[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 81.775913][ T27] audit: type=1800 audit(1564736282.917:25): pid=10528 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 81.817713][ T27] audit: type=1800 audit(1564736282.927:26): pid=10528 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 81.864485][ T27] audit: type=1800 audit(1564736282.927:27): pid=10528 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.1.2' (ECDSA) to the list of known hosts. 2019/08/02 08:58:13 fuzzer started 2019/08/02 08:58:17 dialing manager at 10.128.0.26:39443 2019/08/02 08:58:17 syscalls: 2484 2019/08/02 08:58:17 code coverage: enabled 2019/08/02 08:58:17 comparison tracing: enabled 2019/08/02 08:58:17 extra coverage: extra coverage is not supported by the kernel 2019/08/02 08:58:17 setuid sandbox: enabled 2019/08/02 08:58:17 namespace sandbox: enabled 2019/08/02 08:58:17 Android sandbox: /sys/fs/selinux/policy does not exist 2019/08/02 08:58:17 fault injection: enabled 2019/08/02 08:58:17 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/08/02 08:58:17 net packet injection: enabled 2019/08/02 08:58:17 net device setup: enabled 08:59:47 executing program 0: r0 = socket$inet6(0xa, 0x0, 0xfffffffffffffffe) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5}}, 0xe8) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpu.stat\x00', 0x0, 0x0) recvfrom$rxrpc(r1, &(0x7f0000000040)=""/224, 0x84, 0x1, &(0x7f0000000180)=@in6={0x21, 0x2, 0x2, 0x1c, {0xa, 0x4e21, 0x6, @ipv4={[], [], @multicast1}, 0xffff}}, 0x24) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) r2 = msgget(0x3, 0x231) msgctl$IPC_RMID(r2, 0x0) 08:59:48 executing program 1: socketpair(0x1e, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) recvmsg(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000900)=[{&(0x7f00000005c0)=""/255, 0xff}], 0x1, &(0x7f0000000980)=""/101, 0x65}, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x47, &(0x7f0000000000)}, 0x0) close(r0) syzkaller login: [ 186.927341][T10695] IPVS: ftp: loaded support on port[0] = 21 [ 187.030025][T10697] IPVS: ftp: loaded support on port[0] = 21 [ 187.090555][T10695] chnl_net:caif_netlink_parms(): no params data found 08:59:48 executing program 2: kexec_load(0x1100, 0x1, &(0x7f00000005c0)=[{0x0, 0x0, 0x56c9a000, 0x23e0000}], 0x0) [ 187.144155][T10695] bridge0: port 1(bridge_slave_0) entered blocking state [ 187.152389][T10695] bridge0: port 1(bridge_slave_0) entered disabled state [ 187.160603][T10695] device bridge_slave_0 entered promiscuous mode [ 187.174236][T10695] bridge0: port 2(bridge_slave_1) entered blocking state [ 187.196505][T10695] bridge0: port 2(bridge_slave_1) entered disabled state [ 187.205194][T10695] device bridge_slave_1 entered promiscuous mode [ 187.245079][T10695] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 187.256724][T10695] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 187.290318][T10695] team0: Port device team_slave_0 added [ 187.311702][T10700] IPVS: ftp: loaded support on port[0] = 21 [ 187.328127][T10695] team0: Port device team_slave_1 added 08:59:48 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = mq_open(&(0x7f0000000000)='md5sumeth1wlan0{cgroupmime_type@\x00', 0x6e93ebbbcc0884f2, 0x0, &(0x7f0000000080)={0x0, 0x2, 0x5}) mq_timedsend(r1, 0x0, 0x0, 0x0, 0x0) mq_timedsend(r1, 0x0, 0x0, 0x0, 0x0) mq_timedreceive(r1, &(0x7f0000000140)=""/204, 0x9d, 0x20000140, 0x0) [ 187.440608][T10695] device hsr_slave_0 entered promiscuous mode [ 187.477872][T10695] device hsr_slave_1 entered promiscuous mode [ 187.526809][T10695] bridge0: port 2(bridge_slave_1) entered blocking state [ 187.534140][T10695] bridge0: port 2(bridge_slave_1) entered forwarding state [ 187.541566][T10695] bridge0: port 1(bridge_slave_0) entered blocking state [ 187.548744][T10695] bridge0: port 1(bridge_slave_0) entered forwarding state [ 187.563783][T10697] chnl_net:caif_netlink_parms(): no params data found [ 187.582387][T10703] IPVS: ftp: loaded support on port[0] = 21 [ 187.660058][T10697] bridge0: port 1(bridge_slave_0) entered blocking state [ 187.667174][T10697] bridge0: port 1(bridge_slave_0) entered disabled state [ 187.675595][T10697] device bridge_slave_0 entered promiscuous mode [ 187.699894][T10697] bridge0: port 2(bridge_slave_1) entered blocking state 08:59:48 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$VIDIOC_G_CROP(r1, 0xc01456b8, &(0x7f0000000100)={0x0, {0x94, 0x80000000000001a, 0x6aa0}}) [ 187.707011][T10697] bridge0: port 2(bridge_slave_1) entered disabled state [ 187.719072][T10697] device bridge_slave_1 entered promiscuous mode [ 187.810356][T10695] 8021q: adding VLAN 0 to HW filter on device bond0 [ 187.851862][T10697] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 187.887664][T10704] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 187.896621][T10704] bridge0: port 1(bridge_slave_0) entered disabled state [ 187.915010][T10704] bridge0: port 2(bridge_slave_1) entered disabled state [ 187.928805][T10704] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready 08:59:49 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000240)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) write$binfmt_elf64(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="7f454cc6060507000700000000000000020000000d0000007b0300000000000040000002e7477bdce6f020acaf499ccc553a0004000000000000001600341cc73a00003f00"], 0x45) recvmmsg(r0, &(0x7f0000008880), 0x45b, 0x44000102, 0x0) [ 187.958179][T10697] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 187.971475][T10695] 8021q: adding VLAN 0 to HW filter on device team0 [ 187.998967][T10700] chnl_net:caif_netlink_parms(): no params data found [ 188.009128][T10703] chnl_net:caif_netlink_parms(): no params data found [ 188.025815][T10709] IPVS: ftp: loaded support on port[0] = 21 [ 188.061746][ T2901] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 188.072370][ T2901] bridge0: port 1(bridge_slave_0) entered blocking state [ 188.079505][ T2901] bridge0: port 1(bridge_slave_0) entered forwarding state [ 188.087333][ T2901] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 188.097115][ T2901] bridge0: port 2(bridge_slave_1) entered blocking state [ 188.104218][ T2901] bridge0: port 2(bridge_slave_1) entered forwarding state [ 188.113946][T10697] team0: Port device team_slave_0 added [ 188.159965][T10697] team0: Port device team_slave_1 added [ 188.178593][T10700] bridge0: port 1(bridge_slave_0) entered blocking state [ 188.185690][T10700] bridge0: port 1(bridge_slave_0) entered disabled state [ 188.193294][T10700] device bridge_slave_0 entered promiscuous mode [ 188.202027][T10703] bridge0: port 1(bridge_slave_0) entered blocking state [ 188.209188][T10703] bridge0: port 1(bridge_slave_0) entered disabled state [ 188.216714][T10703] device bridge_slave_0 entered promiscuous mode [ 188.224154][T10703] bridge0: port 2(bridge_slave_1) entered blocking state [ 188.231301][T10703] bridge0: port 2(bridge_slave_1) entered disabled state [ 188.238903][T10703] device bridge_slave_1 entered promiscuous mode [ 188.245702][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 188.254509][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 188.263048][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 188.285626][T10700] bridge0: port 2(bridge_slave_1) entered blocking state [ 188.295182][T10711] IPVS: ftp: loaded support on port[0] = 21 [ 188.295607][T10700] bridge0: port 2(bridge_slave_1) entered disabled state [ 188.309377][T10700] device bridge_slave_1 entered promiscuous mode [ 188.335600][T10700] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 188.390023][T10697] device hsr_slave_0 entered promiscuous mode [ 188.448844][T10697] device hsr_slave_1 entered promiscuous mode [ 188.507646][T10697] debugfs: Directory 'hsr0' with parent '/' already present! [ 188.539110][T10703] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 188.549585][T10700] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 188.571876][ T2903] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 188.580709][ T2903] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 188.589213][ T2903] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 188.597572][ T2903] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 188.615611][T10703] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 188.626302][T10700] team0: Port device team_slave_0 added [ 188.634111][T10700] team0: Port device team_slave_1 added [ 188.677629][T10703] team0: Port device team_slave_0 added [ 188.688719][ T2901] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 188.696908][ T2901] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 188.711100][T10695] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 188.759408][T10700] device hsr_slave_0 entered promiscuous mode [ 188.818213][T10700] device hsr_slave_1 entered promiscuous mode [ 188.877670][T10700] debugfs: Directory 'hsr0' with parent '/' already present! [ 188.886535][T10703] team0: Port device team_slave_1 added [ 188.941746][T10703] device hsr_slave_0 entered promiscuous mode [ 188.978095][T10703] device hsr_slave_1 entered promiscuous mode [ 189.018552][T10703] debugfs: Directory 'hsr0' with parent '/' already present! [ 189.037185][T10695] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 189.098031][T10711] chnl_net:caif_netlink_parms(): no params data found [ 189.203012][T10711] bridge0: port 1(bridge_slave_0) entered blocking state [ 189.212855][T10711] bridge0: port 1(bridge_slave_0) entered disabled state [ 189.220940][T10711] device bridge_slave_0 entered promiscuous mode [ 189.243247][T10711] bridge0: port 2(bridge_slave_1) entered blocking state [ 189.252168][T10711] bridge0: port 2(bridge_slave_1) entered disabled state [ 189.260343][T10711] device bridge_slave_1 entered promiscuous mode [ 189.280480][T10709] chnl_net:caif_netlink_parms(): no params data found [ 189.309706][T10711] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 189.330951][T10697] 8021q: adding VLAN 0 to HW filter on device bond0 08:59:50 executing program 0: r0 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000040)='/dev/video35\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r0, 0x4020565a, &(0x7f0000000100)={0x80000000003, 0x81000981900, 0x1}) [ 189.365563][T10711] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 189.402848][T10709] bridge0: port 1(bridge_slave_0) entered blocking state 08:59:50 executing program 0: [ 189.412265][T10709] bridge0: port 1(bridge_slave_0) entered disabled state [ 189.430565][T10709] device bridge_slave_0 entered promiscuous mode 08:59:50 executing program 0: [ 189.471054][ T2903] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 189.480115][ T2903] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 189.502052][T10697] 8021q: adding VLAN 0 to HW filter on device team0 [ 189.512783][T10709] bridge0: port 2(bridge_slave_1) entered blocking state 08:59:50 executing program 0: [ 189.523249][T10709] bridge0: port 2(bridge_slave_1) entered disabled state [ 189.531876][T10709] device bridge_slave_1 entered promiscuous mode [ 189.552145][T10703] 8021q: adding VLAN 0 to HW filter on device bond0 [ 189.561653][T10711] team0: Port device team_slave_0 added [ 189.572110][T10711] team0: Port device team_slave_1 added 08:59:50 executing program 0: [ 189.600057][ T2902] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 189.609412][ T2902] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 189.627856][ T2902] bridge0: port 1(bridge_slave_0) entered blocking state [ 189.634962][ T2902] bridge0: port 1(bridge_slave_0) entered forwarding state 08:59:50 executing program 0: [ 189.643703][ T2902] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 189.652775][ T2902] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 189.661552][ T2902] bridge0: port 2(bridge_slave_1) entered blocking state [ 189.668639][ T2902] bridge0: port 2(bridge_slave_1) entered forwarding state [ 189.676658][ T2902] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 189.685950][ T2902] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready 08:59:50 executing program 0: [ 189.695590][ T2902] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 189.704295][ T2902] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 189.736771][T10700] 8021q: adding VLAN 0 to HW filter on device bond0 [ 189.763710][ T2903] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 189.771971][ T2903] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 189.788283][ T2903] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 189.797404][ T2903] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 189.816647][T10703] 8021q: adding VLAN 0 to HW filter on device team0 [ 189.826589][T10709] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 189.837961][T10709] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 189.860321][T10711] device hsr_slave_0 entered promiscuous