[....] Starting enhanced syslogd: rsyslogd[ 14.847648] audit: type=1400 audit(1571988904.575:4): avc: denied { syslog } for pid=1922 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.116' (ECDSA) to the list of known hosts. 2019/10/25 07:35:17 fuzzer started 2019/10/25 07:35:19 dialing manager at 10.128.0.26:32805 2019/10/25 07:35:20 syscalls: 1337 2019/10/25 07:35:20 code coverage: enabled 2019/10/25 07:35:20 comparison tracing: CONFIG_KCOV_ENABLE_COMPARISONS is not enabled 2019/10/25 07:35:20 extra coverage: extra coverage is not supported by the kernel 2019/10/25 07:35:20 setuid sandbox: enabled 2019/10/25 07:35:20 namespace sandbox: enabled 2019/10/25 07:35:20 Android sandbox: /sys/fs/selinux/policy does not exist 2019/10/25 07:35:20 fault injection: kernel does not have systematic fault injection support 2019/10/25 07:35:20 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/10/25 07:35:20 net packet injection: enabled 2019/10/25 07:35:20 net device setup: enabled 2019/10/25 07:35:20 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 07:35:55 executing program 0: pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) openat$keychord(0xffffffffffffff9c, 0x0, 0x0, 0x0) write(r0, &(0x7f00000001c0), 0xfffffef3) read(0xffffffffffffffff, &(0x7f0000000000)=""/250, 0x128b9372) r1 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/mcfilter6\x00') readv(r1, &(0x7f0000002340)=[{&(0x7f0000002380)=""/4096, 0xbc1}], 0x2000000000000024) readv(r1, &(0x7f0000000580), 0x3c1) setxattr$security_smack_transmute(0x0, &(0x7f0000000140)='security.SMACK64TRANSMUTE\x00', 0x0, 0x0, 0x4) syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x2) 07:35:55 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='erspan0\x00', 0xff89) perf_event_open(0x0, 0x0, 0xfeffffffffffffff, 0xffffffffffffffff, 0x0) connect$inet(r0, &(0x7f0000000100)={0x2, 0x0, @rand_addr=0x7fffffff}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x400000000000030, 0x0) 07:35:55 executing program 2: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) getpid() sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x5}, 0x0) socket$inet6(0xa, 0x2, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000000540), 0x0, 0x0, 0x0) pipe(&(0x7f0000001380)={0xffffffffffffffff}) vmsplice(r0, &(0x7f0000000000)=[{0x0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) ioctl$sock_ifreq(0xffffffffffffffff, 0x0, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x77359400}}, 0x0) timer_delete(r1) 07:35:55 executing program 1: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0x2a, &(0x7f0000000040), 0x4) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0xfffffffffffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$PPPIOCGDEBUG(0xffffffffffffffff, 0x80047441, &(0x7f00000000c0)) setsockopt$inet_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r1, 0x89a1, &(0x7f0000000300)={@local={0xfe, 0x80, [0x600, 0x3ef, 0x0, 0x3f00000000000000, 0x100000000000000, 0x0, 0x1103, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0xfffffffffffffffc}) ioctl$sock_inet6_SIOCADDRT(r1, 0x89a0, &(0x7f0000000100)={@local={0xfe, 0x80, [0x0, 0xfeff0000]}, @empty, @loopback}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x10811, 0xffffffffffffffff, 0x0) setsockopt$EBT_SO_SET_COUNTERS(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000680)=ANY=[@ANYBLOB="6e61740000f4ff0000000000000000000000000000000000000000000000000000000000000000000000000000000009000000000000000000000000000000000000000000000000000000177600000000000000000000000000000d19eca760d6bf2c6b5983b062041ed09c8e96af28ddaa9657abeafa2671c3113b1202cf08021ba8211821aea2f6bb4fb615eb3e5d3853a6b6e682f335ff06e471c0519fce5ed79272c8333b6a92c624cf12bcc000fe175243591c320264b91e7c6bb64e053d3a5ff5ce319a900e8a8245b3d5e484c19ee81844ba5e4495e22d6c5f588da6dd5e202cb817eb6e518f8f6e0c05da7ad2e9aa9e16953ac7fa9181425fd69e", @ANYPTR=&(0x7f0000000c40)=ANY=[]], 0x2) socket$inet6_udplite(0xa, 0x2, 0x88) getsockopt$IP_VS_SO_GET_DESTS(0xffffffffffffffff, 0x0, 0x484, &(0x7f0000000440)=""/128, &(0x7f0000000000)=0x80) 07:35:55 executing program 3: syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='projid_map\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000280)='fd/3\x00\x02\x17\x87:\xf4\x03\xdfc\x88,5I\xd7^\xb5D\xf7\xd7\xdb,(\xd5\x00\xc2\x06MG\xcd\xe9w\xe5s\x02\xf2\xea\xb6\xabsp\x12xT8\x01\x00\xd4S\xd8F\xab.x|\x8b\x87\xb0\xa2\xf5Y>\xb1 p\x998(\xe63\xcf\x7f\xac\x89F\x03n\x96\x15zsw\x98\xca\xcb3\xb6M=h\x01i.