link={0x20, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) 10:24:22 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270ff", 0x15}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2250.300231][T26552] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2250.339334][T26553] FAT-fs (loop2): invalid media value (0x00) [ 2250.345425][T26553] FAT-fs (loop2): Can't find a valid FAT filesystem [ 2250.391738][T26552] 8021q: adding VLAN 0 to HW filter on device bond177 [ 2250.401589][T26552] bond0: (slave bond177): Enslaving as an active interface with an up link [ 2250.572552][T26562] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2251.095349][ T27] audit: type=1804 audit(1579947863.215:906): pid=26551 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1247/file0/file0" dev="loop0" ino=2966 res=1 10:24:23 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x2000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:24:23 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0xf, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) 10:24:23 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r1 = socket$kcm(0x2, 0x2, 0x73) bind(r1, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) getpeername(r1, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) connect$inet6(r2, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @empty, 0x9}, 0x1c) sendmsg$TEAM_CMD_PORT_LIST_GET(r2, &(0x7f0000002580)={0x0, 0x0, 0x0}, 0x4000000) ioctl$sock_SIOCDELDLCI(r2, 0x8981, &(0x7f0000000000)={'veth0_to_batadv\x00', 0x9}) r3 = socket$inet_udplite(0x2, 0x2, 0x88) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000040)=0x1, 0x4) recvfrom(r0, 0x0, 0x0, 0x2, &(0x7f0000000140)=@ax25={{0x3, @default}, [@bcast, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x716000) 10:24:23 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270ff", 0x15}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:24:23 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x88a8ffff, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2251.141654][ T27] audit: type=1800 audit(1579947863.215:907): pid=26551 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="loop0" ino=2966 res=0 [ 2251.238155][ T27] audit: type=1804 audit(1579947863.215:908): pid=26570 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1247/file0/file0" dev="loop0" ino=2966 res=1 [ 2251.275280][T26578] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2251.430827][T26580] FAT-fs (loop2): invalid media value (0x00) [ 2251.437017][T26580] FAT-fs (loop2): Can't find a valid FAT filesystem [ 2251.465872][T26582] 8021q: adding VLAN 0 to HW filter on device bond178 10:24:24 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270ff", 0x15}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2251.818365][T26582] bond0: (slave bond178): Enslaving as an active interface with an up link [ 2251.834348][ T27] audit: type=1804 audit(1579947864.045:909): pid=26573 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/960/file0/file0" dev="loop5" ino=2969 res=1 [ 2251.864138][T26584] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2251.926286][T26603] FAT-fs (loop2): invalid media value (0x00) [ 2251.932403][T26603] FAT-fs (loop2): Can't find a valid FAT filesystem 10:24:24 executing program 5: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x1300) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2252.099393][T26589] 8021q: adding VLAN 0 to HW filter on device bond2 10:24:24 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = msgget$private(0x0, 0x0) msgctl$IPC_SET(r2, 0x1, &(0x7f0000000200)={{0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5fba}) msgctl$MSG_STAT(r2, 0xb, &(0x7f00000001c0)=""/164) r3 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000040)=0x1, 0x4) recvfrom(r0, 0x0, 0x0, 0x2, &(0x7f0000000140)=@ax25={{0x3, @default}, [@bcast, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x716000) [ 2252.198266][T26589] bond0: (slave bond2): Enslaving as an active interface with an up link 10:24:24 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(0x0, 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2252.306390][T26599] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:24:24 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x9effffff, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) 10:24:24 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0xf, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) 10:24:24 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x1) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000040)=0x1, 0x4) recvfrom(r0, 0x0, 0x0, 0x2, &(0x7f0000000140)=@ax25={{0x3, @default}, [@bcast, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x716000) [ 2252.960551][T26638] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2253.217776][T26640] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2253.241971][ C0] net_ratelimit: 16 callbacks suppressed [ 2253.241981][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2253.253742][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2253.259531][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2253.265300][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2253.278142][ T27] audit: type=1804 audit(1579947865.485:910): pid=26610 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1248/file0/file0" dev="loop0" ino=2972 res=1 [ 2253.482449][T26644] 8021q: adding VLAN 0 to HW filter on device bond179 10:24:25 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(0x0, 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:24:25 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) r3 = socket$inet(0x2, 0x4000000805, 0x0) r4 = socket$inet_sctp(0x2, 0x5, 0x84) r5 = dup3(r3, r4, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000d6cff0)=[@in={0x2, 0x4e20, @loopback}], 0x10) sendto$inet(r5, &(0x7f00000000c0)='\t', 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendto$inet(r4, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r4, 0x84, 0x1d, &(0x7f0000000240)={0x3, [0x0, 0x0, 0x0]}, &(0x7f0000a8a000)=0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r5, 0x84, 0x7a, &(0x7f000059aff8)={r6}, &(0x7f000034f000)=0x2059b000) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f0000000000)={r6, 0x8001, 0x6}, &(0x7f00000000c0)=0x8) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f0000000100)={r7, 0x2}, &(0x7f00000001c0)=0x8) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000040)=0x1, 0x4) recvfrom(r0, 0x0, 0x0, 0x2, &(0x7f0000000140)=@ax25={{0x3, @default}, [@bcast, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x716000) [ 2253.536339][T26644] bond0: (slave bond179): Enslaving as an active interface with an up link [ 2253.553908][T26647] 8021q: adding VLAN 0 to HW filter on device bond3 10:24:25 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x3f00) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2253.579598][T26647] bond0: (slave bond3): Enslaving as an active interface with an up link [ 2253.620592][ T27] audit: type=1800 audit(1579947865.515:911): pid=26610 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="loop0" ino=2972 res=0 [ 2253.756735][ T27] audit: type=1804 audit(1579947865.515:912): pid=26635 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1248/file0/file0" dev="loop0" ino=2972 res=1 10:24:26 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(0x0, 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:24:26 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0xc3ffffff, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) 10:24:26 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000040)=0x1, 0x4) clock_adjtime(0x6, &(0x7f00000001c0)={0x10000, 0x9, 0x1, 0x1, 0x8, 0x10001, 0x1, 0x10af945c, 0x6, 0xff, 0x34dd, 0x5, 0x9ce, 0x7fffffff, 0x0, 0x4, 0x200, 0x100000000, 0x3, 0xb, 0x101, 0x9b, 0x3, 0x2, 0x81, 0x3}) recvfrom(r0, 0x0, 0x0, 0x2, &(0x7f0000000140)=@ax25={{0x3, @default}, [@bcast, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x716000) [ 2253.969868][ T27] audit: type=1804 audit(1579947865.745:913): pid=26623 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/961/file0/file0" dev="loop5" ino=2975 res=1 [ 2254.181270][T26681] 8021q: adding VLAN 0 to HW filter on device bond180 [ 2254.211191][ T27] audit: type=1800 audit(1579947865.745:914): pid=26623 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.5" name="file0" dev="loop5" ino=2975 res=0 [ 2254.252688][T26681] bond0: (slave bond180): Enslaving as an active interface with an up link [ 2254.341963][ T27] audit: type=1804 audit(1579947865.745:915): pid=26655 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/961/file0/file0" dev="loop5" ino=2975 res=1 [ 2254.366905][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2254.366933][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2254.366975][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2254.367011][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2254.462620][T26688] validate_nla: 2 callbacks suppressed [ 2254.462632][T26688] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2254.649143][ T27] audit: type=1804 audit(1579947866.855:916): pid=26692 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1249/file0/file0" dev="loop0" ino=2978 res=1 10:24:26 executing program 5: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x2000) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:24:26 executing program 3: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x2000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:24:26 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0x0, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:24:26 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0xc5575982, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2254.722005][ T27] audit: type=1800 audit(1579947866.855:917): pid=26692 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="loop0" ino=2978 res=0 10:24:27 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xf000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2254.864447][T26706] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2254.996238][T26712] 8021q: adding VLAN 0 to HW filter on device bond181 10:24:27 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36", 0x32}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2255.065278][T26712] bond0: (slave bond181): Enslaving as an active interface with an up link 10:24:27 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0x0, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2255.277996][T26716] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2255.322071][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2255.328031][ C0] protocol 88fb is buggy, dev hsr_slave_1 10:24:28 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0xf0ffffff, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2256.204089][T26754] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:24:28 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup(r1) r3 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCGSERIAL(r3, 0x541e, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x4, 0x0, 0x7, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, @perf_config_ext={0x8}, 0x0, 0x0, 0x0, 0x5, 0x2, 0x0, 0x1}, 0x0, 0x5, r3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$packet(0x11, 0x3, 0x300) bind$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000500)=ANY=[@ANYBLOB="2000000011000d0400"/20, @ANYRES32=r6, @ANYBLOB="0004000000000000"], 0x20}}, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'ip_vti0\x00', r6}) r8 = creat(&(0x7f0000000040)='./bus\x00', 0x0) fcntl$setstatus(r8, 0x4, 0x65400) ioctl$EXT4_IOC_SETFLAGS(r8, 0x40086602, &(0x7f0000000000)) r9 = creat(&(0x7f0000000040)='./bus\x00', 0x0) fcntl$setstatus(r9, 0x4, 0x65400) ioctl$EXT4_IOC_SETFLAGS(r9, 0x40086602, &(0x7f0000000000)=0xaa850ab34c804c98) io_submit(0x0, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r9, &(0x7f00000006c0)}]) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000600)={r9, 0xc0, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=0x1, 0x0, 0x0, 0x0, &(0x7f0000000140), 0x0, 0x0, &(0x7f0000000200)={0x0, 0x1, 0x8, 0x10001}, &(0x7f0000000240), 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=0x2f}}, 0x10) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000680)={r8, 0x10, &(0x7f0000000640)={&(0x7f0000000440)=""/203, 0xcb, r10}}, 0x10) r11 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000480)='/dev/vcs\x00', 0x20080, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x18, 0x7, &(0x7f0000000100)=@framed={{0x18, 0x0, 0x0, 0x0, 0x528dbc8d, 0x0, 0x0, 0x0, 0x5}, [@initr0={0x18, 0x0, 0x0, 0x0, 0x1f8000, 0x0, 0x0, 0x0, 0x9}, @alu={0x4, 0x1, 0x7, 0x6, 0x1, 0xfffffffffffffff8, 0x1}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff8}]}, &(0x7f0000000140)='syzkaller\x00', 0x9, 0x0, 0x0, 0x40f00, 0x1, [], r7, 0x10, r3, 0x8, &(0x7f0000000400)={0x4, 0x4}, 0x8, 0x10, &(0x7f0000000440)={0x0, 0xe, 0xfff, 0x9}, 0x10, r10, r11}, 0x78) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000000)=r10, 0x4) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000040)=0x1, 0x4) recvfrom(r0, 0x0, 0x0, 0x2, &(0x7f0000000140)=@ax25={{0x3, @default}, [@bcast, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x716000) [ 2256.539661][T26756] 8021q: adding VLAN 0 to HW filter on device bond182 [ 2256.715295][T26756] bond0: (slave bond182): Enslaving as an active interface with an up link 10:24:29 executing program 3: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:24:29 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0x0, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2256.956652][T26754] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:24:29 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$kcm(0x2, 0x2, 0x73) bind(r2, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) getpeername(r2, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) connect$inet6(r3, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @empty, 0x9}, 0x1c) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f0000002580)={0x0, 0x0, 0x0}, 0x4000000) sendmmsg$unix(r3, &(0x7f0000000000), 0x0, 0x4000) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000000)=0x0) capset(&(0x7f0000000100)={0x19980330, r4}, &(0x7f0000000280)={0xb76, 0xb0, 0xab7, 0xa036, 0xf3f7, 0x2}) r5 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) getresuid(&(0x7f0000000380)=0x0, &(0x7f00000003c0), &(0x7f0000000400)) r7 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000440)='/dev/vcsu\x00', 0x88001, 0x0) r8 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000480)={{{@in6=@mcast2, @in6=@ipv4={[], [], @multicast2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in6=@empty}}, &(0x7f0000000580)=0xe8) r10 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000005c0), 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000016c0)={0xffffffffffffffff}) getsockopt$sock_cred(r11, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setuid(r12) sendmsg$nl_netfilter(r5, &(0x7f0000000640)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000600)={&(0x7f00000025c0)={0x25ac, 0xb, 0x8, 0x101, 0x70bd26, 0x25dfdbfc, {0x7, 0x0, 0x8}, [@nested={0x1ad, 0x78, 0x0, 0x1, [@typed={0x8, 0x3d, 0x0, 0x0, @uid=r6}, @typed={0x8, 0xe, 0x0, 0x0, @u32=0x8}, @generic="c4e04031d9c87805de35e563fff295f5a77a6b3587f4c68b121f8f8ee648a74e54fba6fd36d2e69e03f2f56f77f6ef45271b3b35a7106992dd18c85aecbd4fd8129ed1d63dffdeb31f3b63c2826b2f9f5d3c544838bd10a04629e90aa97200da4bcdc86cdbff1cd2d7b659eb930482f55c5a99a42cd4", @generic="474f8bbb11f809199e0c81858a882dabd86270b996d5b5141935b8e0ffd24bbc501f927984a0c2d72c177ff4b700595eb41df3ad8bfb1c52bfd7ffbf6a2aaa5f1fb86fa67aec81c081c28b75abee15603f307c0e1dba4d46c6d92dce6a1550ce120ac7eefc6ac45b00e6293dea1813a1c1ddaf0441068a2fb60a29b39008b38891cd970c90bf4002368c3da7b2b79134c6e1e3d25e314a496e6a66bb0d17091e26f2c1c153f8dbc0e46497c34118d54da6e4ca44fdb0bf6136ca191e1e8240893dff1c12a49c027f13f5f668659bdf0c6e6962c7d01611a4c812f412ac2fb0a4d388a37647627d39", @typed={0x14, 0x8c, 0x0, 0x0, @ipv6=@remote}, @typed={0x8, 0x4, 0x0, 0x0, @ipv4=@rand_addr=0x8}, @generic="17124a812d0be5ee96888661c6dd9c357d95a7bb11c6929797897f54e8b14a"]}, @nested={0x116b, 0x72, 0x0, 0x1, [@generic="54b085d8c7e39b30eb8c0eb7e30612614eae43979d3b5f37e9b8d607fe3c73a204fdb0b6e61e624d1603dca11d3a647396b24d090741a8db53e4eca04a41a6c3", @typed={0x8, 0x93, 0x0, 0x0, @fd=r7}, @generic="3835f624cf665de5f0fae6728f3ed8a04529908039716860e03a808ffe68d1223cf831ce3abe4b011f8a7bcc3666093815260570124f8ee6eb126d2b561f371c98647115a2ee6846dbf2e4f9ebbd8ab10de68a3788960c3c0af7a53f20de3235cb5bbdfaa3be2d0b8ae6127e646f8e75f8f8b8bfa450052321a84ed3b82f80a42899f566d1abe66198ff98b4da345c49c7f775891503c729dc913cf9836ff28e0bd3293894717e90f58409c18b85f599ba518ad71f133ad8626dfaf3da17757d24a6867473e800085512af85833b3f14", @typed={0x8, 0x7d, 0x0, 0x0, @ipv4=@multicast2}, @generic="fae65e70400c18d3da7a51fc075b317bb0f6be013a0e90f2289471093272a55786632dc5b233cbfb20bb029ae39d3178657233ed20aa2cb7d31441fa54296e5734586e35dc2cbbe121aacde980e5c4fed5e0d27bc5d631d595a580c66fbcc0a6f49c7ca20fcee8229eabd308d6c9515f4654e80020b290495c4ab5f9d594d033d94bf8dc8fe7fcef5c3c0262f70882713f883ea16eec6cc0b02c9d82f1cefe36f7d4d248ed08a2359e443b1dcb60b09603582da2c2f70560128dc687640ced9b7f19ff5c654462e62a27652d272ebd76909fbe51a669fc77b2a569627afb5c0b7ee4ecfd0cc6ec007e1a0aec62f7aa2f8b740bfc6e61cf32afe50318e2fa268fcd471e47f2cbbb00c85b30811186932ce3f963131af74c6d83605319dfa28b1d07bfada1074d6fdfa06c2b0e4491aa8f105d6a2c0126d6cff9d171e9b845ea487b42145127851ec26a211e483bfc04c23c20f8b87783f0b73d66b1cebc4878c60f4b1fc3b9f827c68733ad480da78ab42c3f632fac892d18b08da05bd90ffe478315bb45e611ad77bbec898d991abe60b312bd613d6f227d7e5aa4d4853300b33f7a478aa28d77e88de693a6bb07f504a60a24612fd81a1060f464733a64c422aba54696e89deae95afd4a513871f378d208af0b98703c08254b059862f28a7b71345deb5d314f0ff61614f8d873f315ca2235f2202e6e3ad4364a8b918a91a0965d20f15d066167e6891a5f61a9f19b19e24ae671ce5cf8fa4bcb22101c59bc65786ae1a4107c552f0fe648b29af416f427d2e77a6aba6ad27b84a18b6837300384456a34573886557c0cb1fe81809bcf39b58a247702c810fd6dfa9b39f5ffa89a9039c58f56cb318f62b829eec429bccd4d5ad149eb4f5af83de0bab2ff11175904156378854ed3b32783f80a8764bab702dbf012c8808cfde6deb60872f2b921489a8ef85043284b4325ba4931d69311f50c60d4630d8e0ead02637badeaa023ac333017fbb8bb34fc3a3c8cc30a7693a6674879e746340ff61fe508a5ccc3cbe53ef39560984428aefda0e563ca03afd5cbd8caf1ff3c939805c7d6a9ebe99d6b22fac2630c7f105416eb422195f8c3ffe3e9626773f5ad107e6c4f4471b4183eb02bd3b5861f5f79f251cd93ea5b23ca114aa1882efb987261430fa573fbe124dfae666a3885dc68e6983698c3a50f80b4cc048ae76b5895eeab25114de3ee80a856e078ca24417f7f802e65d8f90caeab3011fdda2b84a8425bb50ccbe96a6f54a741288bbc8607817264420f6e8185053c39477e1f459ce0c9e35203a6ce082a610ed432a2aa4522dbbbcbae13b1dabf1d7eaf8da9da1a006d32104022b3d5af05879aea413c56bba9ed2fda29035359bd5d2fab465c8fd54a3bd4472031d98c78f6f0a333be9d903aa46958df812c22ae1513def3e8fd3330a198a2444a39785950b37fe6cf39540cbcda50f50dfe9afb14d3c401e3838f7bb065cc3a3f5ae781d34cc27040ff49ef5fc7177a6424d72168dcdad225f8dbe5db48051eb90f28439ab07e440f914ad43724709531d3440d1da13f6fd067f9712ad62e20c600deba2d6c717186b7f6989dc02a302ed4f176b2d87216ef638f9cdaebca5064ed53bcac672cea12cd5bdd4fcc00f3bc52eabe62abfb07402792eaaa954594b4ecba5d74c09cfa2cf69b624a7e223c5c592da163d7e53010a5e15bd0bb7349a3ea9f4f7449e11d0c9244ee315ccd0e6f0da7f8f0d7f5e37e1c106da9ff47342d19b6d142ab035e6ee087dfd19f8efe220dc99f41767ca0199c5498ad96227a271bba1afe593b2a370eb77d62782cb439579a4cbc5e418d94d29ccfbaa77b74a2402eb2f7cd8ff8fd1ec01b3ebbdb60e1a6a361681a81d26760e552942b8be25fa3186c81012003802299c048a54bb4f485e8f23499ed11dd1558207e220e0d0153ce07702a214fc4e6533c92bfcff220a9ea4122a1611e82042346dd0e75436ede00c52c39f8d28fe1b55c2fc447ee1b7638f444db63c55c73106a82c2c7e2179c0150299b31d86f26c0c9826d3b541468b9bee75c2cf4901ba2c073986110bd04af0d192efb26af8f260fc1a8b47ff84f1bb14d4f7565c54eeefafafd45377dc4b5e8217c937bea008f75afb86dc9ba3355f019c0cb48fb4eaa6b32d5465c074c6fd874731827e63c770f645ca9d455e73839ca8c021545377bea8da39adf89e85c21e7a79f7ee34f7c8aff95d07ec7fcfe8ce1a213eb87d269fcef86db0d396e1f99510b4d3f70f79a89bbed0a0d0f81512e8060f40900b3533b59ebe996ee6dde39a6b480bd4b312215fbcf181b0c9b4fe2da342b04d3546103a15ffa0f4c082abd8de512a11dcbf4830ef489da68450068a1060b1dcb6bc690a534e200fe43b9d3a5c21f7256a648478ff358f8b65ca91ef2690b013f6998eb9fb18e0155f223e72a58cdb2ac86b33f819ec88fe5af7b61e68c44ea8a3f2b00fb8cf9186d4b0bc81979398833202b3ec6fbf00289678218941c83d3a37dea390af54c21b57590cab1b5bbf73e97b0f4e95511a3b535eed2af59a428cdc79848cbd7a54dbff437ad82aca90fa88a26ad465ab10aed31e14cf8dc8a1e9bf4bd258947c9fe987ecd4038e40181cb0eb23a9c7e84fd1b030d600fceab67dcc490481fde683228ca9c5087bc8b2b17b831b6b385a023ed88b99b97e842148fe801ddbc7744ba5c3b4e46b06a2d29239370a0be7dc0dbb5ef6993d80eb87902021d89af9ad6e87e81b28269c20a8c40642b0f36f1e9d785e635ee6c92d4fc88aec7c76a9d015a4c84641a4913b8d0e792a52baa6fa3aeab3f3346888c7750b6d0cd904ef7e2366ee575a79bde5fd4cc3f9c5bc5427b148ea63f50a37c3f95fb438bae008ede089e8bb8acb3c5f4f2fa63466da7454a618a6f337826ddaa4b12e158248d4b65cfa765420800aa8054b8f3d75af17f579e9ddaa584fcf8126e5d968421aa8c922fcea31903c98b57751e2a696dddf7108432ed6fe701032dfdd07579e50fe2da8c4a8bdb81d428f691a454d4f4a4c9b3bd1a610366dc8ad1d06392a2be594d65290c49aaa042366625640b7201728df60cb65ac72fe9c455b4fb8c906026998bfa49d588bb9e264e28719c8cd977baa7e569d0af32e35ecb0a40939f85fb2087d844641fdba2ed4f1f2daac3c39782b90df69c673f4f74188b244996478aa47ef0b6d6fdc12b9a2e951baa53db84d7d24b7c6f4e17aea7fb2a3f93d04190a74279574879e413c3ef953c448b1aa25987946548a9aa15bec6345b924fe61e3547a054ad565ed0f48f57d2c620d9c355db4b7e23c6289445950a93e3f4d2e6ea98c5e9a9a3bffe3580458f89d44b1c9b8f1c9751bbad204c5ffaf2096374632a19c5f9c2b8209dbcfb6c94806a633a218590c1395d8adb7951c3583c9c9fcc491772b2510e861385997a5a893fe9190b58535aee96a37dcd54011a2130fc483c8c8e8a849aff14ea4621c2aec72cdeab97a7fd5735988a498e2aec02e4abb7dfeccfb0052036ee6e8ae2c37149520a9b447461fdffb6c3e402df072f88803adb3d164944e218a97c9d3b1f95e954c44b8034e01f69d6d0e4143098393402755bbf50cc2ef1b7d9b8333c8e6ba20732797fc8608d36e677e7bf7744030cf6b8a3b4d319ca63f2bece8faec701bef955c2e4f2df88f4deeb474446279f566ed1a58c4a30f4cb6207f319614a303eb91461ff276c29f9473b3dcb7c891a38d5d9fba42da74ffd6e72153f595e39760bbaad8ca3342d3adefd47080e4deca4f7afa0f02df504415e355bcd0ab630968d1e24e7b44d58d50b7e25f4f711dfaaea76ab3b26f674f15f2ed443732c838f0ef458c0be7cf96b9c0341e816963c94d70eb937e232d9d80ac180db327ec0f689756b9d0631b36cfcc0c03fed75652fa3a070c551be0b9e42ed2a0a66ea7a30fa0d30e7f3701074ccdcff3199c8aff510ee5045ca0969db07fc1e0c86cd2412abbc1c4128207b61d416a4c373cf2df09d27ba52c32c8069d8d4c607ed2208c6a37972b1aa708109b267d65ab3f75e48489ed3b39bc8dd491f7919dd60f07a7bdb46a3f008b97f0b7909031e58f41a71ce6157db576fe60d0c0a2ad207c11535da2f618f0a7551fa132d39499aecad1f9541014de0518b8c0bd38c9edad56dc6684d8aeb6f51bc2cd6a3cb6661edaa027d78b7e9d15df017d340ff6a8380e62ac78605c7d277b22111ac8ecf367c90f8f2390d1eba81341a0858ffad7d9700a0cef89449f81c9064b4831344346f1a5fc3d28ddd4f5840397f82593b9977b44f49aef8c31f3f54ae1b10422c24881b77783799be71780b1088b72220f4488fdbd4bb86f843213f0165518b48f988b2cfca8aa9ecf12e41b25043a08786e51980fb396c2eb3c12c372dbdd6a50f1daa88017eb688fbee5399b32f05127a48e1b20d941e0893bb31b319048e497599257df03705f3bc37ab36e5313d3facc49721a448e01f3be5a6cc84f4caa2160acd0bee7ee335a9d4d844b8e2bde7119baaa7745825f42d684569775317d2c67a2bdc970dd9d41c641c1e34cabd2cb0912c6317de77de56fa573753100b7bf39db9bc04c32a326f2275219426ebe72e6ff39bb29fc5b153e7bc121750600efa693cf84f6fe9c23ffc5eee990f501dfa6405a87ee7ba412aa82d4bb8a577504c79229fc5f5e91eba9430b4ddf053b558a8172a6bd0f7583a6be3a714ca9f39b730dc67ea8df2692a1cfa49c3e52cbdc7b97f3b453528b01ea49b3e7211828efcec15bd216bfebdecbe606e2457c83d90894da5963165a9f90b621f76b2609fda2a3ef1a15ddae911fc9639b03810141699abd03a0d782e143899804d89f5b10edab435495e9aa34cbb4f7ea14bfbb8c41fd1708460308ea52bde8bab8e3c71de6fe4f345480bc0bc0ab265e3913078c341f507223bfee28e9b6f952837e81621ca03fbc46fbacf4e3c0863427de3123c09d394eb655334a8c01c894ecd7085d4db8e88dcb3eda603de74c7e6a4ef3be36830a445d95a5913fb2934926575b20ba566832035d18c9f1abf008cb70ffbd133a3e925cabdbc966cb642606bbf8a31e9a00a6379efb2d96e85ec0013771cd0b7d0ab5f7fd7eb85ba80aeccd72a602ce219420dd21278085ede1ac1cc4c1b05b13b5e6c192f1efc416d7c7f6684ecc6ab01c6dc30f0d722051cebd698d354e76a0612ad28551d0a51fefb8a3b81099dc869765be3fa695d55eae9c3ed117c96285baf6eb58d4e6578f27c3c77f10ad56fa7d2ee3ae92b7cf8c491bbb1a0b6bac022f18764519e7ceebecc6972dba511e9bee63e282ebb1a39d254c7657695dab9eca844a58ef5b4f4098c580c20f91d0a14c113cf9afc098104d56b0cb582217e8303e102a71a0e4948eb1bfe77b5b50f44c8b11fae76bd2f195dff4f92264337097e6198142786f6521211973303998befa8ac4ffd2cde0b8d4a694c53edf9258452aa292b429995819d3c612172860cb0201a494116e8e3a91abe1df524c4328b9829c8143d2035aa97bf381d9995275001535638eab22df64a6cd31cdc95ded56d97d4882b4205ad30b576d18a85c4d1f09fa091803a059ac2e1b7f949c31c04aeab8394180ef8935dfb457b0d68abe57c1b6d727a0dc5e717d404b5819422143e0354e4e237df173a441c507be1f8b2c44f614d629b12276e047a86f23fbdb9f8f3b75743f3b3b91fdebd1685708eee3507df48dab10473aad853c4e419ee7a9921445d4027e70cb064a77d93f10572c84cecc364", @typed={0x8, 0x73, 0x0, 0x0, @fd=r8}, @typed={0xc, 0x7a, 0x0, 0x0, @u64=0x6}, @generic="6c1fda0eff84a5ecfa94dc18", @generic="c987ad610697cf2e200e5d67412c9c04dab7b0f6f974a3551112183b7f33cf00ca2bb5abcefb54"]}, @nested={0x8, 0x1d, 0x0, 0x1, [@typed={0x4, 0x26}]}, @typed={0x8, 0x8f, 0x0, 0x0, @uid=r9}, @nested={0x64, 0x11, 0x0, 0x1, [@generic="f17b2c96e9f06ff42b06e753caeed3177038e5e70b5feca57f58b4990eb1aa868324bba83314dcee20b498de9d7d0def39acadcb3e5dea942dae53a480af22c95e9a54c0c169d30b70da38ec78c861045e375414f7f92d9d", @typed={0x8, 0x43, 0x0, 0x0, @ipv4=@loopback}]}, @nested={0x103e, 0x7f, 0x0, 0x1, [@typed={0x8, 0x19, 0x0, 0x0, @fd=r10}, @generic="cd5cf3a64c8a8f63aeb2de7868f97966b8e152131f7f6215a7eb60852b70178b125a1338d4aa1744e322dbaaaaf347cd82d3cd7abbe1bec5c93cf0dae4b3d9a3091a56734a88926312c820f81c652f0e659f19aef276897bb28c74fae4d571848f30dc58b67589da95fc1cd22184d28d47e1f6a80fa65da7cf353d9cb2c5ae399b358659020380c4f71f6e0c95847f64a5a1f6fcb7d8aaff7d25b95d4e5cf069a3cf4641bf57df9870062fac2c3b98c289fda258934759ca5d0f3a733abc55b4d74af3bc68ffc4beb8eda7ba5027bde4b280402f06d8465b7a0027527a539293244a3045ddad850ce6755fd12f03604abd90edce5b12f656bc57c321ca16f307669507b6f4ba4f7608e8247433a134a765614df91815d67b2712d89f279477c5dcf4d8fe2a86821218e4fc8d4b6d0500f0c54b5a6ba39733ac468569053f833c78f2df3a9996efbe4a6e29eb6ec1ccb37531e3de21ac8f2a3241e92e5684a65bab6a7ad05ee870fe1e079e86122055a5548ffb080e6243842f4954fd0958d3a2c236ad2fba84726eba9e8ca60c0a7bda97e9fbbc423ceb064b5ab937fe42c7acf847e34c6ce848218b94607410b6f6fb80c9fb23a0d0d89e940d7e1dbf8165e0240abb4662e5dea555cccbb5b5a03aaea5537789a5596eb9e9bfd5fb843efad455eb65273a66c4ebdad2b4c1602cfd18164905d978f289732d9b0e3d6eac1050846a3eb90db9fc8b836baa67a17a39bc6500eac8775e8e5ae6e22110edfc0339069db661f0124373076665bc2d4032cfb664188c8f7f16b47d3559e00fd814107e3032284ae3171345c99df285b8e1342a3f6c0168cc4098bad8951abb6ea99a0f68d83068b0103ddc11ba5128cfea5f3cfe7d994fc0fe18e97f8dcaf62aab67ff68c8d0b226a626a60bf4fef0512656758fb16910784a3baaaa78705ae5ad85f4ed5c4644d49ffece6b53d59c2d512d4c11f5d6c3f564faaeff8e4549823b852c5d22b29929ab6e9ab1e0a0a1920facc11ab3caedbf8dadda93687e7b63dad5e42bad7a8d261e66d858cb6a7f04a39f764be71dffe56642119430021d5095a1e85d8ac430588af97a5c473a78076f994d26c2d1006684599abedee424f72e100759bd52c73c1c46488e9c7138abe0b6b946cdbd3a376ebd742eb8df0fbfd35719e7a9f63a158bfd29dc0688e36f23d2a06bff8e3a4039d46b09eb680978bf47ca31f561bbb7434981de4cc9bcf0160ffc5d61f1463f2c3750b4b1e1e69f94c65314fca820d2d217fce60dd837fb2a9c2d4ac234734a59536d2c74fa3e748d9e4855ca4bff003695aad496e731269923b7d8cb7df2d3fed23fb89aa9594389fd97c6e253bf34f482024d86a0659f288f1528653014ddaddbb7eeaee9f87535d1e36f4a6d4f5f2d474b663a7588f63d71bfdfe7efb6782c69c09290caad47b19be65a9853064707f1d6720840b9134c156ae3812a9508f71f07f87a07bcdee793a3086d24b7df0bda25657393855ea5d4647ee263ac35f506061e8a21b0328035a11f6d0823fe23499028ef190b0dd8eaa01ec022e8c389b998371a7535f3bfa73cdf250c4837cbbd3f15718ce242352547b4f96cbf4912292ba2ef3ac5c0291cadb2bf520489b3339db571de22196e4b2a6ca18c273786504d56c61cb14c0ca8cc60720c178b5e9f1d0a1efab21fa9b7deb55632174098f16d3fef5255dbc1a88b8f09342e0211dbe3f909c27843a3c5fb15603214be4cdd018f177dca100627f7ddf81856bb0454e6aced9f3a1ecbaa6195d85be59a9ad8f2c4d7945b367c325f1b262cc35677fbd514682cf8fe74feaddc315c496a42b5f164b752c3f49879738d951a54417791d0e7981b9acc8aa8ae57d35ae3448ce66d8ee3eef76034890011f87089ca9cce5fd1880a2653d2f681893c6ded8a4134ddc02a0d6aa0afc1482ae3f17a72bd0316e072927ca48d0dcdfeb02673cc90667b1efa958411533c7e0407c1a8dc905ab8c81327e5a576e2637a6ff989724727625694819ef5708832d462dba1b334af2d54dfaa8cd41ead14ccefad4d515fc9a808722772726673e9d31711ea5a8919d0ba09ac426cebbd06ed8150745a39619094dbf0610c0af7daf7bd8104e7d549c40f674e79f5ad3472ba126c62b00f71805ba62c13c8bc14002ce0d85b1c2f44ad89ab09bbf459340b2a991900c228b6b36fbdc17081fb0cc5902ff0903ded440278051df1eb84ada1d9beaaf8021c2e807fd09191d09d6e18f8c423b9118cd84da7036ce535d1f369e700afe9b5345d60ef9c3652d8efb95119dd42b5f47b17a6e501e420b6b619a4ca5578fa7292c4fc90e82e71643730153b2268057fa6b6cbefb27ff329e5b7ba6167b3f79ee2967843eac45a65db1702d18293f8acbbd74f516fa08f77e011a6f3f64a9f2a6dcce647c9149e4c7c5a8c39d837e4190e9fde1995556aa898ae28e340d75bfc84b5bcbff4ce6c6c88986fc53f85d9278dd7160173fd09d05735637c83e5b98b38239f8b2b189a859d7994e5c729f7c1502c7b9f55594bbc809aca565ef719f40d9c849cdb01e47c9de5c4145fc71b119d0cb0bd3235051447f72125c344afdd1befd419f5d02ef8137b8b9af11565fc5602db6e1f0baf5c7bff03f054aabd54ea7f9d243c5ea36267300f8f14c40560b10971c81c9535c6d79d95827627adf7aa6d7c5e37c4d8b93029a73ae5a9b9710362ac95ab82fbfb0de587e99506ad92651445afdea9df28b3e5c8b3d1f07d936c4168014d11182d5c5ca13f3e6f1d3ae199987a5fd9413e38293c8ae471bd5d2e83ad58da46b82b594a583d5f4c04747f89bdd9ae1967bde416b22fa4e9b3ec573c7ed0e7da74e24eec12dfbfc9f8204ff02dab8212f37a588a09c5572599ed3a65777e35b8edb832b1468392147a578af834eec7c8cbb230696ee1684951a20ddd568d491e6ed039a3d24565d32255722da08cae9442100b21eedea7c72b8526e0fe3b686ec5db2c85369e0654c5746dd75d819a32d46c717b2be4c8afc6ed989708492ef753fc97735ba9a814872e1764792e8a8d1731d39c2dc57306659a3cade5827b29b05c67d20265e4ddabd5a084e27c263d53996a25de4c0d4f17396bb3bc491cc4deb11c1dcdc962bba6b2f1cc3105389fea07e7ad767e81f4649951887e9a5e7f90f758dcf39202dee34f222a1395874baaf05b6f857aa564cbaa2b4a797058a2434d749e781ae39c879682d080699442404ffa51bd9472b876b4f89f419d4b1189d38bff7eff0ff74f06ba21ad4192d4046913beeb1fbb762d89f66912ca4431706461584dafb9c346d658ca9d4b5bb58af668a96912cb3efbb02d882f1489b7649a456f9e72c4605263a8c56b295403f46255c16bfdc7fe1516a1e977b3dae6ef54073cd18adbe1a4d38a1c34e44b1373f0e25b88bb71c425243ac821ab648fa15e28f4c1f00923e3808910c7db52aa21c3d8f36cf47a49d902d87bf20188d699ce986e1532f6caa301b908d8f8a7bf2746e22bade28d681b57bb62954d9a6d66c1a47d30eda52fec0f06cee6b65f3639c021ff17d83bbb50e7b2cebfbf188247b8d6e3591a8052f731bf70fa571938caf7323c52490a612ff4d8ebd2cd7aac709cac9b90fc048ff2574d9119a0768c4fc2fdc8896270cd557e89677a88874bff5eb36bfc4a6bbfebad12b443c1e3abee547b1388f1986caf9d12d79a8526d098d9e37a8829dbc35f4aa05a34b2267d32bd244e34f5985d4e8dc91f44a1e241bc26149b44fe124255a00fd5d83e7ba6991fbe761e3ad42d84b2b0e0aa7d03b9e3ac94b4a1ed8e931a9852db54d040a69fad8017d369b835a80a61874c2f4a17854e490e91734940be46da36fd8c345c420b49c452dee2bcb83b99c15106effbbcbeba3ed455f6159633bb35901fdab29e395dd242a4f30ac928bdec5162e00f93a0922464fbb5e791f06b944be6fc6b1bb2ddb42f666a988c62e47bb9161cf8eae7140006b505b01320c009f00a6d64b3574a231a12f0692944dfcc2b78200684a79ff05a8c41541c77a89dfc01d3323b5bcd38e6a1af366a17f88b249b6327f963f3f32e6b8d2002326e93402ec7661f922aa00ffae1517758e9e1f780c4b051bebda24e44ede86308ae7660d776e6abcfe500baff743fcb4c0a219f1c6feb0bfa780b25d7fe1a03dd7c4d2c06338eb04b55fec66c2b8943472182efde87a540e51c1e8997c90b9950d0cdb1a1333e7adb0fb50c58715f565f2f51e9d77223b14a471b4f2ec0868f4258cda69d1962ec9e1942f9461a1c3ad0fbdde0f5af7b11c62e1fc34cc7d78b533984c8a30c02d36b93ff19df458eea6a6b5d96d3bc9639b421f3e726310d9a456abc7361d6433fcc12c1e3931d2008ce8355568b78d42658d47b10bf41dc793013c5828aaf59c7a5a7b6c89648913bcf45685c14841bea123f265367f4a6682988f2e33ed42e1e2c9f453d38ccbd14db1d4061bbda3803cc2dbb9c148ad3a8c5e903826e0c13724e864605be124266ed7028fee82275455e3ae14b25bf60edde004de283c85e40860e00fdbe43adb716b416d252d6cb6793c6de27a12f8bd4e3a25534165bba626533511422f517986270146f93e2ef648f7654b31e9bc6006535078f657e0c436fc06555235b45384023034ba956fd0f8053ba2f87d935b48cab4fad219b4f2991dd01887b826fe2edda85b412bb92501c7a2472621f04d5c4a068eaca30ffa1837973d2cae2e9493407bcc3625d9301f90ae717d9a9b454c3031375303d160d832b171f04ca0b05361d6428639a42fa5aca0bb17e7ed982a664904e5880a0cdc8c66f8dbdff80094ca44209ff37be15332ca6fb42e9dfded5e40e4bce1f8e8f4eef48cd8d7db4188791157ba37491bb113ee1d247122fb90e8a6c2ad21b5ed012972183fa5c2978e56a25e946abc1c133793c6c8bdf46e026a9f5449ab9f65d9233d6d809f3a7e4bec59ad5f8c6ac781f088196020a582047d9d1ebe57a8ebe4a8f3154275e67130a87d524ff518906bc7be53d533d5e22b58e4f097e370648647f1a275b111c7cd60e9b2d35c6dc3445b0679852871bc0b2ba8c27e750366d60d1867de3c1766305158a405deee149e99ec8a19251722ba201ad59ddc549321b3c032d32f6e3854fa1e40924ac4edd3ba3ee63e6dc565e3ebbe50834656dae8d59e3ebf60c6844ed04fa640befb955efbbae95becb9ac6740918a4e042768b28f40f3a1963f1ae612b3a99c3a246e764c900070e69f7e42b4d14a02bfd3c3763c707771bd94efeff77e781afed05700f39eb8877a1c45200d74e63be75c9ed6179b6753849f322fe660ab01ed2bcc38b4dd0ea63dc9b6ccec14808e20c39faff660e40a84570469070d8b90e5abfecf92cda5713884b4613586a58ed5d910f15bd79a38101f575d7cb61a2e0499f990f42a6bb57e7e6001f2b42b188f029426897c5898d6a207e30c7291f09d6b5c5e4b484a419aac1db990da5efbf6932510a4ff4ecfdd88ab34ea54d57b0dad4ca85d56b8b0767ab6f309e4f05a473d5e0ba3d2c69e656be4339c46ff7c3c7b68928b2cc450afbe22ce456eec5950b903ccf628e7978a714cecd30cd7a0173447095100ce9e3cdb7b5b175a16bd7d9b0ca127be904d21a6f2d018f75773a6df796016e7985f5f45bf46290c63f0150bbce377fc6a888f7ab11f742e14d9a7d8bfd1a0775f85e1727c9060cb2d9d0ad620ab2d31b5d6817f423fde33dec7d73c74b39e0395553d7ff7fd1fd9aaad46d2bd2841aaf", @typed={0x8, 