mode [ 189.908252][T10711] device hsr_slave_1 entered promiscuous mode [ 189.947770][T10711] debugfs: Directory 'hsr0' with parent '/' already present! [ 189.956109][ T2901] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 189.963912][ T2901] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 189.975293][T10697] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 189.986307][T10697] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 190.020130][ T2903] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 190.030150][ T2903] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 190.038727][ T2903] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 190.048554][ T2903] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 190.056631][ T2903] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 190.065425][ T2903] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 190.073944][ T2903] bridge0: port 1(bridge_slave_0) entered blocking state [ 190.081030][ T2903] bridge0: port 1(bridge_slave_0) entered forwarding state [ 190.088973][ T2903] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 190.097431][ T2903] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 190.105961][ T2903] bridge0: port 2(bridge_slave_1) entered blocking state [ 190.113143][ T2903] bridge0: port 2(bridge_slave_1) entered forwarding state [ 190.120731][ T2903] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 190.128478][ T2903] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 190.136470][ T2903] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 190.144517][ T2903] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 190.160358][T10700] 8021q: adding VLAN 0 to HW filter on device team0 [ 190.176006][T10709] team0: Port device team_slave_0 added [ 190.182304][ T2903] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 190.204764][T10697] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 190.214860][T10709] team0: Port device team_slave_1 added [ 190.223052][ T2903] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 190.232408][ T2903] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 190.243679][ T2903] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 190.252019][ T2903] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 190.260931][ T2903] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 190.269297][ T2903] bridge0: port 1(bridge_slave_0) entered blocking state [ 190.276339][ T2903] bridge0: port 1(bridge_slave_0) entered forwarding state [ 190.284341][ T2903] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 190.292443][ T2903] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 190.334420][T10704] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 190.343751][T10704] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 190.352599][T10704] bridge0: port 2(bridge_slave_1) entered blocking state [ 190.359724][T10704] bridge0: port 2(bridge_slave_1) entered forwarding state [ 190.368916][T10704] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 190.377771][T10704] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 190.386159][T10704] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 190.394737][T10704] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 190.403328][T10704] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 190.411545][T10704] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 190.419885][T10704] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 190.428422][T10704] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 190.500532][T10709] device hsr_slave_0 entered promiscuous mode [ 190.538087][T10709] device hsr_slave_1 entered promiscuous mode [ 190.578254][T10709] debugfs: Directory 'hsr0' with parent '/' already present! [ 190.601304][T10703] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 190.627161][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 190.636675][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 190.645343][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 190.655180][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 190.664368][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 190.672798][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 190.681211][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 190.690142][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 190.698777][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 190.713205][T10711] 8021q: adding VLAN 0 to HW filter on device bond0 [ 190.731540][T10700] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 190.755702][T10703] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 190.802469][T10700] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 190.810336][T10704] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 190.821964][T10704] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 08:59:52 executing program 0: [ 190.849977][T10711] 8021q: adding VLAN 0 to HW filter on device team0 [ 190.891430][T10709] 8021q: adding VLAN 0 to HW filter on device bond0 [ 190.911697][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 190.923855][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 190.932960][ T17] bridge0: port 1(bridge_slave_0) entered blocking state [ 190.940066][ T17] bridge0: port 1(bridge_slave_0) entered forwarding state [ 190.968620][ T2903] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 190.976567][ T2903] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 190.985888][ T2903] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 190.994248][ T2903] bridge0: port 2(bridge_slave_1) entered blocking state [ 191.001398][ T2903] bridge0: port 2(bridge_slave_1) entered forwarding state [ 191.010543][ T2903] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 191.019371][ T2903] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 191.028202][ T2903] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 191.036690][ T2903] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 191.047085][ T2903] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 191.061229][ T2902] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 191.070385][ T2902] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 191.084170][T10711] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 191.095263][T10711] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 191.133266][ T2903] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 191.143710][ T2903] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 191.153785][ T2903] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 191.162415][ T2903] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 191.170834][ T2903] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 191.178875][ T2903] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 191.189872][T10711] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 191.231055][T10709] 8021q: adding VLAN 0 to HW filter on device team0 [ 191.242966][ T2903] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 191.260409][ T2901] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 191.276097][ T2901] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 191.307166][ T2901] bridge0: port 1(bridge_slave_0) entered blocking state [ 191.314326][ T2901] bridge0: port 1(bridge_slave_0) entered forwarding state [ 191.338222][ T2901] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 191.365371][ T2901] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 191.378617][ T2901] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 191.387159][ T2901] bridge0: port 2(bridge_slave_1) entered blocking state [ 191.403254][ T2901] bridge0: port 2(bridge_slave_1) entered forwarding state [ 191.411430][ T2901] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 191.420586][ T2901] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 191.431961][ T2901] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 191.441937][ T2901] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 191.452992][ T2901] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready 08:59:52 executing program 2: 08:59:52 executing program 1: [ 191.462577][ T2901] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 191.491175][T10709] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 191.519695][T10709] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 191.555134][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 191.572315][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 191.583852][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 191.592477][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 191.601204][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 191.620154][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 191.644867][T10709] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 191.688836][ C0] hrtimer: interrupt took 60944 ns [ 191.714498][T10775] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. 08:59:53 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$VIDIOC_G_CROP(r1, 0xc01456b8, &(0x7f0000000100)={0x0, {0x94, 0x80000000000001a, 0x6aa0}}) 08:59:53 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000240)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) write$binfmt_elf64(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="7f454cc6060507000700000000000000020000000d0000007b0300000000000040000002e7477bdce6f020acaf499ccc553a0004000000000000001600341cc73a00003f00"], 0x45) recvmmsg(r0, &(0x7f0000008880), 0x45b, 0x44000102, 0x0) 08:59:53 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = mq_open(&(0x7f0000000000)='md5sumeth1wlan0{cgroupmime_type@\x00', 0x6e93ebbbcc0884f2, 0x0, &(0x7f0000000080)={0x0, 0x2, 0x5}) mq_timedsend(r1, 0x0, 0x0, 0x0, 0x0) mq_timedsend(r1, 0x0, 0x0, 0x0, 0x0) mq_timedreceive(r1, &(0x7f0000000140)=""/204, 0x9d, 0x20000140, 0x0) 08:59:53 executing program 0: 08:59:53 executing program 1: 08:59:53 executing program 2: 08:59:53 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$VIDIOC_G_CROP(r1, 0xc01456b8, &(0x7f0000000100)={0x0, {0x94, 0x80000000000001a, 0x6aa0}}) 08:59:53 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x8000, &(0x7f0000000240)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) write$binfmt_elf64(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="7f454cc6060507000700000000000000020000000d0000007b0300000000000040000002e7477bdce6f020acaf499ccc553a0004000000000000001600341cc73a00003f00"], 0x45) recvmmsg(r0, &(0x7f0000008880), 0x45b, 0x44000102, 0x0) 08:59:53 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) recvmsg(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000340)=""/144, 0x90}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x8}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0x73a0b1b, 0x0, 0x0, 0x800e00549) shutdown(r1, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000005c0)=""/50, 0x32}], 0x1}, 0x0) r4 = dup(r3) r5 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r5, 0x0, 0xccf3, 0x0, 0x0, 0x800e00551) shutdown(r4, 0x0) r6 = socket$inet6_sctp(0x1c, 0x5, 0x84) readv(r6, &(0x7f0000000a80)=[{&(0x7f00000000c0)=""/195, 0xc3}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x7) shutdown(r5, 0x0) shutdown(r2, 0x0) 08:59:53 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = mq_open(&(0x7f0000000000)='md5sumeth1wlan0{cgroupmime_type@\x00', 0x6e93ebbbcc0884f2, 0x0, &(0x7f0000000080)={0x0, 0x2, 0x5}) mq_timedsend(r1, 0x0, 0x0, 0x0, 0x0) mq_timedsend(r1, 0x0, 0x0, 0x0, 0x0) mq_timedreceive(r1, &(0x7f0000000140)=""/204, 0x9d, 0x20000140, 0x0) 08:59:53 executing program 1: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) socket$inet(0x2, 0x3, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$P9_RRENAME(r1, &(0x7f0000000000)={0x7, 0x15, 0x2}, 0x7) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x1100000000000000) 08:59:53 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$VIDIOC_G_CROP(r1, 0xc01456b8, &(0x7f0000000100)={0x0, {0x94, 0x80000000000001a, 0x6aa0}}) 08:59:53 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = mq_open(&(0x7f0000000000)='md5sumeth1wlan0{cgroupmime_type@\x00', 0x6e93ebbbcc0884f2, 0x0, &(0x7f0000000080)={0x0, 0x2, 0x5}) mq_timedsend(r1, 0x0, 0x0, 0x0, 0x0) mq_timedsend(r1, 0x0, 0x0, 0x0, 0x0) mq_timedreceive(r1, &(0x7f0000000140)=""/204, 0x9d, 0x20000140, 0x0) [ 192.680593][T10808] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. 