\xc5\"dxRA\xcbo\x00\xb1\xddb\xd8{\x99\xa8~\xcb2\x98\xad\xf9\xae\x1e\x93\x98\xd9\xbf\xd7\xd7QU\x82e\xfe\xa4O\xac\xbe\xb7\xcd>nC\xa1(\x89\xf2\xbau\x1a\xb5\xc5<\xe6\xb3\xf53%\xed\xc7\x8d\'\n\xa6V\xcau\xd3\x9ax$\x01\x88\xa9bk\xf0\xf7\xaa\x9d[\xa3') r3 = add_key$keyring(&(0x7f0000000540)='keyring\x00', &(0x7f0000000580)={'syz', 0x0}, 0x0, 0x0, 0x0) keyctl$instantiate_iov(0x14, 0x0, &(0x7f0000000500)=[{&(0x7f00000004c0)}], 0x1, r3) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={&(0x7f0000000080)=@can, 0x80, 0x0}, 0x0) preadv(r2, &(0x7f00000017c0), 0x1fe, 0x400000000000) 00:30:21 executing program 2: open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) rt_sigprocmask(0x0, &(0x7f0000032ff8), 0x0, 0x8) rt_sigtimedwait(0x0, 0x0, 0x0, 0x0) r0 = eventfd(0x0) read$eventfd(r0, &(0x7f0000000040), 0x8) creat(&(0x7f0000000400)='./file0\x00', 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000200)='pagemap\x00') sendfile(r0, r1, 0x0, 0xffffffff) 00:30:23 executing program 3: mlockall(0x1) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xddf000)=nil, 0xddf000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 00:30:23 executing program 5: 00:30:23 executing program 1: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) msgsnd(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="06"], 0x1, 0x0) msgrcv(0x0, 0x0, 0x0, 0x3, 0x3800) 00:30:23 executing program 4: 00:30:23 executing program 2: 00:30:23 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_AUTO_ASCONF(0xffffffffffffffff, 0x84, 0x1e, &(0x7f0000000100), &(0x7f0000000140)=0x4) socket$bt_bnep(0x1f, 0x3, 0x4) fanotify_init(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) readahead(r0, 0xe561, 0x1429) listen(r1, 0x20000000) r2 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r3 = accept4(r1, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000000)=0x80, 0x0) setsockopt$inet6_int(r3, 0x29, 0x33, &(0x7f0000000040)=0x100000000001f, 0x87) sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0) 00:30:23 executing program 2: 00:30:23 executing program 1: 00:30:23 executing program 4: 00:30:24 executing program 1: 00:30:24 executing program 5: 00:30:24 executing program 4: 00:30:24 executing program 3: 00:30:24 executing program 2: 00:30:24 executing program 5: 00:30:24 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0a5c1f023c126285719070") semctl$IPC_INFO(0x0, 0x0, 0x3, 0x0) 00:30:24 executing program 1: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuset.effective_mems\x00', 0x0, 0x0) 00:30:24 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) creat(&(0x7f0000000680)='./bus\x00', 0x0) 00:30:24 executing program 3: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setstatus(r1, 0x4, 0x2000006800) write$binfmt_elf64(r1, &(0x7f0000000180)=ANY=[], 0xffffff49) readv(r0, &(0x7f00000000c0)=[{&(0x7f0000000140)=""/4096, 0x1000}], 0x1) 00:30:24 executing program 2: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_GET_STATUS64(r0, 0x1268, &(0x7f0000000100)) 00:30:24 executing program 5: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 00:30:25 executing program 1: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000240)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) recvmsg(r0, &(0x7f0000001d40)={0x0, 0x0, 0x0}, 0x0) sendto(r0, &(0x7f0000000340), 0x0, 0x0, 0x0, 0x0) 00:30:25 executing program 4: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_GET_STATUS64(r0, 0x4c05, &(0x7f0000000100)) 00:30:25 executing program 3: request_key(&(0x7f0000000280)='dns_resolver\x00', &(0x7f0000000180)={'sy.', 0x2}, 0x0, 0xffffffffffffffff) 00:30:25 executing program 2: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x802, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_SET_KEYBIT(r0, 