0x26, 0x0, 0x0, @ipv4=@initdev={0xac, 0x1e, 0x1, 0x0}}, @generic="cc0ffc5bd6a732cde51bafaffecba4c5b9003b783568484ae92dc893e68a", @typed={0xc, 0x7a, 0x0, 0x0, @u64=0x1}]}, @generic="70efcdef8c482a5cfa3f419eafcc8fb62339499ffdc79d24e4817ecccc85cc81a81b9122d57ef1011670fdc5eb5648f935165bae2fb007805ee7426e964cb477557adb970420caead3", @generic="8aaa404aa65fac993e3ee0c6520657967ec51825b7ec6d01dfd0e02878aee8e697aadda71c85efe55a70925d3949f95df5d22ebba5aa89e614857422be1f1b0fe7c1901108b4f12a418e5c50c589f541a5757c1694c6d4b2db2ac75ffc1f71128368e9b9aa2a134058542fa1d5fef6b87f4a98dade3b0c6fa22677", @nested={0xfc, 0x29, 0x0, 0x1, [@typed={0xc, 0x7b, 0x0, 0x0, @u64=0x1f}, @typed={0x8, 0x22, 0x0, 0x0, @uid=r12}, @generic="4e15036998068b505b9e1c4da99b7cdf9e552644f0e32e00dbbd1a373585f441e25911208221316858a760efec7e062d21b4ca56d46426c31b03f98a30d154b06e8b83f59122e61af92b2c400c263c439c5b54a4aa2e15a4ecec3ba49b01a0f0c1bc4f6ba0eecfaf3e5e34ac284f12a0491543daa971503f5653642d45fdf5a84c72f55301e390ce4e9d051e2cc250df004a9539364451b9c26f35b1dcbde93e4649a8232d99282da04d9447a88250a7f21d6bc819c2c9674d8b5153d0fc5cff497f96962c05b09346d95d06f66d0b386355bf366fd99c261c6cb00e020eccd206a4a441"]}, @typed={0x8, 0x4c, 0x0, 0x0, @ipv4=@loopback}]}, 0x25ac}, 0x1, 0x0, 0x0, 0x4000}, 0x4008000) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) syz_open_dev$sndpcmc(&(0x7f0000000300)='/dev/snd/pcmC#D#c\x00', 0x4, 0x1a1000) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000040)=0x1, 0x4) recvfrom(r0, 0x0, 0x0, 0x2, &(0x7f0000000140)=@ax25={{0x3, @default}, [@bcast, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x716000) 10:24:29 executing program 5: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x3f00) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:24:29 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0xfcffffff, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) 10:24:29 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040)='devlink\x00') sendmsg$DEVLINK_CMD_RELOAD(r3, &(0x7f0000000800)={0x0, 0x411ef, &(0x7f0000000380)={&(0x7f0000000000)={0x3c, r4, 0x536ae464467e3e0b, 0x0, 0x0, {0x24}, [{@nsim={{0x10, 0x1, 'netdevsim\x00'}, {0x10, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8}}]}, 0x3c}}, 0x0) sendmsg$DEVLINK_CMD_PORT_SET(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={0xa0, r4, 0x2, 0x70bd2d, 0x25dfdbfc, {}, [{{@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x6, 0x4, 0x3}}, {{@pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, {0x8, 0x3, 0x2}}, {0x6, 0x4, 0x6f3d}}, {{@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x6, 0x4, 0x1}}]}, 0xa0}}, 0x40001) r5 = socket$kcm(0x2, 0x2, 0x73) bind(r5, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) getpeername(r5, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) r6 = fcntl$dupfd(r1, 0x406, r5) bind$can_raw(r6, &(0x7f00000001c0), 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000040)=0x1, 0x4) recvfrom(r0, 0x0, 0x0, 0x2, &(0x7f0000000140)=@ax25={{0x3, @default}, [@bcast, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x716000) 10:24:29 executing program 3 (fault-call:23 fault-nth:0): gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2257.718700][T26779] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2257.807385][T26783] 8021q: adding VLAN 0 to HW filter on device bond183 [ 2257.959480][T26783] bond0: (slave bond183): Enslaving as an active interface with an up link [ 2257.975595][ T27] kauditd_printk_skb: 5 callbacks suppressed [ 2257.975613][ T27] audit: type=1800 audit(1579947870.185:923): pid=26722 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="sda1" ino=16710 res=0 [ 2258.202618][T26791] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2258.258893][T26790] FAULT_INJECTION: forcing a failure. [ 2258.258893][T26790] name failslab, interval 1, probability 0, space 0, times 0 [ 2258.271834][T26790] CPU: 0 PID: 26790 Comm: syz-executor.3 Not tainted 5.5.0-rc1-syzkaller #0 [ 2258.280518][T26790] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2258.290780][T26790] Call Trace: [ 2258.294085][T26790] dump_stack+0x11d/0x181 [ 2258.298549][T26790] should_fail.cold+0xa/0x1a [ 2258.303210][T26790] __should_failslab+0xee/0x130 [ 2258.308105][T26790] should_failslab+0x9/0x14 [ 2258.312635][T26790] kmem_cache_alloc+0x29/0x5d0 [ 2258.317488][T26790] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 2258.323402][T26790] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2258.329664][T26790] getname_flags+0x91/0x380 [ 2258.334631][T26790] getname+0x23/0x40 [ 2258.338545][T26790] do_sys_open+0x27f/0x4f0 [ 2258.343035][T26790] __x64_sys_open+0x55/0x70 [ 2258.347564][T26790] do_syscall_64+0xcc/0x3a0 [ 2258.352145][T26790] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2258.358044][T26790] RIP: 0033:0x45b349 [ 2258.361953][T26790] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2258.381792][T26790] RSP: 002b:00007f860e716c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 2258.390215][T26790] RAX: ffffffffffffffda RBX: 00007f860e7176d4 RCX: 000000000045b349 [ 2258.398330][T26790] RDX: 0000000000000000 RSI: 0000000000141042 RDI: 00000000200001c0 [ 2258.406427][T26790] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 2258.414411][T26790] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000000b [ 2258.422391][T26790] R13: 000000000000074d R14: 00000000005013bf R15: 0000000000000000 [ 2258.521979][ C1] net_ratelimit: 6 callbacks suppressed [ 2258.521989][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2258.533580][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2258.539407][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2258.545227][ C1] protocol 88fb is buggy, dev hsr_slave_1 10:24:30 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xff00) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:24:30 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x20000001, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_BT_FLUSHABLE(r3, 0x112, 0x8, &(0x7f0000000280)=0x5, 0x4) getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000001c0)={'nat\x00', 0x0, 0x3, 0xe, [], 0x5, &(0x7f00000000c0)=[{}, {}, {}, {}, {}], &(0x7f0000000000)=""/14}, &(0x7f0000000240)=0x78) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000040)=0x1, 0x4) recvfrom(r0, 0x0, 0x0, 0x2, &(0x7f0000000140)=@ax25={{0x3, @default}, [@bcast, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x716000) 10:24:31 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0xffffa888, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2259.409528][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2259.415362][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2259.485329][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2259.491139][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2259.496966][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2259.502736][ C0] protocol 88fb is buggy, dev hsr_slave_1 10:24:31 executing program 3 (fault-call:23 fault-nth:1): gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2259.639708][ T27] audit: type=1804 audit(1579947871.845:924): pid=26796 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/963/file0/file0" dev="loop5" ino=2988 res=1 10:24:32 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$kcm(0x2, 0x2, 0x73) bind(r2, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) getpeername(r2, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) connect$inet6(r3, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @empty, 0x9}, 0x1c) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f0000002580)={0x0, 0x0, 0x0}, 0x4000000) ioctl$sock_inet_tcp_SIOCOUTQ(r3, 0x5411, &(0x7f0000000000)) r4 = dup(r1) r5 = socket$kcm(0x2, 0x2, 0x73) bind(r5, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) getpeername(r5, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) connect$inet6(r6, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @empty, 0x9}, 0x1c) sendmsg$TEAM_CMD_PORT_LIST_GET(r6, &(0x7f0000002580)={0x0, 0x0, 0x0}, 0x4000000) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000013c0)={{{@in6=@dev, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@local}}, &(0x7f00000014c0)=0xe8) setsockopt$inet_pktinfo(r6, 0x0, 0x8, &(0x7f0000001500)={r7, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote}, 0xc) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000040)=0x1, 0x4) recvfrom(r0, 0x0, 0x0, 0x2, &(0x7f0000000140)=@ax25={{0x3, @default}, [@bcast, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x716000) [ 2259.935247][T26817] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2260.050414][T26815] 8021q: adding VLAN 0 to HW filter on device bond184 10:24:32 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) r1 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r2, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r3 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r3, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2260.127669][T26815] bond0: (slave bond184): Enslaving as an active interface with an up link [ 2260.428889][T26835] FAULT_INJECTION: forcing a failure. [ 2260.428889][T26835] name failslab, interval 1, probability 0, space 0, times 0 [ 2260.530575][T26835] CPU: 1 PID: 26835 Comm: syz-executor.3 Not tainted 5.5.0-rc1-syzkaller #0 [ 2260.539307][T26835] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2260.549375][T26835] Call Trace: [ 2260.552678][T26835] dump_stack+0x11d/0x181 [ 2260.557158][T26835] should_fail.cold+0xa/0x1a [ 2260.562109][T26835] __should_failslab+0xee/0x130 [ 2260.566975][T26835] should_failslab+0x9/0x14 [ 2260.571490][T26835] kmem_cache_alloc+0x29/0x5d0 [ 2260.576314][T26835] ? apic_timer_interrupt+0xa/0x20 [ 2260.581451][T26835] __alloc_file+0x4d/0x210 [ 2260.585961][T26835] alloc_empty_file+0x8f/0x180 [ 2260.590734][T26835] path_openat+0x74/0x3580 [ 2260.595237][T26835] ? apic_timer_interrupt+0xa/0x20 [ 2260.600391][T26835] ? apic_timer_interrupt+0xa/0x20 [ 2260.605603][T26835] ? __read_once_size+0x41/0xe0 [ 2260.610470][T26835] ? __tsan_read4+0x31/0x100 [ 2260.615077][T26835] do_filp_open+0x11e/0x1b0 [ 2260.619677][T26835] ? __check_object_size+0x5f/0x346 [ 2260.624896][T26835] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 2260.630865][T26835] ? __alloc_fd+0x2ef/0x3b0 [ 2260.635379][T26835] do_sys_open+0x3b3/0x4f0 [ 2260.639809][T26835] __x64_sys_open+0x55/0x70 [ 2260.644386][T26835] do_syscall_64+0xcc/0x3a0 [ 2260.648944][T26835] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2260.654834][T26835] RIP: 0033:0x45b349 [ 2260.658729][T26835] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2260.678505][T26835] RSP: 002b:00007f860e6f5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 2260.686921][T26835] RAX: ffffffffffffffda RBX: 00007f860e6f66d4 RCX: 000000000045b349 [ 2260.694997][T26835] RDX: 0000000000000000 RSI: 0000000000141042 RDI: 00000000200001c0 [ 2260.702973][T26835] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 2260.710952][T26835] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000000b [ 2260.718930][T26835] R13: 000000000000074d R14: 00000000005013bf R15: 0000000000000001 10:24:32 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) r3 = creat(&(0x7f0000000280)='./file0\x00', 0x0) close(r3) ioctl$RFKILL_IOCTL_NOINPUT(r3, 0x5201) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000040)=0x1, 0x4) recvfrom(r0, 0x0, 0xfffffffffffffe24, 0x2, &(0x7f0000000140)=@ax25={{0x3, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}}, [@bcast, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x80) 10:24:32 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0xffffff7f, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2261.138677][T26843] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2261.335710][T26847] 8021q: adding VLAN 0 to HW filter on device bond185 [ 2261.395470][T26847] bond0: (slave bond185): Enslaving as an active interface with an up link [ 2261.622667][T26843] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:24:34 executing program 5: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xff00) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:24:34 executing program 3 (fault-call:23 fault-nth:2): gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:24:34 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xf0ffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:24:34 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0xffffff9e, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2262.105869][T26862] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2262.182355][T26866] 8021q: adding VLAN 0 to HW filter on device bond186 [ 2262.191795][T26866] bond0: (slave bond186): Enslaving as an active interface with an up link [ 2262.342481][T26862] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:24:35 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0xffffffc3, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2263.183144][ T27] audit: type=1804 audit(1579947875.385:925): pid=26864 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1252/file0/file0" dev="loop0" ino=2997 res=1 [ 2263.542499][T26887] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2263.562029][ C0] net_ratelimit: 10 callbacks suppressed [ 2263.562039][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2263.573503][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2263.641955][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2263.647854][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2263.653645][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2263.659397][ C0] protocol 88fb is buggy, dev hsr_slave_1 10:24:35 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x1000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2263.746316][ T27] audit: type=1800 audit(1579947875.385:926): pid=26864 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="loop0" ino=2997 res=0 [ 2263.910928][ T27] audit: type=1804 audit(1579947875.395:927): pid=26878 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1252/file0/file0" dev="loop0" ino=2997 res=1 [ 2263.937731][T26893] 8021q: adding VLAN 0 to HW filter on device bond187 [ 2263.940443][ T27] audit: type=1800 audit(1579947875.815:928): pid=26874 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.5" name="bus" dev="loop5" ino=3001 res=0 [ 2263.991760][ T27] audit: type=1800 audit(1579947875.825:929): pid=26888 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.5" name="bus" dev="loop5" ino=3001 res=0 [ 2264.019839][T26893] bond0: (slave bond187): Enslaving as an active interface with an up link 10:24:36 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) r1 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r2, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r3 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r3, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2264.049672][ T27] audit: type=1804 audit(1579947876.075:930): pid=26875 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/964/file0/file0" dev="loop5" ino=3000 res=1 10:24:36 executing program 5: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x1000000) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:24:36 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0xfffffff0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2264.430853][T26915] FAULT_INJECTION: forcing a failure. [ 2264.430853][T26915] name failslab, interval 1, probability 0, space 0, times 0 [ 2264.595793][T26922] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2264.666372][T26915] CPU: 0 PID: 26915 Comm: syz-executor.3 Not tainted 5.5.0-rc1-syzkaller #0 [ 2264.675227][T26915] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2264.685345][T26915] Call Trace: [ 2264.688663][T26915] dump_stack+0x11d/0x181 [ 2264.693032][T26915] should_fail.cold+0xa/0x1a [ 2264.697634][T26915] __should_failslab+0xee/0x130 [ 2264.702504][T26915] should_failslab+0x9/0x14 [ 2264.707129][T26915] kmem_cache_alloc+0x29/0x5d0 [ 2264.711905][T26915] ? kmem_cache_alloc+0x1f3/0x5d0 [ 2264.716954][T26915] security_file_alloc+0x48/0x110 [ 2264.722006][T26915] __alloc_file+0xa3/0x210 [ 2264.726465][T26915] alloc_empty_file+0x8f/0x180 [ 2264.731249][T26915] path_openat+0x74/0x3580 [ 2264.735730][T26915] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2264.741993][T26915] ? aa_file_perm+0x3a1/0xc20 [ 2264.746687][T26915] ? apic_timer_interrupt+0xa/0x20 [ 2264.751849][T26915] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 2264.757798][T26915] ? __read_once_size+0x41/0xe0 [ 2264.762697][T26915] do_filp_open+0x11e/0x1b0 [ 2264.767216][T26915] ? __check_object_size+0x5f/0x346 [ 2264.772481][T26915] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 2264.778392][T26915] ? __alloc_fd+0x2ef/0x3b0 [ 2264.783027][T26915] do_sys_open+0x3b3/0x4f0 [ 2264.787454][T26915] __x64_sys_open+0x55/0x70 [ 2264.791974][T26915] do_syscall_64+0xcc/0x3a0 [ 2264.796492][T26915] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2264.803323][T26915] RIP: 0033:0x45b349 [ 2264.807294][T26915] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2264.827050][T26915] RSP: 002b:00007f860e6f5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 2264.835645][T26915] RAX: ffffffffffffffda RBX: 00007f860e6f66d4 RCX: 000000000045b349 [ 2264.841955][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2264.843627][T26915] RDX: 0000000000000000 RSI: 0000000000141042 RDI: 00000000200001c0 [ 2264.843647][T26915] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 2264.849497][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2264.857432][T26915] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000000b [ 2264.857443][T26915] R13: 000000000000074d R14: 00000000005013bf R15: 0000000000000002 [ 2264.887490][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2264.893272][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2265.316138][T26925] 8021q: adding VLAN 0 to HW filter on device bond188 [ 2265.325789][ T27] audit: type=1804 audit(1579947877.535:931): pid=26913 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1253/file0" dev="sda1" ino=16533 res=1 [ 2265.449261][T26925] bond0: (slave bond188): Enslaving as an active interface with an up link 10:24:37 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) r1 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r2, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r3 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r3, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2265.664182][T26930] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:24:38 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:24:38 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x2000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:24:38 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0xfffffffc, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2266.007217][ T27] audit: type=1804 audit(1579947878.215:932): pid=26931 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/965/file0/file0" dev="loop5" ino=3006 res=1 [ 2266.037060][ T27] audit: type=1800 audit(1579947878.215:933): pid=26931 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.5" name="file0" dev="loop5" ino=3006 res=0 [ 2266.078543][ T27] audit: type=1804 audit(1579947878.285:934): pid=26950 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/965/file0/file0" dev="loop5" ino=3006 res=1 10:24:38 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2266.146215][T26962] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2266.222795][T26964] 8021q: adding VLAN 0 to HW filter on device bond189 [ 2266.284526][T26964] bond0: (slave bond189): Enslaving as an active interface with an up link [ 2266.506360][T26964] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:24:38 executing program 5: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x2000000) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:24:39 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x3000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:24:39 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:24:39 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x2, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2267.896851][T26991] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2268.019063][T26995] 8021q: adding VLAN 0 to HW filter on device bond190 [ 2268.129760][T26995] bond0: (slave bond190): Enslaving as an active interface with an up link 10:24:40 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x4000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2268.433527][T26995] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:24:40 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x3, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2268.946592][T27010] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2269.001992][ C1] net_ratelimit: 10 callbacks suppressed [ 2269.002001][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2269.013475][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2269.019268][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2269.025042][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2269.096454][T27011] 8021q: adding VLAN 0 to HW filter on device bond191 [ 2269.146515][T27011] bond0: (slave bond191): Enslaving as an active interface with an up link [ 2269.292462][T27010] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:24:41 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x4, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2269.547498][ T27] kauditd_printk_skb: 3 callbacks suppressed [ 2269.547524][ T27] audit: type=1804 audit(1579947881.755:938): pid=27016 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1256/file0/file0" dev="loop0" ino=3011 res=1 [ 2269.668628][T27032] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2269.801951][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2269.807808][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2270.566101][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2270.571947][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2270.577955][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2270.583713][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2270.757134][ T27] audit: type=1800 audit(1579947881.755:939): pid=27016 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="loop0" ino=3011 res=0 [ 2270.862921][T27035] 8021q: adding VLAN 0 to HW filter on device bond192 10:24:43 executing program 5: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x3000000) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2271.086109][T27035] bond0: (slave bond192): Enslaving as an active interface with an up link [ 2271.094873][ T27] audit: type=1804 audit(1579947881.755:940): pid=27019 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1256/file0/file0" dev="loop0" ino=3011 res=1 10:24:43 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x2) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:24:43 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:24:43 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x5000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2271.200914][ T27] audit: type=1800 audit(1579947881.815:941): pid=26980 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.5" name="file0" dev="sda1" ino=16913 res=0 [ 2271.202000][T27040] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:24:43 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x5, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2271.609903][T27055] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2271.723467][T27058] 8021q: adding VLAN 0 to HW filter on device bond193 [ 2271.821606][T27058] bond0: (slave bond193): Enslaving as an active interface with an up link [ 2272.113467][T27055] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2272.188050][ T27] audit: type=1804 audit(1579947884.395:942): pid=27066 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/967/file0/file0" dev="sda1" ino=16844 res=1 10:24:44 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x6, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) 10:24:44 executing program 5: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x4000000) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2272.481672][T27073] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2272.545237][T27075] 8021q: adding VLAN 0 to HW filter on device bond194 [ 2272.567949][T27075] bond0: (slave bond194): Enslaving as an active interface with an up link [ 2272.600870][ T27] audit: type=1804 audit(1579947884.805:943): pid=27063 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1257/file0/file0" dev="loop0" ino=3017 res=1 [ 2272.672776][T27073] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2272.719120][ T27] audit: type=1800 audit(1579947884.835:944): pid=27063 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="loop0" ino=3017 res=0 [ 2273.044230][ T27] audit: type=1804 audit(1579947884.835:945): pid=27068 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1257/file0/file0" dev="loop0" ino=3017 res=1 10:24:45 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x7, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) 10:24:45 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x6000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2274.252980][T27094] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2274.599035][ T27] audit: type=1804 audit(1579947886.805:946): pid=27078 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/968/file0/file0" dev="loop5" ino=3021 res=1 [ 2274.692003][ C0] net_ratelimit: 12 callbacks suppressed [ 2274.692015][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2274.703464][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2274.709277][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2274.715074][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2274.885940][T27097] 8021q: adding VLAN 0 to HW filter on device bond195 [ 2274.895572][T27097] bond0: (slave bond195): Enslaving as an active interface with an up link 10:24:47 executing program 5: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x5000000) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2275.242055][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2275.247839][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2275.253646][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2275.259390][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2275.687897][T27094] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2275.688630][ T27] audit: type=1804 audit(1579947887.765:947): pid=27088 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/989/file0/file0" dev="loop3" ino=3024 res=1 [ 2275.940474][T27088] FAT-fs (loop3): error, fat_free_clusters: deleting FAT entry beyond EOF [ 2275.949461][T27088] FAT-fs (loop3): Filesystem has been set read-only 10:24:48 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x3) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2276.042010][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2276.047914][ C0] protocol 88fb is buggy, dev hsr_slave_1 10:24:48 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x0, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2276.264181][ T27] audit: type=1804 audit(1579947888.475:948): pid=27120 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1258/file0/file0" dev="sda1" ino=16580 res=1 10:24:49 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x8, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) 10:24:49 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x7000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2277.188993][T27130] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2277.302712][ T27] audit: type=1804 audit(1579947889.515:949): pid=27125 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/969/file0/file0" dev="loop5" ino=3027 res=1 [ 2277.496363][ T27] audit: type=1800 audit(1579947889.515:950): pid=27125 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.5" name="file0" dev="loop5" ino=3027 res=0 [ 2277.544772][T27134] 8021q: adding VLAN 0 to HW filter on device bond196 [ 2277.736708][T27134] bond0: (slave bond196): Enslaving as an active interface with an up link [ 2277.989598][T27134] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2278.051967][ T27] audit: type=1804 audit(1579947889.545:951): pid=27132 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/969/file0/file0" dev="loop5" ino=3027 res=1 [ 2278.326570][ T27] audit: type=1804 audit(1579947890.215:952): pid=27150 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1259/file0/file0" dev="sda1" ino=16860 res=1 10:24:50 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x8000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:24:50 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x9, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) 10:24:50 executing program 5: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x6000000) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2278.680237][T27161] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2278.702662][T27161] 8021q: adding VLAN 0 to HW filter on device bond197 [ 2278.712796][T27161] bond0: (slave bond197): Enslaving as an active interface with an up link [ 2278.758210][ T27] audit: type=1804 audit(1579947890.865:953): pid=27156 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/990/file0/file0" dev="loop3" ino=3030 res=1 [ 2278.862938][T27168] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2278.908582][ T27] audit: type=1800 audit(1579947890.865:954): pid=27156 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.3" name="file0" dev="loop3" ino=3030 res=0 [ 2279.068908][ T27] audit: type=1804 audit(1579947890.865:955): pid=27154 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/990/file0/file0" dev="loop3" ino=3030 res=1 10:24:51 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0xa, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2279.565981][T27186] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2279.701407][T27188] 8021q: adding VLAN 0 to HW filter on device bond198 [ 2279.768684][T27188] bond0: (slave bond198): Enslaving as an active interface with an up link [ 2279.982437][T27188] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:24:52 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xc000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2280.171078][ T27] kauditd_printk_skb: 2 callbacks suppressed [ 2280.171098][ T27] audit: type=1804 audit(1579947892.375:958): pid=27182 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/970/file0/file0" dev="loop5" ino=3033 res=1 [ 2280.332626][ T27] audit: type=1800 audit(1579947892.375:959): pid=27182 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.5" name="file0" dev="loop5" ino=3033 res=0 [ 2280.353301][ T27] audit: type=1804 audit(1579947892.435:960): pid=27192 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/970/file0/file0" dev="loop5" ino=3033 res=1 10:24:52 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x4) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:24:52 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0xb, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2280.921956][ C0] net_ratelimit: 10 callbacks suppressed [ 2280.921965][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2280.933406][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2280.939170][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2280.946044][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2280.988760][T27219] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2281.472292][T27223] 8021q: adding VLAN 0 to HW filter on device bond199 [ 2281.482023][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2281.487805][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2281.493604][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2281.499358][ C1] protocol 88fb is buggy, dev hsr_slave_1 10:24:53 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x0, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2281.590827][T27223] bond0: (slave bond199): Enslaving as an active interface with an up link [ 2281.716268][ T27] audit: type=1804 audit(1579947893.925:961): pid=27208 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1261/file0/file0" dev="loop0" ino=3035 res=1 [ 2281.833063][T27219] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2282.019845][ T27] audit: type=1800 audit(1579947893.965:962): pid=27208 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="loop0" ino=3035 res=0 10:24:54 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x5) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2282.321957][ T27] audit: type=1804 audit(1579947893.965:963): pid=27228 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1261/file0/file0" dev="loop0" ino=3035 res=1 10:24:54 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xf000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2282.405840][ T27] audit: type=1804 audit(1579947894.305:964): pid=27229 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/991/file0/file0" dev="loop3" ino=3041 res=1 10:24:54 