[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[   60.712431][   T26] audit: type=1800 audit(1558135158.546:25): pid=8747 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0
[   60.751478][   T26] audit: type=1800 audit(1558135158.546:26): pid=8747 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0
[   60.772366][   T26] audit: type=1800 audit(1558135158.546:27): pid=8747 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added '10.128.1.17' (ECDSA) to the list of known hosts.
2019/05/17 23:19:29 fuzzer started
2019/05/17 23:19:32 dialing manager at 10.128.0.26:37669
2019/05/17 23:19:32 syscalls: 1006
2019/05/17 23:19:32 code coverage: enabled
2019/05/17 23:19:32 comparison tracing: enabled
2019/05/17 23:19:32 extra coverage: extra coverage is not supported by the kernel
2019/05/17 23:19:32 setuid sandbox: enabled
2019/05/17 23:19:32 namespace sandbox: enabled
2019/05/17 23:19:32 Android sandbox: /sys/fs/selinux/policy does not exist
2019/05/17 23:19:32 fault injection: enabled
2019/05/17 23:19:32 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled
2019/05/17 23:19:32 net packet injection: enabled
2019/05/17 23:19:32 net device setup: enabled
23:19:33 executing program 0:
r0 = socket$inet(0x10, 0x3, 0xc)
sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="240000000c0607031dfffd946fa2830020200a0009000100061d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0)

syzkaller login: [   75.710524][ T8916] IPVS: ftp: loaded support on port[0] = 21
[   75.721962][ T8916] NET: Registered protocol family 30
[   75.727286][ T8916] Failed to register TIPC socket type
23:19:33 executing program 1:
syz_emit_ethernet(0x36, &(0x7f00000001c0)={@local, @random="ba4b976fff68", [], {@ipv4={0x800, {{0xa, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x0, 0x0, @dev, @remote={0xac, 0x14, 0x223}}, @icmp=@timestamp_reply={0xffffff86, 0x9}}}}}, 0x0)

[   75.925097][ T8918] IPVS: ftp: loaded support on port[0] = 21
[   75.935539][ T8918] NET: Registered protocol family 30
[   75.940860][ T8918] Failed to register TIPC socket type
23:19:33 executing program 2:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070")
syz_emit_ethernet(0x38a, &(0x7f0000000000)={@local, @local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x2ce, 0x0, 0x0, 0x0, 0x11, 0x0, @rand_addr, @multicast1}, @icmp=@address_reply={0x8}}}}}, &(0x7f0000000040)={0x0, 0x3, [0x2, 0x2d9, 0x3]})

[   76.250813][ T8920] IPVS: ftp: loaded support on port[0] = 21
[   76.275924][ T8920] NET: Registered protocol family 30
[   76.291508][ T8920] Failed to register TIPC socket type
23:19:34 executing program 3:
r0 = socket$inet6(0xa, 0x2, 0x0)
connect$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c)
connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c)
connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @mcast1}, 0x1c)

[   76.768540][ T8922] IPVS: ftp: loaded support on port[0] = 21
[   76.805691][ T8922] NET: Registered protocol family 30
[   76.811020][ T8922] Failed to register TIPC socket type
23:19:34 executing program 4:
bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001, 0x1}, 0x2c)
bpf$MAP_CREATE(0x2, &(0x7f0000000000)={0x3, 0x0, 0x77ffff, 0x0, 0x820000, 0x0}, 0x2c)
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070")
bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c)

[   77.409853][ T8924] IPVS: ftp: loaded support on port[0] = 21
[   77.445377][ T8924] NET: Registered protocol family 30
[   77.450716][ T8924] Failed to register TIPC socket type
23:19:35 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x21000008912, &(0x7f0000000080)="0adc1f123c123f319bd070")
r1 = socket$inet(0x10, 0x3, 0xc)
sendmsg(r1, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0)
sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000100)="24000000020307031dfffd946ff20c0020200a1009000100021d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0)

