[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 75.793596][ T31] audit: type=1800 audit(1566388688.857:25): pid=11364 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 75.816644][ T31] audit: type=1800 audit(1566388688.877:26): pid=11364 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 75.852954][ T31] audit: type=1800 audit(1566388688.897:27): pid=11364 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.156' (ECDSA) to the list of known hosts. 2019/08/21 11:58:21 fuzzer started 2019/08/21 11:58:27 dialing manager at 10.128.0.26:44297 2019/08/21 11:58:27 syscalls: 2376 2019/08/21 11:58:27 code coverage: enabled 2019/08/21 11:58:27 comparison tracing: CONFIG_KCOV_ENABLE_COMPARISONS is not enabled 2019/08/21 11:58:27 extra coverage: enabled 2019/08/21 11:58:27 setuid sandbox: enabled 2019/08/21 11:58:27 namespace sandbox: enabled 2019/08/21 11:58:27 Android sandbox: /sys/fs/selinux/policy does not exist 2019/08/21 11:58:27 fault injection: enabled 2019/08/21 11:58:27 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/08/21 11:58:27 net packet injection: enabled 2019/08/21 11:58:27 net device setup: enabled 12:00:47 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_NET_SET_BACKEND(r0, 0xaf02, 0x0) syzkaller login: [ 234.381652][T11530] IPVS: ftp: loaded support on port[0] = 21 [ 234.523482][T11530] chnl_net:caif_netlink_parms(): no params data found [ 234.578953][T11530] bridge0: port 1(bridge_slave_0) entered blocking state [ 234.586215][T11530] bridge0: port 1(bridge_slave_0) entered disabled state [ 234.595095][T11530] device bridge_slave_0 entered promiscuous mode [ 234.605206][T11530] bridge0: port 2(bridge_slave_1) entered blocking state [ 234.612435][T11530] bridge0: port 2(bridge_slave_1) entered disabled state [ 234.620938][T11530] device bridge_slave_1 entered promiscuous mode [ 234.653106][T11530] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 234.665978][T11530] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 234.698446][T11530] team0: Port device team_slave_0 added [ 234.707495][T11530] team0: Port device team_slave_1 added [ 234.996293][T11530] device hsr_slave_0 entered promiscuous mode [ 235.152737][T11530] device hsr_slave_1 entered promiscuous mode [ 235.430803][T11530] bridge0: port 2(bridge_slave_1) entered blocking state [ 235.438082][T11530] bridge0: port 2(bridge_slave_1) entered forwarding state [ 235.445809][T11530] bridge0: port 1(bridge_slave_0) entered blocking state [ 235.453004][T11530] bridge0: port 1(bridge_slave_0) entered forwarding state [ 235.528265][T11530] 8021q: adding VLAN 0 to HW filter on device bond0 [ 235.536804][ T5] bridge0: port 1(bridge_slave_0) entered disabled state [ 235.547210][ T5] bridge0: port 2(bridge_slave_1) entered disabled state [ 235.558478][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 235.585289][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 235.593917][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 235.608439][T11530] 8021q: adding VLAN 0 to HW filter on device team0 [ 235.627720][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 235.637425][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 235.646842][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 235.654066][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 235.662439][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 235.671624][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 235.680538][ T5] bridge0: port 2(bridge_slave_1) entered blocking state [ 235.687750][ T5] bridge0: port 2(bridge_slave_1) entered forwarding state [ 235.700516][ T2929] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 235.719953][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 235.730154][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 235.739864][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 235.750155][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 235.769602][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 235.779295][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 235.805171][T11530] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 235.816165][T11530] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 235.829772][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 235.839284][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 235.848714][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 235.857654][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 235.888335][T11530] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 235.896972][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready 12:00:49 executing program 0: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffff9c, &(0x7f0000008880)=[{{0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000240)=""/62, 0x3e}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/snmp\x00') preadv(r0, &(0x7f0000000480), 0x10000000000000e1, 0x0) getegid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 12:00:49 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, 0x0) syz_open_pts(0xffffffffffffffff, 0x0) openat$mixer(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000240)='/dev/dri/card#\x00', 0xc72f, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000380)={0x8, 0x5}) ioctl$DRM_IOCTL_MODE_SETCRTC(r0, 0xc06864a2, &(0x7f0000000400)={0x0, 0x0, 0x200000000001d, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "77100b6a1cc076a15ad9f0552d5b12bfc338e5269b12ac2a4ee4202c64122b0a"}}) setsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000040)=ANY=[@ANYRES32], 0x1) read$FUSE(0xffffffffffffffff, &(0x7f0000003000), 0x1000) 12:00:49 executing program 0: dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffff9c, &(0x7f0000008880)=[{{0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000240)=""/62, 0x3e}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/snmp\x00') preadv(r0, &(0x7f0000000480), 0x10000000000000e1, 0x0) 12:00:49 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REPLACE(r0, 0xc1105518, &(0x7f0000000100)={{0x0, 0x0, 0x0, 0x0, 'syz1\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00', 0x0}) 12:00:49 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) writev(r1, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) socket$unix(0x1, 0x2, 0x0) write$binfmt_elf64(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="7f455c410600010005010d4d"], 0xc) close(r2) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="73797a30991bca6c3cd27a92013b3804abc3edb69c23645bbd22c3c68907763089d3763663d5badeace1a986060819384670bc22880e82afe9bcce763a598e8002cbace19bddb4cd3154"], 0x4a) socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfef0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) splice(r0, 0x0, r2, 0x0, 0x80000001, 0x0) 12:00:49 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000005000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000000)={0x68, 0x0, 0x1b}) pipe(&(0x7f0000000040)={0xffffffffffffffff}) ioctl$PPPIOCSDEBUG(r1, 0x40047440, &(0x7f0000000080)=0x1f) 12:00:50 executing program 0: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) r2 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cachefiles\x00', 0x540, 0x0) ioctl$VIDIOC_S_AUDIO(r2, 0x40345622, &(0x7f00000000c0)={0xfffffffffffffff8, "393d38d69cd9f15cc6adb5aa219dfb937ddc16bbacd5f42af961dddf887713c3", 0x3, 0x1}) listen(r0, 0x4d) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @loopback=0x7f000002}, 0x10) getsockopt$inet_int(r1, 0x10d, 0x97, &(0x7f0000000140), &(0x7f0000000040)=0xc6) 12:00:50 executing program 0: ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, 0xffffffffffffffff) r0 = socket$bt_cmtp(0x1f, 0x3, 0x5) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000080)=0x1, 0x4) r1 = socket$kcm(0x2b, 0x8000000000001, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003300050bd25a80648c6356c10324fc00120000000a000a00053582c1b0acea8b0900018004021700d1bd", 0x2e}], 0x1}, 0x0) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer2\x00', 0x20000, 0x0) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000180)='IPVS\x00') openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/hwrng\x00', 0x60200, 0x0) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000280)={&(0x7f0000000140), 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x58, r4, 0x0, 0x70bd2b, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_SERVICE={0x2c, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'ovf\x00'}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x4}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'sh\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xc2d2}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x20}]}, 0x58}, 0x1, 0x0, 0x0, 0x84}, 0x4898b46bf840776b) [ 237.106040][T11564] netlink: 'syz-executor.0': attribute type 10 has an invalid length. [ 237.120351][T11565] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 12:00:50 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000080)="f2a6bad004b00fee0f090f3036f30f1a970000660f3806581e0f08bad004b0beeef30f2af8baa100b000ee", 0x2b}], 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f0000000040)=0x96d1, 0x193) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000100)="11dca50d5e0bcfe47bf070") r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) getpeername$packet(r1, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) ioctl$FS_IOC_FIEMAP(r1, 0xc020660b, &(0x7f00000006c0)={0x9, 0x1, 0x2, 0x3, 0x2, [{0x3, 0x8, 0x5, 0x0, 0x0, 0x200}, {0x8, 0xa000000000000, 0xffffffff, 0x0, 0x0, 0x1}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) accept4(0xffffffffffffffff, &(0x7f0000000480)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @dev}}, &(0x7f0000000000)=0xfeb6, 0x0) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f00000002c0)={[0x0, 0x0, 0x40000004, 0x0, 0x0, 0x0, 0x4cb], 0x100000}) r4 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000280)='/dev/qat_adf_ctl\x00', 0x1, 0x0) stat(&(0x7f0000000440)='./file0\x00', &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r6 = getegid() fstat(r0, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x1, &(0x7f0000000580)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x6000}, 0x2c, {'user_id', 0x3d, r5}, 0x2c, {'group_id', 0x3d, r6}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x4}}, {@blksize={'blksize', 0x3d, 0x800}}, {@blksize={'blksize', 0x3d, 0x800}}, {@blksize={'blksize', 0x3d, 0x1000}}], [{@context={'context', 0x3d, 'staff_u'}}, {@fowner_lt={'fowner<', r7}}]}}) ioctl$KVM_RUN(r3, 0xae80, 0x0) [ 237.214509][T11568] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 237.240009][T11568] user requested TSC rate below hardware speed [ 237.266795][T11568] kvm [11567]: vcpu0, guest rIP: 0x8a Hyper-V uhandled wrmsr: 0x4000008f data 0x4d00000000f [ 237.277648][T11568] kvm [11567]: vcpu0, guest rIP: 0x8a Hyper-V uhandled wrmsr: 0x4000008d data 0x4d00000000f [ 237.288166][T11568] kvm [11567]: vcpu0, guest rIP: 0x8a Hyper-V uhandled wrmsr: 0x4000008b data 0x4d00000000f [ 237.299248][T11568] kvm [11567]: vcpu0, guest rIP: 0x8a Hyper-V uhandled wrmsr: 0x40000089 data 0x4d00000000f [ 237.309813][T11568] kvm [11567]: vcpu0, guest rIP: 0x8a Hyper-V uhandled wrmsr: 0x40000087 data 0x4d00000000f [ 237.320875][T11568] kvm [11567]: vcpu0, guest rIP: 0x8a Hyper-V uhandled wrmsr: 0x40000085 data 0x4d00000000f [ 237.332501][T11568] kvm [11567]: vcpu0, guest rIP: 0x8a Hyper-V uhandled wrmsr: 0x4000007f data 0x4d00000000f [ 237.342984][T11568] kvm [11567]: vcpu0, guest rIP: 0x8a Hyper-V uhandled wrmsr: 0x4000007d data 0x4d00000000f [ 237.354048][T11568] kvm [11567]: vcpu0, guest rIP: 0x8a Hyper-V uhandled wrmsr: 0x4000007b data 0x4d00000000f [ 237.364608][T11568] kvm [11567]: vcpu0, guest rIP: 0x8a Hyper-V uhandled wrmsr: 0x40000079 data 0x4d00000000f [ 237.427719][T11568] user requested TSC rate below hardware speed 12:00:50 executing program 0: r0 = socket$netlink(0x10, 0x3, 0xb) sendmsg$nl_generic(r0, &(0x7f0000005000)={&(0x7f0000000040)={0x10, 0xf0ffffff00000f00, 0x400000000000000}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)={0x48, 0x14, 0x207, 0x0, 0x0, {0x2, 0xf0ffff, 0x600}, [@nested={0x0, 0x0, [@typed={0x300, 0x0, @fd}]}]}, 0x24c}}, 0x0) 12:00:50 executing program 1: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x8000, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r0, 0x28, 0x1, &(0x7f0000000040)=0x644, 0x8) setsockopt$inet_sctp_SCTP_AUTOCLOSE(r0, 0x84, 0x4, &(0x7f0000000080)=0x3, 0x4) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f00000000c0)={0x0, 0x7fff, 0x20}, &(0x7f0000000100)=0xc) getsockopt$inet_sctp6_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000140)=@assoc_value={r1, 0x3b36}, &(0x7f0000000180)=0x8) r2 = gettid() fcntl$setownex(r0, 0xf, &(0x7f00000001c0)={0x0, r2}) ioctl$HIDIOCGFLAG(r0, 0x8004480e, &(0x7f0000000200)) fcntl$lock(r0, 0x6, &(0x7f0000000240)={0x2, 0x3, 0x3, 0x1000, r2}) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@remote, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@multicast2}}, &(0x7f0000000380)=0xe8) setfsuid(r3) sync() ioctl$CAPI_GET_ERRCODE(r0, 0x80024321, &(0x7f00000003c0)) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='fuse\x00', 0x400, &(0x7f0000000540)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x2000}, 0x2c, {'user_id', 0x3d, r3}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@allow_other='allow_other'}, {@blksize={'blksize', 0x3d, 0xa00}}, {@allow_other='allow_other'}, {@max_read={'max_read', 0x3d, 0x80}}, {@default_permissions='default_permissions'}], [{@context={'context', 0x3d, 'system_u'}}, {@dont_hash='dont_hash'}, {@uid_lt={'uid<', r3}}, {@smackfshat={'smackfshat', 0x3d, '/dev/dlm-monitor\x00'}}, {@obj_user={'obj_user', 0x3d, '\\vboxnet0'}}]}}) r5 = syz_open_dev$midi(&(0x7f0000000680)='/dev/midi#\x00', 0x5, 0x100) ioctl$VHOST_SET_VRING_KICK(r5, 0x4008af20, &(0x7f00000006c0)={0x3, r0}) ioctl$CAPI_GET_PROFILE(r5, 0xc0404309, &(0x7f0000000700)=0x1) mkdirat$cgroup(r5, &(0x7f0000000740)='syz1\x00', 0x1ff) r6 = syz_open_dev$usbmon(&(0x7f0000000780)='/dev/usbmon#\x00', 0xff, 0x10000) bind$inet(r0, &(0x7f00000007c0)={0x2, 0x4e20, @local}, 0x10) ioctl$DRM_IOCTL_AUTH_MAGIC(r6, 0x40046411, &(0x7f0000000800)=0x2) prctl$PR_SET_NAME(0xf, &(0x7f0000000840)='\x10system!systemposix_acl_access\x00') r7 = syz_open_dev$dmmidi(&(0x7f0000000880)='/dev/dmmidi#\x00', 0x7ff, 0x10000) ioctl$sock_inet_SIOCGIFDSTADDR(r7, 0x8917, &(0x7f00000008c0)={'bcsh0\x00', {0x2, 0x4e20, @remote}}) fcntl$getownex(r0, 0x10, &(0x7f0000000900)) connect$bt_rfcomm(r0, &(0x7f0000000940)={0x1f, {0xffff, 0xed8, 0x6, 0x83ec, 0x3, 0x1000}, 0x100000001}, 0xa) ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000a80)={r6, r5, 0xd7, 0xc5, &(0x7f0000000980)="f9a9a2d793ecd2b0f380258f47d81f4d344bc0e194053fd593d3de83e0081a5d476ebfa73ff755a35ca2b4f5d51b5d4d59ec9cf9fe5513beaf632e7817d507c81a62b263e117c16647d72cb15faf478fd4210cd21b074c6b1942e0d90a753884399ac707c88a2ffd2abd402031649a04ca6f07ce6f9280e3832a8775c007478d7a02d5014d5265f3da668f0e5f544b3beb63d8d1b5a4cd196404b605fa6379a295a62cc06662b4ee9c037eb44a4b376b504d4995ecf9aa54c611f8b3e498d8fa3b1e5b9379", 0x1, 0x6, 0x8, 0x10000, 0x6, 0x2, 0x6, 'syz0\x00'}) fcntl$getownex(r0, 0x10, &(0x7f0000000b40)) clock_gettime(0x0, &(0x7f0000000b80)={0x0, 0x0}) write$input_event(r5, &(0x7f0000000bc0)={{r8, r9/1000+10000}, 0x0, 0x505, 0xffff}, 0x18) 12:00:50 executing program 0: r0 = socket(0x200000000000011, 0x2, 0x4000000000000) ioctl$sock_inet_SIOCGIFDSTADDR(r0, 0x8917, &(0x7f0000000080)={'lo\x00\xd8$\xf5\x00\x18\x7f\x00\b\x00', {0x2, 0xfffffffffffffffc, @loopback}}) getsockopt$sock_timeval(r0, 0x1, 0x14, &(0x7f0000000000), &(0x7f00000000c0)=0x10) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f0000000040)=0x400, 0x4) 12:00:50 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000016000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000080)="baa100b000eef36cba2100ec66b9800000c00f326635001000000f30bad104ecc80080d267d9f8f30f1bb429000f20c06635200000000f22c067f3af", 0x3c}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_REINJECT_CONTROL(0xffffffffffffffff, 0xae71, &(0x7f0000000000)={0x94}) name_to_handle_at(0xffffffffffffffff, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="9a"], 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000017000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 237.893803][T11581] user requested TSC rate below hardware speed [ 237.933116][T11581] user requested TSC rate below hardware speed [ 237.988876][T11584] IPVS: ftp: loaded support on port[0] = 21 12:00:51 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = memfd_create(&(0x7f0000000400)='/dev/snd/seq\x00', 0x0) r2 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x1) socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup2(r2, r1) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r3, 0xc08c5332, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00'}) setsockopt$packet_fanout_data(r3, 0x107, 0x16, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x5, 0xfffffffffffff655, 0x6, 0xfd41}]}, 0x10) write$sndseq(r1, &(0x7f0000000000)=[{0x5, 0x21, 0x0, 0x0, @tick, {}, {}, @connect}], 0xffffff76) 12:00:51 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) unshare(0x20400) bind$inet(r0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1b, &(0x7f0000000000)={0x0, 0x6f, "270f43eca1060cd7c75cea414266b4ee219c3cafdb212ee06c87925d356182f518e15073dab347b6a76c7cd82d153248e064b1686c526c635344786618dce718778a4ae44e4a889094a7e8ede1341cfb4f652d18062290e6f406d3e02d61e2b00a53ba3c7ec1f5c3527d5676d1c2c6"}, &(0x7f0000000080)=0x77) getsockopt$inet_sctp_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f00000000c0)={r1, 0x720f, 0xfe31, 0x7fffffff}, &(0x7f0000000100)=0x10) [ 238.216312][T11584] chnl_net:caif_netlink_parms(): no params data found 12:00:51 executing program 0: unshare(0x400) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x200241, 0x0) fsmount(r0, 0x0, 0x0) [ 238.300082][T11584] bridge0: port 1(bridge_slave_0) entered blocking state [ 238.307412][T11584] bridge0: port 1(bridge_slave_0) entered disabled state [ 238.316872][T11584] device bridge_slave_0 entered promiscuous mode [ 238.326718][T11584] bridge0: port 2(bridge_slave_1) entered blocking state [ 238.334602][T11584] bridge0: port 2(bridge_slave_1) entered disabled state [ 238.343177][T11584] device bridge_slave_1 entered promiscuous mode 12:00:51 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2) ioctl$VIDIOC_S_MODULATOR(r1, 0x40445637, &(0x7f00000000c0)={0xfffffffffffffff9, "d026d66e7b23181da6675688b916e0bc74a4405d5f8e08f3eafdbbe4c7a6ea7a", 0x1020, 0x4, 0x3, 0x10, 0x4}) setsockopt$inet_int(r0, 0x0, 0xf, &(0x7f0000000000)=0x4, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4, @empty}, 0x10) [ 238.405144][T11584] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 238.436050][T11584] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link 12:00:51 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca5055e0bcfe47bf070") r1 = socket$inet_udplite(0x2, 0x2, 0x88) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x10032, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000080)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000280)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r3, 0x84, 0xd, &(0x7f0000013ff4)=@assoc_value, &(0x7f0000002000)=0x8) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x14, 0x0, 0x0) r4 = dup2(r1, r3) dup3(r4, r3, 0x80000) [ 238.468576][T11584] team0: Port device team_slave_0 added [ 238.478725][T11584] team0: Port device team_slave_1 added [ 238.558135][T11584] device hsr_slave_0 entered promiscuous mode [ 238.593682][T11584] device hsr_slave_1 entered promiscuous mode [ 238.842054][T11584] debugfs: Directory 'hsr0' with parent '/' already present! 12:00:52 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca5055e0bcfe47bf070") r1 = memfd_create(&(0x7f0000000200)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r2 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x100000000000001) dup2(r2, r2) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x8fd\x8dx\x001;\x00\x00\x00\x00\x00\x00\xa8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r1, &(0x7f0000000000)=[{0x0, 0x8, 0x0, 0xfffffffd, @tick, {}, {}, @connect}], 0xffffff76) [ 239.510015][T11584] 8021q: adding VLAN 0 to HW filter on device bond0 [ 239.529001][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 239.537484][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 239.553460][T11584] 8021q: adding VLAN 0 to HW filter on device team0 [ 239.579649][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 239.589291][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 239.598201][ T17] bridge0: port 1(bridge_slave_0) entered blocking state [ 239.605393][ T17] bridge0: port 1(bridge_slave_0) entered forwarding state [ 239.613737][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 239.622874][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 239.631630][ T17] bridge0: port 2(bridge_slave_1) entered blocking state [ 239.638809][ T17] bridge0: port 2(bridge_slave_1) entered forwarding state [ 239.647026][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 239.660462][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 239.669688][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 239.702367][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 239.712370][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 239.721514][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 239.730956][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 239.740235][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 