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0xc, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2282.516776][ T27] audit: type=1804 audit(1579947894.305:965): pid=27227 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/991/file0/file0" dev="loop3" ino=3041 res=1 [ 2282.713529][T27244] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:24:55 executing program 5: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x7000000) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2282.775111][T27248] 8021q: adding VLAN 0 to HW filter on device bond200 [ 2282.800973][T27248] bond0: (slave bond200): Enslaving as an active interface with an up link [ 2282.835169][ T27] audit: type=1804 audit(1579947895.045:966): pid=27252 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/992/file0" dev="sda1" ino=16993 res=1 [ 2282.912771][T27244] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2283.011952][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2283.017797][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2283.286921][ T27] audit: type=1804 audit(1579947895.495:967): pid=27266 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1262/file0/file0" dev="sda1" ino=16945 res=1 10:24:56 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0xd, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) 10:24:56 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x13000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2284.091503][T27280] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2284.308916][T27282] 8021q: adding VLAN 0 to HW filter on device bond201 [ 2284.437941][T27282] bond0: (slave bond201): Enslaving as an active interface with an up link [ 2284.552508][T27280] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:24:57 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0xe, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2284.874162][T27305] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2284.940229][T27305] 8021q: adding VLAN 0 to HW filter on device bond202 [ 2284.976354][T27305] bond0: (slave bond202): Enslaving as an active interface with an up link [ 2285.086020][T27309] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:24:57 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0xf, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2285.268643][ T27] kauditd_printk_skb: 3 callbacks suppressed [ 2285.268667][ T27] audit: type=1804 audit(1579947897.465:971): pid=27308 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1263/file0/file0" dev="loop0" ino=3047 res=1 [ 2285.416214][ T27] audit: type=1800 audit(1579947897.465:972): pid=27308 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="loop0" ino=3047 res=0 10:24:57 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x0, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:24:57 executing program 5: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x8000000) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2285.498333][T27316] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2285.516399][ T27] audit: type=1804 audit(1579947897.475:973): pid=27311 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1263/file0/file0" dev="loop0" ino=3047 res=1 [ 2285.591861][ T27] audit: type=1800 audit(1579947897.685:974): pid=27239 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.3" name="file0" dev="sda1" ino=16993 res=0 [ 2285.620903][T27318] 8021q: adding VLAN 0 to HW filter on device bond203 10:24:57 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x6) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:24:57 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x18000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2285.793422][T27318] bond0: (slave bond203): Enslaving as an active interface with an up link [ 2286.192480][T27316] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2286.451939][ C0] net_ratelimit: 16 callbacks suppressed [ 2286.451949][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2286.463540][ C0] protocol 88fb is buggy, dev hsr_slave_1 10:24:59 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x10, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2286.872026][ T27] audit: type=1804 audit(1579947899.075:975): pid=27334 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/972/file0/file0" dev="loop5" ino=3054 res=1 10:24:59 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x0, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2287.090626][ T27] audit: type=1800 audit(1579947899.075:976): pid=27334 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.5" name="file0" dev="loop5" ino=3054 res=0 [ 2287.115400][T27353] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2287.167344][ T27] audit: type=1804 audit(1579947899.105:977): pid=27338 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/972/file0/file0" dev="loop5" ino=3054 res=1 [ 2287.195719][T27356] 8021q: adding VLAN 0 to HW filter on device bond204 [ 2287.328509][T27356] bond0: (slave bond204): Enslaving as an active interface with an up link 10:24:59 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x20000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2287.403969][ T27] audit: type=1804 audit(1579947899.495:978): pid=27345 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1264/file0/file0" dev="loop0" ino=3055 res=1 [ 2287.468247][ T27] audit: type=1800 audit(1579947899.495:979): pid=27345 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="loop0" ino=3055 res=0 [ 2287.494641][ T27] audit: type=1804 audit(1579947899.495:980): pid=27346 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1264/file0/file0" dev="loop0" ino=3055 res=1 [ 2287.545828][T27353] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2287.722010][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2287.727821][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2287.733643][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2287.739400][ C1] protocol 88fb is buggy, dev hsr_slave_1 10:25:00 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x11, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2288.404994][T27390] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2288.531979][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2288.537790][ C0] protocol 88fb is buggy, dev hsr_slave_1 10:25:00 executing program 5: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xc000000) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:25:00 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x0, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:25:00 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x7) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:25:00 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x3f000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2288.801975][T27393] 8021q: adding VLAN 0 to HW filter on device bond205 [ 2288.811944][T27393] bond0: (slave bond205): Enslaving as an active interface with an up link [ 2288.912442][T27393] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:25:01 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x12, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2289.241977][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2289.247790][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2290.613570][T27430] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2291.044999][ T27] kauditd_printk_skb: 3 callbacks suppressed [ 2291.045020][ T27] audit: type=1804 audit(1579947903.235:984): pid=27423 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/994/file0/file0" dev="loop3" ino=3071 res=1 10:25:03 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x8) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2291.396995][T27436] 8021q: adding VLAN 0 to HW filter on device bond206 [ 2291.435622][T27436] bond0: (slave bond206): Enslaving as an active interface with an up link 10:25:03 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x0, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2291.457475][ T27] audit: type=1804 audit(1579947903.325:985): pid=27403 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/973/file0/file0" dev="loop5" ino=3069 res=1 [ 2291.561424][ T27] audit: type=1804 audit(1579947903.765:986): pid=27432 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1266/file0/file0" dev="sda1" ino=17554 res=1 10:25:03 executing program 5: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xf000000) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2291.643099][T27436] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:25:04 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xe5ffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:25:04 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x13, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2291.900124][ T27] audit: type=1804 audit(1579947904.105:987): pid=27443 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/995/file0/file0" dev="sda1" ino=17409 res=1 10:25:04 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xb) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:25:04 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r2, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r3 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r3, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2292.349133][T27469] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2292.536248][T27473] 8021q: adding VLAN 0 to HW filter on device bond207 [ 2292.681985][ C0] net_ratelimit: 12 callbacks suppressed [ 2292.682001][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2292.693721][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2292.777734][T27473] bond0: (slave bond207): Enslaving as an active interface with an up link [ 2293.401982][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2293.407790][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2293.413589][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2293.419325][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2293.913344][ T27] audit: type=1804 audit(1579947905.835:988): pid=27472 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/974/file0/file0" dev="loop5" ino=3076 res=1 [ 2293.954061][ T27] audit: type=1804 audit(1579947906.145:989): pid=27483 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/974/file0/file0" dev="loop5" ino=3076 res=1 [ 2293.961954][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2293.984631][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2293.990416][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2293.996314][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2294.052997][T27469] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2294.629684][ T27] audit: type=1804 audit(1579947906.495:990): pid=27487 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1267/file0/file0" dev="loop0" ino=3075 res=1 10:25:07 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r2, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r3 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r3, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:25:07 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x14, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) 10:25:07 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xc) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2295.030837][ T27] audit: type=1804 audit(1579947906.495:991): pid=27489 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1267/file0/file0" dev="loop0" ino=3075 res=1 [ 2295.056950][ T27] audit: type=1804 audit(1579947906.805:992): pid=27502 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/996/file0/file0" dev="loop3" ino=3080 res=1 [ 2295.082557][ T27] audit: type=1804 audit(1579947906.955:993): pid=27485 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/996/file0/file0" dev="loop3" ino=3080 res=1 10:25:07 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xf6ffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2295.175688][T27508] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2295.304829][T27510] 8021q: adding VLAN 0 to HW filter on device bond208 [ 2295.402558][T27510] bond0: (slave bond208): Enslaving as an active interface with an up link [ 2295.543033][T27510] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:25:09 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r2, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r3 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r3, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:25:09 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) modify_ldt$write(0x1, &(0x7f00000001c0)={0xfffffffd, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3, 0x1, 0x0, 0x0, 0x1}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000040)=0x1, 0x4) recvfrom(r0, 0x0, 0x0, 0x2, &(0x7f0000000140)=@ax25={{0x3, @default}, [@bcast, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x716000) r3 = creat(&(0x7f0000000280)='./file0\x00', 0x0) syz_open_dev$vivid(&(0x7f0000000200)='/dev/video#\x00', 0x2, 0x2) r4 = socket$kcm(0x2, 0x2, 0x73) bind(r4, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) getpeername(r4, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) r5 = socket$kcm(0x2, 0x2, 0x73) bind(r5, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) getpeername(r5, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) close(r5) pipe2$9p(&(0x7f0000000000), 0x800) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r3, 0xc00c642e, &(0x7f00000000c0)={0x0, 0x80000}) ioctl$DRM_IOCTL_GEM_CLOSE(0xffffffffffffffff, 0x40086409, &(0x7f0000000100)={r6}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000300)={[0x8001, 0x4, 0x7ff, 0x7f, 0x1ff, 0x2, 0x5b0, 0x6, 0x1, 0x62, 0x40, 0x9, 0x8, 0x1f, 0xce, 0x6], 0x6000, 0x80040}) 10:25:09 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x15, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) 10:25:09 executing program 5: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x13000000) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2297.077212][T27539] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:25:09 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xf) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2297.118955][T27539] 8021q: adding VLAN 0 to HW filter on device bond209 [ 2297.128660][T27539] bond0: (slave bond209): Enslaving as an active interface with an up link [ 2297.142527][ T27] audit: type=1804 audit(1579947909.355:994): pid=27541 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1268/file0/file0" dev="sda1" ino=16877 res=1 10:25:09 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$can_bcm(0x1d, 0x2, 0x2) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000040)=0x1, 0x4) recvfrom(r0, 0x0, 0x0, 0x2, &(0x7f0000000140)=@ax25={{0x3, @default}, [@bcast, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x716000) [ 2297.282877][T27549] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:25:09 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xfeffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:25:10 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000040)=0x1, 0x4) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x69a) r4 = socket$netlink(0x10, 0x3, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000002a00)=0x14) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x24000000, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa}]}, 0x28}}, 0x0) recvfrom(r0, 0x0, 0xffffffffffffff0c, 0x2, &(0x7f0000000140)=@generic={0x1f, "c0c3898147ecb6185f3053d8ce6fb4f45648a780f831c358e972beddac99a962c06c9d70892afc0ee259da3f35e0076b50c704addc3d1c53142f059ae965e6ba8c8a4a14739127bf455fb3032f9a5f2607aee46290951a9a1e3aa2f3d8fa59fa382a15b9be44453d3d4a806d512745b0270045bac534a516aebc272b7f3d"}, 0x80) 10:25:10 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x16, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2298.453654][ T27] audit: type=1804 audit(1579947910.665:995): pid=27559 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/975/file0/file0" dev="loop5" ino=3088 res=1 [ 2298.484314][ T27] audit: type=1800 audit(1579947910.665:996): pid=27559 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.5" name="file0" dev="loop5" ino=3088 res=0 [ 2298.504173][ T27] audit: type=1804 audit(1579947910.665:997): pid=27563 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/975/file0/file0" dev="loop5" ino=3088 res=1 10:25:10 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) write(r0, &(0x7f0000000300)="66567c7354dcfdc1e3ab8a572f2ae3b93694bd9bd848268eab36f54b08fd22d2dd7ba21ee4c7734114736e9616f5b7e26f59ef5dd0123987df1832cd602b3a954bd583b91b2f2107a9615cc4fcaeadfd9a49f3a6712d001b6ba21841fac129ac3b275144cc620feb19fc0e2af56a1249de509848f374f22bb36ae2cf43ab8e85080d441a9ef260a84fd4721b42da7e1ba8e48edbf0f367dfaf1884130df9365ff3d45a0cd025ee038edc8c77312232e674b88737ec1547206a66c2dff91d414c08ba37f7bee0562e294d87fdebd4560c20ebbec0ffe1c468e49d8ff32a3760dec837d848707f11371254824202a6dac839ff46e91827aedafc132331a480c1bee9a009832d74ff4af3bd1790e671307fede24cae80bb9bb9b0fd995ab7df3234c12f5e50220b807be69667c51b910aa6e46c07707f12b027dbc713f6021f92d146d6f210c79a5c073f7b655fea9a87ba74e441afd9326f5931b9973adf3278148dfe7f5a40136fb1302d983c26003282eb936376a926b13af639e2a37371c53e3d90598adcc8b1826210aef338c39d48a84aeb52284924bbcf874208822e712189992a90d38ec206209040d0421856d2eb337008678c1baeff02cb7c954b6a6185b7cf48fb75968f0d207e21104cf510bbbdaf8d4065614e5feca5706fa9b202a5c94e7e2c9c514d92e0ac714c047795bfd0a2280f742ded742ea897710841c42e20b9d374623b216b24d368905883f15849c7113112d78fdf0e5736cb8965087a47dc85d8967559fdf63ad6a4374d845c06df865168c645b08cac158242bd8ae4681f100434436224d11d89a604304cf5325cca3d77a24ea9c424731e5c2cee11f157958bd7f35205bb10c764c3ecaea84a9a58a267a21be82678a03948d30ffe8db1473d1d68c6ad64d0f9982a5435982ded2a9c154f909a94de0e1e7359e81d2c0407814950cd1d2c4c3fb62f2b0b6b7d409cbdd4a92da938d13a916cc591fa3d773d6a777734ab0d2cc1e7a79448b11dffc3bceea149f9eff0c1cd9ed1fd1dffd74d7fa00eb022d207e74beec55be634a53e72937c016617f3b96b83646b6a1add734dfe77bbc901a6d9baa4eeb57db557a5e8bc83a5882e03cc86d2a48cab904086f1874000dc670b420a219585f43807db669dfe59f78de9640e041615bb344f4f0662a0d89a33ceafbc5c0bf6892a523837b20f40764702c10968c319edfeb58a3f3cc1950bc1550ae54edc19d05e9fd8512790a4509f15c7a796f8adde079bbd6323e389b14feb933143efb87c05fd315aed44448dc15bd3182afc9a0b8b3eb4c5f81d8f0c00f4c8a8a62ecdcd5edcdd39f1a28186b4662b722f44b80aebd880b02d85da5b4175f83bc4eeb0245db321631bb16d6e8eb1a032ade5d2d80ba7dc8c6d70035aa8e229856be67a480951ff97a35bdd3765db8916bc104ff511c478cc359a9c91a6e736d2c156509eda2244ff69ac77be947d3b252405746d4dfd531b7e4c90c6064f13187be35f4a5b1d80ec52d6a0ec82d77aecbc233a4f42b73478b8ea9139a3ff3669859ad5e65e5d5ec43350140642ca40b8fd21391642fdc79b73d47b6449b0921a8d591c62b40fe69c16cba1a462f720934a565661ade3786fc6808e9a8a75bafff41a54b4be8dec25296993155e656ed6eeced3209c1601659e506815aa4a01d84877f1cc68557b2b6747c65330731325d4943fbf25f468b42d44a83d977ccaef5edeec02a4437be752486d00d3e2ae410fd4ec3ed5a5f13ecbe15fd13f8749cb87e27effc63543f1dcfd0b9838b6019dde5404a64c10d349e771780983a592b941c87bcd35ae814c766343d563e179a39753508d16188dbb769e5884eb5665e2ba6cb7916d10ba41bcc8467fb6c81cb2ea79005f21a89d21fa03f973f46a2369b2170a6ef48129c8f4b951a82d5c6ab9cef004efc3d1aa5d3cef1915ac1c84e4a7b39eef6ee8e5831e185ca967153665be1905aca33b016edc17a809afa5014129d04a8f68894a156e20771b84ef84bf150ad588030e934fc50203c6e40e21cbe2e558fd72d44db475dec6af176c536a9b6264ef81f295b8edfd5287a83b586201ee649e5efe458f45d19447525f2461e70bbcf39e61a79ecbdcfabdec6713f230c751f23c06ffdf830f6f202d139f74c721ee093e7afb3c0f6b0a0b8d015fa7cbac2162822a49c4ec69f72d70af17c1fdfad367a5b65fafd250be844a5b1c3d914877ae41377ba86de30de7358b8912c88c45c238499c27b1c022ee62e04d889964c109b1213f417cd83a5e4e7e80df79010d1c336d4e5f62904bf88f642e2b0f1e8fdf1208d0140ab3adae93e841a8ea1b20ecedc10364cfaede62f97b2db1481e6360ca242754447c032ae02a91be6563208d469d010200ff5a1a1abb590a59ebf034e562d3c79fda08469125c61fec1cfb9bfb3970c188f0420f5faa86e0c3b8c519ff688eab848fa1b57ec8cfa3b9584f1181d66d0c0fd36c1fbc0d5e187b3bbf7b808b87d1075ef158225a3e02c104e7ed083d6c9d2feb241a6a2febe8ebb8ee565fb9a66284d5be3a7fa026343b0b6b4756eadf770994a68faa3a9e759feafd77ab219eb1f740509267f99c2c117e874d533276478accb54d6e7f5710f4468c0bf87c3b7825bc585ba5647d2bdc9e0b0e19846b27b2f5e2be04e037c2a8f5cf42cbb5bac4c2a566aed90807c67e60aca6f79fc347b362389804f8cafb15a1ac8dfca802bf2c162e952b162e172b497e8509674521573deff894049344d670d2150e7065f6bc51a78877857427fb5edbb40590bf0fb6b9f0b562150a6ed28b0c6983e1bd8ed9e499aa24950f45fac964695400d66ac22c98505b8009f87304e8b89bccebdb2d87eff00e41cc742251c3c38914da4dd30b25d666442520e7190259c256f1e17bf69b3c86be99874b50a87048f472945fd75d6776d8022823a0a9c9459c7a24489ddbf9eece9b85805cdd9bd952bf698ef1fd3df97bebcdf36270c3545211f957faede2600ef31f32e350ca86f3b94ae42fc8e65c050c48d8fe018d3863495790aa23526e1ba235bc7b5d75f92a648d15812ab00af646990ff60eedde7348312bc0496d248d0b93885b64e5d799d0b3804f049176789ec87ced522fa749a9c2fa929c3e7615e40d46e38c05825dcfc887084937eca6b184468a3dedbcd6a5c9c26467849ea4bef489f277f92a86458d3db8479226524758635d292f8d7b541be7c657797aed3f6f5c93912e559ccfebda87a20aab674b255f1286a9265ddc7a28dc51b7fb2d63113de3b4fd9332177ad1be05fae60d9f5d3f1069a7d8d6a0f623008ddc2f467bbb8172b22ba0b2a88af8b5bc98064ce617c040d75e266024c7c87f4a2097377dacd1da507900c0f040e57c1457114cf7dfd82039af842c563d20a26a4787833948544445587818da52eb3739ce8d0c90421fbaf3089698dc5ccd661391a9a62257179644611f54bad2fde00eb8ed7b9effd914675d621212f570d9aba9f6f3a47a6687fb6cb312705cb7dd50a01faed78c02152658bb3d21926eedb62340f46d30e5f231358c801e582cfafc6c7d69a0d496368073a12d4672a36c4e72a9556a73a1e2e33297d29dab58d7bfec7d0e3115df2ea8a09ebb938b3d820f1a8f208f46843ac78b3ae56c92341892b4cc059c359c494c37de50c1f05f6b692a90f6529926a47abda7af416223bc51e85d393eefc0692b4df88c8ed511e7a5cbd9d2c009698404617301adf8d3ee56b164bd5865c6d33412cff2a26c3680b89b16abd3422f809081a3f6c0b5157e09e11f89ab5de8fe0d8af4f23d23f0c630279c2992119efc55cc5b56016a4dcba30d0c957416ba885998b4304e11cdeac36fc6e09ad0e32adfed511c5df62539bf08ae023c7c78671534d0fd690106db2fbfbcc1e39408608a20821fca3614989ec01a868d7d27f3df0fa8d4b14919766820fa88fc292ffa1c570d71e1c6c2a7fec4eb471de760f4118b7b4094983df5153601611b77f96c342bfd6e831a9387b9fbc041a5d5d1c1288362e0af2ef79b9d31598bf92528144277be24ddffa9a7fe907dd84fb6f74fd30739fcca28297a36ccd59ca89a82519781eac777695db4f1513225f8201cef2e2abe4f7cd5d524a551dfc8cf95487ad1c745e66d742b3c7b9fa8b50813539828695843ede4b6a25a39279b452dd09a29ae3c9d7c35d8ac5e377483405352765b7c2d7f1dcaea98eb3b458a4245f10a025a59a471338de142d5bbbebf72f01cd96319a7597e989080468be84a90c0bdbf8d4daa50553840a9bdcc4c03034efb6821b85e7b989c282a47673ddea5136b55fe6463a7af2a282e559c9888d63d96587e6a1f67519f6d51f4b78fc1846e5c60c59dec9c4c758e9634e4d8ee1e8d1fc4ef691e00f1084aaafaf02e718ac702f7b4048039db29f3081a9af95f8f5ca988e4a40597806cf71aa7e5e74cf098da826adad7a722ffe866b4da07b287c92bf1363c7d53b5eb6cce8172c16b7d5be37b69102be2b0ee68d972577bfd6cde95b2af1807d7cce094670c96fa4e2eb7cd56d0189aa610a1088ab772668a0596fbe8213acb738e1c7e77380a358da9d856d8ce7edb78f1b8404950f89ef00819251cd14dfb10a8b3467c58808f00eff3819e7c5ada5d6ffca272a0d03746328ece47b4808ace401c696846e65e5ea200a4c8c377b9c9c963403537dddb53982e6d03092fb274749aee97f53636686b001d83a99ac7158d8b5f7600f6f40c3aec839130c207eda327a54d52f6c86cf77e173f470f3355158aa60bc5807dab987ea711a089b5ca5251911402a296228f8a7801955685cc59286abb05ef03ceade4a965feab6e6fe518151e6715f67fabf4fe56eea4c097e73ca5688fc217973c3f8367dd49bf59d94c8b9932fd51a02680210c70d4f6068173de24e4e5e5b0457e8bd48fcce2c3cf8ad7d460541b010d572e7dd2e9b234d0420ecfaa5d0355a9990781971efbb14d155d922818c7343883eaed62b8ba703be52fe5250d89a253871bebf7c047be131156db993c166416cdb87c8451fdbfa7ec7aa0ddca26b2b0185b21f5439584b3614e7b7bc21f2044a230c85daea1e60256dcc452b3f6a95987d9809d51f445ae1e0ba501e94185cdf8ac11dedb125c26e4d162199ff9ccbbf2e739f8a68bccf23db5ed72025e22bf03d3a675033064f47a80e6b19a2a6d6025e2f76bb4bed76cc77a5e7395b1873d0a456f03ea47bbe473ae49034004150ccbb8edbf0da5b29f31e79f58bd34a25e3e36386b5e829b82cd54a6332c5de0fdcf0806b0766b7673788e860acc31d6482000f6ae667405c3b8f18baf6706a3ca384964ba4f3c67203d118f416cc980b18c147091c200ab9fb5efd0e9a3163312ce359a0669908750d04c3b7b1f5cb75a21ddeb039166585f1b9b0e4effc61cfb12b6dab650c58bdc2564b3ab1257d08a07f12a9fd0bc863cf4aa9f7419b227396abf011659bf499a48d33544e1b3e59cdb2656db77ae63425190ac76392f74139b40609169a953788f4c174878fd9ccc60bbabb0b26f552f3372ecca4e56f7502c07ddd52878a5fee211751ce803956d7da98c9233ca4c62cb3d7a5568a1eb73c09b76320bd7ebe28ac00140ccadfb94240b00fdf363ba3d453dad20d569cc200550d6c12028d5ec14e25748ca4fec6b75d09d5d3642c49fdd3493750d9bdebaf286fea11dd6591ed8d758a1a6e7b197c88f38087ae723a4c6a5a052590305bf35f4f2ba501cdaf82b4f22ce3a443cb434daa6", 0x1000) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000040)=0x1, 0x4) recvfrom(r0, 0x0, 0x0, 0x2, &(0x7f0000000140)=@ax25={{0x3, @default}, [@bcast, @default, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x80) [ 2298.710263][ T27] audit: type=1804 audit(1579947910.915:998): pid=27574 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1269/file0" dev="sda1" ino=16863 res=1 [ 2298.833656][T27586] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2298.921947][ C0] net_ratelimit: 14 callbacks suppressed [ 2298.921957][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2298.933438][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2298.963632][T27579] 8021q: adding VLAN 0 to HW filter on device bond210 10:25:11 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xff000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2299.018558][T27579] bond0: (slave bond210): Enslaving as an active interface with an up link 10:25:11 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000000c0)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000040)=0x1, 0x4) recvfrom(r0, 0x0, 0x0, 0x2, &(0x7f0000000140)=@ax25={{0x3, @default}, [@bcast, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x716000) [ 2299.562792][ T27] audit: type=1804 audit(1579947911.775:999): pid=27605 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1270/file0/file0" dev="sda1" ino=16902 res=1 [ 2300.201969][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2300.207824][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2300.213649][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2300.219422][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2301.001991][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2301.007785][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2301.653243][ T27] audit: type=1804 audit(1579947913.865:1000): pid=27620 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/998/file0/file0" dev="loop3" ino=3091 res=1 10:25:14 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, 0x0) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:25:14 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x17, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) 10:25:14 executing program 5: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x20000000) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:25:14 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) dup(r1) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000040)=0x1, 0x4) recvfrom(r0, 0x0, 0x0, 0x2, &(0x7f0000000140)=@ax25={{0x3, @bcast}, [@bcast, @bcast, @null, @bcast, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x80) 10:25:14 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x13) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:25:14 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xfffff000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2301.964045][T27626] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:25:14 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x7, &(0x7f0000000040)=0x3, 0x2f) r3 = gettid() ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x5) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, r3, 0x5, &(0x7f00000001c0)=""/176) recvfrom(r0, 0x0, 0x0, 0x2, &(0x7f0000000140)=@ax25={{0x3, @default}, [@bcast, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x716000) [ 2302.156481][T27641] 8021q: adding VLAN 0 to HW filter on device bond211 [ 2302.250655][T27641] bond0: (slave bond211): Enslaving as an active interface with an up link [ 2302.281951][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2302.287756][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2302.642209][ T27] audit: type=1804 audit(1579947914.645:1001): pid=27644 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1271/file0" dev="sda1" ino=17576 res=1 10:25:15 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x8000, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r3, 0x0, 0xd3, 0xc6, &(0x7f00000001c0)="7484dc1944dc4c87c3e3330b6761fef041ad1bd2a28cde2f7ef4684ef9c1f4762f235cc62d6733eac5ce61720439a4a56ae163097b6163ad9d44cb8436531d47688fb0c261617d0153afd843bc51145c017eca4a6b48fcb8b69a3dc6a16e1fe1ef90c6660d19941b47bcf56af5787b80d6d6abdd5e3c4c4cb157e91dfc3c1981ba9f23208c4d964139201283f25a6b89bfad5921a5b7bf4412eebd7d1d4d94462640a0ee0b18bb44ad98e146405a5963c24ec4f9156a19b8a4f79c909725ed587681c34a8a4cd880f54317dbc8529e2e230155", &(0x7f0000000300)=""/198, 0x7, 0x0, 0xbc, 0xd6, &(0x7f0000000400)="0b21ffbf008f2a0c44458231e81c80d6cdacc87794f342ffcfe5e200eda96f3ad1c3288e4843afc871d2b0b74c4cce99fab8e145db911c6af1d3f7de1b3ec47aae1449d7890a10eec1e21c151d44707a9ce3aa93e121427b1995f2139ecf5f66ce4d6bd0de39e529fbdf6652fe035464c69c3a437feeac6a9d93d1afe78b000a62b5cb7829492a117e57dd9b4e6f63761a5346635a9e81d8b4f063fc20894c65ee47f258ae8a9fef3778f1480ceb0dbd0bdb12e1ed3e6cc525551354", &(0x7f00000004c0)="c9c5d31218193d70d30e1adcc94bcc95cf2bf95dac00bd8bcbd679c386cb56540a5767371bb2a08db625a50d82d0e049723783238e591f6a3dfac1327a955024c56f24bed99fbc552de339a59196ba110560741ef3aae03f36611fb094c954504288c1a7dd71ad2c1e62b6af74ef363bc90e09caef184029765a22a0ddd4a0ca5a083f3f0e5c9674da500591f00be005c8bedc654296333122d76ab36c21dacff7177198e13f5a22527a51d1fd68584a0c746edc3fe85a565f1c35ce215c1ce26f589a11bf20993388b72457b4e2f2f3610853f67894"}, 0x40) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000040)=0x1, 0x4) recvfrom(r0, 0x0, 0x0, 0x2, &(0x7f0000000140)=@ax25={{0x3, @default}, [@bcast, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x716000) 10:25:15 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xffffffe5) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2303.373312][T27641] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2303.437441][ T27] audit: type=1804 audit(1579947915.645:1002): pid=27629 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/976/file0/file0" dev="loop5" ino=3096 res=1 10:25:15 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x4, &(0x7f0000d06000)=0x6, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000040)=0x1, 0x4) recvfrom(r0, 0x0, 0x0, 0x2, &(0x7f0000000140)=@ax25={{0x3, @default}, [@bcast, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x80) [ 2303.548710][ T27] audit: type=1800 audit(1579947915.645:1003): pid=27629 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.5" name="file0" dev="loop5" ino=3096 res=0 10:25:15 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x300) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2303.631516][ T27] audit: type=1804 audit(1579947915.685:1004): pid=27653 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/999/file0/file0" dev="loop3" ino=3099 res=1 10:25:16 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x18, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2303.917790][ T27] audit: type=1800 audit(1579947915.685:1005): pid=27653 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.3" name="file0" dev="loop3" ino=3099 res=0 [ 2304.078527][ T27] audit: type=1804 audit(1579947915.685:1006): pid=27660 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/999/file0/file0" dev="loop3" ino=3099 res=1 [ 2304.146783][T27686] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2304.361970][ C1] net_ratelimit: 8 callbacks suppressed [ 2304.362000][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2304.373604][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2304.379386][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2304.385170][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2304.387177][T27693] 8021q: adding VLAN 0 to HW filter on device bond212 [ 2304.418935][ T27] audit: type=1804 audit(1579947915.685:1007): pid=27659 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/976/file0/file0" dev="loop5" ino=3096 res=1 [ 2304.520207][T27693] bond0: (slave bond212): Enslaving as an active interface with an up link [ 2304.589668][ T27] audit: type=1804 audit(1579947916.455:1008): pid=27673 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1272/file0/file0" dev="sda1" ino=16580 res=1 [ 2304.903948][T27693] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2304.994672][ T27] audit: type=1804 audit(1579947917.205:1009): pid=27691 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1000/file0/file0" dev="loop3" ino=3103 res=1 [ 2305.161999][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2305.167994][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2305.196543][ T27] audit: type=1804 audit(1579947917.235:1010): pid=27688 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1000/file0/file0" dev="loop3" ino=3103 res=1 [ 2305.881964][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2305.887776][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2305.893619][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2305.899378][ C0] protocol 88fb is buggy, dev hsr_slave_1 10:25:18 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, 