0x40045565, 0x151) write$uinput_user_dev(r0, &(0x7f0000000540)={'syz0\x00'}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) 00:30:25 executing program 0: socketpair$unix(0x1, 0x401000000005, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) semctl$SEM_INFO(0x0, 0x0, 0x13, 0x0) [ 379.322720] input: syz0 as /devices/virtual/input/input5 [ 379.360852] input: syz0 as /devices/virtual/input/input6 00:30:25 executing program 4: r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000240)={0x18, 0x0, {0x2, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xf}, 'batadv0\x00'}}, 0x1e) socket$pppoe(0x18, 0x1, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, 0x0) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) 00:30:25 executing program 3: r0 = signalfd(0xffffffffffffffff, &(0x7f0000000040), 0x8) close(r0) r1 = inotify_init1(0x0) fcntl$setstatus(r0, 0x4, 0x2c00) creat(&(0x7f0000000000)='./control\x00', 0x0) fcntl$setsig(0xffffffffffffffff, 0xa, 0x0) inotify_add_watch(r1, &(0x7f00007a7000)='./control\x00', 0xa4000960) open(&(0x7f0000000200)='./control\x00', 0x0, 0x0) 00:30:25 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000040)=0x74, 0x4) bind$inet(r0, &(0x7f0000000180)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x20000800, 0x0, 0xfffffffffffffe2e) ioctl$FS_IOC_GETFLAGS(0xffffffffffffffff, 0x80086601, &(0x7f0000000140)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000440)) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x1000000004e23, @local}, 0x10) write$P9_RLERROR(0xffffffffffffffff, &(0x7f00000005c0)=ANY=[@ANYBLOB="450000000701003c0073656375726974796d696d655f74797065656d3021766d6e65000000006f632873656375726974796b657972696e672a73656375726974795e7b237bb9ac8823338651902c58b965ca58449497229a5ed48fa502f54e22"], 0x60) sendto$inet(r0, &(0x7f0000000b40)="762d013abf428f831f537d10987f3f009e134c11cb6b5d479d61fac22b7c399e31904cab65dc1f2efc95ac1348db76ab634cf0fbde36acede0e45438773d28036919fd3c82e3622eb6f09975594f6bda43d29d0021a06e309383d903c1c4fd79f21eb35886e667dbe7", 0x69, 0x4008000, 0x0, 0x0) recvmsg(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000740)=""/199, 0xc7}], 0x1}, 0x40000120) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000080)=0xda9, 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x8200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$binfmt_elf64(r0, &(0x7f0000000100)=ANY=[@ANYRES32, @ANYRES16=0x0], 0xff5a) 00:30:25 executing program 2: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000040)=0x74, 0x4) bind$inet(r0, &(0x7f0000000180)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, 0x0) sendto$inet(r0, 0x0, 0x0, 0x20000800, 0x0, 0xfffffffffffffe2e) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) pipe(0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000440)) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x1000000004e23, @local}, 0x10) sendto$inet(r0, &(0x7f0000000b40)="762d013abf428f831f537d10987f3f009e134c11cb6b5d479d61fac22b7c399e31904cab65dc1f2efc95ac1348db76ab634cf0fbde36acede0e45438773d28036919fd3c82e3622eb6f09975594f6bda43d29d0021a06e309383d903c1c4fd79f21eb35886e667dbe7", 0x69, 0x4008000, 0x0, 0x0) recvmsg(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000740)=""/199, 0xc7}], 0x1}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000080)=0xda9, 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x8200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$binfmt_elf64(r0, &(0x7f0000000100)=ANY=[@ANYRES32, @ANYRES16=0x0], 0xff5a) 00:30:25 executing program 3: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000a00)=@polexpire={0xc0, 0x1b, 0x1, 0x0, 0x0, {{{@in=@broadcast, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x2, 0xa0}}}}, 