239.749200][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 239.758104][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 239.767079][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 239.780186][T11584] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 239.788840][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 239.846090][T11584] 8021q: adding VLAN 0 to HW filter on device batadv0 12:00:53 executing program 1: r0 = socket(0x10, 0x2, 0x0) getsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f0000000040), &(0x7f0000000080)=0x4) getsockopt$sock_cred(r0, 0x1, 0x26, &(0x7f0000caaffb), &(0x7f0000000000)=0xc) connect$l2tp(r0, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r0, 0x0, 0x2, 0x4, 0x3, {0xa, 0x4e22, 0x80000000, @local, 0x20}}}, 0x3a) 12:00:53 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x800, 0x0) ioctl$VIDIOC_DV_TIMINGS_CAP(r1, 0xc0905664, &(0x7f0000000400)={0x0, 0x0, [], @raw_data=[0x2, 0x7, 0x80, 0xfffffffffffff801, 0x9, 0x7, 0xffffffffffffc89b, 0x4, 0x6, 0x7f, 0x6, 0x4, 0x0, 0x1000, 0x9, 0x9, 0x7fff, 0x80000001, 0x7, 0x4, 0x4, 0x7, 0x81, 0x7fff, 0xfffffffffffffff8, 0x1, 0x2c50000000, 0x6, 0x2, 0x7ff, 0x5, 0x3]}) ioctl$KVM_CHECK_EXTENSION(r1, 0xae03, 0x100) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000100)={0xffffffffffffffff}, 0x13f, 0x1}}, 0x20) write$FUSE_OPEN(r1, &(0x7f00000000c0)={0x20, 0x0, 0x4, {0x0, 0x2}}, 0x20) ioctl$DRM_IOCTL_MODE_GETCRTC(r1, 0xc06864a1, &(0x7f0000000280)={&(0x7f0000000080)=[0xffffffffffff7fff, 0x6, 0x80000001, 0x7, 0x2], 0x5, 0x4, 0x7, 0x0, 0x4, 0x5, {0x0, 0x9, 0x4ef, 0x7, 0x5, 0xab89, 0xffffffff, 0x1, 0x40, 0x6, 0xffffffffffffff80, 0x5, 0x7, 0x80000000, "48466d37a83dbe200f14ac014d8607ec51089b0ce476756ad733eae7c7b6a9f6"}}) ioctl$sock_inet6_tcp_SIOCINQ(r1, 0x541b, &(0x7f0000000040)) write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x4e24, 0x9, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x80000001}, {0xa, 0x4e23, 0x2, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x8}, r2, 0x3}}, 0x48) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$sock_ifreq(r0, 0x89a3, &(0x7f00000001c0)={'ip_vti0\x00', @ifru_settings={0x0, 0x0, @te1=0x0}}) fcntl$setstatus(r0, 0x4, 0x42000) 12:00:53 executing program 1: r0 = socket$kcm(0x2b, 0x200004000000001, 0x0) listen(r0, 0x0) r1 = socket$kcm(0x10, 0x200000000003, 0x4) sendmsg$kcm(r1, &(0x7f0000002000)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000100)="39000000140081ae00d175040f62b04a2b546f2a66bf8c6e3fa1bcb3735858eba3390983b34f897506e606dbb7d553b4a40004000000000008", 0x39}], 0x1}, 0x0) r2 = msgget(0x0, 0x1) msgctl$IPC_RMID(r2, 0x0) 12:00:53 executing program 1: r0 = socket$kcm(0x2b, 0x200004000000001, 0x0) listen(r0, 0x0) r1 = socket$kcm(0x10, 0x200000000003, 0x4) sendmsg$kcm(r1, &(0x7f0000002000)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000100)="39000000140081ae00d175040f62b04a2b546f2a66bf8c6e3fa1bcb3735858eba3390983b34f897506e606dbb7d553b4a40004000000000008", 0x39}], 0x1}, 0x0) r2 = msgget(0x0, 0x1) msgctl$IPC_RMID(r2, 0x0) 12:00:53 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) r0 = syz_open_dev$media(&(0x7f0000000040)='/dev/media#\x00', 0x6, 0xbb7f887cb7138cd9) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mlockall(0x2) shmat(0x0, &(0x7f0000ff5000/0x2000)=nil, 0x5008) ioctl$MON_IOCX_MFETCH(r0, 0xc0109207, &(0x7f00000000c0)={&(0x7f0000000080)=[0x0], 0x1, 0xaa0}) 12:00:53 executing program 1: r0 = openat$capi20(0xffffffffffffff9c, &(0x7f0000000380)='/dev/capi20\x00', 0x0, 0x0) unshare(0x2000400) r1 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x100) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000040)=@assoc_value={0x0}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f00000000c0)={r2, 0x2, 0x30}, &(0x7f0000000100)=0xc) ioctl$CAPI_REGISTER(r0, 0x400c4301, 0x0) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r1, 0x40485404, &(0x7f0000000140)={{0xffffffffffffffff, 0x1, 0x2, 0x3, 0xbd55}, 0x1, 0x7fffffff}) 12:00:53 executing program 0: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000140)="2e0000001a008100a00f80ecdb4cb904024865160b000000d4126efb120003000800da1b40d819a9ffe200000000", 0x2e}], 0x1}, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TLS_TX(r1, 0x6, 0x1, &(0x7f0000000040)=@ccm_128={{0x304}, "376bcd391f7f420d", "d0e5b4ecdcee57b7ea262628b2bfb755", "fc0c1991", "4a23b034e82b2431"}, 0x28) [ 240.769197][T11643] netlink: 'syz-executor.0': attribute type 3 has an invalid length. [ 240.785451][T11643] netlink: 'syz-executor.0': attribute type 3 has an invalid length. 12:00:53 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x40080, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000300)=[@in6={0xa, 0x4e22, 0x3ff, @dev={0xfe, 0x80, [], 0x11}, 0x3f}, @in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x19}}, @in6={0xa, 0x4e21, 0x401, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x5}, @in6={0xa, 0x4e22, 0x10000, @remote, 0x7}], 0x64) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f00000000c0)={0x0, @in={{0x2, 0x4e23, @broadcast}}, 0x98, 0x2}, &(0x7f00000001c0)=0x90) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000200)={r2, 0x2, 0x316}, &(0x7f00000002c0)=0x8) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r3 = socket$inet(0x2, 0xa, 0x0) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @remote}, 0x10) getsockopt$sock_timeval(r3, 0x1, 0x0, &(0x7f0000000280), &(0x7f0000000380)=0x10) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_msfilter(r3, 0x0, 0x19, &(0x7f0000000080)=ANY=[@ANYBLOB='6'], 0x1) accept$inet(r0, 0x0, &(0x7f0000000240)) 12:00:53 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="11dca5055e0bcfe47bf070") r1 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000140)='/proc/thread-self/attr/current\x00', 0x2, 0x0) eventfd(0xfffffffffffffff9) write$apparmor_current(r1, &(0x7f0000000040)=ANY=[], 0x0) 12:00:54 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000180)='/dev/sg#\x00', 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETOFFLOAD(r1, 0x400454da, 0x400014) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'veth0\xcato_bridge\x00', 0x1f}) llistxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/196, 0xc4) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, 0x0) [ 240.905605][T11648] syz-executor.0 uses obsolete (PF_INET,SOCK_PACKET) 12:00:54 executing program 0: r0 = syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0x2, 0x2) sendmsg$key(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="0203060910000000000000089e0000000200130002000000000000000000000105000600000000000a00000000000000000700e50008070000001f00000000000009200000000000020001000000000000000002000098a805000500000000000a00000000000000ff1700a51409ac4cb3cbcf00000000000000000000000017396492192dd44f0970ce39a4acfd8ad3059f0034c5c1fa789930e190337c675a8b2155c8ccc713898d5e72de91248e1a7be1176a32a935e7c28fdc9903e64934c12f1df64e3eeb5e560fc5"], 0x80}}, 0x0) sendmmsg(r1, &(0x7f0000000180), 0x40000000000002b, 0x0) 12:00:54 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x7, 0x20000) ioctl$VT_RELDISP(r0, 0x5605) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) read$FUSE(r1, &(0x7f0000000240), 0x2305e2b7) write$FUSE_ENTRY(r1, &(0x7f0000000180)={0x90, 0x0, 0x2, {0x7}}, 0x90) 12:00:54 executing program 1: r0 = syz_open_dev$evdev(&(0x7f0000000140)='/dev/input/event#\x00', 0x3ff, 0x60001) r1 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x0) ioctl$FS_IOC_GETFSMAP(r1, 0xc0c0583b, &(0x7f0000000200)={0x0, 0x0, 0x2, 0x0, [], [{0xfffffffffffffffc, 0x2, 0x80, 0x69fe, 0x1000, 0x9}, {0x10001, 0x5, 0x7, 0x3, 0x100000000, 0x7}], [[], []]}) write$evdev(r0, &(0x7f00000001c0)=[{{}, 0x2, 0x6, 0xfffffffffffff000}], 0x18) fcntl$setstatus(r0, 0x4, 0x400) write$evdev(r0, &(0x7f0000000180)=[{{0x0, 0x7530}}], 0x11e8) 12:00:54 executing program 0: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x3b5d2a2ebd2d74d7, 0x0) ioctl$TIOCMBIC(r0, 0x5417, &(0x7f0000000080)=0x6) r1 = socket(0xa, 0x80005, 0x0) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, 0x0, &(0x7f0000000040)) 12:00:54 executing program 0: r0 = openat$mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/mixer\x00', 0x0, 0x0) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000100)=0x0) r2 = syz_open_procfs(r1, &(0x7f0000000080)='attr/prev\x00') readv(r2, &(0x7f0000000000)=[{&(0x7f0000000140)=""/169, 0xffffffffffffffa4}], 0x1) 12:00:54 executing program 0: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000000c0)=ANY=[@ANYBLOB="0600000000000000001000000000000022000000e5ffffff0274a7673ff28b773de1a2b4bce9d3545e218a82e68d454db42e00e02ea9f72c298506a3359da15683c47c8919f4cb803ffcc790fc417c424679c3b6e9687b7bfc6f479d0645885cbed55365d1ba9c2ded2669b46d2d8b72d9e36086d8a76aba201759f499f39fcb53dca712a016cee0b328170167411ef039117aa5071de489f90b78f930283622996e28b5278f9cc905acaf543edfef6e90"]) close(r0) 12:00:54 executing program 0: seccomp(0x3, 0x0, &(0x7f0000001980)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0xfffffffffffffffb}]}) r0 = syz_open_dev$vcsa(&(0x7f0000000080)='/dev/vcsa#\x00', 0xfffffffffffffff7, 0x3a4da96f33b0ad1e) dup(r0) io_uring_register$IORING_UNREGISTER_BUFFERS(r0, 0x1, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f00000000c0)={'filter\x00'}, &(0x7f0000000140)=0x78) 12:00:54 executing program 0: r0 = socket$pppoe(0x18, 0x1, 0x0) r1 = socket$pppoe(0x18, 0x1, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='cgroup.events\x00', 0x0, 0x0) r3 = syz_genetlink_get_family_id$team(&(0x7f00000002c0)='team\x00') accept$packet(0xffffffffffffffff, &(0x7f00000003c0)={0x11, 0x0, 0x0}, &(0x7f0000000400)=0x14) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000440)={{{@in6=@empty, @in6=@ipv4={[], [], @loopback}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@loopback}}, &(0x7f0000000540)=0xe8) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0xc3b345b61507f0ba, &(0x7f0000000580)={@loopback, @initdev, 0x0}, &(0x7f00000005c0)=0xc) accept4$packet(0xffffffffffffffff, &(0x7f0000002580)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000025c0)=0x14, 0x80800) accept4$packet(0xffffffffffffffff, &(0x7f0000002780)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000027c0)=0x14, 0x800) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000002840)={{{@in=@local, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@loopback}}, &(0x7f0000002940)=0xe8) accept$packet(0xffffffffffffffff, &(0x7f0000002980)={0x11, 0x0, 0x0}, &(0x7f00000029c0)=0x14) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000002a00)={0x0, @remote, @local}, &(0x7f0000002a40)=0xc) ioctl$KVM_HYPERV_EVENTFD(r2, 0x4018aebd, &(0x7f0000000340)={0x3, r2}) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000002b80)={{{@in6=@ipv4={[], [], @remote}, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@empty}}, &(0x7f0000002c80)=0xe8) sendmsg$TEAM_CMD_PORT_LIST_GET(r2, &(0x7f00000031c0)={&(0x7f0000000280), 