\xa3\xda}\x190~\xe7d6\xa5\x17\xb3\xe9\xd9QV\x0f\xf3\x02\xd6\xc1\xc3n\xcd*R\x9a\x95\x12\x05K\xa0<\xc9\xe3\xed\xab\xc9\x8bK\xb3\x86\xe2\x93f\x92iKA|e\x97k :,J36\x11\xf0\x99\x96\xb7]\xfd\xe3\v\xd8\x98\xc5o\xc6\xde\x80\xf7_\xc9\x8f\xaf\xf9\xd5\xb7ui\xea\xde\xd0\xeb\xd9\xf5_\v\xe2*\xa3\xf4\xab?n\xcb\x19i\x80\x91\xd2\xf6\x14\xfe!!0\x84L\x86\x81\x95,B\x11\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xab*[\xa5\xb217\x93\xf3\x88\x92\xa6\xde\x11\xa2-J\x9d\xc9\xb2\x97\xa3\x88v\x9eR\x155\xc7N!\xdb\"8\xc8I\xb9c\xed\xa7!\t\x85s\xb1\xa5\xa7R2Yf\x1c\xf8\xc2z>\xb1\x9c\x02a\x87\xe9\xb8\xf8\xdcv\xb6\xe4\xa6\n\x0e\x83lM7\xcc?\xea\x19\x99\xce\x1c\x10\xd2lQ(\xc7\xe9\xef\xd2Q\vY\xf58\x10|8}uE\xaf\xb4w;\xbc\xe4\x01\xd8\xf2\xf9u\xc1Dt\'\x84\xb5\xa4\x83\xeft\xfc\xf3\xdd\x870xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_elf64(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000001, 0x13, 0xffffffffffffffff, 0x0) close(r1) r2 = socket$inet6(0xa, 0x2000000000801, 0x0) setsockopt$inet6_opts(r2, 0x29, 0x3b, &(0x7f0000000100)=ANY=[], 0x0) setsockopt$inet6_int(r2, 0x29, 0x33, &(0x7f00000001c0)=0x1, 0x4) bind$inet6(r2, &(0x7f0000402000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) socket$inet(0x10, 0x0, 0x0) sendmsg(0xffffffffffffffff, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20000000, &(0x7f0000f62fe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) syz_genetlink_get_family_id$fou(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0x4240a2a0) 07:35:56 executing program 2: socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0xfffffffffffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x0, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$PPPIOCGDEBUG(0xffffffffffffffff, 0x80047441, &(0x7f00000000c0)) setsockopt$inet_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) perf_event_open(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r1, 0x89a1, &(0x7f0000000300)={@local={0xfe, 0x80, [0x600, 0x3ef, 0x0, 0x3f00000000000000, 0x100000000000000, 0x0, 0x1103, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0xfffffffffffffffc}) ioctl$sock_inet6_SIOCADDRT(r1, 0x89a0, &(0x7f0000000100)={@local={0xfe, 0x80, [0x0, 0xfeff0000]}, @empty, @loopback}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x10811, r0, 0x0) setsockopt$EBT_SO_SET_COUNTERS(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000680)=ANY=[@ANYPTR=&(0x7f0000000c40)=ANY=[]], 0x1) socket$inet6_udplite(0xa, 0x2, 0x88) getsockopt$IP_VS_SO_GET_DESTS(0xffffffffffffffff, 0x0, 0x484, &(0x7f0000000440)=""/128, 0x0) syzkaller login: [ 67.170844] audit: type=1400 audit(1571988956.905:5): avc: denied { create } for pid=2309 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 67.198525] audit: type=1400 audit(1571988956.935:6): avc: denied { write } for pid=2309 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 67.233212] audit: type=1400 audit(1571988956.965:7): avc: denied { read } for pid=2309 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 07:35:57 executing program 0: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r0) 07:35:57 executing program 1: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup\x00', 0x200002, 0x0) openat$cgroup_ro(r0, &(0x7f0000000340)='memory.events\x000Y\b/\xe5I\xdd\xdd/fu7\xc6{\x06\xa2\bW]\x05\x7f\xfa\xc3\xed\xbdA~\xb1\xb0+\x1dw{\x12\xd8p\xf9\xd0s\xc2jP\xdd\xca\x9e\x1f\xe8\xe3\xce\xc7\x05\xf7s\xd6\x19\xadj\x90N\\\xf3\x86\xbb\xa9}\x9feIM\xbb\xb7b\vc\xe1c\xf6~}\x0f\xa9\x92x&T\xe7\xc8o\xaa\x86\xfa\xee\xda`H\x87\v\x04b\xc5\x9f%\xd6N\vR^\x13\x84\xddE\xe9', 0x7a05, 0x1700) 07:35:57 executing program 2: r0 = socket$inet6(0xa, 0x801, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) listen(r0, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000200)={@local, @link_local, [], {@ipv6={0x86dd, {0x0, 0x6, '\x00', 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd]}, @local, {[], @tcp={{0x0, 0x4e20, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) 07:35:57 executing program 3: accept4$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000300), 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) inotify_init() r3 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) write$nbd(r3, &(0x7f0000000380), 