0x0) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:25:18 executing program 5: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x3f000000) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:25:18 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = creat(&(0x7f0000000280)='./file0\x00', 0x0) r2 = socket$rds(0x15, 0x5, 0x0) getsockopt$sock_buf(r2, 0x1, 0x37, &(0x7f0000000300)=""/72, &(0x7f0000000380)=0x48) close(r1) write$capi20_data(r1, &(0x7f0000000000)={{0x10, 0x1, 0x4, 0x81, 0x5, 0x6e}, 0x19, "f0ce8a9bfb72d7943de90a4ab621edeed0331f92ad3598b0ab"}, 0x2b) shutdown(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r3 = socket$inet_udplite(0x2, 0x2, 0x88) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) r5 = socket$kcm(0x2, 0x2, 0x73) bind(r5, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) getpeername(r5, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) connect$inet6(r6, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @empty, 0x9}, 0x1c) sendmsg$TEAM_CMD_PORT_LIST_GET(r6, &(0x7f0000002580)={0x0, 0x0, 0x0}, 0x4000000) ioctl$VIDIOC_QUERYBUF(0xffffffffffffffff, 0xc0585609, &(0x7f00000000c0)={0x0, 0x1, 0x4, 0x100000, 0x5, {0x0, 0x2710}, {0x1, 0x8, 0xd2, 0x0, 0x5, 0x9, "92eda78a"}, 0x7ff, 0x2, @offset=0x792f, 0x8, 0x0, r6}) ioctl$SOUND_PCM_READ_BITS(r7, 0x80045005, &(0x7f00000001c0)) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000040)=0x1, 0x4) recvfrom(r0, 0x0, 0x0, 0x2, &(0x7f0000000140)=@ax25={{0x3, @default}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x80) 10:25:18 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xfffffff6) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:25:18 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x500) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:25:18 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x19, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2306.397715][T27724] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2307.256891][T27729] 8021q: adding VLAN 0 to HW filter on device bond213 [ 2307.391191][T27729] bond0: (slave bond213): Enslaving as an active interface with an up link 10:25:19 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) r3 = socket$kcm(0x2, 0x2, 0x73) r4 = socket$kcm(0x2, 0x2, 0x73) bind(r4, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) getpeername(r4, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) connect$inet6(r5, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @empty, 0x9}, 0x1c) sendmsg$TEAM_CMD_PORT_LIST_GET(r5, &(0x7f0000002580)={0x0, 0x0, 0x0}, 0x4000000) ioctl$sock_rose_SIOCADDRT(r5, 0x890b, &(0x7f00000003c0)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x3}, 0x843, @bcast, @netrom={'nr', 0x0}, 0x0, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) bind(r3, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) getpeername(r3, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) r6 = socket$kcm(0x2, 0x2, 0x73) bind(r6, &(0x7f0000000180)=@in6={0xa, 0x4e23, 0x0, @initdev={0xfe, 0x88, [], 0x0, 0x0}}, 0x80) getpeername(r6, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) r8 = shmget$private(0x0, 0x2000, 0x1000, &(0x7f0000ffc000/0x2000)=nil) shmctl$IPC_INFO(r8, 0x3, &(0x7f0000000440)=""/121) connect$inet6(r7, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @empty, 0x9}, 0x1c) sendmsg$TEAM_CMD_PORT_LIST_GET(r7, &(0x7f0000002580)={0x0, 0x0, 0x0}, 0x4000000) connect$ax25(r7, &(0x7f0000000340)={{0x3, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x5}, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x48) readv(r3, &(0x7f0000000300)=[{&(0x7f0000000100)=""/12, 0xffffffffffffff13}, {&(0x7f00000004c0)=""/265, 0xfa}], 0x2) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000040)=0x1, 0x4) r9 = openat(r2, &(0x7f0000000000)='./file0\x00', 0x44000, 0x102) ioctl$GIO_FONT(r9, 0x4b60, &(0x7f00000000c0)=""/15) recvfrom(r0, 0x0, 0x0, 0x2, &(0x7f0000000140)=@ax25={{0x3, @default}, [@bcast, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x716000) 10:25:19 executing program 5: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xe5ffffff) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:25:19 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:25:20 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x1a, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) 10:25:20 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000040)=0x1, 0x4) r3 = creat(&(0x7f0000000280)='./file0\x00', 0x0) close(r3) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f00000000c0)={0x1, 0x0, [0x116, 0x7f, 0x5, 0x4, 0x7ff, 0x100000000, 0x9, 0x6]}) recvfrom(r0, 0x0, 0x0, 0x2, &(0x7f0000000140)=@ax25={{0x3, @default}, [@bcast, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x716000) [ 2308.193667][T27761] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2308.553272][T27767] 8021q: adding VLAN 0 to HW filter on device bond214 10:25:20 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x4, &(0x7f0000d06000)=0x1, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) r3 = openat$zero(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/zero\x00', 0xa09ca6639d40e6c0, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000200), &(0x7f0000000240)=0x14) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000040)=0x1, 0x4) recvfrom(r0, 0x0, 0x0, 0x0, &(0x7f0000000140)=@hci={0x1f, 0x4}, 0x92) [ 2308.667681][T27767] bond0: (slave bond214): Enslaving as an active interface with an up link [ 2308.922480][T27761] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2309.141974][ T27] kauditd_printk_skb: 3 callbacks suppressed [ 2309.141998][ T27] audit: type=1804 audit(1579947921.215:1014): pid=27773 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1002/file0/file0" dev="loop3" ino=3115 res=1 [ 2309.336076][ T27] audit: type=1804 audit(1579947921.215:1015): pid=27763 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1002/file0/file0" dev="loop3" ino=3115 res=1 [ 2309.416483][ T27] audit: type=1800 audit(1579947921.475:1016): pid=27736 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="sda1" ino=17598 res=0 [ 2310.042012][ C0] net_ratelimit: 10 callbacks suppressed [ 2310.042022][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2310.053563][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2310.059324][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2310.065096][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2310.611980][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2310.617790][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2310.623567][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2310.629292][ C1] protocol 88fb is buggy, dev hsr_slave_1 10:25:23 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, 0x0) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:25:23 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x700) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:25:23 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$NFQNL_MSG_CONFIG(r2, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000001c0)={&(0x7f00000000c0)={0x54, 0x2, 0x3, 0x101, 0x0, 0x0, {0x1, 0x0, 0x9}, [@NFQA_CFG_MASK={0x8, 0x4, 0x1, 0x0, 0xa}, @NFQA_CFG_CMD={0x8, 0x1, {0x0, 0x0, 0xb}}, @NFQA_CFG_PARAMS={0x9, 0x2, {0x2, 0x944cfd36380a8a98}}, @NFQA_CFG_MASK={0x8, 0x4, 0x1, 0x0, 0x1a}, @NFQA_CFG_QUEUE_MAXLEN={0x8, 0x3, 0x1, 0x0, 0xfffffff8}, @NFQA_CFG_PARAMS={0x9, 0x2, {0xffff}}, @NFQA_CFG_MASK={0x8}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000041}, 0x20) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000040)=0x1, 0x4) recvfrom(r0, 0x0, 0x0, 0x2, &(0x7f0000000140)=@ax25={{0x3, @default}, [@bcast, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x716000) 10:25:23 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xfffffffe) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:25:23 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x1b, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2311.026547][T27804] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2311.401940][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2311.407766][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2311.455644][ T27] audit: type=1804 audit(1579947923.665:1017): pid=27798 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/978/file0/file0" dev="loop5" ino=3122 res=1 [ 2311.557668][ T27] audit: type=1804 audit(1579947923.765:1018): pid=27795 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/978/file0/file0" dev="loop5" ino=3122 res=1 [ 2311.620499][T27812] 8021q: adding VLAN 0 to HW filter on device bond215 10:25:24 executing program 5: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xf6ffffff) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2311.853741][T27812] bond0: (slave bond215): Enslaving as an active interface with an up link [ 2311.982406][ T27] audit: type=1804 audit(1579947924.185:1019): pid=27820 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1003/file0" dev="sda1" ino=17089 res=1 10:25:24 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) r1 = socket$kcm(0x2, 0x2, 0x73) bind(r1, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/qat_adf_ctl\x00', 0x40, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(r2, 0x8905, &(0x7f0000000280)) getpeername(r1, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) connect$inet6(r3, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @empty, 0x9}, 0x1c) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f0000002580)={0x0, 0x0, 0x0}, 0x4000000) setsockopt$inet6_mtu(r3, 0x29, 0x17, &(0x7f0000000000), 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r4 = socket$inet_udplite(0x2, 0x2, 0x88) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000040)=0x1, 0x4) recvfrom(r0, 0x0, 0x0, 0x2, &(0x7f0000000140)=@ax25={{0x3, @default}, [@bcast, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x716000) [ 2312.043016][T27804] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:25:24 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xb00) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:25:24 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x1000000000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:25:24 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x1c, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2312.282257][T27832] QAT: Invalid ioctl [ 2312.296954][T27832] QAT: Invalid ioctl 10:25:24 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x5, 0x800) write$nbd(r2, &(0x7f00000000c0)={0x67446698, 0x1, 0x4, 0x2, 0x1, "f20ab21f141133"}, 0x17) ioctl$RTC_ALM_READ(r2, 0x80247008, &(0x7f0000000100)) r3 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000040)=0x1, 0x4) recvfrom(r0, 0x0, 0x0, 0x2, &(0x7f0000000140)=@ax25={{0x3, @default}, [@bcast, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x716000) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f00000001c0)=[@in6={0xa, 0x4e21, 0x8001, @mcast1, 0x3d}, @in6={0xa, 0x4e24, 0x5, @mcast2, 0x7}, @in6={0xa, 0x4e21, 0x5, @rand_addr="9b5283dafeac2e6f7456c6a3558929ca", 0x8000}, @in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}, @in6={0xa, 0x4e22, 0x0, @rand_addr="dccdfe49ee449b3bdb69198074be7b2b"}], 0x80) [ 2312.372681][T27841] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2312.429685][T27841] 8021q: adding VLAN 0 to HW filter on device bond216 [ 2312.474368][T27841] bond0: (slave bond216): Enslaving as an active interface with an up link [ 2313.202284][ T27] audit: type=1804 audit(1579947925.315:1020): pid=27831 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/979/file0/file0" dev="sda1" ino=16775 res=1 [ 2313.262806][T27856] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:25:25 executing program 5: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xfeffffff) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2313.738066][ T27] audit: type=1804 audit(1579947925.945:1021): pid=27858 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1004/file0/file0" dev="loop3" ino=3124 res=1 [ 2314.093395][ T27] audit: type=1804 audit(1579947925.975:1022): pid=27855 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1004/file0/file0" dev="loop3" ino=3124 res=1 [ 2314.252110][ T27] audit: type=1804 audit(1579947926.175:1023): pid=27861 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1275/file0/file0" dev="loop0" ino=3125 res=1 [ 2314.279019][ T27] audit: type=1800 audit(1579947926.175:1024): pid=27861 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="loop0" ino=3125 res=0 [ 2314.310715][ T27] audit: type=1804 audit(1579947926.175:1025): pid=27866 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1275/file0/file0" dev="loop0" ino=3125 res=1 [ 2314.343421][ T27] audit: type=1804 audit(1579947926.455:1026): pid=27878 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/980/file0/file0" dev="sda1" ino=16925 res=1 10:25:27 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) r1 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r2, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r3 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r3, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:25:27 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = creat(&(0x7f0000000280)='./file0\x00', 0x0) close(r2) ioctl$RTC_PIE_ON(r2, 0x7005) r3 = socket$kcm(0x2, 0x2, 0x73) bind(r3, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) getpeername(r3, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) connect$inet6(r4, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @empty, 0x9}, 0x1c) sendmsg$TEAM_CMD_PORT_LIST_GET(r4, &(0x7f0000002580)={0x0, 0x0, 0x0}, 0x4000000) r5 = dup(r1) openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x10000, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x406) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000040)=0x2001, 0x4) recvfrom(r0, 0x0, 0x0, 0x2, &(0x7f0000000140)=@ax25={{0x3, @default}, [@bcast, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x716000) 10:25:27 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x1d, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) 10:25:27 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xc00) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:25:27 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xf0ffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:25:27 executing program 5: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xff000000) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:25:27 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) r3 = getpgid(0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r2, 0xc1105517, &(0x7f0000000300)={{0x5, 0x2, 0x47d, 0x7f, '\x00', 0x9}, 0x2, 0x200, 0x264, r3, 0x1, 0x400, 'syz0\x00', &(0x7f0000000000)=['\x00'], 0x1, [], [0x1, 0x2, 0x4, 0x4010]}) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000040)=0x1, 0x4) recvfrom(r0, 0x0, 0x0, 0x2, &(0x7f0000000140)=@ax25={{0x3, @default}, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x80) ioctl$sock_SIOCGIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r2, 0x8982, &(0x7f00000000c0)={0x3, 'rose0\x00', {0x5}, 0xe9}) [ 2315.550907][T27902] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2315.561939][ C0] net_ratelimit: 14 callbacks suppressed [ 2315.561948][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2315.573558][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2315.617081][T27906] 8021q: adding VLAN 0 to HW filter on device bond217 [ 2315.793587][T27906] bond0: (slave bond217): Enslaving as an active interface with an up link [ 2316.281998][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2316.288120][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2316.294277][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2316.300123][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2316.841985][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2316.847883][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2316.853871][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2316.859886][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2317.552012][ T27] audit: type=1804 audit(1579947929.755:1027): pid=27914 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/981/file0/file0" dev="loop5" ino=3135 res=1 [ 2317.612236][T27921] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2317.688828][ T27] audit: type=1804 audit(1579947929.885:1028): pid=27898 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1005/file0/file0" dev="loop3" ino=3133 res=1 10:25:30 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) r3 = socket$kcm(0x2, 0x2, 0x73) bind(r3, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) getpeername(r3, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) connect$inet6(r4, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @empty, 0x9}, 0x1c) sendmsg$TEAM_CMD_PORT_LIST_GET(r4, &(0x7f0000002580)={0x0, 0x0, 0x0}, 0x4000000) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x24, &(0x7f0000000040)=0x1000001, 0x4) recvfrom(r0, 0x0, 0x0, 0x2, &(0x7f0000000140)=@ax25={{0x3, @default}, [@bcast, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x716000) 10:25:30 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x1e, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2318.022055][ T27] audit: type=1804 audit(1579947930.235:1029): pid=27920 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1276/file0/file0" dev="loop0" ino=3131 res=1 [ 2318.023019][T27938] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:25:30 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xf00) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2318.105634][T27941] 8021q: adding VLAN 0 to HW filter on device bond218 [ 2318.131965][ T27] audit: type=1800 audit(1579947930.275:1030): pid=27920 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="loop0" ino=3131 res=0 [ 2318.143316][T27941] bond0: (slave bond218): Enslaving as an active interface with an up link [ 2318.152453][ T27] audit: type=1804 audit(1579947930.275:1031): pid=27919 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1276/file0/file0" dev="loop0" ino=3131 res=1 10:25:30 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x100000000000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:25:30 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) r3 = socket$kcm(0x2, 0x2, 0x73) bind(r3, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) getpeername(r3, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) connect$inet6(r4, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @empty, 0x9}, 0x1c) sendmsg$TEAM_CMD_PORT_LIST_GET(r4, &(0x7f0000002580)={0x0, 0x0, 0x0}, 0x4000000) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r4, 0x6, 0x15, &(0x7f0000000000)=0x1ff, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000040)=0x1, 0x4) recvfrom(r0, 0x0, 0x0, 0x2, &(0x7f0000000140)=@ax25={{0x3, @default}, [@bcast, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x716000) [ 2318.342572][T27941] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2319.451141][ T27] audit: type=1804 audit(1579947931.655:1032): pid=27971 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1006/file0/file0" dev="loop3" ino=3139 res=1 10:25:31 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) r1 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r2, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r3 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r3, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:25:31 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x25, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) 10:25:31 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) close(0xffffffffffffffff) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000040)=0x1, 0x4) recvfrom(r0, 0x0, 0x0, 0x2, &(0x7f0000000140)=@ax25={{0x3, @default}, [@bcast, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x716000) 10:25:31 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x200000000000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:25:31 executing program 5: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xffffffe5) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:25:31 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x1300) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2319.662054][ T27] audit: type=1804 audit(1579947931.655:1033): pid=27964 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1006/file0/file0" dev="loop3" ino=3139 res=1 [ 2319.745033][T27986] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2319.827752][T27990] 8021q: adding VLAN 0 to HW filter on device bond219 [ 2319.890316][T27990] bond0: (slave bond219): Enslaving as an active interface with an up link [ 2320.889825][ T27] audit: type=1804 audit(1579947933.095:1034): pid=28007 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir489728754/syzkaller.GmU4Kb/180/file0" dev="sda1" ino=16906 res=1 [ 2320.892396][T27990] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2321.752240][ T27] audit: type=1804 audit(1579947933.735:1035): pid=28012 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1007/file0/file0" dev="loop3" ino=3146 res=1 [ 2321.801999][ C0] net_ratelimit: 10 callbacks suppressed [ 2321.802009][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2321.813736][ C0] protocol 88fb is buggy, dev hsr_slave_1 10:25:34 executing program 5: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xfffffff6) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2322.127969][ T27] audit: type=1804 audit(1579947934.245:1036): pid=28013 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1278/file0/file0" dev="loop0" ino=3143 res=1 10:25:34 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0xc0, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2322.247953][ T27] audit: type=1800 audit(1579947934.245:1037): pid=28013 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="loop0" ino=3143 res=0 10:25:34 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x300000000000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2322.324998][T28028] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2322.393123][ T27] audit: type=1804 audit(1579947934.245:1038): pid=28016 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1278/file0/file0" dev="loop0" ino=3143 res=1 [ 2322.483600][T28029] 8021q: adding VLAN 0 to HW filter on device bond220 [ 2322.521942][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2322.527764][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2322.533571][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2322.539318][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2322.636896][T28029] bond0: (slave bond220): Enslaving as an active interface with an up link [ 2322.792504][T28029] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2323.054898][ T27] audit: type=1800 audit(1579947935.265:1039): pid=28007 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.2" name="file0" dev="sda1" ino=16906 res=0 [ 2323.081963][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2323.087923][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2323.093986][ C1] protocol 88fb is buggy, dev hsr_slave_0 10:25:35 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0xec0, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2323.099880][ C1] protocol 88fb is buggy, dev hsr_slave_1 10:25:35 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) r1 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r2, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r3 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r3, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:25:35 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x2000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2323.340302][T28042] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2323.427978][T28044] 8021q: adding VLAN 0 to HW filter on device bond221 [ 2323.438324][T28044] bond0: (slave bond221): Enslaving as an active interface with an up link [ 2323.572831][T28050] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2323.819851][ T27] audit: type=1804 audit(1579947936.025:1040): pid=28038 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1279/file0/file0" dev="loop0" ino=3151 res=1 [ 2324.509517][ T27] audit: type=1800 audit(1579947936.065:1041): pid=28038 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="loop0" ino=3151 res=0 10:25:37 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x2000, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2325.276356][ T27] audit: type=1804 audit(1579947936.065:1042): pid=28037 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1279/file0/file0" dev="loop0" ino=3151 res=1 [ 2325.543714][T28071] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:25:37 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x400000000000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2325.757936][ T27] audit: type=1804 audit(1579947937.835:1043): pid=28059 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1008/file0/file0" dev="loop3" ino=3158 res=1 10:25:38 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2325.898459][T28075] 8021q: adding VLAN 0 to HW filter on device bond222 [ 2325.947716][T28075] bond0: (slave bond222): Enslaving as an active interface with an up link [ 2326.052631][T28075] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:25:38 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x3f00) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2326.161017][ T27] audit: type=1804 audit(1579947938.365:1044): pid=28074 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/983/file0" dev="sda1" ino=16906 res=1 10:25:38 executing program 5: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xfffffffe) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:25:38 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x33fe0, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2326.830403][T28109] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2327.241976][ C1] net_ratelimit: 16 callbacks suppressed [ 2327.241986][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2327.253970][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2327.259766][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2327.266145][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2328.041988][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2328.048307][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2328.151320][T28110] 8021q: adding VLAN 0 to HW filter on device bond223 [ 2328.268742][T28110] bond0: (slave bond223): Enslaving as an active interface with an up link [ 2328.323055][ T27] audit: type=1804 audit(1579947940.475:1045): pid=28113 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/984/file0/file0" dev="loop5" ino=3166 res=1 [ 2328.761966][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2328.767770][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2328.773588][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2328.779337][ C0] protocol 88fb is buggy, dev hsr_slave_1 10:25:42 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x200000e0, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) 10:25:42 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xff00) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:25:42 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x500000000000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2330.262014][ T27] audit: type=1804 audit(1579947940.565:1046): pid=28096 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1009/file0/file0" dev="loop3" ino=3163 res=1 10:25:42 executing program 5: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x1000000000000) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2330.320677][T28123] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2330.335543][ T27] audit: type=1804 audit(1579947940.805:1047): pid=28103 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/984/file0/file0" dev="loop5" ino=3166 res=1 [ 2330.416467][ T27] audit: type=1804 audit(1579947941.125:1048): pid=28092 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1280/file0/file0" dev="loop0" ino=3160 res=1 [ 2330.467676][T28125] 8021q: adding VLAN 0 to HW filter on device bond224 [ 2330.612698][T28125] bond0: (slave bond224): Enslaving as an active interface with an up link [ 2330.685380][ T27] audit: type=1800 audit(1579947941.125:1049): pid=28092 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="loop0" ino=3160 res=0 [ 2330.852217][T28125] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2330.925611][ T27] audit: type=1804 audit(1579947941.125:1050): pid=28094 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1280/file0/file0" dev="loop0" ino=3160 res=1 10:25:43 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x7ffff000, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2331.343158][ T27] audit: type=1804 audit(1579947943.555:1051): pid=28135 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1281/file0/file0" dev="sda1" ino=16959 res=1 [ 2331.497753][T28141] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2331.669599][T28142] 8021q: adding VLAN 0 to HW filter on device bond225 [ 2331.745341][T28142] bond0: (slave bond225): Enslaving as an active interface with an up link [ 2331.913170][T28141] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:25:44 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0xfffffdef, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2332.314640][T28152] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2332.401575][T28154] 8021q: adding VLAN 0 to HW filter on device bond226 [ 2332.487419][T28154] bond0: (slave bond226): Enslaving as an active interface with an up link [ 2332.921955][ C0] net_ratelimit: 10 callbacks suppressed [ 2332.921966][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2332.933405][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2332.939185][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2332.944970][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2333.481963][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2333.487778][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2333.493753][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2333.499514][ C1] protocol 88fb is buggy, dev hsr_slave_1 10:25:46 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x600000000000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2333.919546][ T27] audit: type=1800 audit(1579947946.125:1052): pid=28134 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="sda1" ino=16959 res=0 [ 2333.990401][T28152] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2334.084409][ T27] audit: type=1804 audit(1579947946.295:1053): pid=28160 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1010/file0/file0" dev="loop3" ino=3169 res=1 10:25:46 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x1000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:25:46 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:25:46 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x2, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2335.001988][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2335.007769][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2336.131858][T28187] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2336.349315][ T27] audit: type=1804 audit(1579947948.555:1054): pid=28200 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/985/file0/file0" dev="loop5" ino=3173 res=1 [ 2336.563771][T28197] 8021q: adding VLAN 0 to HW filter on device bond227 [ 2336.642932][T28197] bond0: (slave bond227): Enslaving as an active interface with an up link [ 2336.686178][ T27] audit: type=1804 audit(1579947948.835:1055): pid=28204 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1011/file0/file0" dev="loop3" ino=3176 res=1 [ 2336.822829][T28197] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:25:49 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0xa, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) 10:25:49 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x700000000000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2337.181422][T28211] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2337.275201][T28211] 8021q: adding VLAN 0 to HW filter on device bond228 [ 2337.356772][T28211] bond0: (slave bond228): Enslaving as an active interface with an up link [ 2337.532436][T28214] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:25:50 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0xf, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2337.926481][T28224] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2338.002325][T28225] 8021q: adding VLAN 0 to HW filter on device bond229 [ 2338.036895][T28225] bond0: (slave bond229): Enslaving as an active interface with an up link 10:25:50 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x2000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2338.222511][T28225] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:25:50 executing program 5: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x100000000000000) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2338.411536][ T27] audit: type=1804 audit(1579947950.615:1056): pid=28228 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1283/file0/file0" dev="loop0" ino=3179 res=1 [ 2338.441941][ C0] net_ratelimit: 12 callbacks suppressed [ 2338.441951][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2338.453461][ C0] protocol 88fb is buggy, dev hsr_slave_1 10:25:50 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x25, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2338.569596][ T27] audit: type=1800 audit(1579947950.645:1057): pid=28228 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="loop0" ino=3179 res=0 [ 2338.906643][ T27] audit: type=1804 audit(1579947950.645:1058): pid=28231 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1283/file0/file0" dev="loop0" ino=3179 res=1 [ 2338.972842][T28248] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2339.161953][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2339.167753][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2339.173583][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2339.179326][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2340.460040][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2340.465904][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2340.471713][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2340.477538][ C1] protocol 88fb is buggy, dev hsr_slave_1 10:25:52 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x800000000000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2340.614586][T28252] 8021q: adding VLAN 0 to HW filter on device bond230 [ 2340.669663][T28252] bond0: (slave bond230): Enslaving as an active interface with an up link [ 2340.701378][T28256] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2340.735246][ T27] audit: type=1804 audit(1579947952.945:1059): pid=28239 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1012/file0/file0" dev="loop3" ino=3183 res=1 10:25:53 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2341.051492][ T27] audit: type=1804 audit(1579947952.965:1060): pid=28238 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1012/file0/file0" dev="loop3" ino=3183 res=1 10:25:53 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x3000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2341.077049][ T27] audit: type=1804 audit(1579947953.215:1061): pid=28263 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/986/file0/file0" dev="loop5" ino=3187 res=1 10:25:53 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x6f, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2341.462323][T28279] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2341.732328][T28282] 8021q: adding VLAN 0 to HW filter on device bond231 [ 2341.800367][T28282] bond0: (slave bond231): Enslaving as an active interface with an up link 10:25:54 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x4000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2342.166704][T28279] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2342.201410][ T27] audit: type=1804 audit(1579947954.405:1062): pid=28280 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1284/file0/file0" dev="loop0" ino=3189 res=1 10:25:54 executing program 5: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x200000000000000) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2342.336758][ T27] audit: type=1800 audit(1579947954.445:1063): pid=28280 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="loop0" ino=3189 res=0 10:25:54 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x2000, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2342.434946][ T27] audit: type=1804 audit(1579947954.445:1064): pid=28292 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1284/file0/file0" dev="loop0" ino=3189 res=1 10:25:54 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xc00000000000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2342.597954][T28298] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2342.692230][T28302] 8021q: adding VLAN 0 to HW filter on device bond232 [ 2342.910092][T28302] bond0: (slave bond232): Enslaving as an active interface with an up link [ 2343.472694][T28302] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2343.769104][ T27] audit: type=1804 audit(1579947955.975:1065): pid=28315 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/987/file0/file0" dev="loop5" ino=3196 res=1 [ 2344.107667][ T27] audit: type=1800 audit(1579947955.975:1066): pid=28315 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.5" name="file0" dev="loop5" ino=3196 res=0 10:25:56 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x2000, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2344.380350][ T27] audit: type=1804 audit(1579947956.015:1067): pid=28321 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/987/file0/file0" dev="loop5" ino=3196 res=1 [ 2344.508946][T28336] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2344.681952][ C0] net_ratelimit: 6 callbacks suppressed [ 2344.681961][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2344.693356][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2344.696501][ T27] audit: type=1804 audit(1579947956.405:1068): pid=28314 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1285/file0/file0" dev="loop0" ino=3197 res=1 [ 2344.752081][ T27] audit: type=1800 audit(1579947956.405:1069): pid=28314 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="loop0" ino=3197 res=0 [ 2344.942633][T28341] 8021q: adding VLAN 0 to HW filter on device bond233 [ 2345.019698][ T27] audit: type=1804 audit(1579947956.405:1070): pid=28316 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1285/file0/file0" dev="loop0" ino=3197 res=1 [ 2345.029646][T28341] bond0: (slave bond233): Enslaving as an active interface with an up link 10:25:57 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xf00000000000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:25:57 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x5000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2345.045325][ T27] audit: type=1804 audit(1579947957.035:1071): pid=28328 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1014/file0/file0" dev="loop3" ino=3202 res=1 [ 2345.223788][T28336] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:25:57 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2345.401958][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2345.407870][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2345.413780][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2345.419525][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2345.513707][T28358] FAT-fs (loop0): error, fat_bmap_cluster: request beyond EOF (i_pos 44) [ 2345.531517][T28358] FAT-fs (loop0): Filesystem has been set read-only 10:25:57 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, 0x0, &(0x7f0000001280)) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={0x0, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r3 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r3, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2345.610414][T28365] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:25:58 executing program 5: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x300000000000000) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2346.026919][T28370] 8021q: adding VLAN 0 to HW filter on device bond234 [ 2346.136817][T28370] bond0: (slave bond234): Enslaving as an active interface with an up link [ 2346.363403][T28365] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:25:58 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, 0x0, &(0x7f0000001280)) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={0x0, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r3 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r3, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2346.681985][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2346.687821][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2346.693614][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2346.699369][ C1] protocol 88fb is buggy, dev hsr_slave_1 10:25:59 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x1300000000000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:25:59 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x6000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:25:59 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0x2, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2347.240497][T28398] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2347.569129][ T27] kauditd_printk_skb: 5 callbacks suppressed [ 2347.569151][ T27] audit: type=1804 audit(1579947959.775:1077): pid=28394 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/988/file0/file0" dev="loop5" ino=3214 res=1 [ 2347.608489][T28399] 8021q: adding VLAN 0 to HW filter on device bond235 [ 2347.700598][T28399] bond0: (slave bond235): Enslaving as an active interface with an up link [ 2347.999331][ T27] audit: type=1800 audit(1579947959.775:1078): pid=28394 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.5" name="file0" dev="loop5" ino=3214 res=0 [ 2348.158344][ T27] audit: type=1804 audit(1579947959.815:1079): pid=28403 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/988/file0/file0" dev="loop5" ino=3214 res=1 [ 2348.712279][T28399] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2348.823528][ T27] audit: type=1804 audit(1579947961.035:1080): pid=28423 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1287/file0/file0" dev="sda1" ino=17017 res=1 10:26:01 executing program 5: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x400000000000000) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2349.047507][ T27] audit: type=1804 audit(1579947961.115:1081): pid=28421 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1016/file0/file0" dev="loop3" ino=3218 res=1 10:26:01 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x7000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2349.149846][ T27] audit: type=1804 audit(1579947961.115:1082): pid=28417 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1016/file0/file0" dev="loop3" ino=3218 res=1 10:26:01 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0x3, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2349.693261][T28448] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2349.913279][T28443] 8021q: adding VLAN 0 to HW filter on device bond236 [ 2349.967852][T28443] bond0: (slave bond236): Enslaving as an active interface with an up link 10:26:02 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0x4, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2350.549801][ T27] audit: type=1804 audit(1579947962.755:1083): pid=28462 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/989/file0" dev="sda1" ino=17022 res=1 10:26:02 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, 0x0, &(0x7f0000001280)) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={0x0, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r3 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r3, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2350.593904][T28467] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2350.626347][ T27] audit: type=1804 audit(1579947962.835:1084): pid=28456 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1017/file0/file0" dev="loop3" ino=3221 res=1 [ 2350.652659][ T27] audit: type=1800 audit(1579947962.835:1085): pid=28456 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.3" name="file0" dev="loop3" ino=3221 res=0 [ 2350.672874][ T27] audit: type=1804 audit(1579947962.845:1086): pid=28460 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1017/file0/file0" dev="loop3" ino=3221 res=1 10:26:02 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x1800000000000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:26:03 executing program 5: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x500000000000000) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2350.797775][T28469] 8021q: adding VLAN 0 to HW filter on device bond237 [ 2350.851960][ C1] net_ratelimit: 16 callbacks suppressed [ 2350.851970][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2350.863955][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2350.869795][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2350.875584][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2350.887574][T28469] bond0: (slave bond237): Enslaving as an active interface with an up link [ 2350.921990][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2350.927935][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2351.142611][T28467] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2351.641979][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2351.647776][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2351.653885][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2351.659786][ C0] protocol 88fb is buggy, dev hsr_slave_1 10:26:04 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x0, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:26:04 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0x6, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2352.538558][T28500] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:26:05 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x2000000000000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2352.775090][ T27] kauditd_printk_skb: 2 callbacks suppressed [ 2352.775152][ T27] audit: type=1804 audit(1579947964.985:1089): pid=28493 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/990/file0/file0" dev="loop5" ino=3227 res=1 [ 2352.922506][T28505] 8021q: adding VLAN 0 to HW filter on device bond238 [ 2353.042060][ T27] audit: type=1800 audit(1579947964.985:1090): pid=28493 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.5" name="file0" dev="loop5" ino=3227 res=0 [ 2353.066582][T28505] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2353.116162][T28507] bond0: (slave bond238): slave is up - this may be due to an out of date ifenslave [ 2353.237688][ T27] audit: type=1804 audit(1579947965.035:1091): pid=28502 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/990/file0/file0" dev="loop5" ino=3227 res=1 10:26:05 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0xa, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2353.653756][T28521] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:26:05 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x8000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2353.732436][T28522] 8021q: adding VLAN 0 to HW filter on device bond239 [ 2353.827353][T28522] bond0: (slave bond239): Enslaving as an active interface with an up link [ 2353.966329][T28522] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:26:06 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0xc, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2354.351963][ T27] audit: type=1804 audit(1579947966.505:1092): pid=28518 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1289/file0/file0" dev="loop0" ino=3228 res=1 [ 2354.576530][ T27] audit: type=1800 audit(1579947966.505:1093): pid=28518 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="loop0" ino=3228 res=0 [ 2354.654388][T28540] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2354.793585][ T27] audit: type=1804 audit(1579947966.515:1094): pid=28530 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1289/file0/file0" dev="loop0" ino=3228 res=1 10:26:07 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x3f00000000000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2354.906742][T28541] 8021q: adding VLAN 0 to HW filter on device bond240 10:26:07 executing program 5: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x600000000000000) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2355.203653][T28541] bond0: (slave bond240): Enslaving as an active interface with an up link [ 2355.275553][ T27] audit: type=1804 audit(1579947967.435:1095): pid=28544 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1018/file0/file0" dev="loop3" ino=3231 res=1 [ 2355.674606][T28540] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:26:07 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xb000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:26:08 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x0, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:26:09 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0xe, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2356.821524][ T27] audit: type=1800 audit(1579947969.025:1096): pid=28567 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.5" name="file0" dev="loop5" ino=3238 res=0 [ 2356.879778][ T27] audit: type=1804 audit(1579947969.035:1097): pid=28563 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1290/file0/file0" dev="sda1" ino=16595 res=1 10:26:09 executing program 5: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x700000000000000) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2357.045407][T28585] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2357.081988][ C1] net_ratelimit: 20 callbacks suppressed [ 2357.081998][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2357.093957][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2357.099766][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2357.105818][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2357.171938][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2357.177831][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2357.362833][T28593] 8021q: adding VLAN 0 to HW filter on device bond241 [ 2357.881937][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2357.887931][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2357.893862][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2357.899610][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2357.984654][T28586] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:26:10 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xe5ffffff00000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2358.162115][T28586] bond0: (slave bond241): slave is up - this may be due to an out of date ifenslave 10:26:10 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0xf, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2358.659498][ T27] audit: type=1800 audit(1579947970.715:1098): pid=28587 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.3" name="bus" dev="loop3" ino=3242 res=0 10:26:11 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xc000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2358.892928][ T27] audit: type=1804 audit(1579947970.935:1099): pid=28597 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1019/file0/file0" dev="loop3" ino=3241 res=1 [ 2358.924833][T28608] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2359.069563][T28609] 8021q: adding VLAN 0 to HW filter on device bond242 [ 2359.170574][T28609] bond0: (slave bond242): Enslaving as an active interface with an up link [ 2359.426033][T28609] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:26:12 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0x10, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2359.929567][ T27] audit: type=1804 audit(1579947972.105:1100): pid=28614 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1291/file0/file0" dev="loop0" ino=3243 res=1 [ 2360.305316][ T27] audit: type=1800 audit(1579947972.105:1101): pid=28614 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="loop0" ino=3243 res=0 [ 2360.357849][ T27] audit: type=1804 audit(1579947972.115:1102): pid=28618 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1291/file0/file0" dev="loop0" ino=3243 res=1 [ 2360.385046][T28635] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:26:12 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xf000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:26:12 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xf6ffffff00000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2360.541241][T28639] 8021q: adding VLAN 0 to HW filter on device bond243 [ 2360.561595][ T27] audit: type=1804 audit(1579947972.455:1103): pid=28624 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1020/file0/file0" dev="loop3" ino=3246 res=1 [ 2360.611268][T28639] bond0: (slave bond243): Enslaving as an active interface with an up link [ 2360.833374][T28639] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:26:13 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x0, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2362.361148][ T27] audit: type=1804 audit(1579947972.455:1104): pid=28623 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1020/file0/file0" dev="loop3" ino=3246 res=1 10:26:14 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0x60, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) 10:26:14 executing program 5: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x800000000000000) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2362.700115][ T27] audit: type=1804 audit(1579947974.595:1105): pid=28662 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/992/file0/file0" dev="loop5" ino=3253 res=1 [ 2362.732308][ T27] audit: type=1804 audit(1579947974.845:1106): pid=28667 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1292/file0" dev="sda1" ino=17039 res=1 [ 2362.757348][ T27] audit: type=1804 audit(1579947974.865:1107): pid=28671 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1021/file0/file0" dev="loop3" ino=3255 res=1 [ 2362.833022][T28677] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2362.949820][T28682] 8021q: adding VLAN 0 to HW filter on device bond244 [ 2363.153464][T28682] bond0: (slave bond244): Enslaving as an active interface with an up link 10:26:15 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xfeffffff00000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2363.321981][ C1] net_ratelimit: 16 callbacks suppressed [ 2363.321991][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2363.333532][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2363.339321][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2363.345134][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2363.401972][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2363.407786][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2364.121955][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2364.127766][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2364.133551][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2364.139498][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2364.184949][T28682] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:26:16 executing program 5: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xc00000000000000) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:26:16 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x0, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:26:16 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0x300, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2364.847123][ T27] audit: type=1804 audit(1579947977.055:1108): pid=28703 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1293/file0" dev="sda1" ino=17056 res=1 [ 2365.013589][T28712] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:26:17 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xff00000000000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2365.162308][T28714] 8021q: adding VLAN 0 to HW filter on device bond245 [ 2365.171888][T28714] bond0: (slave bond245): Enslaving as an active interface with an up link 10:26:17 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x13000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2365.576152][T28712] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:26:18 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0x600, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2366.491422][T28738] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2366.848192][ T27] audit: type=1804 audit(1579947979.055:1109): pid=28731 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1022/file0/file0" dev="loop3" ino=3264 res=1 [ 2366.928685][T28745] 8021q: adding VLAN 0 to HW filter on device bond246 [ 2366.965378][T28745] bond0: (slave bond246): Enslaving as an active interface with an up link [ 2366.975969][ T27] audit: type=1800 audit(1579947979.055:1110): pid=28731 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.3" name="file0" dev="loop3" ino=3264 res=0 [ 2366.999207][ T27] audit: type=1804 audit(1579947979.055:1111): pid=28742 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1022/file0/file0" dev="loop3" ino=3264 res=1 [ 2367.027380][ T27] audit: type=1804 audit(1579947979.105:1112): pid=28724 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1294/file0/file0" dev="loop0" ino=3261 res=1 [ 2367.071633][ T27] audit: type=1800 audit(1579947979.105:1113): pid=28724 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="loop0" ino=3261 res=0 [ 2367.107315][ T27] audit: type=1804 audit(1579947979.105:1114): pid=28734 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1294/file0/file0" dev="loop0" ino=3261 res=1 [ 2367.192477][T28745] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:26:19 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xffffffff00000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:26:19 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x20000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:26:19 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0xa00, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2368.152632][T28767] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2368.292489][ T27] audit: type=1804 audit(1579947980.495:1115): pid=28753 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/994/file0/file0" dev="loop5" ino=3268 res=1 [ 2368.439209][T28776] 8021q: adding VLAN 0 to HW filter on device bond247 [ 2368.468459][ T27] audit: type=1800 audit(1579947980.505:1116): pid=28753 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.5" name="file0" dev="loop5" ino=3268 res=0 [ 2368.503274][T28776] bond0: (slave bond247): Enslaving as an active interface with an up link [ 2368.606001][ T27] audit: type=1804 audit(1579947980.535:1117): pid=28771 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/994/file0/file0" dev="loop5" ino=3268 res=1 10:26:20 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xfffffffffffff000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2368.676679][T28776] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2369.561992][ C1] net_ratelimit: 20 callbacks suppressed [ 2369.562004][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2369.574229][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2369.579992][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2369.585935][ C1] protocol 88fb is buggy, dev hsr_slave_1 10:26:21 executing program 5: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xf00000000000000) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:26:21 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0xc00, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) 10:26:21 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x0, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2369.865352][T28797] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2369.962131][T28803] 8021q: adding VLAN 0 to HW filter on device bond248 [ 2370.113240][ T27] kauditd_printk_skb: 1 callbacks suppressed [ 2370.113263][ T27] audit: type=1804 audit(1579947982.325:1119): pid=28792 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1023/file0/file0" dev="loop3" ino=3271 res=1 [ 2370.170131][T28803] bond0: (slave bond248): Enslaving as an active interface with an up link [ 2370.361938][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2370.367753][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2370.373648][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2370.379526][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2370.509167][ T27] audit: type=1800 audit(1579947982.325:1120): pid=28792 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.3" name="file0" dev="loop3" ino=3271 res=0 [ 2370.670684][ T27] audit: type=1804 audit(1579947982.415:1121): pid=28799 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1023/file0/file0" dev="loop3" ino=3271 res=1 [ 2370.884327][T28803] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2371.031530][ T27] audit: type=1804 audit(1579947983.235:1122): pid=28808 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/995/file0/file0" dev="loop5" ino=3278 res=1 [ 2371.057246][ T27] audit: type=1800 audit(1579947983.235:1123): pid=28808 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.5" name="file0" dev="loop5" ino=3278 res=0 [ 2371.077082][ T27] audit: type=1804 audit(1579947983.235:1124): pid=28812 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/995/file0/file0" dev="loop5" ino=3278 res=1 10:26:23 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0xe00, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) 10:26:23 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x3f000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2371.415532][T28824] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2371.496736][T28826] 8021q: adding VLAN 0 to HW filter on device bond249 [ 2371.532597][T28826] bond0: (slave bond249): Enslaving as an active interface with an up link [ 2371.541345][ T27] audit: type=1804 audit(1579947983.745:1125): pid=28813 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1296/file0/file0" dev="loop0" ino=3279 res=1 [ 2371.664085][T28826] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:26:23 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSBRK(r1, 0x5409, 0x5) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2371.721943][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2371.727721][ C0] protocol 88fb is buggy, dev hsr_slave_1 10:26:24 executing program 5: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x1300000000000000) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:26:24 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0xf00, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2372.577627][T28850] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2372.741651][ T27] audit: type=1804 audit(1579947984.945:1126): pid=28845 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1297/file0" dev="sda1" ino=16759 res=1 [ 2372.766814][ T27] audit: type=1804 audit(1579947984.975:1127): pid=28836 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1024/file0/file0" dev="loop3" ino=3284 res=1 [ 2372.792977][ T27] audit: type=1804 audit(1579947984.975:1128): pid=28849 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1024/file0/file0" dev="loop3" ino=3284 res=1 [ 2372.895576][T28858] 8021q: adding VLAN 0 to HW filter on device bond250 [ 2373.770499][T28858] bond0: (slave bond250): Enslaving as an active interface with an up link 10:26:26 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xf6ffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2374.047548][T28858] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:26:26 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x0, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:26:26 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x1e5842, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:26:27 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0x4000, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2375.158639][ T27] kauditd_printk_skb: 1 callbacks suppressed [ 2375.158661][ T27] audit: type=1800 audit(1579947987.365:1130): pid=28881 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.0" name="bus" dev="sda1" ino=17081 res=0 [ 2375.297578][T28894] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2375.500142][ T27] audit: type=1800 audit(1579947987.625:1131): pid=28887 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.0" name="bus" dev="sda1" ino=17081 res=0 [ 2375.731486][T28898] 8021q: adding VLAN 0 to HW filter on device bond251 [ 2375.801991][ C1] net_ratelimit: 14 callbacks suppressed [ 2375.802001][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2375.813690][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2375.819529][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2375.825440][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2375.839549][T28898] bond0: (slave bond251): Enslaving as an active interface with an up link [ 2375.858181][ T27] audit: type=1804 audit(1579947988.065:1132): pid=28893 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1025/file0/file0" dev="loop3" ino=3291 res=1 [ 2375.892009][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2375.897802][ C0] protocol 88fb is buggy, dev hsr_slave_1 10:26:28 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xe8) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:26:28 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xfeffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2376.152473][T28898] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2376.180392][ T27] audit: type=1800 audit(1579947988.065:1133): pid=28893 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.3" name="file0" dev="loop3" ino=3291 res=0 [ 2376.201056][ T27] audit: type=1804 audit(1579947988.065:1134): pid=28891 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1025/file0/file0" dev="loop3" ino=3291 res=1 10:26:28 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0x5865, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2376.494011][T28914] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2376.537317][T28914] 8021q: adding VLAN 0 to HW filter on device bond252 [ 2376.561409][T28914] bond0: (slave bond252): Enslaving as an active interface with an up link [ 