[   78.118700][ T8926] IPVS: ftp: loaded support on port[0] = 21
[   78.135337][ T8926] NET: Registered protocol family 30
[   78.140673][ T8926] Failed to register TIPC socket type
[   78.643648][ T8916] chnl_net:caif_netlink_parms(): no params data found
[   78.976125][ T8916] bridge0: port 1(bridge_slave_0) entered blocking state
[   79.092474][ T8916] bridge0: port 1(bridge_slave_0) entered disabled state
[   79.163345][ T8916] device bridge_slave_0 entered promiscuous mode
[   79.333349][ T8916] bridge0: port 2(bridge_slave_1) entered blocking state
[   79.340540][ T8916] bridge0: port 2(bridge_slave_1) entered disabled state
[   79.516686][ T8916] device bridge_slave_1 entered promiscuous mode
[   80.052484][ T8916] bond0: Enslaving bond_slave_0 as an active interface with an up link
[   80.343769][ T8916] bond0: Enslaving bond_slave_1 as an active interface with an up link
[   81.111302][ T8916] team0: Port device team_slave_0 added
[   81.385063][ T8916] team0: Port device team_slave_1 added
[   82.487056][ T8916] device hsr_slave_0 entered promiscuous mode
[   83.084195][ T8916] device hsr_slave_1 entered promiscuous mode
[   85.539950][ T8916] 8021q: adding VLAN 0 to HW filter on device bond0
[   86.150747][ T9031] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[   86.255418][ T9031] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[   86.582868][ T8916] 8021q: adding VLAN 0 to HW filter on device team0
[   86.843048][ T9031] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[   86.955032][ T9031] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[   87.128940][ T9031] bridge0: port 1(bridge_slave_0) entered blocking state
[   87.136312][ T9031] bridge0: port 1(bridge_slave_0) entered forwarding state
[   87.575125][    T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[   87.593082][    T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[   87.745063][    T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[   87.882648][    T5] bridge0: port 2(bridge_slave_1) entered blocking state
[   87.889810][    T5] bridge0: port 2(bridge_slave_1) entered forwarding state
[   88.155681][ T9031] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[   88.294307][ T2993] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[   88.475089][    T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[   88.553193][    T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[   88.772133][ T2993] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[   88.780612][ T2993] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[   89.036157][ T2993] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[   89.439651][    T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[   89.482226][    T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[   89.681676][    T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[   89.690262][    T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[   89.986357][ T8916] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[   90.595476][ T8916] 8021q: adding VLAN 0 to HW filter on device batadv0
[   92.715807][ T9378] netlink: 'syz-executor.0': attribute type 1 has an invalid length.
23:19:51 executing program 0:
r0 = socket$inet(0x10, 0x3, 0xc)
sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="240000000c0607031dfffd946fa2830020200a0009000100061d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0)

23:19:53 executing program 0:
r0 = socket$inet(0x10, 0x3, 0xc)
sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="240000000c0607031dfffd946fa2830020200a0009000100061d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0)

[   96.086481][ T9388] IPVS: ftp: loaded support on port[0] = 21
[   96.541288][ T9392] netlink: 'syz-executor.0': attribute type 1 has an invalid length.
[   96.604889][ T9390] IPVS: ftp: loaded support on port[0] = 21
[   96.615038][ T9388] NET: Registered protocol family 30
[   96.620348][ T9388] Failed to register TIPC socket type
[   97.054176][ T9390] list_add double add: new=ffffffff89544ab0, prev=ffffffff89334ac0, next=ffffffff89544ab0.
[   97.218229][ T9393] IPVS: ftp: loaded support on port[0] = 21
23:19:55 executing program 0:
r0 = socket$inet(0x10, 0x3, 0xc)
sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="240000000c0607031dfffd946fa2830020200a0009000100061d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0)