0xc, &(0x7f0000003180)={&(0x7f0000002cc0)={0x494, r3, 0x100, 0x70bd2a, 0x25dfdbfb, {}, [{{0x8, 0x1, r4}, {0x1d0, 0x2, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'broadcast\x00'}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x7fff}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x5c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x2c, 0x4, [{0x93, 0x36e, 0xfffffffffffffffc, 0x3f}, {0x7, 0x3f, 0x7, 0x9100}, {0x6, 0xc5, 0xffffffff, 0x81}, {0x100, 0x8, 0x3ff, 0x9}, {0x5, 0x5, 0x7f, 0xfffffffffffffff8}]}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x40}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r5}}}]}}, {{0x8, 0x1, r6}, {0x254, 0x2, [{0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x5}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r7}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0xfffffffffffffff7}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x80}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r8}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x28af}}, {0x8, 0x6, r9}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x5}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r10}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x401}}, {0x8, 0x6, r11}}}]}}, {{0x8, 0x1, r12}, {0x44, 0x2, [{0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'loadbalance\x00'}}}]}}]}, 0x494}, 0x1, 0x0, 0x0, 0x800}, 0x44) ioctl$HIDIOCGCOLLECTIONINFO(r1, 0xc0104811, &(0x7f0000000300)={0x57e1, 0xfffffffffffffffc, 0x3, 0x9}) connect$pppoe(r1, &(0x7f0000000040)={0x18, 0x0, {0x3, @local, 'syz_tun\x00'}}, 0x1e) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4000000000000003, @local, 'syz_tun\x00'}}, 0x1e) connect$pppoe(r0, &(0x7f0000000100)={0x18, 0x0, {0x0, @empty, 'bri\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe1\x00'}}, 0x1e) r13 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x4000, 0x0) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000140)={0x0, 0xa2, "644304aaa028c83b20af4175c5e08e1480116cc6483bf16c62e26a22555c461d601e8af117f5f1052ecccd4f1f881280e62a8bfe78baeb4d08c2dfc7325cb4ead9ca36bb3c2cce45fc28e5c6f7950e037075c45e21d4bab28f6b1600b9dff599bcf7b8ea1a18eb32f856befcf9a44fb4d928bd0ea120fc04c11f1175bf19af08611d5e7936cc827d3b77fc2d39a8c0493f8a14953f3648c8883f5134ee01a76b4d51"}, &(0x7f00000000c0)=0xaa) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r13, 0x84, 0x79, &(0x7f0000000200)={r14, 0x101, 0x8}, 0x8) dup2(r0, r1) 12:00:54 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc7724e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507daea1c09fc1fe6c"}, 0x20) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'vlan0\x00', 0x4009}) bpf$MAP_CREATE(0x0, &(0x7f0000000180)={0x1f}, 0x3c) r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f0000000200)=0xa7) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000440)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') setsockopt$kcm_KCM_RECV_DISABLE(r1, 0x119, 0x1, &(0x7f0000000000)=0x4, 0x4) write$cgroup_subtree(r0, &(0x7f0000000700)=ANY=[@ANYBLOB="00113a1e9fab64d06c64d3b3b18f064a9ab5983d153be9d12a649cf52a3898791ba490e82b0793a1fb3ef288b0abb8c381e931f2ad73497a55e8c3874f3bde55b125ec80a3f350c65f5fc31abb868cb9edd9d70889df468427e6eb4adf3dfed21944a9e0c1e973fcbbd256f06567df9cbc5a5a6d0415e645d815f3c5a0c34e8db48ab7dbc4eb00cc72343068bbec18291b9d8a1e271e2e5ca738b956174cff071ea37431a2b0b6049c81c6b21bd2c9d41824a61f01d583b7389610a3d7af0912"], 0x90ad) 12:00:54 executing program 0: openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r0 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x2, 0x80000) ioctl$HIDIOCGFEATURE(r0, 0xc0404807, &(0x7f0000000140)={0x0, "ed3d19bcf6c852c84865d51a9b4b3c0ef1147abd932db0671c6daea7654e202667634c06ca5a2f47a85a6f5ac822178048573eba802e146155eb06784a05389b"}) ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, &(0x7f0000000040)) 12:00:54 executing program 0: r0 = syz_open_dev$dmmidi(&(0x7f0000000180)='/dev/dmmidi#\x00', 0x0, 0x10000) read$FUSE(r0, &(0x7f00000004c0), 0x1000) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040)='IPVS\x00') sendmsg$IPVS_CMD_ZERO(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x28, r3, 0x4, 0x70bd2c, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xff}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x401}, @IPVS_CMD_ATTR_DEST={0x4}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000040) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000002c0)={0x2c, r2, 0x211, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x18, 0x1, [@TIPC_NLA_BEARER_NAME={0x14, 0x1, @l2={'eth', 0x3a, 'ip6_vti0\x00'}}]}]}, 0x2c}}, 0x0) 12:00:55 executing program 1: r0 = syz_open_dev$vbi(&(0x7f0000000000)='/dev/vbi#\x00', 0xffffffffffffffff, 0x2) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$VIDIOC_S_PARM(r0, 0xc0cc5616, &(0x7f0000000040)={0x9}) ioctl$KVM_TRANSLATE(r0, 0xc018ae85, &(0x7f0000000140)={0x1, 0x5000, 0x5, 0xffff, 0x9}) flistxattr(r0, &(0x7f0000000180)=""/139, 0x8b) [ 241.969878][T11703] Started in network mode [ 241.974376][T11703] Own node identity , cluster identity 4711 [ 241.980291][T11703] Failed to obtain node identity [ 241.985637][T11703] Enabling of bearer rejected, failed to enable media 12:00:55 executing program 1: recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0xfffffd1e, 0x0, 0x229}}], 0x0, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/udp\x00') getrusage(0x0, &(0x7f0000000080)) perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(r0, &(0x7f00000017c0), 0x333, 0x229) ioctl$DRM_IOCTL_ADD_BUFS(r0, 0xc0206416, &(0x7f0000000140)={0x3, 0xad71, 0xffffffff, 0x81, 0x0, 0xffffffff80000000}) [ 242.045113][T11709] Started in network mode [ 242.049566][T11709] Own node identity , cluster identity 4711 [ 242.055558][T11709] Failed to obtain node identity [ 242.060536][T11709] Enabling of bearer rejected, failed to enable media 12:00:55 executing program 0: r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000180)=@broute={'broute\x00', 0x20, 0x0, 0x90, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x3f000000, 0x0, &(0x7f00000000c0)=[{}, {}, {}]}, 0x108) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/sequencer\x00', 0x2000, 0x0) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1b, &(0x7f0000000240)={0x0, 0x6b, "0c7c21483a5576e1212c19e4f54d7fcbf9a4b95cbf4e529f99dbfa1c7ee77cb732071800fa7b9530d1ea688f549155767aa813053cf24f01a0ee79d315d3e89a34548b6583947961bb509d25030c22efb1181850239325e7e78af17e85b1297f4920b252e6d44fb64c241b"}, &(0x7f00000002c0)=0x73) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000300)={r2, 0x1, 0x10}, &(0x7f0000000340)=0xc) [ 242.251769][ C1] hrtimer: interrupt took 53398 ns 12:00:55 executing program 0: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x101002, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(0xffffffffffffffff, 0x4010641a, &(0x7f0000000140)={0x0, &(0x7f0000000100)}) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0xb31abc5beabb3889, 0x0) getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r1, 0x84, 0xc, &(0x7f0000000100), &(0x7f0000000180)=0x4) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f00000002c0)=""/246) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) pwritev(r0, &(0x7f00000000c0)=[{&(0x7f0000000080)="80fd06969341", 0x6}], 0x1000000000000183, 0x0) 12:00:55 executing program 2: r0 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x20000, 0x0) ioctl$KVM_CHECK_EXTENSION_VM(r0, 0xae03, 0x56f) ioctl$VIDIOC_ENCODER_CMD(r0, 0xc028564d, &(0x7f0000000040)={0x1, 0x1, [0x1, 0x0, 0x8000, 0x9, 0x101, 0x3, 0x8eb9, 0xfff]}) ioctl$LOOP_SET_DIRECT_IO(r0, 0x4c08, 0x9) ioctl$EVIOCSKEYCODE_V2(r0, 0x40284504, &(0x7f0000000080)={0x20, 0x15, 0x9, 0xb489, "81de1fb5bf2fb4495cc01d39bc6b6f361830dfc58efc9f0d997e85652694a4e6"}) ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f00000000c0)={0x4, 0x4, 0x4}) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0xc) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r0, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x70, r1, 0x800, 0x70bd25, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_SERVICE={0x10, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x20, 0x10}}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x7ff}, @IPVS_CMD_ATTR_DEST={0x2c, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x4}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x3}, @IPVS_DEST_ATTR_TUN_PORT={0x8, 0xe, 0x4e20}, @IPVS_DEST_ATTR_L_THRESH={0x8}, @IPVS_DEST_ATTR_TUN_PORT={0x8, 0xe, 0x4e24}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xffff}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}]}, 0x70}, 0x1, 0x0, 0x0, 0x20000804}, 0x800) setsockopt$RXRPC_SECURITY_KEYRING(r0, 0x110, 0x2, &(0x7f0000000280)='keyring.vmnet0\x00', 0xf) r2 = msgget(0x0, 0x20) msgrcv(r2, &(0x7f00000002c0)={0x0, ""/180}, 0xbc, 0x2, 0x2000) ioctl$GIO_FONTX(r0, 0x4b6b, &(0x7f0000000380)=""/102) ioctl$SNDRV_CTL_IOCTL_HWDEP_NEXT_DEVICE(r0, 0xc0045520, &(0x7f0000000400)=0xffffffff) bind(r0, &(0x7f0000000440)=@tipc=@id={0x1e, 0x3, 0x3, {0x4e21, 0x3}}, 0x80) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0x5, &(0x7f00000004c0)=0x100000000, 0x4) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0x5, &(0x7f0000000500)=0x2, 0x4) fcntl$setpipe(r0, 0x407, 0x2) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000540)={0x6677, 0x2, 0x400, 0xffffffffffffffb2, 0x0}, &(0x7f0000000580)=0x10) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f00000005c0)={r3}, 0x8) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000640)=0x0) sendmsg$nl_netfilter(r0, &(0x7f0000000e00)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000dc0)={&(0x7f0000000680)={0x710, 0x0, 0x2, 0x400, 0x70bd2a, 0x25dfdbfe, {0xa, 0x0, 0x7}, [@generic="14967e0f5af71e2e2cf6681f931041154b7d14f49530c2cc358d2842a8f0b53fd3198b034443561b6f902d5cb1609d9972f498be18827065fe893042cd966d6ef712f5a60a0add6168a4e53a2499b6467ed62934fb072d7449be6b762bb44db4171418feab273b5700ae7a3fa3ba8574a6ca048eb34c5c5c6c1a75f37ab6a7bccaeb", @nested={0x168, 0x4c, [@generic="68e4f42d907e4a94535596e5b805f3779c1ffb9f609bcadc573dc1578e864be156ab930a2b3029ae8817ba00f5454d14ea5accec1a1524aa677a361dccfbb7518041ff88280de902ddb76fe662e8377138d31ad14d863c08bbeaeb8882316e0e0b5d6e71af338c8ad49052e92ae796fc2208902542e124905a287bff6fe2eb52d78221b47fc411f912719bb3f077a62a531d284b6d34bd1bff27af4c13178692bd33f258a04ea93d988e30de659511c4ffb23a2fa088a76e98e7b7b39a5b0710a6", @generic="c2d0d8b38cb124378fa709e5e1447d62ebf9f9c4951f41eb1c3b44b9b9c2f5b1ae167aa0da6f42f02b60f8df3ee76033f1e3eb43bcce2dd882e440c7c47daeb8cf5a05649c05f4af5090142ff0e6d6d6128d00409256531262d86be9d835f41d5a104f85660dba1ab29480cb5e90c2363597a6e4d5db716269613e1a4dcc7d26763f9cec90837ad0467f0a137da7505fd912821258da4cba008ac6", @typed={0x8, 0x6d, @u32=0x20}]}, @nested={0x204, 