2376.602170][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2376.608278][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2376.614289][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2376.620091][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2376.713129][T28920] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2376.735332][ T27] audit: type=1804 audit(1579947988.945:1135): pid=28910 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1026/file0/file0" dev="loop3" ino=3295 res=1 10:26:29 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xff000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:26:29 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0x6000, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2377.258776][T28931] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2377.299556][T28931] 8021q: adding VLAN 0 to HW filter on device bond253 [ 2377.310182][T28931] bond0: (slave bond253): Enslaving as an active interface with an up link 10:26:29 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) r1 = socket$kcm(0x2, 0x2, 0x73) bind(r1, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) getpeername(r1, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) connect$inet6(r2, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @empty, 0x9}, 0x1c) sendmsg$TEAM_CMD_PORT_LIST_GET(r2, &(0x7f0000002580)={0x0, 0x0, 0x0}, 0x4000000) r3 = socket$kcm(0x2, 0x2, 0x73) bind(r3, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) getpeername(r3, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) connect$inet6(r4, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @empty, 0x9}, 0x1c) sendmsg$TEAM_CMD_PORT_LIST_GET(r4, &(0x7f0000002580)={0x0, 0x0, 0x0}, 0x4000000) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000400)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f0000000240)=0xcc) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) prctl$PR_SET_NAME(0xf, &(0x7f0000000080)='memory.events\x00') openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2377.432816][T28935] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:26:29 executing program 5: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x2000000000000000) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:26:29 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0x6558, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2377.928907][T28952] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2378.150888][ T27] audit: type=1804 audit(1579947990.355:1136): pid=28939 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1300/file0" dev="sda1" ino=17084 res=1 [ 2378.397316][T28959] 8021q: adding VLAN 0 to HW filter on device bond254 [ 2378.599282][T28959] bond0: (slave bond254): Enslaving as an active interface with an up link [ 2379.701979][ T27] audit: type=1804 audit(1579947991.905:1137): pid=28954 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/997/file0/file0" dev="loop5" ino=3304 res=1 [ 2379.794327][ T27] audit: type=1800 audit(1579947991.905:1138): pid=28954 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.5" name="file0" dev="loop5" ino=3304 res=0 [ 2379.892156][ T27] audit: type=1804 audit(1579947991.905:1139): pid=28978 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/997/file0/file0" dev="loop5" ino=3304 res=1 10:26:32 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0x8100, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) 10:26:32 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000400)={0x0, 0x0}) sched_setattr(r2, &(0x7f0000000480)={0x38, 0x5, 0x20, 0x3, 0x2000, 0x5, 0x7f, 0x6, 0xaa4e, 0x80000000}, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) r3 = socket$kcm(0x2, 0x2, 0x73) bind(r3, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) getpeername(r3, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) connect$inet6(r4, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @empty, 0x9}, 0x1c) sendmsg$TEAM_CMD_PORT_LIST_GET(r4, &(0x7f0000002580)={0x0, 0x0, 0x0}, 0x4000000) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f00000000c0)={@multicast2, @local, 0x0}, &(0x7f0000000180)=0xc) r6 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vcsa\x00', 0x101800, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000300)={&(0x7f0000003400)=ANY=[@ANYBLOB="2c0e00006400000226bd7000fddbdf2500000000", @ANYRES32=r5, @ANYBLOB="0f00f1ff0a000a000a00e0ff070001006677000053fe02001404020004040300ffffff7f100000000500000010000000200c000006000000feffffff020000007c0e000004000000090000008e00000002000000020000003d25826654000000050000000100008020000000ff000000010100000000000001000100f63b0000080000008a090000ffffff7f0800000000010000860000000010000081ffffff0500000036000000f8070000c70900000300000001000080ffff00000010000000000054890000001f00000004000000000000000100010080000000008000007ca90000030000000180ffffd6080000f80200000300000001000000ff0f00000400000001ffffff0001000040000000810000000000000000a000004000000004000000ff0300000200000000040000040000000000008009000000a9df0000050000000700000081000000ffffffff050000000500000004000000ef0a00000300000003000000010100000700000045bd00000347ffff01000000ff07000006000000ffffffff04000000070000000900000000040000f8ffffff01000000010000000000000004000000c6000000ff000000660b00000000bb00eb000000ff000000cb000000960000000004000008000000feffffff000000c800000000ff01000001010000ffffffff80000000000000800700000003000000070000007607000005000000ff0f000005000000a300000092000000000000d0090000004000000002000000060000000000000008000000c0d7250000080000c6000000020000000300000002000000ff7f0000fbffffff65c6000005000000b600000001000000070000000200000000020000ff010000008000000500000000000080030000000600000003000000ffffff7fff0f000003000000ff7000000000000065070000a301000009000000000800000300000003000000080000000300000001000000d800000001000000050000000100010000000000020000001b0400000200000007000000c3381e4d01000080ff030000d300000001000000060000009244000000100000000001000000000003000000010000004200000007000000030000000300000087000000010000805626cf5afcffffffffffff7f000000000700000080000000310c000004000000008000000180ffffff030000090000000101000000000000e5d700000100000007000000ff01000025720000020000000500000002000000020000000000008001feffff00000030d82e00000104000008000000ff000000ff7fffffffffffff09000000ff0700000500000003000000e300000007000000060000000000000008000000ed0000000700000006000000f40b00000001000009000000020000007f000000d100000008000000000200000010000000010000ff0f00000700000000fcffff0800000008000000008000000c0009000500000000000000060005000701000008000b00ffffffff0600050008090000080001007533320018000200140008007866726d30000000000000000000000008000b009700000009000100666c6f77000000004c01020008000700c608000020010b80300002802c00020000000400ffff00000c0001000100ff001f007a0108000300010000000c0001001f000801090001020000030001000300b2510000000000070001000109000000320e0000c4000280400001000700000009000000d9703e3b3a4d6b385ce6c06ee8d1429bbc209a68b18504e56e8bedcd0e096c29e61fb9d91ce9b91d8eb6dbbdbc8f19cb8cadc9b6800002000700090000000000050004000c0000000500040002000000050003001f000000050004000a0000004c000500bd58ea9b5b85160992a11b9440da75ff6a11903075598464587e74a3a2699c75c489af22128b996c70874862da601e1d4f9fe283e993817dd377a5d96c70d58c57f9ab66c2578d240800010001000000080001000600000018000280140002000500020003000000060000000220f6e20800010002000000080006000100010008000400018000000800040000000000080008000000008008000100627066004808020008000900040000000c0007002e2f66696c65300018080200040402000200000001000000000001000400000081000000ff000000080000000004000094b863770000000001040000050000000600000003000000faffffffab09000006000000e5060000800000000400000005000000001000000200000009000000000000000700000040000000090000000008000002000000ff010000ffff000000000000f9ffffffff7f00000500000001000000ffffffff010001003b000000faffffffb80f00000900000008000000010100007f000000fbffffff00000080caf0000004000000030000000004000001ffffff09000000000400000008000007000000070000000080ffff02000000030000006224000007000000ac0f00000800000009000000f8ffffff000000004ca3b72981000000060000001e02000006000000040000000400000006000000000000004000000001000000fff5ffffbc0c00005f000000090000006c00000005000000070000000300000095000000040000000000008009000000008000000010000004000000080000000900000075690000040000000200000000020000008000000100008000000000810000003f00000002000000080000002500000009000000a0ffffff050000000600000000000000c0ffffff0700000002000000b83a00000208000007000000400000000600000000000000010100004c2e000006000000feffffff060000000600000000feffff0400000088000000ffffff7fbb0000000000000006000000000000007f000000050000000000010007000000000000000600000004000000040000000200000000000000feffffffffffffff000000800101000004000000ff070000000018000000000006000000ff0f0000efa80000010000000100000008000000080000006a0400000100000001000000090000003f000000ff010000030000003f00000003000000000100000700000005000000010000000500000002000000857e0000030000000900000081060000050000000200000003000000070000000000000005000000ffffffff00800000bc0500000008000004000000a50000000800000006000000f025000000100000250800000000000001000080a6000000cc000000030000000100000004000000f60000000200000004000000ffff00000500000034e400000100000008000000f2000000f8ffffff0800000000000000190200000500000001000000040000000800000004000000009c0d0008000000a5090000810000000500000066000000b00c00000400000000000000ff00000000080000150000000300000013000000f3f1ffff7d0e00000900000000010000ffffffff0200000003000000420000000800000008000000010000000600000003000000060400000500000001000000070000000800000000000000ff0100000c00080001000080000000000404030008000000000200000700000077080000070000000900000081000000010000003f0000000400000000800000000000000000008003000000d8000000090000000500000001010000050000008000000061d3b21d00000080f8ffffff0800000000004000e20000005806000003000000060000007f00000005000000070000000700000060d5000003000000e9eb73220700000000040000050000001e0000001f000000010000000100000009000000e20000000100000007000000090000000400000004000000ffff000000800000000001000600000001040000090000006c0d000008000000000200000800000001010000030000000600000004000000010000801004000006000000c50800000700000006000000020000000008000080ffffffb3ff000081000000410b000001000000140c00000100ffff7f00000000010000ff0f000040000000080000006b090000a9910000ffffff7f05000000c30e000000000000feffffff560000000100000000000000f8ffffff05000000210e0000ff0100000000000008000000050000000000000008000000ffffff7f20000000ffffffffffffffff80000000ffff0000008000007d0e0000ff00000005000000070000007f0000000800000004000000ffff000007000000030000000100000000400200000100000600000006000000080000000900000002000000050000003ee5732401000000ff07000000000000040000007f0000003f000000080000000900000055bdffff010000000900000001000080f906000020000000ff0f000005000000776128340001000000004800ffff00000100010001000000ff0700007a080000f7ffffffff07000004000000ff0100001c3d0000ebe2000006000000030000000100010006000000000000206e02000001000000080000008100000005000000020000002fe5000005000000000000000900000005000000000000000800000002000000000200007f000000090000000000000001fcffff0400000007000000040000000800000008000000080000000400000007000000f9ffffff1f00000009000000070000007f000000ff03000008000000b9000000ff0f000004000000ff01000001000000060000000400000034840000000100001f0000007d0000005e0300000800000008000000000040007b000000440b00000008000006000000bc1100000000010008000000950e00000700000020000000d9000000fbffffff06000000000400000400000081000000ff7f00000300000005000000000800000400000071f6ffff2c0700000000010007000000b90000000100000005000000fdffffff3f00000002000000030000000700000000000000090000000800000002000000015500000100000005000000ad94000040000000080009000200000008000600", @ANYRES32=r6, @ANYBLOB="0100000000000000"], 0xe2c}, 0x1, 0x0, 0x0, 0x1}, 0x20000000) 10:26:32 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = creat(&(0x7f0000000280)='./file0\x00', 0x0) close(r3) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r3, 0xc00c642d, &(0x7f0000000000)={0x0}) r5 = creat(&(0x7f0000000280)='./file0\x00', 0x0) close(r5) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r2, 0xc00c642d, &(0x7f00000000c0)={r4, 0x80000, r5}) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f0000000100)={0x1}) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) r6 = socket$kcm(0x2, 0x2, 0x73) bind(r6, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) getpeername(r6, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) connect$inet6(r7, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @empty, 0x9}, 0x1c) sendmsg$TEAM_CMD_PORT_LIST_GET(r7, &(0x7f0000002580)={0x0, 0x0, 0x0}, 0x4000000) setsockopt$inet_tcp_int(r7, 0x6, 0x4, &(0x7f0000000040)=0x7, 0x4) recvfrom(r0, 0x0, 0x0, 0x2, &(0x7f0000000140)=@ax25={{0x3, @default}, [@bcast, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x80) r8 = syz_open_dev$mice(&(0x7f0000000380)='/dev/input/mice\x00', 0x0, 0x404c00) r9 = socket$inet(0x2, 0x4000000805, 0x0) r10 = socket$inet_sctp(0x2, 0x5, 0x84) r11 = dup3(r9, r10, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r10, 0x84, 0x64, &(0x7f0000d6cff0)=[@in={0x2, 0x4e20, @loopback}], 0x10) sendto$inet(r11, &(0x7f00000000c0)='\t', 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendto$inet(r10, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r10, 0x84, 0x1d, &(0x7f00000003c0)=ANY=[@ANYBLOB="0379d271278d225b7db4f685975069c3c8612f73f90b36adc9f8d11e2222b1904fa45f0fc112dfe96739eee51223e5f406ddf47506abe2360007f4dd0d38696ee0a800308a8eb52fb7fb1983ceb114e0391d30bd52132effd9db2bcdedae35fcb586d6", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0], &(0x7f0000a8a000)=0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r11, 0x84, 0x7a, &(0x7f000059aff8)={r12}, &(0x7f000034f000)=0x2059b000) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r8, 0x84, 0x7c, &(0x7f0000000340)={r12, 0x7f, 0x7}, 0x8) 10:26:32 executing program 5: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x3f00000000000000) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:26:32 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xfffffff6) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:26:32 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x0, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:26:32 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) r1 = socket$kcm(0x2, 0x2, 0x73) bind(r1, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) getpeername(r1, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) connect$inet6(r2, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @empty, 0x9}, 0x1c) sendmsg$TEAM_CMD_PORT_LIST_GET(r2, &(0x7f0000002580)={0x0, 0x0, 0x0}, 0x4000000) r3 = socket$kcm(0x2, 0x2, 0x73) bind(r3, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) getpeername(r3, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) connect$inet6(r4, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @empty, 0x9}, 0x1c) sendmsg$TEAM_CMD_PORT_LIST_GET(r4, &(0x7f0000002580)={0x0, 0x0, 0x0}, 0x4000000) setsockopt$inet_tcp_int(r4, 0x6, 0x10000000013, &(0x7f0000d06000)=0x6, 0x4) r5 = socket$inet_udplite(0x2, 0x2, 0x88) r6 = dup(r5) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000040)=0x1, 0x4) recvfrom(r0, 0x0, 0x0, 0x2, &(0x7f0000000140)=@ax25={{0x3, @default}, [@bcast, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x80) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0}, &(0x7f00000000c0)=0xc) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0}, &(0x7f00000001c0)=0xc) getresuid(&(0x7f0000000200), &(0x7f0000000240), &(0x7f0000000280)=0x0) r10 = creat(&(0x7f0000000280)='./file0\x00', 0x0) close(r10) r11 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000300)='/dev/cachefiles\x00', 0x10000, 0x0) ioctl$UDMABUF_CREATE_LIST(r6, 0x40087543, &(0x7f0000000340)={0x0, 0x3, [{r6, 0x0, 0xfffffffff0000000, 0x1000}, {r10, 0x0, 0x0, 0x1000}, {r11, 0x0, 0x4000, 0x10ffff000}]}) setresuid(r7, r8, r9) [ 2380.136275][T28988] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2380.441295][T28994] 8021q: adding VLAN 0 to HW filter on device bond255 [ 2380.565556][T28994] bond0: (slave bond255): Enslaving as an active interface with an up link [ 2380.943078][T28988] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:26:34 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup(r1) exit_group(0x2) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000040)=0x1, 0x4) recvfrom(r0, 0x0, 0x0, 0x2, &(0x7f0000000140)=@ax25={{0x3, @default}, [@bcast, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x716000) openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video37\x00', 0x2, 0x0) [ 2381.765155][ T27] audit: type=1804 audit(1579947993.975:1140): pid=29018 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1301/file0/file0" dev="sda1" ino=17096 res=1 10:26:34 executing program 5: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xe5ffffff00000000) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:26:34 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) accept4$netrom(r0, &(0x7f0000000080)={{0x3, @bcast}, [@netrom, @remote, @netrom, @null, @remote, @rose, @rose, @rose]}, &(0x7f0000000180)=0x48, 0x80800) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2382.114658][ T27] audit: type=1804 audit(1579947994.325:1141): pid=29025 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1028/file0/file0" dev="loop3" ino=3311 res=1 [ 2382.141187][ C0] net_ratelimit: 14 callbacks suppressed [ 2382.141195][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2382.152759][ C0] protocol 88fb is buggy, dev hsr_slave_1 10:26:34 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0x34000, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) 10:26:34 executing program 1: shutdown(0xffffffffffffffff, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) r2 = socket$inet(0x2, 0xa, 0x3) r3 = socket$inet_sctp(0x2, 0x5, 0x84) r4 = dup3(r2, r3, 0x0) r5 = fcntl$dupfd(0xffffffffffffffff, 0x406, r4) ioctl$DRM_IOCTL_AGP_FREE(r5, 0x40206435, &(0x7f0000000100)={0x5, 0x0, 0x1, 0x8}) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000d6cff0)=[@in={0x2, 0x4e20, @loopback}], 0x10) sendto$inet(r4, &(0x7f00000000c0)='\t', 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) exit(0xfffffffffffffff9) sendto$inet(r3, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f0000000480)=ANY=[@ANYBLOB="f9cdf231b6a89f19766509000000ddc25c3fe52e8804dd2cd90a118e48c76226c1fefa2565819ead0f6cc30cbd85f9eebd73028e9d8072ed7cde0e1ef4f89dd2c3cd9560f858f8c210a2b9a21df80104fe05321c8cb7b536b312886cb8234309c95f709a15d0b6348ee6581b79b51a36645aff0fd142fe81ae8fd4d6d0da824f742cb3315d87b9a53fd29576fedae0640cdb0891f7b1f0367047c6dfdda94166868d00879125081d9bbd829a8d15cc47778b040333377de9d8a3de64365798e3c03e11729ba92c83d1b3379701dbf568c3dc170ed2ecf23b7337a80cea4ca6bf84533df86805f6bd89f9515d89106e36a0fccf4a715ed868b227153452656bba71ba6388b3e529e49e6ebb67c413c4a5bf1577bb92ec00ee184eae145054c6c54f40a3dd2a72071dfb099ccf07d011d35d5870808ac95412e44d0a280002662c22e331601b26c0c70f0d53ee8bdec1bece0ed0c76a78e42d005f683564e476b25dd7145bf6ca28d9159024b7a13d0966e00baef9abcf49ee2c96e4107c81dd536a66fba1874aa682e1c12a4a34b4e9edbc58ffffc6d275c404286bff68d3b570851a4fa618da47f942394022e5d9ab27e112c4ab436b5982636d3d41be5761ac3896245c81d6bd684b592e0f131f0f06de82e6ba4ef192fd45ac01354e5c9fd2e8fbeb232e6329bb4e7efeb9294d7bb6480a6b44fb3cac82e3bf8f2d34b6390d9197f0cc1f5b", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0], &(0x7f0000a8a000)=0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r4, 0x84, 0x7a, &(0x7f000059aff8)={r6}, &(0x7f000034f000)=0x2059b000) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000000000)={0x9, 0x272f, 0x5, 0x8000, 0x3, 0x88dc, 0xf4, 0x7fffffff, r6}, &(0x7f00000000c0)=0x20) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x24, &(0x7f0000000040)=0x1, 0x4) getdents64(r1, &(0x7f0000000300)=""/205, 0xcd) recvfrom(0xffffffffffffffff, 0x0, 0x0, 0x2, &(0x7f0000000140)=@ax25={{0x3, @default}, [@bcast, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x716000) [ 2382.490969][T29037] syz-executor.1 uses obsolete (PF_INET,SOCK_PACKET) [ 2382.589922][T29043] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2382.627489][T29043] bond256 (uninitialized): Released all slaves [ 2382.752155][T29047] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2382.851986][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2382.857958][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2382.863766][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2382.869525][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2382.895780][T29043] 8021q: adding VLAN 0 to HW filter on device bond256 [ 2382.950450][T29043] bond0: (slave bond256): Enslaving as an active interface with an up link 10:26:35 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0x400300, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2383.319028][T29056] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2383.559165][ T27] audit: type=1804 audit(1579947995.765:1142): pid=29046 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1302/file0/file0" dev="loop0" ino=3315 res=1 [ 2383.657329][T29064] 8021q: adding VLAN 0 to HW filter on device bond257 [ 2383.766931][T29064] bond0: (slave bond257): Enslaving as an active interface with an up link [ 2383.781349][ T27] audit: type=1800 audit(1579947995.805:1143): pid=29046 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="loop0" ino=3315 res=0 10:26:36 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_genetlink_get_family_id$gtp(&(0x7f0000000100)='gtp\x00') r4 = socket$netlink(0x10, 0x3, 0x2) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x69a) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r7, @ANYBLOB="0000000000000000280012000c000100766574680000000018000200fd0001000000000023cd3741ce8074c5fe8524c0306554362ddd4c0617b1ed0cd8cb892ef805ab93a186423f124b7c6a03d724f7ead1ef33adfdbe08b8c5236b93b9797b4409f6e3", @ANYRES32=0x0, @ANYBLOB="00000079abd1932a"], 0x48}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0x0, 0x0, 0x0, r7}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) sendmsg$GTP_CMD_NEWPDP(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x30, r3, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@GTPA_TID={0xc, 0x3, 0x4}, @GTPA_MS_ADDRESS={0x8, 0x5, @multicast2}, @GTPA_LINK={0x8, 0x1, r7}]}, 0x30}, 0x1, 0x0, 0x0, 0x840}, 0x80) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000040)=0x1, 0x4) r8 = socket$kcm(0x2, 0x2, 0x73) bind(r8, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) getpeername(r8, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) connect$inet6(r9, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @empty, 0x9}, 0x1c) sendmsg$TEAM_CMD_PORT_LIST_GET(r9, &(0x7f0000002580)={0x0, 0x0, 0x0}, 0x4000000) recvfrom(r9, 0x0, 0x0, 0x12001, &(0x7f0000000140)=@ax25={{0x3, @default, 0xfffffffd}, [@bcast, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @default, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x80) 10:26:36 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x0, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2383.909299][ T27] audit: type=1804 audit(1579947995.805:1144): pid=29035 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1302/file0/file0" dev="loop0" ino=3315 res=1 10:26:36 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) r2 = socket$kcm(0x2, 0x2, 0x73) bind(r2, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) getpeername(r2, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) connect$inet6(r3, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @empty, 0x9}, 0x1c) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f0000002580)={0x0, 0x0, 0x0}, 0x4000000) ioctl$sock_SIOCGSKNS(r3, 0x894c, &(0x7f0000000080)=0x5694e0a0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2383.965720][T29072] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.1'. [ 2383.985575][T29056] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2384.122227][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2384.128047][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2384.133877][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2384.139746][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2384.147851][T29075] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.1'. 10:26:36 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xfffffffe) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:26:36 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0x1000000, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) 10:26:36 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = syz_open_dev$usbfs(&(0x7f0000001280)='/dev/bus/usb/00#/00#\x00', 0x200, 0x802) ioctl$USBDEVFS_CONTROL(r2, 0x8108551b, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$USBDEVFS_SETINTERFACE(r2, 0x80045510, &(0x7f0000000100)) sendfile(0xffffffffffffffff, r2, &(0x7f0000000040)=0x1, 0x5) fallocate(r2, 0x2, 0x1, 0xffff) r3 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000040)=0x1, 0x4) recvfrom(r0, 0x0, 0x0, 0x2, &(0x7f0000000140)=@ax25={{0x3, @default}, [@bcast, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x716000) [ 2384.555132][T29090] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2384.589596][T29090] 8021q: adding VLAN 0 to HW filter on device bond258 [ 2384.606916][T29090] bond0: (slave bond258): Enslaving as an active interface with an up link 10:26:36 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$kcm(0x2, 0x2, 0x73) bind(r1, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) getpeername(r1, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r2, 0x6, 0x21, &(0x7f0000000380)="c4fad4bd4c23482d3414ffe2e76833b9", 0x10) connect$inet6(r2, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @empty, 0x9}, 0x1c) sendmsg$TEAM_CMD_PORT_LIST_GET(r2, &(0x7f0000002580)={0x0, 0x0, 0x0}, 0x4000000) setsockopt$IP_VS_SO_SET_EDIT(r2, 0x0, 0x483, &(0x7f0000000000)={0x2c, @multicast1, 0x4e24, 0x1, 'ovf\x00', 0x9, 0x8, 0x67}, 0x2c) shutdown(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r3 = socket$inet_udplite(0x2, 0x2, 0x88) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = socket$kcm(0x2, 0x2, 0x73) bind(r5, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) getpeername(r5, &(0x7f0000000300)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) connect$inet6(r6, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @empty, 0x9}, 0x1c) sendmsg$TEAM_CMD_PORT_LIST_GET(r6, &(0x7f0000002580)={0x0, 0x0, 0x0}, 0x4000000) getsockopt$IP_VS_SO_GET_INFO(r6, 0x0, 0x481, &(0x7f0000000100), &(0x7f0000000280)=0xc) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000040)=0x1, 0x4) recvfrom(r0, 0x0, 0x0, 0x2, &(0x7f0000000140)=@ax25={{0x3, @default}, [@bcast, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x716000) [ 2384.794879][T29101] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2384.817758][ T27] audit: type=1804 audit(1579947997.025:1145): pid=29093 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1303/file0/file0" dev="sda1" ino=17076 res=1 [ 2387.230132][ T27] audit: type=1804 audit(1579947999.185:1146): pid=29110 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/999/file0/file0" dev="loop5" ino=3323 res=1 [ 2388.170243][ T27] audit: type=1800 audit(1579948000.325:1147): pid=29087 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="sda1" ino=17076 res=0 [ 2388.222074][ T27] audit: type=1800 audit(1579948000.425:1148): pid=29114 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.3" name="file0" dev="loop3" ino=3321 res=0 [ 2388.281948][ C1] net_ratelimit: 8 callbacks suppressed [ 2388.281964][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2388.293361][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2388.299118][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2388.304951][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2388.362829][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2388.368625][ C0] protocol 88fb is buggy, dev hsr_slave_1 10:26:40 executing program 5: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xf6ffffff00000000) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:26:40 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$kcm(0x2, 0x2, 0x73) bind(r1, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) getpeername(r1, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) r2 = socket$kcm(0x2, 0x2, 0x73) bind(r2, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) getpeername(r2, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) connect$inet6(r3, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @empty, 0x9}, 0x1c) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f0000002580)={0x0, 0x0, 0x0}, 0x4000000) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000040)=0x1, 0x4) perf_event_open(&(0x7f0000000300)={0x5, 0x70, 0x1, 0x1f, 0xb4, 0x8, 0x0, 0xffffffff00000000, 0x22028, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x7fffffff, 0x0, @perf_config_ext={0x0, 0x5}, 0x4, 0x200, 0x8a, 0x1, 0xffffffff, 0x4, 0xfc01}, 0x0, 0x9, r4, 0x0) recvfrom(r0, 0x0, 0x0, 0x10022, &(0x7f00000000c0)=@ax25={{0x3, @default}, [@bcast, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) 10:26:40 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) ioctl$SNDCTL_DSP_GETIPTR(r1, 0x800c5011, &(0x7f0000000080)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:26:40 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0x2000000, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) 10:26:40 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x1000000000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:26:40 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x0, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2388.499141][T29132] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2388.771046][T29138] 8021q: adding VLAN 0 to HW filter on device bond259 10:26:41 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000001280)='/dev/bus/usb/00#/00#\x00', 0x200, 0x802) ioctl$USBDEVFS_CONTROL(r1, 0x8108551b, &(0x7f0000000100)={0x80, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0}) ioctl$USBDEVFS_SETINTERFACE(r1, 0x80045510, &(0x7f0000000100)) sendfile(0xffffffffffffffff, r1, &(0x7f0000000040)=0x1, 0x5) getsockname(r0, &(0x7f00000001c0)=@nfc, &(0x7f00000000c0)=0x80) fcntl$getownex(r1, 0x10, &(0x7f0000000000)) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) r4 = creat(&(0x7f0000000280)='./file0\x00', 0x0) close(r4) ioctl$NS_GET_USERNS(r4, 0xb701, 0x0) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000040)=0x1, 0x4) recvfrom(r0, 0x0, 0x0, 0x2, &(0x7f0000000140)=@ax25={{0x3, @default}, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x80) [ 2388.873835][T29138] bond0: (slave bond259): Enslaving as an active interface with an up link [ 2389.081981][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2389.087810][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2389.093632][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2389.099402][ C0] protocol 88fb is buggy, dev hsr_slave_1 10:26:41 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup(r1) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000300)={0x1e8, 0x3, 0x1, 0x101, 0x0, 0x0, {0xc, 0x0, 0x3}, [@CTA_SEQ_ADJ_REPLY={0x2c, 0x10, 0x0, 0x1, [@CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x7fff}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x6ed}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x97c9}, @CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x72b2c81b}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x582d}]}, @CTA_PROTOINFO={0x30, 0x4, 0x0, 0x1, @CTA_PROTOINFO_SCTP={0x2c, 0x3, 0x0, 0x1, [@CTA_PROTOINFO_SCTP_STATE={0x5, 0x1, 0x5}, @CTA_PROTOINFO_SCTP_VTAG_ORIGINAL={0x8}, @CTA_PROTOINFO_SCTP_VTAG_ORIGINAL={0x8, 0x2, 0x1, 0x0, 0x8000}, @CTA_PROTOINFO_SCTP_VTAG_ORIGINAL={0x8, 0x2, 0x1, 0x0, 0xce}, @CTA_PROTOINFO_SCTP_STATE={0x5, 0x1, 0x1}]}}, @CTA_TUPLE_ORIG={0x54, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x8, 0x2, @rand_addr=0x401}}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @dev={0xac, 0x14, 0x14, 0x20}}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}]}, @CTA_TUPLE_ORIG={0x5c, 0x1, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x84}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @local}, {0x8, 0x2, @rand_addr=0x4}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @broadcast}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}]}, @CTA_TUPLE_MASTER={0xc8, 0xe, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @remote}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @local}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @remote}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @ipv4={[], [], @empty}}, {0x14, 0x4, @ipv4={[], [], @broadcast}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2b}}]}]}, 0x1e8}, 0x1, 0x0, 0x0, 0x8008800}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000040)=0x1, 0x4) r3 = socket$kcm(0x2, 0x2, 0x73) bind(r3, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) getpeername(r3, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) connect$inet6(r4, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @empty, 0x9}, 0x1c) sendmsg$TEAM_CMD_PORT_LIST_GET(r4, &(0x7f0000002580)={0x0, 0x0, 0x0}, 0x4000000) r5 = socket$kcm(0x2, 0x2, 0x73) bind(r5, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) getpeername(r5, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) connect$inet6(r6, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @empty, 0x9}, 0x1c) sendmsg$TEAM_CMD_PORT_LIST_GET(r6, &(0x7f0000002580)={0x0, 0x0, 0x0}, 0x4000000) r7 = socket$inet(0x2, 0x4000000805, 0x0) r8 = socket$inet_sctp(0x2, 0x5, 0x84) r9 = dup3(r7, r8, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r8, 0x84, 0x64, &(0x7f0000d6cff0)=[@in={0x2, 0x4e20, @loopback}], 0x10) sendto$inet(r9, &(0x7f00000000c0)='\t', 