[   97.610385][ T9390] ------------[ cut here ]------------
[   97.615987][ T9390] kernel BUG at lib/list_debug.c:29!
[   98.052253][ T9390] invalid opcode: 0000 [#1] PREEMPT SMP KASAN
[   98.058505][ T9390] CPU: 0 PID: 9390 Comm: syz-executor.2 Not tainted 5.1.0+ #18
[   98.066047][ T9390] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   98.076379][ T9390] RIP: 0010:__list_add_valid.cold+0x26/0x3c
[   98.082287][ T9390] Code: 56 ff ff ff 4c 89 e1 48 c7 c7 20 4c a3 87 e8 00 60 25 fe 0f 0b 48 89 f2 4c 89 e1 4c 89 ee 48 c7 c7 60 4d a3 87 e8 e9 5f 25 fe <0f> 0b 48 89 f1 48 c7 c7 e0 4c a3 87 4c 89 e6 e8 d5 5f 25 fe 0f 0b
[   98.101910][ T9390] RSP: 0018:ffff888080d97b88 EFLAGS: 00010282
[   98.108000][ T9390] RAX: 0000000000000058 RBX: ffffffff89544920 RCX: 0000000000000000
[   98.115974][ T9390] RDX: 0000000000000000 RSI: ffffffff815afbe6 RDI: ffffed10101b2f63
[   98.123961][ T9390] RBP: ffff888080d97ba0 R08: 0000000000000058 R09: ffffed1015d06011
[   98.131958][ T9390] R10: ffffed1015d06010 R11: ffff8880ae830087 R12: ffffffff89544ab0
[   98.139954][ T9390] R13: ffffffff89544ab0 R14: ffffffff89544ab0 R15: ffffffff89544a50
[   98.147951][ T9390] FS:  0000000001fab940(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
[   98.156892][ T9390] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   98.163582][ T9390] CR2: 00000000006197e0 CR3: 0000000081af2000 CR4: 00000000001406f0
[   98.171561][ T9390] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   98.179541][ T9390] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   98.187513][ T9390] Call Trace:
[   98.190957][ T9390]  ? mutex_lock_nested+0x16/0x20
[   98.195895][ T9390]  proto_register+0x459/0x8e0
[   98.200692][ T9390]  ? lockdep_init_map+0x1be/0x6d0
[   98.205722][ T9390]  tipc_socket_init+0x1c/0x70
[   98.210403][ T9390]  tipc_init_net+0x32a/0x5b0
[   98.214993][ T9390]  ? tipc_exit_net+0x40/0x40
[   98.219589][ T9390]  ops_init+0xb6/0x410
[   98.223677][ T9390]  setup_net+0x2d3/0x740
[   98.227945][ T9390]  ? copy_net_ns+0x1c0/0x340
[   98.232543][ T9390]  ? ops_init+0x410/0x410
[   98.236879][ T9390]  ? kasan_check_write+0x14/0x20
[   98.241839][ T9390]  ? down_read_killable+0x51/0x220
[   98.246977][ T9390]  copy_net_ns+0x1df/0x340
[   98.251403][ T9390]  create_new_namespaces+0x400/0x7b0
[   98.256705][ T9390]  unshare_nsproxy_namespaces+0xc2/0x200
[   98.262386][ T9390]  ksys_unshare+0x440/0x980
[   98.266933][ T9390]  ? trace_hardirqs_on+0x67/0x230
[   98.271983][ T9390]  ? walk_process_tree+0x2d0/0x2d0
[   98.277097][ T9390]  ? blkcg_exit_queue+0x30/0x30
[   98.281976][ T9390]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   98.287461][ T9390]  ? entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   98.293532][ T9390]  ? do_syscall_64+0x26/0x680
[   98.298214][ T9390]  ? lockdep_hardirqs_on+0x418/0x5d0
[   98.303516][ T9390]  __x64_sys_unshare+0x31/0x40
[   98.308285][ T9390]  do_syscall_64+0x103/0x680
[   98.312889][ T9390]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   98.318794][ T9390] RIP: 0033:0x45b897
[   98.322692][ T9390] Code: 00 00 00 b8 63 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 ad 8d fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 10 01 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 8d 8d fb ff c3 66 2e 0f 1f 84 00 00 00 00