0xc0}}, 0x0) 00:30:25 executing program 4: seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0xffffffffffffff7f}]}) set_thread_area(0x0) [ 379.923848] audit: type=1326 audit(1546043425.983:35): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=13690 comm="syz-executor4" exe="/root/syz-executor4" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45a81a code=0xffff0000 00:30:26 executing program 5: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000040)=0x74, 0x4) bind$inet(r0, &(0x7f0000000180)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, 0x0) sendto$inet(r0, 0x0, 0x0, 0x20000800, 0x0, 0xfffffffffffffe2e) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) ioctl$FS_IOC_GETFLAGS(0xffffffffffffffff, 0x80086601, &(0x7f0000000140)) pipe(0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000440)) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x1000000004e23, @local}, 0x10) write$P9_RLERROR(0xffffffffffffffff, &(0x7f00000005c0)=ANY=[@ANYBLOB="450000000701003c0073656375726974796d696d655f74797065656d3021766d6e65000000006f632873656375726974796b657972696e672a73656375726974795e7b237bb9ac882333"], 0x4a) sendto$inet(r0, &(0x7f0000000b40)="762d013abf428f831f537d10987f3f009e134c11cb6b5d479d61fac22b7c399e31904cab65dc1f2efc95ac1348db76ab634cf0fbde36acede0e45438773d28036919fd3c82e3622eb6f09975594f6bda43d29d0021a06e309383d903c1c4fd79f21eb35886e667dbe7", 0x69, 0x4008000, 0x0, 0x0) recvmsg(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000740)=""/199, 0xc7}], 0x1}, 0x40000120) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000080)=0xda9, 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$binfmt_elf64(r0, &(0x7f0000000100)=ANY=[@ANYRES32, @ANYRES16=0x0], 0xff5a) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) 00:30:26 executing program 1: clone(0x4000020002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) eventfd(0xfffffffffffffffe) r0 = openat$null(0xffffffffffffff9c, 0x0, 0x8000, 0x0) bind(r0, &(0x7f0000000080)=@ipx={0x4, 0x6, 0xa00e, "01920bd6fe24", 0x7}, 0x80) request_key(&(0x7f0000000280)='dns_resolver\x00', &(0x7f0000000180)={'sy.', 0x1}, &(0x7f0000000000)='syz', 0xffffffffffffffff) 00:30:26 executing program 3: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000a00)=@polexpire={0xc0, 0x1b, 0x1, 0x0, 0x0, {{{@in=@broadcast, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x2, 0xa0}}}}, 0xc0}}, 0x0) 00:30:26 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r0, 0x2) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x10, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140f}]}, &(0x7f00000001c0)=0x10) r2 = accept(r0, 0x0, 0x0) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f0000000040)={0x0, 0x0, 0x30}, 0xc) sendto$inet6(r2, &(0x7f0000000300)="0f", 0x1, 0x0, 0x0, 0x0) 00:30:26 executing program 3: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000a00)=@polexpire={0xc0, 0x1b, 0x1, 0x0, 0x0, {{{@in=@broadcast, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x2, 0xa0}}}}, 0xc0}}, 0x0) 00:30:26 executing program 3: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000a00)=@polexpire={0xc0, 0x1b, 0x1, 0x0, 0x0, {{{@in=@broadcast, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x2, 0xa0}}}}, 0xc0}}, 0x0) 00:30:26 executing program 0: seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0xffffffffffffff7f}]}) poll(0x0, 0x0, 0x7f) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) creat(&(0x7f0000000700)='./bus\x00', 0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x0, 0x0) pread64(r2, 0x0, 0x0, 0x0) 00:30:26 executing program 3: sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000a00)=@polexpire={0xc0, 0x1b, 0x1, 0x0, 0x0, {{{@in=@broadcast, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x2, 