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendto$inet(r8, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r8, 0x84, 0x1d, &(0x7f00000005c0)=ANY=[@ANYBLOB="030000008bfe40278f8960a26fd2396968327567ccc25439ee8a030a62cbbaec3945c48769b029708acb2471d504b08d77707c0c0c87", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0], &(0x7f0000a8a000)=0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r9, 0x84, 0x7a, &(0x7f000059aff8)={r10}, &(0x7f000034f000)=0x2059b000) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r6, 0x84, 0x72, &(0x7f0000000500)={r10, 0xfffffff8, 0x30}, &(0x7f0000000540)=0xc) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r4, 0x84, 0x75, &(0x7f0000000580)={r11, 0x303}, 0x8) r12 = creat(&(0x7f0000000280)='./file0\x00', 0x0) close(r12) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r12, 0x4008240b, &(0x7f0000000200)={0x1, 0x70, 0x40, 0x3, 0x6, 0x1, 0x0, 0x72, 0x10000, 0x3, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x1, 0x0, 0x9, 0x8, 0xfffffffffffffffd, 0x1ff, 0x8000}) [ 2389.243788][T29132] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:26:41 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0x3000000, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2389.647128][ T27] audit: type=1804 audit(1579948001.855:1149): pid=29144 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1304/file0/file0" dev="loop0" ino=3326 res=1 10:26:41 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000040)=0x1, 0x4) r3 = creat(&(0x7f0000000280)='./file0\x00', 0x0) close(r3) ioctl$SNDCTL_DSP_GETISPACE(r3, 0x8010500d, &(0x7f0000000000)) recvfrom(r0, 0x0, 0x0, 0x2, &(0x7f0000000140)=@ax25={{0x3, @default}, [@bcast, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x716000) [ 2389.699883][ T27] audit: type=1800 audit(1579948001.855:1150): pid=29144 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="loop0" ino=3326 res=0 [ 2389.732780][ T27] audit: type=1804 audit(1579948001.855:1151): pid=29152 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1304/file0/file0" dev="loop0" ino=3326 res=1 10:26:42 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = creat(&(0x7f0000000280)='./file0\x00', 0x0) close(r2) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000000c0)={0xcf20, [0x7, 0x8000, 0x7, 0x400, 0x8, 0x401, 0xfae6, 0x9, 0xfff7, 0x1ff, 0x2, 0x1, 0x3ff, 0x1274, 0x3ff, 0xffff, 0xfffd, 0x1, 0x0, 0xfff, 0x7, 0x1, 0xffff, 0x1, 0x54b, 0x635e, 0x1, 0x4, 0x936c, 0x7ff, 0x4, 0x4, 0x0, 0x100, 0x80, 0x1, 0x6, 0x70a4, 0x3, 0x1, 0x3, 0x2, 0x7, 0x9, 0x1000, 0x0, 0x6, 0x5], 0x1}) r3 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000001c0)={0x1, &(0x7f0000000000)=[{0x9, 0x4e, 0x5d, 0x401}]}) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000040)=0x1, 0x4) recvfrom(r0, 0x0, 0x0, 0x2, &(0x7f0000000140)=@vsock={0x28, 0x0, 0x2711, @my=0x1}, 0x80) [ 2389.853122][T29163] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2389.929378][T29165] 8021q: adding VLAN 0 to HW filter on device bond260 [ 2389.948835][T29165] bond0: (slave bond260): Enslaving as an active interface with an up link 10:26:42 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r1 = creat(&(0x7f0000000280)='./file0\x00', 0x0) close(r1) ioctl$KVM_GET_DEBUGREGS(r1, 0x8080aea1, &(0x7f00000000c0)) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000040)=0x1, 0x4) recvfrom(r0, 0x0, 0x0, 0x2, &(0x7f0000000140)=@ax25={{0x3, @default}, [@bcast, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x716000) [ 2390.132503][T29163] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2392.282097][ T27] audit: type=1804 audit(1579948004.485:1152): pid=29199 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/1000/file0/file0" dev="loop5" ino=3332 res=1 [ 2392.436398][ T27] audit: type=1800 audit(1579948004.485:1153): pid=29199 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.5" name="file0" dev="loop5" ino=3332 res=0 [ 2392.488133][ T27] audit: type=1804 audit(1579948004.485:1154): pid=29203 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/1000/file0/file0" dev="loop5" ino=3332 res=1 [ 2392.536199][ T27] audit: type=1804 audit(1579948004.495:1155): pid=29204 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1030/file0/file0" dev="loop3" ino=3334 res=1 [ 2392.562156][ T27] audit: type=1800 audit(1579948004.495:1156): pid=29204 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.3" name="file0" dev="loop3" ino=3334 res=0 [ 2392.615095][ T27] audit: type=1804 audit(1579948004.515:1157): pid=29193 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1030/file0/file0" dev="loop3" ino=3334 res=1 10:26:45 executing program 5: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xfeffffff00000000) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:26:45 executing program 0: r0 = gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) prctl$PR_GET_NAME(0x10, &(0x7f0000000080)=""/101) r1 = socket$kcm(0x2, 0x2, 0x73) bind(r1, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) getpeername(r1, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) connect$inet6(r2, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @empty, 0x9}, 0x1c) sendmsg$TEAM_CMD_PORT_LIST_GET(r2, &(0x7f0000002580)={0x0, 0x0, 0x0}, 0x4000000) getsockopt$inet_dccp_buf(r2, 0x21, 0xf, &(0x7f0000000300)=""/15, &(0x7f0000000340)=0xf) r3 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) r4 = fcntl$getown(r3, 0x9) ptrace$peeksig(0x4209, r4, &(0x7f0000000240)={0x101, 0x1, 0x2}, &(0x7f0000000400)=[{}, {}]) tkill(r0, 0x1f) fchdir(r3) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) r5 = socket$kcm(0x2, 0x2, 0x73) bind(r5, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) getpeername(r5, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) connect$inet6(r6, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @empty, 0x9}, 0x1c) sendmsg$TEAM_CMD_PORT_LIST_GET(r6, &(0x7f0000002580)={0x0, 0x0, 0x0}, 0x4000000) getsockopt$inet6_IPV6_XFRM_POLICY(r6, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xe8) r7 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r7, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vga_arbiter\x00', 0x201, 0x0) 10:26:45 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0x4000000, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) 10:26:45 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x0, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:26:45 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$kcm(0x2, 0x2, 0x73) bind(r1, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) getpeername(r1, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) connect$inet6(r2, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @empty, 0x9}, 0x1c) sendmsg$TEAM_CMD_PORT_LIST_GET(r2, &(0x7f0000002580)={0x0, 0x0, 0x0}, 0x4000000) shutdown(r2, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r3 = socket$kcm(0x2, 0x2, 0x73) bind(r3, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) getpeername(r3, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) connect$inet6(r4, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @empty, 0x9}, 0x1c) sendmsg$TEAM_CMD_PORT_LIST_GET(r4, &(0x7f0000002580)={0x0, 0x0, 0x0}, 0x4000000) getsockopt$inet_tcp_int(r4, 0x6, 0xb, &(0x7f00000003c0), &(0x7f0000000400)=0x4) r5 = dup(0xffffffffffffffff) sendmsg$NFNL_MSG_CTHELPER_NEW(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)=ANY=[@ANYBLOB="b40000000009010200000000000000000a00000508000540000000190800064000000000080005400000000b400002001400018008000100ac1414aa08000200000031071400018008000100e000000108000200e00000011400018008000100e000000108000200ac1414bb08000540000000000800000000000000050001009f0000000c0002800500010088000002080005400000000a0c000200060003400004000008000640000000010800064000000001"], 0xb4}, 0x1, 0x0, 0x0, 0x20004000}, 0x40000) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000040)=0x1, 0x4) recvfrom(r0, 0x0, 0x0, 0x2, &(0x7f0000000140)=@ax25={{0x3, @default}, [@bcast, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x716000) 10:26:45 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x100000000000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:26:45 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x69a) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000280012000c000100766574680000000018000200fd0001000000000023cd3741ce8074c5fe8524c0306554362ddd4c0617b1ed0cd8cb892ef805ab93a186423f124b7c6a03d724f7ead1ef33adfdbe08b8c5236b93b9797b4409f6e3", @ANYRES32=0x0, @ANYBLOB="00000079abd1932a"], 0x48}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000fe6000)={0x3, 0x4, 0x1, 0x100000009, 0x0, 0xffffffffffffffff, 0x0, [], r4}, 0x3c) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) r7 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) dup2(0xffffffffffffffff, r7) perf_event_open(&(0x7f0000000880)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r8 = accept(r6, 0x0, &(0x7f0000000240)) getsockopt$inet_sctp6_SCTP_MAXSEG(r8, 0x84, 0xd, &(0x7f0000000180)=@assoc_value={0x0, 0x100}, 0x0) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000000100)={0x0, 0x7e3ae58a}, 0x8) setsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000000040)={0x0, 0x80000000, 0x0, 0x97}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000f00fb8)={0xb, 0x3, &(0x7f0000b0afd8)=@framed, &(0x7f0000fe9000)='syzkaller\x00', 0x5, 0x1000, &(0x7f0000e18000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x78) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x4}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x10020000000, 0x0}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000100)={r5, &(0x7f0000000040), &(0x7f0000000080)=""/82}, 0x211) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r9 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r9, 0x0, 0x0, 0x2000002) [ 2392.937493][T29221] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2393.051396][T29221] 8021q: adding VLAN 0 to HW filter on device bond261 [ 2393.109339][T29221] bond0: (slave bond261): Enslaving as an active interface with an up link [ 2393.481947][ C0] net_ratelimit: 4 callbacks suppressed [ 2393.481957][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2393.493317][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2393.499082][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2393.504874][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2394.186841][T29237] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. [ 2394.521972][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2394.527771][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2394.533586][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2394.539356][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2394.601963][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2394.607768][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2394.636896][T29237] team0: Port device veth19 added 10:26:46 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup(r1) r3 = msgget$private(0x0, 0x0) msgctl$IPC_SET(r3, 0x1, &(0x7f0000000200)={{0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5fba}) msgrcv(r3, &(0x7f0000000000)={0x0, ""/28}, 0x24, 0x3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x1b, &(0x7f0000000040)=0x100, 0x4) recvfrom(r0, 0x0, 0x0, 0x2, &(0x7f0000000140)=@ax25={{0x3, @default}, [@bcast, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x716000) [ 2394.766674][T29240] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2394.851983][ T27] audit: type=1804 audit(1579948007.055:1158): pid=29244 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/1001/file0/file0" dev="loop5" ino=3339 res=1 [ 2394.988634][T29251] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. [ 2395.126386][ T27] audit: type=1804 audit(1579948007.165:1159): pid=29217 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1031/file0/file0" dev="loop3" ino=3340 res=1 10:26:47 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x200000000000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:26:47 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0x6000000, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2395.258721][ T27] audit: type=1804 audit(1579948007.465:1160): pid=29257 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1306/file0" dev="sda1" ino=16676 res=1 [ 2395.365381][ T27] audit: type=1800 audit(1579948007.545:1161): pid=29247 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="sda1" ino=16676 res=0 10:26:47 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000400)={{{@in=@initdev, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in6=@initdev}}, &(0x7f0000000240)=0xe8) mount$9p_tcp(&(0x7f0000000080)='127.0.0.1\x00', &(0x7f00000000c0)='./file1\x00', &(0x7f0000000180)='9p\x00', 0x1, &(0x7f00000007c0)={'trans=tcp,', {'port', 0x3d, 0x4e22}, 0x2c, {[{@cache_mmap='cache=mmap'}, {@access_any='access=any'}], [{@euid_lt={'euid<', r2}}, {@subj_type={'subj_type', 0x3d, 'vfat\x00'}}, {@fsuuid={'fsuuid', 0x3d, {[0x64, 0x39, 0x64, 0x33, 0x63, 0x66, 0x62, 0x36], 0x2d, [0x35, 0x62, 0x35, 0x31], 0x2d, [0x31, 0x35, 0x39, 0x32], 0x2d, [0xcc, 0x33, 0x36, 0x32], 0x2d, [0x32, 0x66, 0x61, 0x65, 0x38, 0x33, 0x38, 0x35]}}}, {@uid_lt={'uid<', 0xee00}}]}}) r3 = creat(&(0x7f0000000280)='./file0\x00', 0x0) close(r3) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000340)={r3, &(0x7f0000000300)="e863f7458d4b6c47d21cd85bb7acdb7e1bf802d005ddab", &(0x7f0000000880)=""/231}, 0x20) keyctl$set_reqkey_keyring(0xe, 0xffffffffffffffff) 10:26:47 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x0, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2395.490155][T29269] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2395.601825][T29272] 8021q: adding VLAN 0 to HW filter on device bond262 [ 2395.627787][T29272] bond0: (slave bond262): Enslaving as an active interface with an up link [ 2396.489791][T29275] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:26:49 executing program 5: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xff00000000000000) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:26:49 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) dup(0xffffffffffffffff) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000300)=0x2, 0x4) r3 = socket$kcm(0x2, 0x2, 0x73) socket$alg(0x26, 0x5, 0x0) r4 = socket$kcm(0x2, 0x2, 0x73) bind(r4, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) getpeername(r4, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) connect$inet6(r5, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @empty, 0x9}, 0x1c) sendmsg$TEAM_CMD_PORT_LIST_GET(r5, &(0x7f0000002580)={0x0, 0x0, 0x0}, 0x4000000) getsockopt$inet_mreqn(r5, 0x0, 0x20, &(0x7f0000001f80)={@multicast1}, &(0x7f0000001fc0)=0xc) r6 = socket$kcm(0x2, 0x2, 0x73) bind(r6, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) getpeername(r6, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) bind(r6, &(0x7f0000002000)=@nl=@proc={0x10, 0x0, 0x25dfdbfc, 0x80000}, 0x80) getpeername(r3, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) connect$inet6(r7, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @empty, 0x9}, 0x1c) sendmsg$TEAM_CMD_PORT_LIST_GET(r7, &(0x7f0000002580)={0x0, 0x0, 0x0}, 0x4000000) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0xa, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0x6000000, 0x0, 0x0, @empty}, {0xa, 0x0, 0x0, @rand_addr="fe800000000000ae7a29e5e36fc3e001"}, r8}}, 0x48) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f0000000380)={0x16, 0x98, 0xfa00, {&(0x7f0000000340)={0xffffffffffffffff}, 0x2, r8, 0x1c, 0x1, @in={0x2, 0x4e20, @loopback}}}, 0xa0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r2, &(0x7f0000000440)={0x11, 0x10, 0xfa00, {&(0x7f0000000280), r9}}, 0x18) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r7, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000000)=0x0) ioprio_get$pid(0x1, r10) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000040)=0x1, 0x4) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f0000000100)) recvfrom(r0, 0x0, 0x0, 0x2, &(0x7f0000000140)=@ax25={{0x3, @default}, [@bcast, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x716000) 10:26:49 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0xa000000, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) 10:26:49 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000040)=0x1, 0x4) recvfrom(r0, 0x0, 0x0, 0x2, &(0x7f0000000140)=@ax25={{0x3, @default}, [@bcast, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x716000) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_REM(r2, 0x84, 0x65, &(0x7f00000001c0)=[@in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}, @in6={0xa, 0x4e24, 0xfffff721, @local, 0x6}, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x31}}, @in6={0xa, 0x4e24, 0x1, @empty, 0xfa}, @in6={0xa, 0x4e24, 0x0, @dev={0xfe, 0x80, [], 0x23}, 0x4}, @in6={0xa, 0x4e22, 0x9, @loopback, 0x20}, @in6={0xa, 0x4e24, 0x800, @mcast2, 0xfdd9}, @in={0x2, 0x4e23, @broadcast}, @in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x2e}}], 0xcc) [ 2397.225236][T29317] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2397.298746][ T27] kauditd_printk_skb: 3 callbacks suppressed [ 2397.298770][ T27] audit: type=1804 audit(1579948009.505:1165): pid=29290 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1307/file0/file0" dev="loop0" ino=3344 res=1 [ 2398.446294][T29322] 8021q: adding VLAN 0 to HW filter on device bond263 [ 2398.512340][ T27] audit: type=1804 audit(1579948009.545:1166): pid=29300 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1307/file0/file0" dev="loop0" ino=3344 res=1 10:26:50 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) r1 = socket$kcm(0x2, 0x2, 0x73) bind(r1, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) getpeername(r1, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) connect$inet6(r2, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @empty, 0x9}, 0x1c) sendmsg$TEAM_CMD_PORT_LIST_GET(r2, &(0x7f0000002580)={0x0, 0x0, 0x0}, 0x4000000) setsockopt$nfc_llcp_NFC_LLCP_RW(r2, 0x118, 0x0, &(0x7f0000000300)=0x7fffffff, 0x4) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f0000000340)=0xe8) r3 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r3, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x60800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={&(0x7f00000003c0)}, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) r4 = socket$kcm(0x2, 0x2, 0x73) bind(r4, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) getpeername(r4, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) connect$inet6(r5, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @empty, 0x9}, 0x1c) sendmsg$TEAM_CMD_PORT_LIST_GET(r5, &(0x7f0000002580)={0x0, 0x0, 0x0}, 0x4000000) sendmsg$inet(r5, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000400)="c13f2e26a2c51a1095efb3ced90b129000e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da2641de1b3fc5c8aa5a92042874d01664b31472472fd5afcb614e05a9f8963d3465ceab3699dddc73e2178d873b058f9af2f9642636e1e1e0aadf25b4a6c433811be314a3e4016b3d3eb16714457c91980355ce77782f901f082900c94c54495663d467113bb84d98314ee93a9e76a84c5c34883e7fa4428c9abb7c48af2501a6efa5110cf353cc6b8f6cf5ad8a6313a8f2aa4456fb326838eeb06b", 0xdc}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a81984b1d29ae66fe56c875fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762052598cfd5c25de10f5", 0xba}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:26:50 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000040)=0x1, 0x4) r3 = socket$kcm(0x2, 0x2, 0x73) bind(r3, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) getpeername(r3, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) connect$inet6(r4, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @empty, 0x9}, 0x1c) r5 = creat(&(0x7f0000000280)='./file0\x00', 0x0) close(r5) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000016c0)={0xffffffffffffffff}) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setuid(r7) ioctl$TUNSETOWNER(r5, 0x400454cc, r7) sendmsg$TEAM_CMD_PORT_LIST_GET(r4, &(0x7f0000002580)={0x0, 0x0, 0x0}, 0x4000000) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r4, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="8c0000000301010200000000000000000000000a140005800f000100746674702d3201000000000008000740000000045c00048058000280050001000600000005000200ff00000005000200070000000500020001000000050001000100000005000200030000000c0003400000000000000005050001000500000005000100020000000500010007000000"], 0x8c}, 0x1, 0x0, 0x0, 0x4800}, 0x4000004) recvfrom(r0, 0x0, 0x0, 0x2, &(0x7f0000000140)=@ax25={{0x3, @default}, [@bcast, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x80) [ 2398.565354][T29322] bond0: (slave bond263): Enslaving as an active interface with an up link [ 2398.729584][T29330] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2398.771968][ C0] net_ratelimit: 12 callbacks suppressed [ 2398.771979][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2398.783543][ C0] protocol 88fb is buggy, dev hsr_slave_1 10:26:50 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x0, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2398.931992][ T27] audit: type=1804 audit(1579948009.545:1167): pid=29303 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1307/file0/file0" dev="loop0" ino=3344 res=1 [ 2399.131654][ T27] audit: type=1804 audit(1579948011.335:1168): pid=29328 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/1002/file0/file0" dev="loop5" ino=3351 res=1 10:26:51 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0xc000000, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) 10:26:51 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x300000000000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:26:51 executing program 5: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xffffffff00000000) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:26:51 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IP_VS_SO_SET_EDITDEST(0xffffffffffffffff, 0x0, 0x489, &(0x7f00000000c0)={{0xd4, @empty, 0x4e22, 0x0, 'none\x00', 0x12, 0x80000001, 0x53}, {@remote, 0x4e24, 0x2000, 0x7, 0x3, 0x2a}}, 0x44) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$kcm(0x2, 0x2, 0x73) bind(r3, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) getpeername(r3, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) connect$inet6(r4, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @empty, 0x9}, 0x1c) sendmsg$TEAM_CMD_PORT_LIST_GET(r4, &(0x7f0000002580)={0x0, 0x0, 0x0}, 0x4000000) ioctl$sock_rose_SIOCADDRT(r4, 0x890b, &(0x7f00000001c0)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x6, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @netrom={'nr', 0x0}, 0x1, [@default, @null, @bcast, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0xc, &(0x7f0000000040)=0x1, 0x4) r5 = socket$kcm(0x2, 0x2, 0x73) r6 = socket$kcm(0x2, 0x2, 0x73) bind(r6, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) getpeername(r6, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) connect$inet6(r7, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @empty, 0x9}, 0x1c) sendmsg$TEAM_CMD_PORT_LIST_GET(r7, &(0x7f0000002580)={0x0, 0x0, 0x0}, 0x4000000) accept$inet(r7, &(0x7f0000000140), &(0x7f0000000280)=0x10) bind(r4, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @remote}, 0x80) getpeername(r5, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) connect$inet6(r8, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @empty, 0x9}, 0x1c) sendmsg$TEAM_CMD_PORT_LIST_GET(r8, &(0x7f0000002580)={0x0, 0x0, 0x0}, 0x4000000) r9 = socket$netlink(0x10, 0x3, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) r11 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r11, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r11, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x69a) sendmsg$nl_route(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r12, @ANYBLOB="0000000000000000280012000c000100766574680000000018000200fd0001000000000023cd3741ce8074c5fe8524c0306554362ddd4c0617b1ed0cd8cb892ef805ab93a186423f124b7c6a03d724f7ead1ef33adfdbe08b8c5236b93b9797b4409f6e3", @ANYRES32=0x0, @ANYBLOB="00000079abd1932a"], 0x48}}, 0x0) sendmsg$nl_route(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0x0, 0x0, 0x0, r12}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0x10}]}, 0x28}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000000)={'vcan0\x00', r12}) recvfrom(r8, 0x0, 0xf, 0x102, &(0x7f0000000300)=@ll={0x11, 0x2, r13, 0x1, 0x1}, 0x80) [ 2399.555741][ T27] audit: type=1804 audit(1579948011.765:1169): pid=29342 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1308/file0/file0" dev="sda1" ino=17377 res=1 [ 2399.645623][T29354] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2399.721980][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2399.727828][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2399.733615][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2399.739355][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2399.851457][T29359] 8021q: adding VLAN 0 to HW filter on device bond264 [ 2399.861828][T29359] bond0: (slave bond264): Enslaving as an active interface with an up link [ 2399.871201][T29362] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.1'. [ 2399.901422][T29362] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.1'. [ 2400.761976][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2400.768302][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2400.774109][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2400.779867][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2401.038250][T29363] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:26:53 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10, &(0x7f0000d06000)=0x1, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) r3 = creat(&(0x7f0000000280)='./file0\x00', 0x0) close(r3) ioctl$PPPIOCCONNECT(r3, 0x4004743a, &(0x7f0000000000)) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000040)=0x1, 0x4) recvfrom(r0, 0x0, 0x0, 0x2, &(0x7f0000000140)=@ax25={{0x3, @default}, [@bcast, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x716000) [ 2401.702446][ T27] audit: type=1804 audit(1579948013.905:1170): pid=29373 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/1003/file0/file0" dev="loop5" ino=3353 res=1 10:26:54 executing program 5: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) r4 = socket$kcm(0x2, 0x2, 0x73) bind(r4, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) getpeername(r4, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) connect$inet6(r5, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @empty, 0x9}, 0x1c) sendmsg$TEAM_CMD_PORT_LIST_GET(r5, &(0x7f0000002580)={0x0, 0x0, 0x0}, 0x4000000) bind$llc(r5, &(0x7f0000000180)={0x1a, 0x18, 0x0, 0x9, 0x7, 0x0, @remote}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r6 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r6, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2401.935584][ T27] audit: type=1804 audit(1579948014.085:1171): pid=29380 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1033/file0/file0" dev="loop3" ino=3355 res=1 [ 2402.013359][ T27] audit: type=1800 audit(1579948014.145:1172): pid=29380 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.3" name="file0" dev="loop3" ino=3355 res=0 [ 2402.083363][ T27] audit: type=1804 audit(1579948014.185:1173): pid=29384 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1033/file0/file0" dev="loop3" ino=3355 res=1 10:26:54 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0xe000000, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) 10:26:54 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) ioctl$TIOCSTI(r1, 0x5412, 0x101) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r2 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r2, 0x0, 0x0, 0x2000002) r3 = socket$kcm(0x2, 0x2, 0x73) bind(r3, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) getpeername(r3, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) ioctl$sock_SIOCGIFBR(r3, 0x8940, &(0x7f0000000080)=@generic={0x1, 0x40, 0x4}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8574, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:26:54 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x11, &(0x7f0000d06000), 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000002c0)=0xfffffffffffffffe, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000040)=0x1, 0x4) recvfrom(r0, 0x0, 0x0, 0x2, &(0x7f0000000140)=@ax25={{0x3, @default}, [@bcast, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x716000) [ 2402.210086][ T27] audit: type=1800 audit(1579948014.205:1174): pid=29347 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="sda1" ino=17377 res=0 [ 2402.290225][T29404] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2402.344163][T29404] 8021q: adding VLAN 0 to HW filter on device bond265 [ 2402.354933][T29404] bond0: (slave bond265): Enslaving as an active interface with an up link [ 2402.665108][T29416] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2402.679342][ T27] audit: type=1804 audit(1579948014.885:1175): pid=29415 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/1004/file0/file0" dev="sda1" ino=16689 res=1 10:26:55 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0xf000000, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) 10:26:55 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x400000000000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2403.095585][T29427] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2403.155907][T29429] 8021q: adding VLAN 0 to HW filter on device bond266 [ 2403.218645][T29429] bond0: (slave bond266): Enslaving as an active interface with an up link [ 2403.355967][T29429] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2403.891997][ C0] net_ratelimit: 12 callbacks suppressed [ 2403.892007][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2403.903625][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2403.909585][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2403.915336][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2404.427480][ T27] audit: type=1804 audit(1579948016.635:1176): pid=29437 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1309/file0/file0" dev="loop0" ino=3356 res=1 [ 2404.507787][ T27] audit: type=1800 audit(1579948016.685:1177): pid=29437 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="loop0" ino=3356 res=0 10:26:57 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x0, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:26:57 executing program 5: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) r1 = creat(&(0x7f0000000280)='./file0\x00', 0x0) close(r1) openat$cgroup_ro(r1, &(0x7f0000000300)='cpuacct.usage_sys\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) r3 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r4, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fsetxattr$security_evm(r5, &(0x7f0000000240)='security.evm\x00', &(0x7f0000000340)=@md5={0x1, "c239f8bd458b11655a8e138bf46e6ef6"}, 0x11, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r6 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fallocate(r6, 0x0, 0x0, 0x2000002) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:26:57 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0x10000000, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2405.116405][ T27] audit: type=1804 audit(1579948016.685:1178): pid=29414 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1309/file0/file0" dev="loop0" ino=3356 res=1 [ 2405.446001][ T27] audit: type=1804 audit(1579948017.395:1179): pid=29435 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1034/file0/file0" dev="loop3" ino=3360 res=1 [ 2406.544273][T29461] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2406.552022][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2406.558274][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2406.564064][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2406.569806][ C0] protocol 88fb is buggy, dev hsr_slave_1 10:26:58 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x500000000000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:26:59 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r2 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r2, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000016c0)={0xffffffffffffffff}) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setuid(r4) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000016c0)={0xffffffffffffffff}) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setuid(r6) syz_mount_image$reiserfs(&(0x7f0000000300)='reiserfs\x00', &(0x7f0000000340)='./file0\x00', 0x9, 0x6, &(0x7f00000009c0)=[{&(0x7f0000000400)="3fea24ff06c7a07ea2aefcb98e2f807e4500354d1f1afdb240f271af72c01dcf279972921bfb67dfe86af01f4fbdedbb5d36766790b4b64f2a728a352cf63066a982b3acc20c55c4dbd5ab85f6334bf84663ee2571b5292f68b2a9e3bee25255028a382bbdcf29e5f5a17daa0c3e8fb8b688cbaa9955", 0x76, 0x3ca8bcda}, {&(0x7f0000000480)="a6ff8d0adeec241f788f1a5bebed85273fbffe088d29d48e6a67d10f6039b87df5c82e073cc32004577a15a2c8a459a373f7778bc8d842ccc8f3285db200b803c17b285ae9ebd32b52d7053c3b5a5d3171217263c3e95d70167a6bfaf8b007bca5a53e5f81955554dbae45f99fc9711c4474", 0x72, 0x400}, {&(0x7f00000007c0)="0db0d8eb51612df126bab63a29f77e217dbe2ba2c712f83b17d16d839e57ae2c51ca403be17d58418616c9501f71e5d181baa5dd3c8020061dac936df802c16a900ab29ec786e9f2d286d892d17e67754d09afbdd4b4e5a5a4436f2d041970afda8621018f8b66d0070ea6a02959438220a47e08117e2fc206938acb1617f6c62cee316d461c71548c86fbf142ee764b20242bae6748b75714b509dd2028de38c028ef511b37cafcf41083b909cca601316f60f64a466e656876f16c98671eaf356d4baa270d9cfb8e912600941388bc93afd7661d795ad2871efa0eb018d82908f9867f25fe", 