[   98.342310][ T9390] RSP: 002b:00007ffd10380198 EFLAGS: 00000206 ORIG_RAX: 0000000000000110
[   98.350754][ T9390] RAX: ffffffffffffffda RBX: 000000000073c988 RCX: 000000000045b897
[   98.358736][ T9390] RDX: 0000000000000000 RSI: 00007ffd10380140 RDI: 0000000040000000
[   98.366711][ T9390] RBP: 00000000000000f8 R08: 0000000000000000 R09: 0000000000000005
[   98.374682][ T9390] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000414ab0
[   98.382665][ T9390] R13: 0000000000414b40 R14: 0000000000000000 R15: 0000000000000000
[   98.390673][ T9390] Modules linked in:
[   99.015813][ T9409] netlink: 'syz-executor.0': attribute type 1 has an invalid length.
[  100.245604][ T3880] kobject: 'loop0' (00000000c00c312a): kobject_uevent_env
23:19:58 executing program 0:
r0 = accept4(0xffffffffffffffff, 0x0, &(0x7f00000000c0), 0x80000)
r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r0, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x70, r1, 0x300, 0x70bd25, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xffff}, @IPVS_CMD_ATTR_DAEMON={0x30, 0x3, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'erspan0\x00'}]}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x3ff}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1}]}, 0x70}}, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCADDDLCI(0xffffffffffffffff, 0x8980, 0x0)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0)
setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0)
connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @loopback}, 0x10)
setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000240)=@nat={'nat\x00', 0x1b, 0x5, 0x618, 0x110, 0x0, 0x110, 0x330, 0x460, 0x5b0, 0x5b0, 0x5b0, 0x5b0, 0x5b0, 0x5, &(0x7f00000001c0), {[{{@uncond, 0x0, 0xd8, 0x110, 0x0, {}, [@common=@set={0x40, 'set\x00', 0x0, {{0x100000000, [0x1ff, 0xff, 0x8, 0x3, 0x4, 0x2], 0x20, 0x2}}}]}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0x1, {0x14, @multicast1, @initdev={0xac, 0x1e, 0x1, 0x0}, @port=0x4e20, @port=0x4e23}}}}, {{@uncond, 0x0, 0x1e8, 0x220, 0x0, {}, [@common=@inet=@hashlimit2={0x150, 'hashlimit\x00', 0x2, {'ip6_vti0\x00', {0x8, 0x101, 0x20, 0x1, 0x5, 0x0, 0x80, 0x40}, 0x100000001}}]}, @SNAT0={0x38, 'SNAT\x00', 0x0, {0x1, {0x8, @empty, @multicast2, @port=0x4e24, @gre_key}}}}, {{@uncond, 0x0, 0xf8, 0x130, 0x0, {}, [@common=@unspec=@connmark={0x30, 'connmark\x00', 0x1, {0x5, 0x3}}, @common=@addrtype={0x30, 'addrtype\x00', 0x0, {0x186, 0xd6}}]}, @REDIRECT={0x38, 'REDIRECT\x00', 0x0, {0x1, {0xa, @dev={0xac, 0x14, 0x14, 0x20}, @local, @port=0x4e20, @gre_key=0x8}}}}, {{@ip={@local, @rand_addr=0x7, 0x0, 0xffffffff, 'veth0_to_hsr\x00', 'ip6gre0\x00', {0xff}, {0xff}, 0xff, 0x2, 0x78}, 0x0, 0xe8, 0x120, 0x0, {}, [@common=@osf={0x50, 'osf\x00', 0x0, {'syz0\x00', 0x2, 0xa, 0x1}}]}, @SNAT0={0x38, 'SNAT\x00', 0x0, {0x1, {0x2, @remote, @rand_addr=0x5, @gre_key=0x3, @port=0x4e24}}}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x678)
setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf5, 0xf087}, 0x14)
r3 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e21, @local}, 0x10)
connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21}, 0x10)
setsockopt$inet_tcp_int(r3, 0x6, 0xa, &(0x7f0000000100)=0xffffffffffffffff, 0x1ee)
tee(r3, 0xffffffffffffffff, 0xfffffffffffffffa, 0x1)