0x17, [@generic="2cf826159365f8365fa582e550519af1147444a6f1f36d911fdecc0fe8c273131f9c1366b0a4430a0f0c3acfc2e7f409f9ee2c5b55fc8e3f1a5b743297f01cef8b4fe3ef15acb5f344e9346d9030ccd6c393721580c0ed9c4c28775b1ad12ad0d2bbde1ba0ae3b1926f68ffb77e08f2a876155cf145fe4356ff8950e3db1", @generic="f5dfd21d8812597cd75a55cbb0fb6eb321ccb708c5b1d6353275c1ae76641042fe6e98958ab5aee53764adff4689086e079f117ed90420378c4d083659bb76c0bd0e6894f2373b50d2378c3bc44af34132488bd85ddbf5c10a97685ba85859b00f20ab6bc14173f772d4e1de23a7d667efc005bff402637df456ebf6f48e78dd4c4553dfb3073243fc4ed2de9e12db95e6f91c5ae07ae3912c929cfa74fc026c4b9211a1a844edd31e66f51cd2c451ca8f83764fe8157cde29de8755fef0aff4e576ae8dc40a999c89cc2366237bf17fde380dd7aca8d7fbd40f764eb4c126fe3f93e2f76b12c51f6dddf6202bcb3d416d6ece9246d98f", @typed={0xc, 0x2f, @u64=0xfd}, @typed={0xc, 0x24, @u64=0x4}, @generic="2e4d120cb607fbdd721e94566bd4661210d55839face3892872af0c16636fe409f7096f2629a50a7f90b1e27aff2bc4dc292bde22c3efb1fb1fa96e603ad3ac98dd27523b005296f270807c16e0aca701825a07370c266c2600df55fa4bf713c80f03259ce48e76e", @typed={0x8, 0xd, @pid=r4}]}, @nested={0x1ac, 0x7, [@generic="83e8b70649627d99fbc7af0e5209dc97618c86e71cd891acbbc295237e40089fe41d2b1749830015450f3268840839779e7b9db93fdfd4695c73de42374288b9a1a7e9a6f3cb73cfe2087d7eb95fc8e9a6d69a42e584d565fd31a4eb7dc5b8933eebda54d41f73d651e89c711e05e5233ef57c7e92046475da0cfcdc93e82778d67a4230", @typed={0x4, 0x4e}, @typed={0x8, 0x49, @str='-\xab\x00'}, @generic="b8978d825d11303623927f7c7f061b31f701b6783a7bad7a6ff18cc5d6cbc2dbe74e4d7d06d1d96b96bc288d26139022ef5ad3e83271dc26704ff3cd3d55fbf12ed66abe7c472ef7e7d241cccd7ffbe24c1568e67a480ab8bb3bb29400fbea209bcf37fa926e48b478c41aff9221bf588ebdd14676adb134f0119ca6", @generic="d21fb2356a045c64af754c0cec1d08770379c20489547afdc7f07cc7e20c1e92db9ca06f2c1415e19a94378ee2c24eacedb27334101ab4d4c4ec13212c53872c1a52d04f0be099987de5097a5dca230789522f127af97404d5d333daf32d1fc96f0f7695c900fa0ca26955597b3eee959af51d660ab7724cedcf4721baab78c038c6cc905ea67613d4f9996a196e141d860bf0e6d0808d462c"]}, @nested={0x28, 0x33, [@typed={0x1c, 0x49, @str='cpusettrustedGPLselinux\x00'}, @typed={0x8, 0x5b, @u32=0xec}]}, @nested={0x124, 0x86, [@generic="38040e234039160e8233881b428ea02e41a7e29af9044ea13e60cec988bc95bf80", @generic="9651", @generic="24ca023ae4f9012e94ad390ebf294fb55b17cf088a0479817d51733cc9e9a1070d0efb3455df1234163950bf77bc76132ddbf4", @typed={0xc, 0x36, @u64=0x40}, @generic="62818719f74b355072fa3d04e433e8dde7f4ce4ce8387c9a1021c3e0cb394c988598968333eba35070ec19d2018825e2edb9cd0c88b3ad4a53fb4c47b1be78a3739b1f69805cf3c46a8a073e81ddbe6a6ab70d235f0a52c0d3ed3e38e2eb6e6ea86204d565b1852142f45b324adb7b1acf3cf7f1d6103817afed314bfc5c1ca2e9342aeba48d8cd926b5a7521b39d188fbd9ab8a2a814f02c2d238ff78faad0315a496163f5a64cc968b013aa44c399057a77c22", @typed={0x8, 0x51, @fd=r0}]}, @typed={0x14, 0x2d, @ipv6=@remote}]}, 0x710}, 0x1, 0x0, 0x0, 0x4}, 0x24044851) write$eventfd(r0, &(0x7f0000000e40)=0x7fff, 0x8) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000e80)='/dev/mixer\x00', 0x821e5e139815283, 0x0) get_robust_list(r4, &(0x7f0000001000)=&(0x7f0000000fc0)={&(0x7f0000000f00)={&(0x7f0000000ec0)}, 0x0, &(0x7f0000000f80)={&(0x7f0000000f40)}}, &(0x7f0000001040)=0x18) clock_gettime(0x0, &(0x7f00000010c0)={0x0, 0x0}) futex(&(0x7f0000001080), 0x8b, 0x2, &(0x7f0000001100)={r6, r7+10000000}, &(0x7f0000001140)=0x1, 0x2) accept4$vsock_stream(r5, &(0x7f0000001180)={0x28, 0x0, 0x2711}, 0x10, 0x800) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000001280)={&(0x7f00000011c0)=""/152, 0x28000, 0x0, 0xfd9}, 0x18) splice(r5, &(0x7f00000012c0), r5, &(0x7f0000001300), 0x4, 0x2) [ 243.816583][T11723] IPVS: ftp: loaded support on port[0] = 21 [ 247.648257][ C0] clocksource: timekeeping watchdog on CPU0: Marking clocksource 'tsc' as unstable because the skew is too large: [ 247.660410][ C0] clocksource: 'acpi_pm' wd_now: 52bbdb wd_last: 60b685 mask: ffffff [ 247.670618][ C0] clocksource: 'tsc' cs_now: 8908589c10 cs_last: 86a8ee890f mask: ffffffffffffffff [ 247.681938][ C0] tsc: Marking TSC unstable due to clocksource watchdog [ 247.704880][ T5] TSC found unstable after boot, most likely due to broken BIOS. Use 'tsc=unstable'. [ 247.714506][ T5] sched_clock: Marking unstable (247773161511, -68299584)<-(247824027233, -119165238) [ 247.714861][T11724] clocksource: Switched to clocksource acpi_pm 12:01:00 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)=@ipv6_getroute={0x1c, 0x1e, 0x401, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x2}}, 0x1c}}, 0x0) 12:01:01 executing program 0: mmap(&(0x7f0000000000/0xdbb000)=nil, 0xdbb000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x5, 0x400) ioctl$VIDIOC_DBG_G_CHIP_INFO(r0, 0xc0c85666, &(0x7f0000000040)={{0x3, @addr=0x853}, "1ff624ff2477f691a27a5623fd09eaa500ffffffffff00", 0x3}) r1 = socket$inet_dccp(0x2, 0x6, 0x0) setsockopt(r1, 0x0, 0x2, &(0x7f0000d14ffc)="02f9ffff", 0x4) ioctl$SCSI_IOCTL_PROBE_HOST(r0, 0x5385, &(0x7f0000000140)={0xce, ""/206}) [ 247.957372][T11723] chnl_net:caif_netlink_parms(): no params data found [ 248.058609][T11723] bridge0: port 1(bridge_slave_0) entered blocking state [ 248.065866][T11723] bridge0: port 1(bridge_slave_0) entered disabled state [ 248.074440][T11723] device bridge_slave_0 entered promiscuous mode [ 248.112756][T11723] bridge0: port 2(bridge_slave_1) entered blocking state [ 248.119989][T11723] bridge0: port 2(bridge_slave_1) entered disabled state [ 248.128954][T11723] device bridge_slave_1 entered promiscuous mode 12:01:01 executing program 0: r0 = memfd_create(&(0x7f0000000040)='#vmnet1nodevem1\x00', 0x0) write(r0, &(0x7f0000002000)='/', 0x1) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x4, 0x11, r0, 0x0) r1 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x80000000, 0x800) setsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f0000000080)=0x5, 0x4) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000ff8)={0x0, 0x989680}, &(0x7f0000000ff8)={0x0}) [ 248.193703][T11723] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 248.238160][T11723] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 248.307205][T11723] team0: Port device team_slave_0 added [ 248.317153][T11723] team0: Port device team_slave_1 added 12:01:01 executing program 0: r0 = syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x400800) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f00000000c0)={0x0, 0x94, "a7f6f507c2ff5e757c234d0bfaa22c71e6229c2057f523a59c53c5f976880dc7e492bc39e4cac8d20f6cda18481a964e6b089fffd1ab85bd5c23fc6bcd14a43c346e1f0062a79ad90acc874e984ad09a522c7e9ccee8c47f9cf84e798f634223da3dd5402d5e3aed7e2f1368cd599944c595ba14cc3846adef90648dda7ac071a4380091aa56f69b1c699672b27fd6e0bffc5e95"}, &(0x7f0000000180)=0x9c) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f00000001c0)=@sack_info={r1, 0x2, 0x1}, 0xc) mmap(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x0, 0x1b071, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000009000/0x3000)=nil, 0x3000) r2 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x0, 0x0) r3 = msgget$private(0x0, 0x2) msgctl$IPC_STAT(r3, 0x2, &(0x7f0000000200)=""/160) ioctl$KVM_ASSIGN_DEV_IRQ(r2, 0x4040ae70, &(0x7f0000000040)={0x9, 0x64f2, 0x1, 0x1}) remap_file_pages(&(0x7f0000005000/0x3000)=nil, 0x3000, 0x0, 0xdff3, 0x10) 12:01:01 executing program 1: recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0xfffffd1e, 0x0, 0x229}}], 0x0, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/udp\x00') getrusage(0x0, &(0x7f0000000080)) perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(r0, &(0x7f00000017c0), 0x333, 0x229) ioctl$DRM_IOCTL_ADD_BUFS(r0, 0xc0206416, &(0x7f0000000140)={0x3, 0xad71, 0xffffffff, 0x81, 0x0, 0xffffffff80000000}) [ 248.407077][T11723] device hsr_slave_0 entered promiscuous mode [ 248.428495][T11740] mmap: syz-executor.0 (11740) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.rst. [ 248.452551][T11723] device hsr_slave_1 entered promiscuous mode 12:01:01 executing program 3: r0 = syz_open_dev$vivid(&(0x7f0000000000)='/dev/video#\x00', 0x1, 0x2) ioctl$VIDIOC_SUBDEV_G_SELECTION(r0, 0xc040563d, &(0x7f0000000040)={0x9fcc72aa67a03157, 0x0, 0x0, 0xd2b38046796bb010, {0x9, 0x6, 0x3, 0x1}}) prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/mixer\x00', 0x24000, 0x0) ioctl$sock_inet6_tcp_SIOCINQ(r1, 0x541b, &(0x7f00000000c0)) ioctl$RNDADDTOENTCNT(r1, 0x40045201, &(0x7f0000000100)=0xef) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="eb5d3064bcc337d838d5732015cc699c", 0x10) ioctl$PPPIOCGIDLE(r1, 0x8010743f, &(0x7f0000000180)) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_GET(r0, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x8076caf5308e5ed5}, 0xc, &(0x7f0000000440)={&(0x7f0000000240)={0x1dc, r2, 0x100, 0x70bd2d, 0x25dfdbfc, {}, [@TIPC_NLA_NET={0x38, 0x7, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x3}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x7}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x7}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x9}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x207}]}, @TIPC_NLA_LINK={0xa4, 0x4, [@TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x54, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8000}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x516}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7fff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x81}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x34, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x50}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2a16}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x714}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}]}]}, @TIPC_NLA_SOCK={0x8, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_BEARER={0x9c, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x5}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0x9, @mcast1, 0x2e36}}, {0x20, 0x2, @in6={0xa, 0x4e20, 0x2, @mcast2, 0x1}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x3}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xb56}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0x9, @ipv4={[], [], @loopback}, 0x1b}}, {0x14, 0x2, @in={0x2, 0x4e23, @local}}}}]}, @TIPC_NLA_SOCK={0x48, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x4}, @TIPC_NLA_SOCK_REF={0x8}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x80}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x3ff}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xfff}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xffff}]}]}, 0x1dc}, 0x1, 0x0, 0x0, 0x20000000}, 0x20040000) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000500)='IPVS\x00') sendmsg$IPVS_CMD_DEL_SERVICE(r1, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x24, r3, 0x200, 