0xa0}}}}, 0xc0}}, 0x0) [ 380.587229] audit: type=1326 audit(1546043426.643:36): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=13722 comm="syz-executor0" exe="/root/syz-executor0" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45a81a code=0xffff0000 00:30:26 executing program 3: socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000a00)=@polexpire={0xc0, 0x1b, 0x1, 0x0, 0x0, {{{@in=@broadcast, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x2, 0xa0}}}}, 0xc0}}, 0x0) 00:30:26 executing program 2: socketpair$unix(0x1, 0x0, 0x0, 0x0) clone(0x2002102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000640)=@nat={'Xat\x00\x00\x00\x00\x00\x00\x03\b\x01\x00', 0x19, 0x3, 0x130, [0x20001600, 0x0, 0x0, 0x20001860, 0x20001890], 0x0, 0x0, &(0x7f0000001600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x0, 0x0, 0x0, 'vcan0\x00', 'nr0\x00', 'veth1_to_bridge\x00', 'lapb0\x00', @remote, [], @remote, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff}, {0x0, '\x00', 0x2}]}, 0x1a8) [ 380.697995] audit: type=1326 audit(1546043426.753:37): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=13690 comm="syz-executor4" exe="/root/syz-executor4" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45a81a code=0xffff0000 [ 380.811230] kernel msg: ebtables bug: please report to author: EBT_ENTRY_OR_ENTRIES shouldn't be set in distinguisher 00:30:26 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/arp\x00') r1 = syz_open_procfs(0x0, &(0x7f0000000000)='oom_score_adj\x00') sendfile(r1, r0, &(0x7f0000000040)=0x5d, 0x239bffffffffffb) 00:30:26 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKROTATIONAL(r0, 0x127e, &(0x7f0000000200)) 00:30:27 executing program 5: 00:30:27 executing program 3: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, 0x0, 0x0) 00:30:27 executing program 4: 00:30:27 executing program 1: r0 = socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r0, &(0x7f0000001540)={&(0x7f0000000040)=@nfc={0x27, 0x3}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000100)="c14305000000400000051fe4ac14140ceb", 0x11}], 0x1}, 0x0) 00:30:27 executing program 4: 00:30:27 executing program 2: [ 381.415418] audit: type=1326 audit(1546043427.473:38): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=13722 comm="syz-executor0" exe="/root/syz-executor0" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45a81a code=0xffff0000 [ 381.437761] ================================================================== [ 381.445180] BUG: KMSAN: uninit-value in __nf_conntrack_find_get+0x1023/0x22f0 [ 381.452471] CPU: 1 PID: 13762 Comm: syz-executor1 Not tainted 4.20.0-rc7+ #15 [ 381.459755] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 381.469130] Call Trace: [ 381.471760] dump_stack+0x173/0x1d0 [ 381.475419] kmsan_report+0x12e/0x2a0 [ 381.479244] __msan_warning+0x82/0xf0 [ 381.483075] __nf_conntrack_find_get+0x1023/0x22f0 [ 381.488069] ? __msan_metadata_ptr_for_load_4+0x10/0x20 [ 381.493487] nf_conntrack_in+0xdf4/0x1cea [ 381.497703] ipv4_conntrack_local+0x1e2/0x370 [ 381.502229] ? ipv4_conntrack_in+0x80/0x80 [ 381.506482] nf_hook_slow+0x176/0x3d0 [ 381.510315] __ip_local_out+0x6dc/0x800 [ 381.514320] ? __ip_local_out+0x800/0x800 [ 381.518483] ip_local_out+0xa4/0x1d0 [ 381.522230] iptunnel_xmit+0x8d1/0xe00 [ 381.526177] ip_tunnel_xmit+0x37c6/0x3b90 [ 381.530397] ipgre_xmit+0xdd8/0xec0 [ 381.534057] ? ipgre_close+0x230/0x230 [ 381.537963] dev_hard_start_xmit+0x607/0xc40 [ 381.542426] __dev_queue_xmit+0x2e42/0x3bc0 [ 381.546807] dev_queue_xmit+0x4b/0x60 [ 381.550632] ? __netdev_pick_tx+0x1270/0x1270 [ 381.555162] packet_sendmsg+0x8306/0x8f30 [ 381.559349] ? __msan_metadata_ptr_for_store_8+0x13/0x20 [ 381.564817] ? rw_copy_check_uvector+0x149/0x6a0 [ 381.569622] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 381.575072] ___sys_sendmsg+0xdb9/0x11b0 [ 381.579172] ? compat_packet_setsockopt+0x360/0x360 [ 381.584220] ? kmsan_internal_unpoison_shadow+0x2f/0x40 [ 381.589620] ? __msan_metadata_ptr_for_load_1+0x10/0x20 [ 381.594999] ? __fget_light+0x6e1/0x750 [ 381.599015] __se_sys_sendmsg+0x305/0x460 [ 381.603208] __x64_sys_sendmsg+0x4a/0x70 [ 381.607291] do_syscall_64+0xbc/0xf0 [ 381.611027] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 381.616226] RIP: 0033:0x4579b9 [ 381.619428] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 381.638348] RSP: 002b:00007f1326c9bc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 381.646073] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004579b9 [ 381.653357] RDX: 0000000000000000 RSI: 0000000020001540 RDI: 0000000000000004 [ 381.660637] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 381.667915] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f1326c9c6d4 [ 381.675194] R13: 00000000004c4d3b R14: 00000000004d84a8 R15: 00000000ffffffff [ 381.682487] [ 381.684115] Uninit was created at: [ 381.687650] No stack [ 381.689970] ================================================================== [ 381.697327] Disabling lock debugging due to kernel taint [ 381.702784] Kernel panic - not syncing: panic_on_warn set ... [ 381.708686] CPU: 1 PID: 13762 Comm: syz-executor1 Tainted: G B 4.20.0-rc7+ #15 [ 381.717350] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 381.727037] Call Trace: [ 381.729649] dump_stack+0x173/0x1d0 [ 381.733307] panic+0x3ce/0x961 [ 381.736567] kmsan_report+0x293/0x2a0 [ 381.740405] __msan_warning+0x82/0xf0 [ 381.744235] __nf_conntrack_find_get+0x1023/0x22f0 [ 381.749221] ? __msan_metadata_ptr_for_load_4+0x10/0x20 [ 381.754634] nf_conntrack_in+0xdf4/0x1cea [ 381.758854] ipv4_conntrack_local+0x1e2/0x370 [ 381.763405] ? ipv4_conntrack_in+0x80/0x80 [ 381.767655] nf_hook_slow+0x176/0x3d0 [ 381.771492] __ip_local_out+0x6dc/0x800 [ 381.775498] ? __ip_local_out+0x800/0x800 [ 381.779663] ip_local_out+0xa4/0x1d0 [ 381.783403] iptunnel_xmit+0x8d1/0xe00 [ 381.787348] ip_tunnel_xmit+0x37c6/0x3b90 [ 381.791564] ipgre_xmit+0xdd8/0xec0 [ 381.795230] ? ipgre_close+0x230/0x230 [ 381.799229] dev_hard_start_xmit+0x607/0xc40 [ 381.803687] __dev_queue_xmit+0x2e42/0x3bc0 [ 381.808072] dev_queue_xmit+0x4b/0x60 [ 381.811893] ? __netdev_pick_tx+0x1270/0x1270 [ 381.816402] packet_sendmsg+0x8306/0x8f30 [ 381.820583] ? __msan_metadata_ptr_for_store_8+0x13/0x20 [ 381.826065] ? rw_copy_check_uvector+0x149/0x6a0 [ 381.830861] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 381.836308] ___sys_sendmsg+0xdb9/0x11b0 [ 381.840396] ? compat_packet_setsockopt+0x360/0x360 [ 381.845443] ? kmsan_internal_unpoison_shadow+0x2f/0x40 [ 381.850832] ? __msan_metadata_ptr_for_load_1+0x10/0x20 [ 381.856726] ? __fget_light+0x6e1/0x750 [ 381.860747] __se_sys_sendmsg+0x305/0x460 [ 381.864939] __x64_sys_sendmsg+0x4a/0x70 [ 381.869028] do_syscall_64+0xbc/0xf0 [ 381.872761] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 381.877959] RIP: 0033:0x4579b9 [ 381.881161] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 381.900079] RSP: 002b:00007f1326c9bc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 381.907828] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004579b9 [ 381.915123] RDX: 0000000000000000 RSI: 0000000020001540 RDI: 0000000000000004 [ 381.922405] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 381.929707] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f1326c9c6d4 [ 381.936991] R13: 00000000004c4d3b R14: 00000000004d84a8 R15: 00000000ffffffff [ 381.945366] Kernel Offset: disabled [ 381.948998] Rebooting in 86400 seconds..