08:59:53 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x5) ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000e40)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e3d63a98fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b5365c5dc26ca097ddda7c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df10000174a3ac8694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde318ead4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d41f6b21224b57f530d0000c1ff53bf79a1f5c5dc34b2262d66ae793b6304a30b97077f1c131045cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f58e068af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28b774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1a1f0000000000000094c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e34000000000000000f4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a800655d127de6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b561659e8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb56d9b962d2fc43fa01a047526865c84f7cff36056cc4ac258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d345a3d6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d8191643"}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_VAPIC_ADDR(r3, 0x4004ae99, &(0x7f0000000080)=0x4) dup2(r2, r3) 08:59:53 executing program 4: syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x0) ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc01456b8, &(0x7f0000000100)={0x0, {0x94, 0x80000000000001a, 0x6aa0}}) 08:59:54 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) nanosleep(&(0x7f0000000040)={0x0, 0x989680}, 0x0) r1 = add_key$user(&(0x7f0000000240)='user\x00', &(0x7f0000000440)={'syz'}, 0x0, 0x0, 0xfffffffffffffffe) r2 = add_key$user(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd) perf_event_open(&(0x7f00000003c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) keyctl$dh_compute(0x17, &(0x7f00000001c0)={r2, r1, r2}, 0x0, 0x0, &(0x7f0000000180)={0x0}) r3 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2) pipe(0x0) ioctl$KVM_GET_SREGS(r3, 0x8138ae83, &(0x7f0000001440)) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, 0x0, &(0x7f0000001300)) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000001340)={0x0, @in6={{0xa, 0x4e21, 0x2, @local, 0x10000}}, 0x6}, 0x0) read$FUSE(r3, &(0x7f0000000300), 0x1000) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) write$P9_RGETLOCK(0xffffffffffffffff, &(0x7f0000000200)={0x24, 0x37, 0x1, {0x1, 0x20, 0x10000, 0x0, 0x6, '}wlan1'}}, 0x24) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r0) [ 192.907357][T10827] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. 08:59:54 executing program 4: syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x0) ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc01456b8, &(0x7f0000000100)={0x0, {0x94, 0x80000000000001a, 0x6aa0}}) [ 193.044689][T10838] vivid-007: kernel_thread() failed 08:59:54 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000500)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000fdfdfff67a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040000010000400404000001000000b7050000050000006a0a00fe00000000850000000a000000b70000000000000095000000000000009cc6b3fcd62c7d1c6238975d43a4505f80fc889f3c530cf08e467b592f868ee3b0a434df0a0e8c1bf176db2a6b2feb4b6fd3d5707ba3b1d4e984c46ea7e2b347a36f5662403e1b2be4cc7c2683908a24411a9872971c7c56f0979bd10b97163c1d6d78589cd4fb21a6d06b50e57b6ede4fab0e196bf02f46c7953ab1abda45cbe8f9de9ca3c00cb9bf4e418d07fa22f0610a70f2bdf4000000000000b0c2940dd8e263f63223b7b80197aa743f7555193161f4bcb3b05ceaa8f839a2e5ca27be29efd7c8e07ede907c84c2073c6a7a4defbd66bbe0f43308a3bd2acc762091214c72a7c34ce30552e2571b36173b39c252747621883b246a0eb21105278de7b680ae57c55704df"], &(0x7f0000000340)='GPL\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r0, 0x0, 0xe, 0x0, &(0x7f0000000380)="538b5ec392459c5fce03145ba2ca", 0x0}, 0x28) 08:59:54 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) poll(&(0x7f0000000080)=[{r0}], 0x1, 0x4e) r1 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r1, 0x0, 0x10101, 0x0, 0x0, 0x800e00988) r2 = socket$inet_udplite(0x2, 0x2, 0x88) readv(r2, &(0x7f0000000b00)=[{&(0x7f0000000300)=""/68, 0x44}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x8) shutdown(r1, 0x0) 08:59:54 executing program 5: unshare(0x8020000) semop(0x0, &(0x7f00000000c0)=[{}, {0x0, 0x0, 0x1000}], 0x2) 08:59:54 executing program 4: syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x0) ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc01456b8, &(0x7f0000000100)={0x0, {0x94, 0x80000000000001a, 0x6aa0}}) 08:59:54 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) nanosleep(&(0x7f0000000040)={0x0, 0x989680}, 0x0) r1 = add_key$user(&(0x7f0000000240)='user\x00', &(0x7f0000000440)={'syz'}, 0x0, 0x0, 0xfffffffffffffffe) r2 = add_key$user(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd) perf_event_open(&(0x7f00000003c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) keyctl$dh_compute(0x17, &(0x7f00000001c0)={r2, r1, r2}, 0x0, 0x0, &(0x7f0000000180)={0x0}) r3 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2) pipe(0x0) ioctl$KVM_GET_SREGS(r3, 0x8138ae83, &(0x7f0000001440)) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, 0x0, &(0x7f0000001300)) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000001340)={0x0, @in6={{0xa, 0x4e21, 0x2, @local, 0x10000}}, 0x6}, 0x0) read$FUSE(r3, &(0x7f0000000300), 0x1000) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) write$P9_RGETLOCK(0xffffffffffffffff, &(0x7f0000000200)={0x24, 0x37, 0x1, {0x1, 0x20, 0x10000, 0x0, 0x6, '}wlan1'}}, 0x24) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r0) 08:59:54 executing program 1: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) socket$inet(0x2, 0x3, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$P9_RRENAME(r1, &(0x7f0000000000)={0x7, 0x15, 0x2}, 0x7) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x1100000000000000) 08:59:54 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) socket$inet(0x2, 0x3, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$P9_RRENAME(r1, &(0x7f0000000000)={0x7, 0x15, 0x2}, 0x7) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x1100000000000000) 08:59:54 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) nanosleep(&(0x7f0000000040)={0x0, 0x989680}, 0x0) r1 = add_key$user(&(0x7f0000000240)='user\x00', &(0x7f0000000440)={'syz'}, 0x0, 0x0, 0xfffffffffffffffe) r2 = add_key$user(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd) perf_event_open(&(0x7f00000003c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) keyctl$dh_compute(0x17, &(0x7f00000001c0)={r2, r1, r2}, 0x0, 0x0, &(0x7f0000000180)={0x0}) r3 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2) pipe(0x0) ioctl$KVM_GET_SREGS(r3, 0x8138ae83, &(0x7f0000001440)) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, 0x0, &(0x7f0000001300)) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000001340)={0x0, @in6={{0xa, 0x4e21, 0x2, @local, 0x10000}}, 0x6}, 