[  100.328839][ T3880] kobject: 'loop0' (00000000c00c312a): fill_kobj_path: path = '/devices/virtual/block/loop0'
[  100.685650][ T9420] IPVS: ftp: loaded support on port[0] = 21
23:19:59 executing program 0:
r0 = accept4(0xffffffffffffffff, 0x0, &(0x7f00000000c0), 0x80000)
r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r0, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x70, r1, 0x300, 0x70bd25, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xffff}, @IPVS_CMD_ATTR_DAEMON={0x30, 0x3, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'erspan0\x00'}]}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x3ff}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1}]}, 0x70}}, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCADDDLCI(0xffffffffffffffff, 0x8980, 0x0)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0)
setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0)
connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @loopback}, 0x10)
setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000240)=@nat={'nat\x00', 0x1b, 0x5, 0x618, 0x110, 0x0, 0x110, 0x330, 0x460, 0x5b0, 0x5b0, 0x5b0, 0x5b0, 0x5b0, 0x5, &(0x7f00000001c0), {[{{@uncond, 0x0, 0xd8, 0x110, 0x0, {}, [@common=@set={0x40, 'set\x00', 0x0, {{0x100000000, [0x1ff, 0xff, 0x8, 0x3, 0x4, 0x2], 0x20, 0x2}}}]}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0x1, {0x14, @multicast1, @initdev={0xac, 0x1e, 0x1, 0x0}, @port=0x4e20, @port=0x4e23}}}}, {{@uncond, 0x0, 0x1e8, 0x220, 0x0, {}, [@common=@inet=@hashlimit2={0x150, 'hashlimit\x00', 0x2, {'ip6_vti0\x00', {0x8, 0x101, 0x20, 0x1, 0x5, 0x0, 0x80, 0x40}, 0x100000001}}]}, @SNAT0={0x38, 'SNAT\x00', 0x0, {0x1, {0x8, @empty, @multicast2, @port=0x4e24, @gre_key}}}}, {{@uncond, 0x0, 0xf8, 0x130, 0x0, {}, [@common=@unspec=@connmark={0x30, 'connmark\x00', 0x1, {0x5, 0x3}}, @common=@addrtype={0x30, 'addrtype\x00', 0x0, {0x186, 0xd6}}]}, @REDIRECT={0x38, 'REDIRECT\x00', 0x0, {0x1, {0xa, @dev={0xac, 0x14, 0x14, 0x20}, @local, @port=0x4e20, @gre_key=0x8}}}}, {{@ip={@local, @rand_addr=0x7, 0x0, 0xffffffff, 'veth0_to_hsr\x00', 'ip6gre0\x00', {0xff}, {0xff}, 0xff, 0x2, 0x78}, 0x0, 0xe8, 0x120, 0x0, {}, [@common=@osf={0x50, 'osf\x00', 0x0, {'syz0\x00', 0x2, 0xa, 0x1}}]}, @SNAT0={0x38, 'SNAT\x00', 0x0, {0x1, {0x2, @remote, @rand_addr=0x5, @gre_key=0x3, @port=0x4e24}}}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x678)
setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf5, 0xf087}, 0x14)
r3 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e21, @local}, 0x10)
connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21}, 0x10)
setsockopt$inet_tcp_int(r3, 0x6, 0xa, &(0x7f0000000100)=0xffffffffffffffff, 0x1ee)
tee(r3, 0xffffffffffffffff, 0xfffffffffffffffa, 0x1)