0x70bd26, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x10001}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x40}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000011}, 0x810) getsockopt$inet_udp_int(r1, 0x11, 0x462e353ba3295cd2, &(0x7f0000000600), &(0x7f0000000640)=0x4) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000680)='/dev/audio\x00', 0x0, 0x0) lremovexattr(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000700)=@random={'btrfs.', 'IPVS\x00'}) ioctl$KDADDIO(r4, 0x4b34, 0x5) ioctl$EVIOCGKEYCODE(r4, 0x80084504, &(0x7f0000000740)=""/169) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000840)={&(0x7f0000000800)='./file0\x00', r1}, 0x10) sendmsg$TIPC_NL_LINK_GET(r4, &(0x7f00000009c0)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0xd2204d050c748833}, 0xc, &(0x7f0000000980)={&(0x7f00000008c0)={0xa4, r2, 0x708, 0x70bd27, 0x25dfdbfc, {}, [@TIPC_NLA_NET={0x40, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xf39}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x5}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x7}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1f}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x3}]}, @TIPC_NLA_SOCK={0x18, 0x2, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x7}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x9}]}, @TIPC_NLA_SOCK={0x38, 0x2, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x5}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x3}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x5700000000}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x6}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x40000}, 0x20008800) setsockopt$IP_VS_SO_SET_DELDEST(r1, 0x0, 0x488, &(0x7f0000000a00)={{0x5e, @rand_addr=0x6, 0x4e20, 0x1, 'sh\x00', 0x1, 0x115, 0xb}, {@local, 0x4e22, 0x1, 0x7, 0x2, 0x8000}}, 0x44) readlinkat(r4, &(0x7f0000000a80)='./file0\x00', &(0x7f0000000ac0)=""/69, 0x45) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r0, 0xc0305615, &(0x7f0000000b40)={0x0, {0x1, 0x80000001}}) getsockopt$packet_int(r1, 0x107, 0x8, &(0x7f0000000b80), &(0x7f0000000bc0)=0x4) fstat(r4, &(0x7f0000000c00)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_get$uid(0x0, r5) r6 = add_key$user(&(0x7f0000000c80)='user\x00', &(0x7f0000000cc0)={'syz', 0x3}, &(0x7f0000000d00)="a8bed16c2c7b6826490505290172796b36830e927778125c8c0b2540f9e9dd705512917211524d8e660a9dd650743101e2af3cfe6045802e5dc9ddb01b2e4b9c75abd439653930d388082c7b8e855e4839572a63921f3dd941140e4bfc34df3c8705111cb711858b1c9b75b8865981470d01d7e2e5abfb48e683", 0x7a, 0x0) r7 = request_key(&(0x7f0000000d80)='pkcs7_test\x00', &(0x7f0000000dc0)={'syz', 0x1}, &(0x7f0000000e00)='btrfs.', 0xfffffffffffffffc) keyctl$link(0x8, r6, r7) ioctl$SG_GET_TIMEOUT(r1, 0x2202, 0x0) ioctl$ASHMEM_SET_PROT_MASK(r4, 0x40087705, &(0x7f0000000e40)={0xb6cd, 0x81}) [ 249.336802][T11744] IPVS: ftp: loaded support on port[0] = 21 [ 251.233802][T11723] debugfs: Directory 'hsr0' with parent '/' already present! 12:01:04 executing program 1: recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0xfffffd1e, 0x0, 0x229}}], 0x0, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/udp\x00') getrusage(0x0, &(0x7f0000000080)) perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(r0, &(0x7f00000017c0), 0x333, 0x229) ioctl$DRM_IOCTL_ADD_BUFS(r0, 0xc0206416, &(0x7f0000000140)={0x3, 0xad71, 0xffffffff, 0x81, 0x0, 0xffffffff80000000}) 12:01:04 executing program 0: r0 = syz_open_dev$mouse(&(0x7f0000000040)='/dev/input/mouse#\x00', 0x80, 0x240) r1 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dlm_plock\x00', 0x40003, 0x0) fsconfig$FSCONFIG_SET_PATH(r0, 0x3, &(0x7f00000000c0)='/dev/vbi#\x00', &(0x7f0000000100)='./file0\x00', r1) socket$inet(0x10, 0x100000000002, 0xc) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(r1, 0x84, 0x6e, &(0x7f0000000200)=[@in6={0xa, 0x4e21, 0x2, @mcast2, 0xd3}, @in={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, @in={0x2, 0x4e20, @local}, @in6={0xa, 0x4e23, 0x5, @local, 0x6}, @in={0x2, 0x4e23, @rand_addr=0x7}], 0x68) r2 = syz_open_dev$vbi(&(0x7f00000001c0)='/dev/vbi#\x00', 0x1, 0x2) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x3f, 0x10001, 0xffffffffffffff00, 0x63ab, 0x2}, 0x14) write$FUSE_LK(0xffffffffffffffff, &(0x7f0000000000)={0x28, 0xffffffffffffffff}, 0x28) syz_open_dev$cec(&(0x7f0000000180)='/dev/cec#\x00', 0x1, 0x2) [ 251.476275][T11744] chnl_net:caif_netlink_parms(): no params data found [ 251.578742][T11723] 8021q: adding VLAN 0 to HW filter on device bond0 [ 251.587184][T11744] bridge0: port 1(bridge_slave_0) entered blocking state [ 251.594924][T11744] bridge0: port 1(bridge_slave_0) entered disabled state [ 251.603457][T11744] device bridge_slave_0 entered promiscuous mode [ 251.626349][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 251.634887][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 251.649553][T11723] 8021q: adding VLAN 0 to HW filter on device team0 [ 251.657586][T11744] bridge0: port 2(bridge_slave_1) entered blocking state [ 251.665385][T11744] bridge0: port 2(bridge_slave_1) entered disabled state [ 251.674035][T11744] device bridge_slave_1 entered promiscuous mode [ 251.690141][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 251.699701][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 251.708702][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 251.715963][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 251.789768][T11744] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 251.801460][T11723] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 251.811960][T11723] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 251.827314][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready 12:01:04 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000080)='/dev/vcsa#\x00', 0x20, 0x83) r1 = accept$inet(0xffffffffffffffff, &(0x7f00000000c0), &(0x7f0000000100)=0x10) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000140)) r2 = epoll_create1(0x80000) r3 = epoll_create1(0x0) close(r2) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r4, 0xc004743e, &(0x7f0000001180)=""/246) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000c85000)={0x3}) socket$netlink(0x10, 0x3, 0x1) epoll_ctl$EPOLL_CTL_MOD(r3, 0x3, r4, &(0x7f0000000000)={0x80000001}) [ 251.836478][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 251.845746][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 251.854669][ T5] bridge0: port 2(bridge_slave_1) entered blocking state [ 251.861947][ T5] bridge0: port 2(bridge_slave_1) entered forwarding state [ 251.870367][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 251.880227][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 251.941162][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 251.951003][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 251.960521][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 251.970251][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 251.979818][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 251.988892][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 251.998471][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 252.007545][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 252.018299][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 252.026917][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 252.050347][T11744] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link 12:01:05 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-control\x00', 0x40, 0x0) ioctl$DRM_IOCTL_GET_CAP(r2, 0xc010640c, &(0x7f00000000c0)={0x5, 0x6}) membarrier(0x2, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r3, 0x4008ae8a, &(0x7f0000000140)=ANY=[@ANYBLOB="050000000000000000000040050000a92000000000fa00000000e23f0003000001000000000000002560b700fff0ffff0403ffffffff00000a00000006"]) ioctl$KVM_SET_MSRS(r3, 0xc008ae88, &(0x7f0000000000)={0xf8, 0x2, [{0x38f}]}) [ 252.142398][T11744] team0: Port device team_slave_0 added [ 252.151253][T11744] team0: Port device team_slave_1 added [ 252.163034][T11723] 8021q: adding VLAN 0 to HW filter on device batadv0 12:01:05 executing program 0: socket(0x4, 0x0, 0x28) [ 252.316255][T11744] device hsr_slave_0 entered promiscuous mode [ 252.330877][T11767] user requested TSC rate below hardware speed [ 252.352613][T11744] device hsr_slave_1 entered promiscuous mode 12:01:05 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) socket$pptp(0x18, 0x1, 0x2) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket(0xa, 0x1, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000700)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="4400000010000100"/20, @ANYRES32=r3, @ANYBLOB="000000000000000024001200140001006272696467655f734c617665000000000c0005000800070000002000"], 0x44}}, 0x0) [ 252.392387][T11744] debugfs: Directory 'hsr0' with parent '/' already present! 12:01:05 executing program 0: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x0, 0x0) openat(r0, &(0x7f0000000040)='./file0\x00', 0x216000, 0x24) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x610c01, 0x0) [ 252.555944][T11779] netlink: 'syz-executor.2': attribute type 7 has an invalid length. [ 252.628797][T11744] 8021q: adding VLAN 0 to HW filter on device bond0 [ 252.647662][T11779] netlink: 'syz-executor.2': attribute type 7 has an invalid length. 