0x0) read$FUSE(r3, &(0x7f0000000300), 0x1000) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) write$P9_RGETLOCK(0xffffffffffffffff, &(0x7f0000000200)={0x24, 0x37, 0x1, {0x1, 0x20, 0x10000, 0x0, 0x6, '}wlan1'}}, 0x24) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r0) 08:59:54 executing program 4: r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$VIDIOC_G_CROP(r0, 0xc01456b8, &(0x7f0000000100)={0x0, {0x94, 0x80000000000001a, 0x6aa0}}) 08:59:54 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) poll(&(0x7f0000000080)=[{r0}, {r0}], 0x2, 0x4e) r1 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r1, 0x0, 0x10101, 0x0, 0x0, 0x800e00988) dup(0xffffffffffffffff) shutdown(0xffffffffffffffff, 0x0) shutdown(0xffffffffffffffff, 0x0) r2 = socket$inet6_sctp(0x1c, 0x5, 0x84) recvmsg(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000600)=[{0x0}, {0x0}, {0x0}], 0x3}, 0x0) shutdown(r1, 0x0) 08:59:54 executing program 4: r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$VIDIOC_G_CROP(r0, 0xc01456b8, &(0x7f0000000100)={0x0, {0x94, 0x80000000000001a, 0x6aa0}}) 08:59:54 executing program 5: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x50000}]}) r0 = openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0) write$P9_RATTACH(r0, 0x0, 0x0) 08:59:55 executing program 1: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) socket$inet(0x2, 0x3, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$P9_RRENAME(r1, &(0x7f0000000000)={0x7, 0x15, 0x2}, 0x7) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x1100000000000000) 08:59:55 executing program 2: socketpair$unix(0x1, 0x800000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, &(0x7f0000444ff8)={0x0, 0x7}, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f0000107ff8)={0x0, 0x10040000}, 0x8) connect$inet6(r1, &(0x7f00008c0000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000000080)={0x0, 0x9}, 0x8) 08:59:55 executing program 3: creat(&(0x7f0000000000)='./file0\x00', 0x0) syz_mount_image$minix(&(0x7f00000000c0)='minix\x00', &(0x7f00000001c0)='./file0\x00', 0x40000000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000140)="600084e002000a0090040300001af5c98f13", 0x12, 0x400}], 0x0, 0x0) 08:59:55 executing program 4: r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$VIDIOC_G_CROP(r0, 0xc01456b8, &(0x7f0000000100)={0x0, {0x94, 0x80000000000001a, 0x6aa0}}) 08:59:55 executing program 5: socket$inet6_udplite(0x1c, 0x2, 0x88) poll(&(0x7f0000000000), 0x2000000000000007, 0x43) r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r0, 0x0, 0xfffffecb, 0x0, 0x0, 0x800e00515) r1 = socket$inet6_sctp(0x1c, 0x5, 0x84) recvmsg(r1, &(0x7f0000002700)={0x0, 0x0, 0x0}, 0x0) shutdown(r0, 0x0) 08:59:55 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca5055e0bcfe47bf070") openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) socket$inet_udplite(0x2, 0x2, 0x88) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000100)='/dev/uhid\x00', 0x2, 0x0) write$UHID_CREATE(r1, &(0x7f0000000340)={0x0, 'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xec\xff\xff\xff\xff\xff\xff\xff\x00', 'syz0\x00', 'syz0\x00', &(0x7f0000000480)=""/195, 0xc3}, 0x120) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000084, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)) writev(r1, &(0x7f0000000180)=[{&(0x7f0000000040), 0xb5}], 0x8) [ 194.326700][T10909] MINIX-fs: mounting unchecked file system, running fsck is recommended 08:59:55 executing program 1: ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20004004, &(0x7f0000000040)={0xa, 0x20004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000000)='tls\x00', 0xc498ead121f97dd6) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000140)=@gcm_128={{0x303}, "d44eb8c7308ec7c4", "442065238929350ade91900b51fc9534", "6bdda720", "7ee51430da3f51b3"}, 0x28) sendto$inet6(r0, &(0x7f00000005c0), 0xffffffffffffffc1, 0x0, 0x0, 0x1201000000003618) dup3(r0, r1, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) 08:59:55 executing program 3: creat(&(0x7f0000000000)='./file0\x00', 0x0) syz_mount_image$minix(&(0x7f00000000c0)='minix\x00', &(0x7f00000001c0)='./file0\x00', 0x40000000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000140)="600084e002000a0090040300001af5c98f13", 0x12, 0x400}], 0x0, 0x0) 08:59:55 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000080)) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x2) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0x3) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)) 08:59:55 executing program 4: r0 = syz_open_dev$dri(0x0, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$VIDIOC_G_CROP(r1, 0xc01456b8, &(0x7f0000000100)={0x0, {0x94, 0x80000000000001a, 0x6aa0}}) [ 194.505742][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 194.540254][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 194.563419][ C1] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 194.597718][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 08:59:55 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) openat$random(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/urandom\x00', 0x1, 0x0) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x8000) sendfile(r1, r2, 0x0, 0xc00000000010) 08:59:55 executing program 4: r0 = syz_open_dev$dri(0x0, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$VIDIOC_G_CROP(r1, 0xc01456b8, &(0x7f0000000100)={0x0, {0x94, 0x80000000000001a, 0x6aa0}}) 08:59:55 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000080)) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x2) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0x3) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)) [ 194.661698][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 194.712466][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 194.765158][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 194.808953][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 194.816808][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 194.837431][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 08:59:56 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="020b0001020000000000400000000000"], 0x10}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB="02030609100000000000004c9e0000000200130002000000000000000010000105000600200000000a00000000000000000500e50000070000001f0000000000000300000000000002000100f5000000000000020000000005000500000000000a000000000000000000000000000000001700"/128], 