[  101.397651][ T3880] kobject: 'loop0' (00000000c00c312a): kobject_uevent_env
[  101.471631][ T3880] kobject: 'loop0' (00000000c00c312a): fill_kobj_path: path = '/devices/virtual/block/loop0'
23:20:00 executing program 0:
r0 = accept4(0xffffffffffffffff, 0x0, &(0x7f00000000c0), 0x80000)
r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r0, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x70, r1, 0x300, 0x70bd25, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xffff}, @IPVS_CMD_ATTR_DAEMON={0x30, 0x3, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'erspan0\x00'}]}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x3ff}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1}]}, 0x70}}, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCADDDLCI(0xffffffffffffffff, 0x8980, 0x0)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0)
setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0)
connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @loopback}, 0x10)
setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000240)=@nat={'nat\x00', 0x1b, 0x5, 0x618, 0x110, 0x0, 0x110, 0x330, 0x460, 0x5b0, 0x5b0, 0x5b0, 0x5b0, 0x5b0, 0x5, &(0x7f00000001c0), {[{{@uncond, 0x0, 0xd8, 0x110, 0x0, {}, [@common=@set={0x40, 'set\x00', 0x0, {{0x100000000, [0x1ff, 0xff, 0x8, 0x3, 0x4, 0x2], 0x20, 0x2}}}]}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0x1, {0x14, @multicast1, @initdev={0xac, 0x1e, 0x1, 0x0}, @port=0x4e20, @port=0x4e23}}}}, {{@uncond, 0x0, 0x1e8, 0x220, 0x0, {}, [@common=@inet=@hashlimit2={0x150, 'hashlimit\x00', 0x2, {'ip6_vti0\x00', {0x8, 0x101, 0x20, 0x1, 0x5, 0x0, 0x80, 0x40}, 0x100000001}}]}, @SNAT0={0x38, 'SNAT\x00', 0x0, {0x1, {0x8, @empty, @multicast2, @port=0x4e24, @gre_key}}}}, {{@uncond, 0x0, 0xf8, 0x130, 0x0, {}, [@common=@unspec=@connmark={0x30, 'connmark\x00', 0x1, {0x5, 0x3}}, @common=@addrtype={0x30, 'addrtype\x00', 0x0, {0x186, 0xd6}}]}, @REDIRECT={0x38, 'REDIRECT\x00', 0x0, {0x1, {0xa, @dev={0xac, 0x14, 0x14, 0x20}, @local, @port=0x4e20, @gre_key=0x8}}}}, {{@ip={@local, @rand_addr=0x7, 0x0, 0xffffffff, 'veth0_to_hsr\x00', 'ip6gre0\x00', {0xff}, {0xff}, 0xff, 0x2, 0x78}, 0x0, 0xe8, 0x120, 0x0, {}, [@common=@osf={0x50, 'osf\x00', 0x0, {'syz0\x00', 0x2, 0xa, 0x1}}]}, @SNAT0={0x38, 'SNAT\x00', 0x0, {0x1, {0x2, @remote, @rand_addr=0x5, @gre_key=0x3, @port=0x4e24}}}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x678)
setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf5, 0xf087}, 0x14)
r3 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e21, @local}, 0x10)
connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21}, 0x10)
setsockopt$inet_tcp_int(r3, 0x6, 0xa, &(0x7f0000000100)=0xffffffffffffffff, 0x1ee)
tee(r3, 0xffffffffffffffff, 0xfffffffffffffffa, 0x1)