12:01:05 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='stat\x00') getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000100)={0x0, @in={{0x2, 0x4e20, @broadcast}}, 0x0, 0x2, 0xdb5, 0x8, 0x28}, &(0x7f00000001c0)=0x98) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x73, &(0x7f0000000200)={r1, 0x6, 0x0, 0x77, 0x800}, &(0x7f0000000300)=0x18) r2 = socket$inet(0x2, 0x2000000080002, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r2, 0x0, 0x80, &(0x7f0000000080)=@broute={'broute\x00\x00\x00\x00\x00P\xe0\x00', 0x10, 0x4, 0x90, [0x0, 0x0, 0x0, 0x0, 0x20000240], 0x2, 0x0, &(0x7f0000000240)=[{0x2}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x2}]}, 0x108) r3 = creat(&(0x7f0000000000)='./file0\x00', 0x40) ioctl$TIOCMIWAIT(r3, 0x545c, 0x0) 12:01:05 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000040)=0x80000000001, 0x4) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_int(r0, 0x6, 0x24, &(0x7f0000000080)=0x1, 0x4) sendto$inet6(r0, &(0x7f0000000280)="732ef3aec60e4a8cec713f781e045414a8e12a5c90f07609a7e941ae234d457fe4672e7e4f371beb748e3ce301d37d30a3fe21983ccc48680c429b59c3b90cd49db01955cdab11c69af93648e07cb828bf7c2c3cf7c1a162579889ac6388f21e835b94cdd11f88840500a5b57fd1e500a0718f047486070d4f96f6eca996bdcd0d96cdc121bb89180ac867190ce511db4f409e22f2556ba5055e59842751d97307b3c83c8f2886", 0xa7, 0x0, 0x0, 0xffffffffffffff9f) r1 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x100) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f0000000100)={0x5f, 0x1, 0x0, "698aafd8486defc70208e9dfface9e1eb49c2b816b1500185c4e3e5f651e88484a015373891cd12b9fa9ef0bfefb334a9b97cbd0213c64945b8d63cba5e75975545e64dc69076e92eeaa1ea500c183ae2cafefbf7ab04d231a967952b97593"}) [ 252.685427][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 252.694348][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 252.711126][T11744] 8021q: adding VLAN 0 to HW filter on device team0 12:01:05 executing program 2: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x2, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r0, &(0x7f0000000100)={0x21}, 0x21) ftruncate(r0, 0xffffffff00000001) [ 252.740496][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 252.750330][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 252.759429][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 252.766694][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 252.863199][T11744] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 252.873835][T11744] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 252.888152][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 252.897661][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 252.907095][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 252.916097][ T5] bridge0: port 2(bridge_slave_1) entered blocking state [ 252.923549][ T5] bridge0: port 2(bridge_slave_1) entered forwarding state [ 252.931977][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 252.941583][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 252.951530][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 252.961228][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 252.970738][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 252.980460][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 252.989793][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 252.998849][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready 12:01:06 executing program 2: r0 = syz_open_dev$admmidi(&(0x7f0000000440)='/dev/admmidi#\x00', 0x6, 0x200) ioctl$UI_DEV_CREATE(r0, 0x5501) finit_module(r0, &(0x7f0000000480)='syz1\x00', 0x1) r1 = socket$netlink(0x10, 0x3, 0x16) r2 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x3, 0x2) write$UHID_CREATE(r2, &(0x7f00000000c0)={0x0, 'syz1\x00', 'syz0\x00', 'syz1\x00', &(0x7f0000000080)=""/60, 0x3c, 0x4000, 0x800, 0x7, 0x5, 0x9}, 0x120) writev(r1, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c5602067fffffff81000000000000dca87086a5c000004f6400940005891550f4a8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000300)={{{@in6, @in6=@initdev}}, {{@in6=@initdev}, 0x0, @in=@initdev}}, &(0x7f0000000400)=0xe8) setsockopt$IP_VS_SO_SET_EDITDEST(r2, 0x0, 0x489, &(0x7f0000000200)={{0xbf, @loopback, 0x4e24, 0x3, 'fo\x00', 0x2e, 0x2, 0x74}, {@empty, 0x4e24, 0x2001, 0x2ec790bb, 0x9}}, 0x44) [ 253.008205][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 253.017286][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 253.056603][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 253.066086][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 253.123391][T11744] 8021q: adding VLAN 0 to HW filter on device batadv0 12:01:06 executing program 3: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x8000, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x80000, 0x40) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000080)={r0, r1, 0x8, 0x2}, 0x10) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, 0x0, 0x0, 0x0) mremap(&(0x7f0000ff6000/0x8000)=nil, 0x8000, 0x1000, 0x7, &(0x7f0000b6a000/0x1000)=nil) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x0) 12:01:06 executing program 0: r0 = socket$inet6(0xa, 0x3, 0x4) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000080)={'bridge0\x00', &(0x7f0000000100)=@ethtool_ringparam={0xb}}) r1 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f0000000140)={0x0, 0x8a, "f71037ea58956193b5f64f3fa22a61c92dec1ae8fac14e72357745b3ef390f6a24f5a0f1825884f67bc37b9db4d0bc0d57e324d517c361db4046450dcf1943e349f3ebef3fed37c5a670b198672e32bdd989551ce4813a043e6914864792a71fcbb057955d71614d90eba6aa344d94c65d846ec8e83d34c5af0a70924ccd6c0989aac5d476ff81f6a694"}, &(0x7f0000000040)=0x92) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f0000000200)={r2, @in={{0x2, 0x4e22, @local}}, 0x1, 0x401}, &(0x7f00000000c0)=0x90) 12:01:06 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'vet\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r1 = ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x8001) ioctl$KIOCSOUND(r1, 0x4b2f, 0x6) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000080)={'ver\x01\x04\b\x00\x00\x00@\x00\x00\x00\b\x00', 0x400}) ioctl$TUNSETSNDBUF(r0, 0x400454e2, &(0x7f00000000c0)=0xc1) 12:01:06 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000140)='cpuacct.stat\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000040)="0f42", 0x2) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000740)={0x3, 0x2, 0xf000, 0x1000, &(0x7f0000000000/0x1000)=nil}) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r1, 0x810c5701, &(0x7f0000000780)) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) sendmsg$TIPC_NL_NET_SET(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000540)=ANY=[]}}, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0xfb]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000480)='TIPC\x00') ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000580)={[0x0, 0x8969], 0x4}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_NMI(r4, 0xae9a) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x0, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)) r6 = mmap$binder(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x11, r5, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x50, 0x0, &(0x7f0000000180)=[@acquire_done={0x40106309, 0x3}, @register_looper, @acquire_done={0x40106309, 0x1}, @request_death={0x400c630e, 0x1}, @free_buffer={0x40086303, r6}, @increfs={0x40046304, 0x2}], 0x31, 0x0, &(0x7f0000000080)="1241876daf42447b973b2359f7dfcd94cedc35d6cc2c489b2c3ff835a64d933984fd46616b51825efd2f89857b6a8517bd"}) ioctl$KVM_RUN(r4, 0xae80, 0x0) 12:01:06 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x200, 0x0) sendmsg$key(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="020201090a00000029bd7000ffdbdf2505001700ffa000000a004f24000000007fcd24476bc4eb6ed077048f186d8be80900000000000000030005006ca0000002004e2100"/80], 0x50}}, 0x8000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000280)=ANY=[@ANYBLOB="020d000010000000000000000000000003000600000000000100eedae075e1601e69a3000002e0000001000000000000000000000000000000b000000003000000000000000000000000000000000000000000150000000001ac1414bb000000000004000000000000030005000000000002200000e00800010000000000000000fc5ade12b2cb450a58e33bf8552921553232538f"], 0x80}}, 0x0) mknodat(r0, &(0x7f00000001c0)='./file0\x00', 0x800, 0x3) [ 253.507980][T11822] user requested TSC rate below hardware speed 12:01:06 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f00000000c0)='/dev/snd/controlC#\x00', 0x0, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000040)) openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0) openat$capi20(0xffffffffffffff9c, &(0x7f0000000080)='/dev/capi20\x00', 0x0, 0x0) signalfd4(0xffffffffffffffff, &(0x7f0000000240), 0x8, 0x0) socketpair$unix(0x1, 0x801000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) unshare(0x20600) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, &(0x7f0000000200), 0x0) r2 = accept4(r1, 0x0, &(0x7f0000000180), 0x800) ioctl$NBD_DISCONNECT(r0, 0xab08) setsockopt$l2tp_PPPOL2TP_SO_DEBUG(r2, 0x111, 0x1, 0x20, 0x4) 12:01:06 executing program 1: r0 = openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f00000001c0)=@in6={0xa, 0x0, 0x0, @empty, 0x3}, 0x1c, 0x0, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000008400000000000200f7ff0200010001002000000000000000840000000800000000000000000000000000ffff00000000"], 0x38}, 0x8800) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x4000, 0x0) ioctl$DRM_IOCTL_ADD_MAP(r0, 0xc0286415, &(0x7f0000000040)={&(0x7f0000ffc000/0x1000)=nil, 0x7, 0x5, 0x80, &(0x7f0000ffb000/0x4000)=nil, 0x3cc7}) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r1, 0x84, 0x12, &(0x7f0000000400), &(0x7f0000000440)=0x4) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r0, 0xc1105517, 0x0) unlink(0x0) getgid() ioctl$MON_IOCH_MFLUSH(r0, 0x9208, 0x7ff) mkdir(0x0, 0x0) open_by_handle_at(0xffffffffffffffff, &(0x7f00000002c0)=ANY=[@ANYBLOB="f5f6fa8c1704648c4c9aa29673c5132107691052d2479ddc2888a8ca546addb400900feb90c0d64a71a93fd9b7de6b51050ebd2f206df9710f044f10876587d1ae5fe1e00a3cde97b446664dc26131ceb9764a92af7100a7ea6a065a8c08238b0e5e03ca05a30fc1c90caaf71a43ca8f2714e2da98ee886b17e0c73dca2d7e4348da053bc3a13c3e1a4d2ee86eaa1338c2805e37ef89a46f497f561a511942c4311504bc9064c8e96613059d290fe466eaa41a9bee4cd551704ac47d581a09c439be42767958f48e206636b2ad5c2cd9d695151b075b65995d70667f9d63f39adf5c5e35372cb44d1aaf914b3a5e3c9942bf7e99c7a31b"], 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f00000004c0)=ANY=[@ANYRES32=0x0], 0x0) ioctl$EVIOCGBITSW(0xffffffffffffffff, 0x80404525, &(0x7f0000000580)=""/135) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) unshare(0x100) 12:01:06 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000480)="11dca50d5e0bcfe47bf070") r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x18000, 0x0) ioctl$KVM_SET_MP_STATE(r1, 0x4004ae99, &(0x7f0000000080)=0xe) r2 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'ip6_vti0\x00', 0x0}) bind$packet(r2, &(0x7f0000000040)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @broadcast}, 0x14) setsockopt$packet_int(r2, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r2, &(0x7f0000000d00), 0x400004e, 0x0) [ 253.757361][T11827] user requested TSC rate below hardware speed [ 253.794532][T11827] set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. 