0x80}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x400000000000002, 0x0) 08:59:56 executing program 4: r0 = syz_open_dev$dri(0x0, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$VIDIOC_G_CROP(r1, 0xc01456b8, &(0x7f0000000100)={0x0, {0x94, 0x80000000000001a, 0x6aa0}}) 08:59:56 executing program 1: ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20004004, &(0x7f0000000040)={0xa, 0x20004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000000)='tls\x00', 0xc498ead121f97dd6) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000140)=@gcm_128={{0x303}, "d44eb8c7308ec7c4", "442065238929350ade91900b51fc9534", "6bdda720", "7ee51430da3f51b3"}, 0x28) sendto$inet6(r0, &(0x7f00000005c0), 0xffffffffffffffc1, 0x0, 0x0, 0x1201000000003618) dup3(r0, r1, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) [ 194.853655][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 194.888955][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 08:59:56 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000080)) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x2) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0x3) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)) [ 194.941381][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 194.973728][ C1] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 194.979803][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.024190][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.042711][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.050572][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.063781][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.076398][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.084460][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.092208][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.099912][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.107396][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.115278][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.124764][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.142739][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.174150][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.183085][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.190870][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.209200][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.220957][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.228813][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.236465][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.244508][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.253370][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.261125][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.269834][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.278900][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.286412][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.294252][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.302909][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.317120][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.324975][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.332866][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.341876][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.349771][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.357261][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.365145][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.372998][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.380838][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.388547][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.396019][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.403833][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.411556][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.419249][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.427735][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.437356][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.445220][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.453025][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.472110][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.490497][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.498541][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.506025][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.513865][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.521591][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.529124][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.536601][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.544079][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.551594][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.559087][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.566480][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.573928][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.581427][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.588864][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.596266][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.603911][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.611393][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.618827][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.626219][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.633660][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.641094][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.648529][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.655919][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.663364][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.670779][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.678403][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.685784][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.693201][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.700677][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.708122][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.715595][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.723005][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.730405][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.738019][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.745402][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.752876][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.760578][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.768136][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.772103][T10967] kasan: CONFIG_KASAN_INLINE enabled [ 195.775616][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.782879][T10967] kasan: GPF could be caused by NULL-ptr deref or user memory access [ 195.788496][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.788520][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.800720][T10967] general protection fault: 0000 [#1] PREEMPT SMP KASAN [ 195.804007][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.811296][T10967] CPU: 1 PID: 10967 Comm: syz-executor.1 Not tainted 5.3.0-rc2-next-20190802 #58 [ 195.811305][T10967] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 195.811375][T10967] RIP: 0010:tls_trim_both_msgs+0x54/0x130 [ 195.811396][T10967] Code: 48 c1 ea 03 80 3c 02 00 0f 85 e3 00 00 00 4d 8b b5 b0 06 00 00 48 b8 00 00 00 00 00 fc ff df 49 8d 7e 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 b3 00 00 00 48 b8 00 00 00 00 00 fc ff df 49 8b [ 195.818359][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.825682][T10967] RSP: 0018:ffff88805e027ac0 EFLAGS: 00010206 [ 195.834862][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.844819][T10967] RAX: dffffc0000000000 RBX: ffff8880932f2480 RCX: ffffc9000815e000 [ 195.844827][T10967] RDX: 0000000000000005 RSI: ffffffff862e29d6 RDI: 0000000000000028 [ 195.844834][T10967] RBP: ffff88805e027ae0 R08: ffff888091c864c0 R09: ffffed1012d4eb59 [ 195.844840][T10967] R10: ffffed1012d4eb58 R11: ffff888096a75ac3 R12: 0000000000000000 [ 195.844847][T10967] R13: ffff888063c22040 R14: 0000000000000000 R15: 00000000ffffffe0 [ 195.844858][T10967] FS: 00007fc643849700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 [ 195.844865][T10967] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 195.844872][T10967] CR2: 0000001b30438000 CR3: 0000000093c28000 CR4: 00000000001406e0 [ 195.844884][T10967] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 195.844890][T10967] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 195.844895][T10967] Call Trace: [ 195.844925][T10967] tls_sw_sendmsg+0xe38/0x17b0 [ 195.844947][T10967] ? tx_work_handler+0x180/0x180 [ 195.844977][T10967] ? retint_kernel+0x2b/0x2b [ 195.845003][T10967] inet6_sendmsg+0x9e/0xe0 [ 195.845015][T10967] ? inet6_ioctl+0x1c0/0x1c0 [ 195.845042][T10967] sock_sendmsg+0xd7/0x130 [ 195.845058][T10967] __sys_sendto+0x262/0x380 [ 195.845073][T10967] ? __ia32_sys_getpeername+0xb0/0xb0 [ 195.845113][T10967] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 195.850917][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.870470][T10967] ? put_timespec64+0xda/0x140 [ 195.870482][T10967] ? nsecs_to_jiffies+0x30/0x30 [ 195.870500][T10967] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 195.870514][T10967] ? __x64_sys_clock_gettime+0x16d/0x240 [ 195.870544][T10967] __x64_sys_sendto+0xe1/0x1a0 [ 195.877963][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.883989][T10967] do_syscall_64+0xfa/0x760 [ 195.891400][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.899296][T10967] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 195.899316][T10967] RIP: 0033:0x459829 [ 195.907312][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.915258][T10967] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 195.915266][T10967] RSP: 002b:00007fc643848c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 195.915277][T10967] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000000459829 [ 195.915283][T10967] RDX: ffffffffffffffc1 RSI: 00000000200005c0 RDI: 0000000000000004 [ 195.915290][T10967] RBP: 000000000075bf20 R08: 0000000000000000 R09: 1201000000003618 [ 195.915297][T10967] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc6438496d4 [ 195.915304][T10967] R13: 00000000004c77d9 R14: 00000000004dcf90 R15: 00000000ffffffff [ 195.915326][T10967] Modules linked in: [ 195.924194][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.937712][T10967] ---[ end trace 31269caa649761a7 ]--- [ 195.940429][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.946972][T10967] RIP: 0010:tls_trim_both_msgs+0x54/0x130 [ 195.955095][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.965993][T10967] Code: 48 c1 ea 03 80 3c 02 00 0f 85 e3 00 00 00 4d 8b b5 b0 06 00 00 48 b8 00 00 00 00 00 fc ff df 49 8d 7e 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 b3 00 00 00 48 b8 00 00 00 00 00 fc ff df 49 8b [ 195.971287][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.975323][T10967] RSP: 0018:ffff88805e027ac0 EFLAGS: 00010206 [ 195.979622][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.987572][T10967] RAX: dffffc0000000000 RBX: ffff8880932f2480 RCX: ffffc9000815e000 [ 195.989254][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 195.993588][T10967] RDX: 0000000000000005 RSI: ffffffff862e29d6 RDI: 0000000000000028 [ 195.998947][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 196.006644][T10967] RBP: ffff88805e027ae0 R08: ffff888091c864c0 R09: ffffed1012d4eb59 [ 196.007568][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 196.013293][T10967] R10: ffffed1012d4eb58 R11: ffff888096a75ac3 R12: 0000000000000000 [ 196.019216][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 196.029233][T10967] R13: ffff888063c22040 R14: 0000000000000000 R15: 00000000ffffffe0 [ 196.031473][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 196.036288][T10967] FS: 00007fc643849700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 [ 196.042648][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 196.051789][T10967] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 196.053084][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 196.061196][T10967] CR2: 0000000000c13000 CR3: 0000000093c28000 CR4: 00000000001406e0 [ 196.065064][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 196.072847][T10967] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 196.078823][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 196.086134][T10967] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 196.090180][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 196.110212][T10967] Kernel panic - not syncing: Fatal exception [ 196.118404][ T12] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 196.127828][T10967] Kernel Offset: disabled [ 196.407601][T10967] Rebooting in 86400 seconds..