[  102.526739][ T3880] kobject: 'loop0' (00000000c00c312a): kobject_uevent_env
[  102.661235][ T3880] kobject: 'loop0' (00000000c00c312a): fill_kobj_path: path = '/devices/virtual/block/loop0'
23:20:01 executing program 0:
r0 = accept4(0xffffffffffffffff, 0x0, &(0x7f00000000c0), 0x80000)
r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r0, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x70, r1, 0x300, 0x70bd25, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xffff}, @IPVS_CMD_ATTR_DAEMON={0x30, 0x3, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'erspan0\x00'}]}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x3ff}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1}]}, 0x70}}, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCADDDLCI(0xffffffffffffffff, 0x8980, 0x0)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0)
setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0)
connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @loopback}, 0x10)
setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000240)=@nat={'nat\x00', 0x1b, 0x5, 0x618, 0x110, 0x0, 0x110, 0x330, 0x460, 0x5b0, 0x5b0, 0x5b0, 0x5b0, 0x5b0, 0x5, &(0x7f00000001c0), {[{{@uncond, 0x0, 0xd8, 0x110, 0x0, {}, [@common=@set={0x40, 'set\x00', 0x0, {{0x100000000, [0x1ff, 0xff, 0x8, 0x3, 0x4, 0x2], 0x20, 0x2}}}]}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0x1, {0x14, @multicast1, @initdev={0xac, 0x1e, 0x1, 0x0}, @port=0x4e20, @port=0x4e23}}}}, {{@uncond, 0x0, 0x1e8, 0x220, 0x0, {}, [@common=@inet=@hashlimit2={0x150, 'hashlimit\x00', 0x2, {'ip6_vti0\x00', {0x8, 0x101, 0x20, 0x1, 0x5, 0x0, 0x80, 0x40}, 0x100000001}}]}, @SNAT0={0x38, 'SNAT\x00', 0x0, {0x1, {0x8, @empty, @multicast2, @port=0x4e24, @gre_key}}}}, {{@uncond, 0x0, 0xf8, 0x130, 0x0, {}, [@common=@unspec=@connmark={0x30, 'connmark\x00', 0x1, {0x5, 0x3}}, @common=@addrtype={0x30, 'addrtype\x00', 0x0, {0x186, 0xd6}}]}, @REDIRECT={0x38, 'REDIRECT\x00', 0x0, {0x1, {0xa, @dev={0xac, 0x14, 0x14, 0x20}, @local, @port=0x4e20, @gre_key=0x8}}}}, {{@ip={@local, @rand_addr=0x7, 0x0, 0xffffffff, 'veth0_to_hsr\x00', 'ip6gre0\x00', {0xff}, {0xff}, 0xff, 0x2, 0x78}, 0x0, 0xe8, 0x120, 0x0, {}, [@common=@osf={0x50, 'osf\x00', 0x0, {'syz0\x00', 0x2, 0xa, 0x1}}]}, @SNAT0={0x38, 'SNAT\x00', 0x0, {0x1, {0x2, @remote, @rand_addr=0x5, @gre_key=0x3, @port=0x4e24}}}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x678)
setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf5, 0xf087}, 0x14)
r3 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e21, @local}, 0x10)
connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21}, 0x10)
setsockopt$inet_tcp_int(r3, 0x6, 0xa, &(0x7f0000000100)=0xffffffffffffffff, 0x1ee)
tee(r3, 0xffffffffffffffff, 0xfffffffffffffffa, 0x1)

[  103.706715][ T3880] kobject: 'loop0' (00000000c00c312a): kobject_uevent_env
[  103.961213][ T3880] kobject: 'loop0' (00000000c00c312a): fill_kobj_path: path = '/devices/virtual/block/loop0'
[  104.987568][ T3880] kobject: 'loop0' (00000000c00c312a): kobject_uevent_env
[  105.221217][ T3880] kobject: 'loop0' (00000000c00c312a): fill_kobj_path: path = '/devices/virtual/block/loop0'
[  105.270164][ T9467] IPVS: ftp: loaded support on port[0] = 21