12:01:06 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_RESET_STATS(r0, &(0x7f0000000380)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000340)={&(0x7f0000000080)={0x2a0, r1, 0x200, 0x70bd2c, 0x25dfdbfb, {}, [@TIPC_NLA_LINK={0xa0, 0x4, [@TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}]}, @TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}]}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x92}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_LINK={0x38, 0x4, [@TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_MEDIA={0x80, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x27}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8000000080000000}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x200}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x101}]}]}, @TIPC_NLA_MON={0xc, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0xffff}]}, @TIPC_NLA_NODE={0x1c, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x3338000000000}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x799}]}, @TIPC_NLA_BEARER={0x100, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'eth', 0x3a, 'tunl0\x00'}}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e22, @multicast2}}, {0x14, 0x2, @in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}}}}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xaa}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}]}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xb2e}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x4}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0x5, @mcast1, 0x6006}}, {0x14, 0x2, @in={0x2, 0x4e22, @rand_addr=0x400}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz1\x00'}]}, @TIPC_NLA_NODE={0xc, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xb5}]}]}, 0x2a0}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) pkey_mprotect(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x0, 0xffffffffffffffff) r2 = syz_open_dev$sg(&(0x7f0000001000)='/dev/sg#\x00', 0x0, 0x2) write$evdev(r2, &(0x7f0000001fdc)=[{}, {{0x77359400}}], 0x11a) 12:01:07 executing program 2: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x805, 0x0) ioctl$UI_SET_ABSBIT(r0, 0x40045567, 0x5) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000040)={0x400000000002f}) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000100)={0x8000, {0x81, 0x4, 0xb0, 0x0, 0x35, 0x1}}) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f0000000600)={'syz0\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001]}, 0x45c) r1 = dup3(r0, r0, 0x80000) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f0000000140)=0x4, 0x4) r2 = syz_open_dev$video4linux(&(0x7f0000000080)='/dev/v4l-subdev#\x00', 0x3, 0x8000) ioctl$VIDIOC_ENUM_FMT(r2, 0xc0405602, &(0x7f00000000c0)={0x80000001, 0xb, 0x1, "907942e0f3aa7f96fa01da7c649467da5cbb82d38ee93a7915ee8b6a7cb37318", 0x7f755f5d}) 12:01:07 executing program 1: r0 = syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000000080)) r1 = dup3(0xffffffffffffffff, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') sendmsg$IPVS_CMD_GET_DAEMON(r1, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="100027bd7000fcdbdf250b0000001c00020008000e004e2240f31f380800621dff23b9a3cd30b965d40008001600080000001c00020008000b000200000008000400c3ffffff0800090055d60000"], 0x54}, 0x1, 0x0, 0x0, 0x40000}, 0x4000) 12:01:07 executing program 3: r0 = syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0x2, 0x2) ioctl$VIDIOC_S_INPUT(r0, 0xc0045627, &(0x7f00000000c0)=0x3) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet6_int(r1, 0x84, 0x7f, 0x0, 0x0) 12:01:07 executing program 2: r0 = socket(0xa, 0x3, 0x3) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000440)=[@in6={0xa, 0x4e24, 0x8, @rand_addr="5ff81f4193cfe9788a06e41dae53e3bf", 0xfffffffffffffff9}, @in6={0xa, 0x4e21, 0x1, @empty, 0x8000}], 0x38) r1 = syz_open_dev$video(&(0x7f00000000c0)='/dev/video#\x00', 0x6, 0x0) r2 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x7ff, 0x88002) sendmsg$rds(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000140)=""/179, 0xb3}, {&(0x7f0000000040)=""/47, 0x2f}], 0x2, &(0x7f0000000300)=[@cswp={0x58, 0x114, 0x7, {{0x6, 0x4}, &(0x7f0000000200)=0x4, &(0x7f0000000240)=0x2, 0x80000001, 0x2e, 0xeb61, 0x1, 0x30, 0x9}}, @mask_fadd={0x58, 0x114, 0x8, {{0x1d5722bf, 0x4}, &(0x7f0000000280)=0x6, &(0x7f00000002c0)=0x81, 0x0, 0x20, 0x3, 0x2, 0x20, 0x7}}], 0xb0, 0x4000}, 0x1) ioctl$VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000100)={0x44, 0x20000000000a, 0x0, "8cac3a94aa7dfd73c37b6187fc5a11e774c84a936b60a327949ce1273b94266c"}) ioctl$TIOCGSOFTCAR(r2, 0x5419, &(0x7f0000000400)) 12:01:07 executing program 1: sendmsg(0xffffffffffffffff, &(0x7f0000001500)={0x0, 0x0, &(0x7f0000001380)=[{&(0x7f00000001c0)="dba387aaa3f10d6be2528089ac8c13cd81820c3b273ad0817812bca551a37c4c0a0e0ece3a1bd6c99e13645c77f6bb255f244f4440df6f47cbb360c9c09b96e0b3fb51406e6f60a3cbfe0021284da9060954583465b718305be3f7fbc023d7442e16b000348ff04d274a4778d0a98963422e9a47d46d6f864e44d29e7d1a57dcf7a5abfd09253f893e23751f06b8d363c06c2217059903da2508e5e432b0d64e50d12b2ff455708ac37efe89f0c2b849d1b0e9d20be065fa78dfd24099880b202715bd8d45eae2fe44447c0f5d8be669e6812ca0dc1edf2504adaded0e73ff119be3fbff5b1dec8c17ce4d4e8182c86ccd92acff48b76951c4f524d89b15565d05ca970eb1fcfbf528895fc615a8a56abe4cf7d2cc7a82159e981ed012baf9c86b34b8628179d4160005f1810162facc519322fc3ae6a68e08f0c0c6c56912f294048d93a28c179da699e08667f3a21c0d807b641370173fe87cea4629fc9c74025b0520b537ed332d6bd6bca8dbf3d8dd1d86de5d00505a870171e02a3c2b3eb825bead9bfa0ccee5f3617e3f0083f0b1f2f1ee2a76bc9423d1fb88d064224969407391a8e3a31efcb243097074b15485cd4862627c2db3574e5535cfc3e1d3d8347c037551a1908775c7de90dc69784943e57baebf4ae5afb05cafc2cf5e200215d4a54859d9fe9d6a83d4fa89f3689db8bb23ae25cf6f501ae4da2863aed982115fa004c6eaa90b004e8c23a7c2e2306115b07d", 0x215}], 0x1}, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={0x14, 0x68, 0x105}, 0x14}}, 0x0) [ 254.305788][T11866] ================================================================== [ 254.313806][T11866] BUG: KMSAN: uninit-value in rtm_new_nexthop+0x447/0x98e0 [ 254.313806][T11866] CPU: 0 PID: 11866 Comm: syz-executor.1 Not tainted 5.3.0-rc3+ #17 [ 254.313806][T11866] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 254.313806][T11866] Call Trace: [ 254.313806][T11866] dump_stack+0x191/0x1f0 [ 254.313806][T11866] kmsan_report+0x162/0x2d0 [ 254.313806][T11866] __msan_warning+0x75/0xe0 [ 254.313806][T11866] rtm_new_nexthop+0x447/0x98e0 [ 254.313806][T11866] ? refcount_dec_and_test_checked+0x14c/0x210 [ 254.313806][T11866] ? kmsan_get_shadow_origin_ptr+0x28c/0x3a0 [ 254.313806][T11866] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 254.313806][T11866] ? kmsan_internal_unpoison_shadow+0x2f/0x40 [ 254.313806][T11866] ? kmsan_get_shadow_origin_ptr+0x28c/0x3a0 [ 254.313806][T11866] ? local_bh_enable+0x40/0x40 [ 254.313806][T11866] rtnetlink_rcv_msg+0x115a/0x1580 [ 254.313806][T11866] ? local_bh_enable+0x36/0x40 [ 254.313806][T11866] ? __dev_queue_xmit+0x304d/0x4270 [ 254.313806][T11866] ? kmsan_set_origin+0x26d/0x340 [ 254.313806][T11866] ? kmsan_get_shadow_origin_ptr+0x28c/0x3a0 [ 254.313806][T11866] netlink_rcv_skb+0x431/0x620 [ 254.313806][T11866] ? rtnetlink_bind+0x120/0x120 [ 254.313806][T11866] rtnetlink_rcv+0x50/0x60 [ 254.313806][T11866] netlink_unicast+0xf6c/0x1050 [ 254.313806][T11866] netlink_sendmsg+0x110f/0x1330 [ 254.313806][T11866] ? netlink_getsockopt+0x1430/0x1430 [ 254.313806][T11866] ___sys_sendmsg+0x14ff/0x1590 [ 254.313806][T11866] ? __fget_light+0x6b1/0x710 [ 254.313806][T11866] ? kmsan_get_shadow_origin_ptr+0x28c/0x3a0 [ 254.313806][T11866] __se_sys_sendmsg+0x305/0x460 [ 254.313806][T11866] __x64_sys_sendmsg+0x4a/0x70 [ 254.313806][T11866] do_syscall_64+0xbc/0xf0 [ 254.313806][T11866] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 254.313806][T11866] RIP: 0033:0x459829 [ 254.313806][T11866] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 254.313806][T11866] RSP: 002b:00007f55139dfc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 254.313806][T11866] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000459829 [ 254.313806][T11866] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000000000003 [ 254.313806][T11866] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 254.313806][T11866] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f55139e06d4 [ 254.313806][T11866] R13: 00000000004c7729 R14: 00000000004dcf30 R15: 00000000ffffffff [ 254.313806][T11866] [ 254.313806][T11866] Uninit was created at: [ 254.313806][T11866] kmsan_internal_poison_shadow+0x53/0xa0 [ 254.313806][T11866] kmsan_slab_alloc+0xaa/0x120 [ 254.313806][T11866] __kmalloc_node_track_caller+0xb55/0x1320 [ 254.313806][T11866] __alloc_skb+0x306/0xa10 [ 254.313806][T11866] netlink_sendmsg+0x783/0x1330 [ 254.313806][T11866] ___sys_sendmsg+0x14ff/0x1590 [ 254.313806][T11866] __se_sys_sendmsg+0x305/0x460 [ 254.313806][T11866] __x64_sys_sendmsg+0x4a/0x70 [ 254.313806][T11866] do_syscall_64+0xbc/0xf0 [ 254.313806][T11866] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 254.313806][T11866] ================================================================== [ 254.313806][T11866] Disabling lock debugging due to kernel taint [ 254.313806][T11866] Kernel panic - not syncing: panic_on_warn set ... [ 254.313806][T11866] CPU: 0 PID: 11866 Comm: syz-executor.1 Tainted: G B 5.3.0-rc3+ #17 [ 254.313806][T11866] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 254.313806][T11866] Call Trace: [ 254.313806][T11866] dump_stack+0x191/0x1f0 [ 254.313806][T11866] panic+0x3c9/0xc1e [ 254.313806][T11866] kmsan_report+0x2ca/0x2d0 [ 254.313806][T11866] __msan_warning+0x75/0xe0 [ 254.313806][T11866] rtm_new_nexthop+0x447/0x98e0 [ 254.313806][T11866] ? refcount_dec_and_test_checked+0x14c/0x210 [ 254.313806][T11866] ? kmsan_get_shadow_origin_ptr+0x28c/0x3a0 [ 254.313806][T11866] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 254.313806][T11866] ? kmsan_internal_unpoison_shadow+0x2f/0x40 [ 254.313806][T11866] ? kmsan_get_shadow_origin_ptr+0x28c/0x3a0 [ 254.313806][T11866] ? local_bh_enable+0x40/0x40 [ 254.313806][T11866] rtnetlink_rcv_msg+0x115a/0x1580 [ 254.313806][T11866] ? local_bh_enable+0x36/0x40 [ 254.313806][T11866] ? __dev_queue_xmit+0x304d/0x4270 [ 254.313806][T11866] ? kmsan_set_origin+0x26d/0x340 [ 254.313806][T11866] ? kmsan_get_shadow_origin_ptr+0x28c/0x3a0 [ 254.313806][T11866] netlink_rcv_skb+0x431/0x620 [ 254.313806][T11866] ? rtnetlink_bind+0x120/0x120 [ 254.313806][T11866] rtnetlink_rcv+0x50/0x60 [ 254.313806][T11866] netlink_unicast+0xf6c/0x1050 [ 254.313806][T11866] netlink_sendmsg+0x110f/0x1330 [ 254.313806][T11866] ? netlink_getsockopt+0x1430/0x1430 [ 254.313806][T11866] ___sys_sendmsg+0x14ff/0x1590 [ 254.313806][T11866] ? __fget_light+0x6b1/0x710 [ 254.313806][T11866] ? kmsan_get_shadow_origin_ptr+0x28c/0x3a0 [ 254.313806][T11866] __se_sys_sendmsg+0x305/0x460 [ 254.313806][T11866] __x64_sys_sendmsg+0x4a/0x70 [ 254.313806][T11866] do_syscall_64+0xbc/0xf0 [ 254.313806][T11866] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 254.313806][T11866] RIP: 0033:0x459829 [ 254.313806][T11866] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 254.313806][T11866] RSP: 002b:00007f55139dfc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 254.313806][T11866] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000459829 [ 254.313806][T11866] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000000000003 [ 254.313806][T11866] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 254.313806][T11866] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f55139e06d4 [ 254.313806][T11866] R13: 00000000004c7729 R14: 00000000004dcf30 R15: 00000000ffffffff [ 254.313806][T11866] Kernel Offset: disabled [ 254.313806][T11866] Rebooting in 86400 seconds..