0xe6, 0x2}, {&(0x7f00000008c0)="e5224e86ceac9a02c76a87d249bd80b62fbd98618e0b63ad837bdf293ffaf64429435140beb84b925ba717dc6ab62b01cee07dfe63d6c2ab6f4707f8673a6d0477ff888f654de683001ec3a2307ac15c4d245800864efd09a87f133c4f14db26ee10a6ce89aa8ea99b3d4614cbc78a613711ff34eb80eea7f9b3eb6d45c212db00d2fede5a046602c4d985ea05c1e6939b09b6423d73a5a284104abe6d727235063745831aa98ea4bc83020842d62663cd24a242508ad4311bf47964697ae5b3cbadd56c0b2035b5095d3cb11e40ec6bb3b065e384c4638083712c34915be60e15122aeec4260232", 0xe8, 0x3}, {&(0x7f0000000500)="cc1257dba18c68490d1d0665b174421a863f333415f57fadbfe5fc", 0x1b, 0x4}, {&(0x7f0000000580)="b631aebf872a8fcbf671c4956ac1d830455f6006e7afd7a5fb07a70182c7be3751a0034076bb0c0d840100c83ee27ed8d41cb958c10734cde1abcbe1c4ab837fe2f981406c0a8b283e7d443785ce9d0a", 0x50, 0x100}], 0x20, &(0x7f0000000a80)={[{@grpjquota='grpjquota'}, {@hash_r5='hash=r5'}, {@balloc_no_unhash_reloc='block-allocator=no_unhashed_relocation'}, {@usrjquota='usrjquota'}], [{@audit='audit'}, {@uid_lt={'uid<', r4}}, {@rootcontext={'rootcontext', 0x3d, 'root'}}, {@audit='audit'}, {@appraise='appraise'}, {@fowner_gt={'fowner>', r1}}, {@dont_appraise='dont_appraise'}, {@measure='measure'}, {@fowner_eq={'fowner', 0x3d, r6}}]}) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) r7 = socket$kcm(0x2, 0x2, 0x73) bind(r7, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) getpeername(r7, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) connect$inet6(r8, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @empty, 0x9}, 0x1c) sendmsg$TEAM_CMD_PORT_LIST_GET(r8, &(0x7f0000002580)={0x0, 0x0, 0x0}, 0x4000000) connect$caif(r8, &(0x7f0000000080)=@rfm={0x25, 0x7, "f80b2db3722e0494572c6bfff3363168"}, 0x18) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2406.781515][ T27] audit: type=1800 audit(1579948018.785:1180): pid=29450 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.3" name="file0" dev="loop3" ino=3360 res=0 [ 2406.812432][T29463] 8021q: adding VLAN 0 to HW filter on device bond267 [ 2406.897685][T29463] bond0: (slave bond267): Enslaving as an active interface with an up link [ 2407.031111][T29468] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2407.081937][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2407.087743][ C0] protocol 88fb is buggy, dev hsr_slave_1 10:26:59 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0x40000000, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2407.866826][T29478] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2408.010121][T29480] 8021q: adding VLAN 0 to HW filter on device bond268 [ 2408.086281][ T27] audit: type=1804 audit(1579948020.295:1181): pid=29475 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1310/file0/file0" dev="loop0" ino=3364 res=1 [ 2408.123608][T29480] bond0: (slave bond268): Enslaving as an active interface with an up link 10:27:00 executing program 5: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xd, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) r4 = socket$netlink(0x10, 0x3, 0x0) getsockopt$IP_SET_OP_GET_FNAME(r4, 0x1, 0x53, &(0x7f0000000300)={0x8, 0x7, 0x0, 'syz2\x00'}, &(0x7f0000000340)=0x2c) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xe8) r5 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VIDIOC_ENUM_FRAMESIZES(0xffffffffffffffff, 0xc02c564a, &(0x7f0000000180)={0x5, 0x50313134, 0x2, @stepwise={0x2, 0x67d8db27, 0x7a, 0x0, 0x0, 0x1}}) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000240)='/dev/sg#\x00', 0x9, 0x100) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2408.225437][ T27] audit: type=1800 audit(1579948020.335:1182): pid=29475 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="loop0" ino=3364 res=0 10:27:00 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) r1 = socket$kcm(0x2, 0x2, 0x73) bind(r1, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) getpeername(r1, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) connect$inet6(r2, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @empty, 0x9}, 0x1c) sendmsg$TEAM_CMD_PORT_LIST_GET(r2, &(0x7f0000002580)={0x0, 0x0, 0x0}, 0x4000000) setsockopt$netlink_NETLINK_NO_ENOBUFS(r2, 0x10e, 0x5, &(0x7f0000000080)=0x2, 0x4) fchdir(r0) getsockopt$IP6T_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x29, 0x45, &(0x7f0000000500)={'IDLETIMER\x00'}, &(0x7f0000000580)=0x1e) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) ustat(0x5, &(0x7f00000005c0)) r3 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r3, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) syz_mount_image$minix(&(0x7f0000000300)='minix\x00', &(0x7f0000000340)='./file0\x00', 0x3, 0x1, &(0x7f00000004c0)=[{&(0x7f0000000400)="bf8146a7666d50d5e78d57292b6f9e7a017177519bd49abaf21a648cb91051eeb1229355a224ea67eb2288c5c3113e2e0dee3e24f1231197999334d053355e478443eae1af28a270d27b217960c8c1790641480ae43cd8d25a9420b601660c8528002b811108687beffca4e8401361f3de44c5e29f35e91a90e8ddc0177cc1349808", 0x82, 0x80000001}], 0x400, 0x0) [ 2408.316902][ T27] audit: type=1804 audit(1579948020.345:1183): pid=29479 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1310/file0/file0" dev="loop0" ino=3364 res=1 [ 2408.342522][T29480] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2408.442182][ T27] audit: type=1800 audit(1579948020.355:1184): pid=29460 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.5" name="bus" dev="loop5" ino=3363 res=0 10:27:00 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0x60000000, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2408.685750][T29494] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2408.855767][T29494] 8021q: adding VLAN 0 to HW filter on device bond269 [ 2408.980034][T29494] bond0: (slave bond269): Enslaving as an active interface with an up link [ 2409.081986][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2409.087794][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2409.093596][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2409.099346][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2409.161950][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2409.167758][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2409.184881][ T27] audit: type=1804 audit(1579948021.395:1185): pid=29505 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1311/file0/file0" dev="loop0" ino=3365 res=1 10:27:02 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xe8) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:27:02 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x0, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2410.682010][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2410.688680][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2410.694505][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2410.700242][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2410.822028][ T27] audit: type=1804 audit(1579948022.865:1186): pid=29507 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1035/file0/file0" dev="loop3" ino=3367 res=1 [ 2410.915074][ T27] audit: type=1804 audit(1579948022.865:1187): pid=29496 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1035/file0/file0" dev="loop3" ino=3367 res=1 10:27:03 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x600000000000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:27:03 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0x65580000, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2411.434638][T29530] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2411.611950][ T27] audit: type=1804 audit(1579948023.805:1188): pid=29526 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1312/file0/file0" dev="sda1" ino=16771 res=1 [ 2411.643808][T29532] 8021q: adding VLAN 0 to HW filter on device bond270 [ 2411.728873][T29532] bond0: (slave bond270): Enslaving as an active interface with an up link [ 2411.872321][T29537] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:27:04 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x1) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:27:04 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0x81000000, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2412.493009][T29553] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2412.786795][T29557] 8021q: adding VLAN 0 to HW filter on device bond271 [ 2412.799913][T29557] bond0: (slave bond271): Enslaving as an active interface with an up link [ 2412.875245][ T27] audit: type=1804 audit(1579948025.085:1189): pid=29555 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1036/file0/file0" dev="loop3" ino=3374 res=1 10:27:05 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$inet6_dccp(0xa, 0x6, 0x0) socket$kcm(0x2b, 0x1, 0x0) [ 2412.952542][T29557] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:27:05 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x700000000000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2413.030580][ T27] audit: type=1804 audit(1579948025.085:1190): pid=29540 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1036/file0/file0" dev="loop3" ino=3374 res=1 10:27:05 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0x825957c5, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2414.842105][ C0] net_ratelimit: 10 callbacks suppressed [ 2414.842113][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2414.853563][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2414.859330][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2414.865116][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2415.039959][T29597] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2415.176798][T29597] 8021q: adding VLAN 0 to HW filter on device bond272 [ 2415.187528][T29597] bond0: (slave bond272): Enslaving as an active interface with an up link [ 2415.332004][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2415.337809][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2415.343724][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2415.349470][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2415.402203][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2415.408165][ C0] protocol 88fb is buggy, dev hsr_slave_1 10:27:07 executing program 5: r0 = gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580)='nl80211\x00') sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r1, &(0x7f0000000740)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000006c0)={&(0x7f00000005c0)={0x2c, r2, 0x300, 0x70bd2d, 0x25dfdbff, {}, [@NL80211_ATTR_PID={0x8, 0x52, r0}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0xffffffffffffffff}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40400d0}, 0x10020000) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r3 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r3) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r4 = socket$inet_sctp(0x2, 0x1, 0x84) r5 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r5, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r4, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r6, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xe8) r7 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r7, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:27:07 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x0, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2415.576887][ T27] audit: type=1804 audit(1579948027.505:1191): pid=29582 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1037/file0/file0" dev="loop3" ino=3381 res=1 [ 2415.615445][T29606] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:27:07 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x800000000000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2415.855026][ T27] audit: type=1804 audit(1579948027.935:1192): pid=29589 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1314/file0/file0" dev="loop0" ino=3377 res=1 [ 2416.067728][ T27] audit: type=1800 audit(1579948027.935:1193): pid=29589 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="loop0" ino=3377 res=0 10:27:08 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0x88a8ffff, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) 10:27:08 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) r1 = socket$kcm(0x2, 0x2, 0x73) bind(r1, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) getpeername(r1, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) connect$inet6(r2, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @empty, 0x9}, 0x1c) sendmsg$TEAM_CMD_PORT_LIST_GET(r2, &(0x7f0000002580)={0x0, 0x0, 0x0}, 0x4000000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000500)={'macvlan1\x00', 0x0}) connect$can_bcm(r2, &(0x7f00000006c0)={0x1d, r3}, 0x10) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) r5 = syz_open_dev$usbfs(&(0x7f0000001280)='/dev/bus/usb/00#/00#\x00', 0x200, 0x802) ioctl$USBDEVFS_CONTROL(r5, 0x8108551b, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$USBDEVFS_SETINTERFACE(r5, 0x80045510, &(0x7f0000000100)) sendfile(0xffffffffffffffff, r5, &(0x7f0000000040)=0x1, 0x5) fdatasync(r5) socket$kcm(0x2b, 0x1, 0x0) [ 2416.417645][ T27] audit: type=1804 audit(1579948027.935:1194): pid=29603 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1314/file0/file0" dev="loop0" ino=3377 res=1 [ 2416.514941][T29627] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2417.596911][T29639] 8021q: adding VLAN 0 to HW filter on device bond273 [ 2417.610627][T29639] bond0: (slave bond273): Enslaving as an active interface with an up link [ 2417.621011][ T27] audit: type=1804 audit(1579948029.685:1195): pid=29632 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/1007/file0/file0" dev="loop5" ino=3385 res=1 [ 2417.771432][T29639] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2417.831263][ T27] audit: type=1804 audit(1579948029.685:1196): pid=29619 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/1007/file0/file0" dev="loop5" ino=3385 res=1 10:27:10 executing program 5: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e24, 0xe0, @mcast2, 0x7}}}, &(0x7f0000001480)=0x84) socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) ioctl$VIDIOC_G_INPUT(r0, 0x80045626, &(0x7f0000000180)) r4 = socket$kcm(0x2, 0x2, 0x73) bind(r4, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) getpeername(r4, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) connect$inet6(r5, &(0x7f0000000240)={0xa, 0x4e23, 0x40003, @mcast2, 0x9}, 0x1c) sendmsg$TEAM_CMD_PORT_LIST_GET(r5, &(0x7f0000002580)={0x0, 0x0, 0x0}, 0x4000000) r6 = socket$kcm(0x2, 0x2, 0x73) bind(r6, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) getpeername(r6, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) connect$inet6(r7, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @empty, 0x9}, 0x1c) sendmsg$TEAM_CMD_PORT_LIST_GET(r7, &(0x7f0000002580)={0x0, 0x0, 0x0}, 0x4000000) r8 = socket$kcm(0x2, 0x2, 0x73) bind(r8, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) getpeername(r8, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) connect$inet6(r9, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @empty, 0x9}, 0x1c) sendmsg$TEAM_CMD_PORT_LIST_GET(r9, &(0x7f0000002580)={0x0, 0x0, 0x0}, 0x4000000) getsockopt$inet6_IPV6_XFRM_POLICY(r9, 0x29, 0x23, &(0x7f00000007c0)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f0000000300)=0xe8) r10 = creat(&(0x7f0000000340)='./bus/file0\x00', 0x1) fallocate(r10, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) ioctl$VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f0000000400)={0x7, @sdr={0x32314142, 0x100}}) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2418.140162][ T27] audit: type=1804 audit(1579948030.345:1197): pid=29652 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1038/file0/file0" dev="loop3" ino=3388 res=1 [ 2418.170366][ T27] audit: type=1800 audit(1579948030.345:1198): pid=29652 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.3" name="file0" dev="loop3" ino=3388 res=0 10:27:10 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0x9effffff, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2418.215677][ T27] audit: type=1804 audit(1579948030.345:1199): pid=29653 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir645663242/syzkaller.AP9JuC/1038/file0/file0" dev="loop3" ino=3388 res=1 [ 2418.468005][T29667] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2418.642188][T29668] 8021q: adding VLAN 0 to HW filter on device bond274 10:27:10 executing program 5: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) r4 = socket$kcm(0x2, 0x2, 0x73) bind(r4, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) getpeername(r4, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(r4, 0x8982, &(0x7f0000000180)) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000180)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0xc080) socket$kcm(0x2b, 0x1, 0x0) [ 2418.715667][T29668] bond0: (slave bond274): Enslaving as an active interface with an up link 10:27:10 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r2 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r2, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$mouse(&(0x7f0000000080)='/dev/input/mouse#\x00', 0x7, 0x503402) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0xa, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0x6000000, 0x0, 0x0, @empty}, {0xa, 0x0, 0x0, @rand_addr="fe800000000000ae7a29e5e36fc3e001"}, r4}}, 0x48) r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600006, 0x0, 0x4002011, r5, 0x0) r6 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x0, 0x0) r7 = ioctl$LOOP_CTL_GET_FREE(r6, 0x4c82) ioctl$LOOP_CTL_REMOVE(r5, 0x4c81, r7) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, r7) write$RDMA_USER_CM_CMD_SET_OPTION(r3, &(0x7f0000000180)={0xe, 0x18, 0xfa00, @ib_path={&(0x7f0000000900)=[{0x10, 0x0, [0xfff, 0x4732, 0xff, 0x2, 0x1, 0x1f, 0x7fff, 0x76, 0xff, 0x9, 0x2, 0x4800, 0x1a, 0x1, 0xd8]}, {0x28, 0x0, [0x7, 0x6, 0x4, 0x1, 0x20, 0x3, 0x2, 0x6, 0x8, 0xffff8000, 0x5, 0x83, 0x1, 0x9, 0x7f, 0xff]}, {0x4a, 0x0, [0x1000, 0x80, 0x7fffffff, 0x21985d01, 0x3, 0x7d6, 0x4, 0x4000100, 0x8001, 0x0, 0x9, 0x2, 0x0, 0x8, 0x3, 0x3]}, {0x0, 0x0, [0x60000000, 0x8, 0x9, 0x8000, 0x7, 0x4, 0xde2, 0x1, 0xfffffff9, 0x3, 0x1, 0x200, 0x1, 0x2, 0x5, 0x100]}], r4, 0x1, 0x1, 0x120}}, 0x20) r8 = memfd_create(&(0x7f0000000040)='trustedeth1vboxnet1vboxnet1user\x00', 0x0) io_submit(0x0, 0x1, &(0x7f0000000440)=[&(0x7f0000000d00)={0x0, 0x0, 0x0, 0x0, 0x0, r8, 0x0}]) io_destroy(0x0) open(&(0x7f00000001c0)='./bus\x00', 0x351040, 0x80) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2418.895532][T29668] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:27:11 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0xc3ffffff, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2419.402347][T29691] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2419.551059][T29692] 8021q: adding VLAN 0 to HW filter on device bond275 [ 2419.630625][T29692] bond0: (slave bond275): Enslaving as an active interface with an up link 10:27:12 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) r0 = syz_open_dev$ptys(0xc, 0x3, 0x0) ioctl$TIOCGSERIAL(r0, 0x541e, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=""/26}) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r1) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r2 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r2, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) r3 = socket$kcm(0x2, 0x2, 0x73) bind(r3, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80) getpeername(r3, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80) connect$inet6(r4, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @empty, 0x9}, 0x1c) sendmsg$TEAM_CMD_PORT_LIST_GET(r4, &(0x7f0000002580)={0x0, 0x0, 0x0}, 0x4000000) sendmsg$inet(r4, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fb7a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2419.942614][T29691] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2420.012140][ T27] audit: type=1804 audit(1579948032.205:1200): pid=29688 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/1009/file0/file0" dev="loop5" ino=3396 res=1 10:27:12 executing program 5: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fsetxattr$trusted_overlay_redirect(r0, &(0x7f0000000180)='trusted.overlay.redirect\x00', &(0x7f0000000240)='./bus\x00', 0x6, 0x2) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6", 0xa3}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:27:12 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0xc5575982, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2420.598873][T29716] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2421.081964][ C0] net_ratelimit: 20 callbacks suppressed [ 2421.081975][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2421.093594][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2421.099408][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2421.105185][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2421.561962][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2421.567771][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2421.573602][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2421.579570][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2421.641969][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2421.647772][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2422.007581][ T27] kauditd_printk_skb: 1 callbacks suppressed [ 2422.007605][ T27] audit: type=1804 audit(1579948034.215:1202): pid=29720 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir969346575/syzkaller.nJpJYD/1317/file0/file0" dev="sda1" ino=16820 res=1 [ 2422.042206][T29722] 8021q: adding VLAN 0 to HW filter on device bond276 [ 2422.463778][T29722] bond0: (slave bond276): Enslaving as an active interface with an up link 10:27:14 executing program 2: gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x0, 0x0, 0x6, 0x2, 0x0, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae", 0x5d}], 0x4}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) 10:27:14 executing program 3: gettid() r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) shmctl$SHM_STAT(0x0, 0xd, 0x0) fchdir(r1) open(0x0, 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, 0x0, &(0x7f00000009c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x6, 0x2, 0x445f8548, 0x0}, &(0x7f0000001280)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000013c0)={r3, @in6={{0xa, 0x4e23, 0xe0, @remote, 0x7}}}, &(0x7f0000001480)=0x1c2) r4 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff028}, {0x80000006}]}, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r5, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0xb00000000000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) [ 2422.603818][ T27] audit: type=1804 audit(1579948034.445:1203): pid=29715 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir249158309/syzkaller.1HGIgj/1010/file0/file0" dev="loop5" ino=3402 res=1 [ 2422.612440][T29716] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 10:27:15 executing program 0: gettid() prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) shmget(0x0, 0x4000, 0xa04, &(0x7f0000ffc000/0x4000)=nil) fchdir(r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001340)={0x5, 0x1, 0x200, 0x4, 0x0, 0x0, 0x2, 0x445f8548}, &(0x7f0000001280)=0x20) socket$packet(0x11, 0xa, 0x300) setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000340)='lp\x00', 0x3) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001580)={{{@in=@local, @in=@loopback}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000012c0)=0xfffffea2) r2 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r2, 0x0, 0x0, 0x2000002) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) r4 = creat(&(0x7f0000000280)='./file0\x00', 0x0) close(r4) ioctl$VHOST_GET_VRING_BASE(r4, 0xc008af12, &(0x7f0000000400)) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0xfffffff5) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000380)="c13f2e26a2c51a1095efb3ced90b1229d8e8fa3ebb42a1bbff93ba4ab5de83cef862de10cbc6e13c0c3a971157b6178a3a36edfe0cadb8f434656ed053f52a34da26", 0x42}, {0x0}, {&(0x7f0000000500)}, {&(0x7f0000000600)="dccd30485725d1e98c5f6b32ce362bd7f0c64cf097bbadede8a0a4745c049574d5a057b4e7d335b899780937902bcf3f1ab22f3bdeb4ed6cd53e9776f189acf5d9f43bb437feb371740d0eca4b1479c191b0592ca3f4570cf9414e86ae216bbd16810f8c3a88989fa201aeaa63ed28371a5cc6e09a819886b86a0daa4fa0a075fbdae7db614f7bf63e82b87e51148a041bb47b35ee3d7adc9375b27d290a4246e3ecf6b05e4949b71fd6dfff9a963f762057598cfd5c25de10f5", 0xba}], 0x4, 0x0, 0xfffffffffffffd64}, 0x4000) socket$kcm(0x2b, 0x1, 0x0) r5 = open(0x0, 0x1141042, 0x0) io_setup(0x0, &(0x7f0000000440)=0x0) r7 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000480)='/proc/thread-self/attr/current\x00', 0x2, 0x0) r8 = creat(&(0x7f0000000280)='./file0\x00', 0x0) close(r8) r9 = syz_open_dev$usbfs(&(0x7f0000001280)='/dev/bus/usb/00#/00#\x00', 0x200, 0x802) ioctl$USBDEVFS_CONTROL(r9, 0x8108551b, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$USBDEVFS_SETINTERFACE(r9, 0x80045510, &(0x7f0000000100)) sendfile(0xffffffffffffffff, r9, &(0x7f0000000040)=0x1, 0x5) r10 = creat(&(0x7f0000000280)='./file0\x00', 0x0) close(r10) io_submit(r6, 0x3, &(0x7f0000000980)=[&(0x7f0000000500)={0x0, 0x0, 0x0, 0x8, 0x9, r7, &(0x7f00000004c0)="9fed41c1e19a1b849a6ff92913464fed354d163da0f4f7512ee70f47b8832e59270b9de69ba9cb6061fa0f", 0x2b, 0x7, 0x0, 0x2, r8}, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x7, 0x4, r9, &(0x7f00000007c0)="a661bd28b1eda56754fc56bcd742571ad762dc2a5bc4a6bfde4442c9e1bde3922412287359abada8ac35c2b0c0e502b563a7e93d3c6ace64ef55b08e73897f4669e82813bcd8f5834b27369752b6ff7550397d393874420fe670c77114f14fc5f66546d9fa4acdd42de8ef6c0ff06443339e010ac2da49fe7d2f79c3fcafdae8501f5e425934813552b8874653143087c6ed0af4e1819bd2", 0x98, 0xe8, 0x0, 0x3}, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, 0x9, r3, &(0x7f0000000880)="bfbb4a1f75f63d0d22d157b1523f4615f9756325b5944ad9778dde6b92b2ef2b3cc4ecbf4a08199fdbc4a4cef6f5da4079e2a79361bb24a699f34a02df452b3843620975d6e512e9d1b99b76ceab9e34c706577bb5e7adf54356695d86443f6f6f2f58ab9547f300e2779c191b7b2361e1047040cd9ff45157a19b0e054200510bfe22b485ad3abf70572abadf10745fcad8391bd8a3046a2ff096646b3bb200f3cad32367a53fc71825f533f8ea4a0193501176ebbe516317b058f344f9748975d1ed9492edb1be9f5df772b04fc4eef0700da3305e3a3b532a7211bd720191afd00f62b2abd0692ebb3b11f5490344a14fa46ef43444f6595654", 0xfb, 0x400, 0x0, 0x3, r10}]) sendfile(0xffffffffffffffff, r5, 0x0, 0x8000fffffffe) r11 = syz_genetlink_get_family_id$ipvs(0x0) sendmsg$IPVS_CMD_GET_CONFIG(r5, &(0x7f0000000300)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="1c000000657c0c3088b3d0cefd0b9eb7b84345ca61da66261ce6c80aa02347aeda54d68777191f45e48f35649b81bd1a90259af892c2a71354f47d4edc337f556a8eab851d1bf6c9", @ANYRES16=r11, @ANYBLOB="ff00008245c5e9a742701332694980d8c800316bad2cb6d439b33516a7c57c48dabc9859ca614a6eefa1020d28c37ed35fc265fad63d63eff0febe90a22367a712266363d0c1989fc83fcd93859ab5acf1421301871723f813afc4a2a741f76fcd31b403b5c0c0f66c44e621627a5ae47c84564cd597dd00f987af9a68615d6e3ee5c0a45ff9af81cbe23b5ee48c49a3"], 0x3}, 0x1, 0x0, 0x0, 0x8004811}, 0x840) sendmsg$IPVS_CMD_DEL_DEST(r1, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x24, r11, 0x300, 0x70bd26, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x40}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x10000}]}, 0x24}, 0x1, 0x0, 0x0, 0x8001}, 0x10da6fb85e02fa7) [ 2423.318689][T29735] ================================================================== [ 2423.326854][T29735] BUG: KCSAN: data-race in clean_buffers / recalc_bh_state [ 2423.334045][T29735] [ 2423.336383][T29735] read to 0xffffffff8625aed0 of 4 bytes by task 12991 on cpu 1: [ 2423.344027][T29735] clean_buffers+0x104/0x1b0 [ 2423.348633][T29735] __mpage_writepage+0xad1/0xe70 [ 2423.353590][T29735] write_cache_pages+0x47a/0xb40 [ 2423.358540][T29735] mpage_writepages+0xab/0x180 [ 2423.363315][T29735] fat_writepages+0x2e/0x40 [ 2423.367867][T29735] do_writepages+0x6b/0x170 [ 2423.372382][T29735] __writeback_single_inode+0xaf/0x8e0 [ 2423.377849][T29735] writeback_sb_inodes+0x4ba/0xa50 [ 2423.382999][T29735] wb_writeback+0x1f9/0x6a0 [ 2423.387616][T29735] wb_workfn+0x22e/0x970 [ 2423.391874][T29735] process_one_work+0x3d4/0x890 [ 2423.396732][T29735] worker_thread+0xa0/0x800 [ 2423.401258][T29735] kthread+0x1d4/0x200 [ 2423.405357][T29735] ret_from_fork+0x1f/0x30 [ 2423.409768][T29735] [ 2423.412110][T29735] write to 0xffffffff8625aed0 of 4 bytes by task 29735 on cpu 0: [ 2423.419854][T29735] recalc_bh_state+0x124/0x150 [ 2423.424637][T29735] alloc_buffer_head+0xa8/0x100 [ 2423.429618][T29735] alloc_page_buffers+0x13d/0x320 [ 2423.434650][T29735] create_empty_buffers+0x47/0x3e0 [ 2423.439779][T29735] create_page_buffers+0x15a/0x180 [ 2423.444928][T29735] __block_write_begin_int+0x14d/0xf10 [ 2423.450407][T29735] block_write_begin+0x77/0x160 [ 2423.455266][T29735] cont_write_begin+0x3d6/0x670 [ 2423.460130][T29735] fat_write_begin+0x72/0xc0 10:27:15 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000d0700000000ff03000000000010", @ANYRES32=r2, @ANYBLOB="00000000e60000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x80002, 0x0) ioctl(r6, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x825, 0xf0ffffff, 0x0, {0xa, 0x0, 0x0, r9, 0xf}}, 0x20}}, 0x0) [ 2423.464731][T29735] pagecache_write_begin+0x6b/0x90 [ 2423.469859][T29735] cont_write_begin+0x17a/0x670 [ 2423.475023][T29735] fat_write_begin+0x72/0xc0 [ 2423.479625][T29735] pagecache_write_begin+0x6b/0x90 [ 2423.484745][T29735] generic_cont_expand_simple+0xb0/0x120 [ 2423.490391][T29735] fat_cont_expand+0x4e/0x1c0 [ 2423.495071][T29735] fat_fallocate+0x1af/0x1f0 [ 2423.499674][T29735] vfs_fallocate+0x3be/0x650 [ 2423.504281][T29735] ksys_fallocate+0x61/0xa0 [ 2423.508798][T29735] __x64_sys_fallocate+0x5e/0x80 [ 2423.513746][T29735] do_syscall_64+0xcc/0x3a0 [ 2423.518387][T29735] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2423.524271][T29735] [ 2423.526604][T29735] Reported by Kernel Concurrency Sanitizer on: [ 2423.532767][T29735] CPU: 0 PID: 29735 Comm: syz-executor.3 Not tainted 5.5.0-rc1-syzkaller #0 [ 2423.541442][T29735] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2423.551506][T29735] ================================================================== [ 2423.559571][T29735] Kernel panic - not syncing: panic_on_warn set ... [ 2423.566300][T29735] CPU: 0 PID: 29735 Comm: syz-executor.3 Not tainted 5.5.0-rc1-syzkaller #0 [ 2423.574977][T29735] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2423.585157][T29735] Call Trace: [ 2423.588465][T29735] dump_stack+0x11d/0x181 [ 2423.592814][T29735] panic+0x210/0x640 [ 2423.596728][T29735] ? vprintk_func+0x8d/0x140 [ 2423.601341][T29735] kcsan_report.cold+0xc/0xd [ 2423.605956][T29735] kcsan_setup_watchpoint+0x3fe/0x460 [ 2423.611348][T29735] __tsan_unaligned_write4+0xc7/0x110 [ 2423.616738][T29735] recalc_bh_state+0x124/0x150 [ 2423.621525][T29735] alloc_buffer_head+0xa8/0x100 [ 2423.626528][T29735] alloc_page_buffers+0x13d/0x320 [ 2423.631575][T29735] create_empty_buffers+0x47/0x3e0 [ 2423.636711][T29735] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 2423.642631][T29735] create_page_buffers+0x15a/0x180 [ 2423.647794][T29735] __block_write_begin_int+0x14d/0xf10 [ 2423.653473][T29735] ? fat_add_cluster+0xd0/0xd0 [ 2423.658437][T29735] ? __unlock_page_memcg+0x47/0xa0 [ 2423.663559][T29735] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2423.669811][T29735] ? wait_for_stable_page+0xa7/0xf0 [ 2423.675019][T29735] ? fat_add_cluster+0xd0/0xd0 [ 2423.679925][T29735] block_write_begin+0x77/0x160 [ 2423.684788][T29735] cont_write_begin+0x3d6/0x670 [ 2423.689646][T29735] ? fat_add_cluster+0xd0/0xd0 [ 2423.694425][T29735] ? generic_write_end+0x175/0x1f0 [ 2423.699552][T29735] fat_write_begin+0x72/0xc0 [ 2423.704155][T29735] ? fat_add_cluster+0xd0/0xd0 [ 2423.709045][T29735] pagecache_write_begin+0x6b/0x90 [ 2423.714181][T29735] cont_write_begin+0x17a/0x670 [ 2423.719049][T29735] ? fat_add_cluster+0xd0/0xd0 [ 2423.723845][T29735] fat_write_begin+0x72/0xc0 [ 2423.728453][T29735] ? fat_add_cluster+0xd0/0xd0 [ 2423.732047][T29753] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 2423.733232][T29735] pagecache_write_begin+0x6b/0x90 [ 2423.733265][T29735] generic_cont_expand_simple+0xb0/0x120 [ 2423.752061][T29735] fat_cont_expand+0x4e/0x1c0 [ 2423.756892][T29735] fat_fallocate+0x1af/0x1f0 [ 2423.761495][T29735] vfs_fallocate+0x3be/0x650 [ 2423.766100][T29735] ? fat_cont_expand+0x1c0/0x1c0 [ 2423.771165][T29735] ksys_fallocate+0x61/0xa0 [ 2423.775685][T29735] __x64_sys_fallocate+0x5e/0x80 [ 2423.780638][T29735] do_syscall_64+0xcc/0x3a0 [ 2423.785170][T29735] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2423.791068][T29735] RIP: 0033:0x45b349 [ 2423.794979][T29735] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2423.814591][T29735] RSP: 002b:00007f860e716c78 EFLAGS: 00000246 ORIG_RAX: 000000000000011d [ 2423.823010][T29735] RAX: ffffffffffffffda RBX: 00007f860e7176d4 RCX: 000000000045b349 [ 2423.830987][T29735] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000009 [ 2423.838963][T29735] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 2423.846951][T29735] R10: 0000000002000002 R11: 0000000000000246 R12: 00000000ffffffff [ 2423.855038][T29735] R13: 00000000000000a8 R14: 00000000004c1e86 R15: 000000000075bf2c [ 2423.864326][T29735] Kernel Offset: disabled [ 2423.868657][T29735] Rebooting in 86400 seconds..