0x10) sendfile(r3, r3, &(0x7f0000000200), 0xa198) 07:35:57 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000013c0)='/dev/ptmx\x00', 0x1, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000080)) r1 = syz_open_pts(r0, 0x0) r2 = fcntl$dupfd(r0, 0x0, r1) ioctl$TCSETS(r2, 0x5402, &(0x7f00000000c0)) write$P9_RSYMLINK(r2, &(0x7f0000000180)={0x14}, 0x10000015a) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000000)) 07:35:57 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = memfd_create(&(0x7f00000000c0)='/dev/net/tun\x00', 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x11, r2, 0x0) fstat(r2, 0x0) 07:35:57 executing program 5: socketpair$unix(0x1, 0x80001, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getresuid(&(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)) 07:35:57 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x3c4) write$binfmt_elf64(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0) close(r2) r3 = socket$inet6(0xa, 0x2000000000801, 0x0) setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) bind$inet6(r3, &(0x7f0000402000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) sendto$inet6(r3, 0x0, 0x0, 0x20000000, &(0x7f0000f62fe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) syz_genetlink_get_family_id$fou(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x80000001, 0x0) 07:35:57 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = eventfd2(0x0, 0x0) r2 = fcntl$dupfd(r0, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syz_emit_ethernet(0x7a, &(0x7f0000000040)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd60352668004484000e810b000000000000000000000000aafe8000000000000000000000000000aa0420655800000000628bf289000086dd080088be0000000010000000010000000000264e6f240e9b18d667b02d0328cb9a0000080022eb00000000200000000200000000000000655800000000000000000000ac1a8dfe4c427eafb140a55242cbd93218fa5ff40b82c9165e0ef45c9847a0c841c101fc15f974acac3200f4dca8bc82a217787d080a87dbe8cd966d9aa271244165f2cc64b648df2be9fd767321cb2d1aa4a44cbcf1cfe5120ad9835ea010c56390b254fd606a5b079665b8bcd15a5fea03d850ac91d318c8f3e588c2f25760a5a9c4b1ded8f1fb8d616f98ea455d87df358400357eeb4a51b9cbd833c8bd42f2ed14608edd52347deaf09f6a2c61d001aeaa316418c6be084351f6d1fd6a5252ef1227eeb78969026c68e1d2405bdd9acbfeff0b0e3942a87c4f7368f64bebfbf5baf2e97fb13552765563375152a9461af88a4dd8b47650fafbd409ca5fdc124fc906eec2adea27b752c0334eb49acc7cacf3f41e3bcbe4c9764993c3fd4386d2819fc040e5ba7e7b6ea2d6d646d94ea98f4489ae7fcfcc"], 0x0) 07:35:57 executing program 5: perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x800000000001, 0x253a4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x20}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, &(0x7f00000012c0)='\x00\x00\x00\x00\x00egy\xc5\x8e\xcb\x1c\xf8\x8f\xca;\xa3?\xad\xae\x0f\xb5\x97ao3\xab\xcdY\x9a\xe3\xe5\xe1\xf4\x87\xac\xad\x80\xa3P\x8c\xea\x9c\xc7\x00\xeb\xedX#\xe34\x80O]\x87\xdd\x894\xdal;w\xf8\xf8\v?v\xf0\xb8\xda=|\xa4\xba\xbbiq!\xd8g\xb7I\x12\x80') 07:35:57 executing program 4: clone(0x7ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) exit_group(0x0) r2 = socket$inet(0x10, 0x2, 0x0) sendmsg(r2, &(0x7f0000000100)={0x0, 0x371, &(0x7f00000000c0)=[{&(0x7f0000000040)="24000000520007031dfffd946fa2830081200a0009000300001d85680c1ba3a20400ff7e", 0x24}], 0x1}, 0x0) 07:35:57 executing program 0: pipe(&(0x7f0000000280)={0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.\xa3\x8f\xe8P\x00\x14\xd5U9r\x9b\x06\xbd\xa8w\xe1\x17\xfb\x89#\x17\x98\x18\x9d\xc5V\xaf', 0x275a, 0x0) splice(r0, 0x0, r1, 0x0, 0x80000001, 0x0) 07:35:57 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) getpid() recvmmsg(0xffffffffffffffff, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}, 0xd6c}], 0x1, 0x0, 0x0) pipe(&(0x7f0000001380)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r1, 0x407, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x8000fffffffe) syz_open_procfs(0x0, &(0x7f0000000040)='\x00\x00\x00\x00H') listxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f00000013c0)=""/196, 0xc4) socket$inet(0x10, 0x5, 0x20) 07:35:57 executing program 0: pipe(0x0) r0 = creat(&(0x7f0000000040)='./bus\x00', 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, 0x0) perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x20018, 0x0, 0x0, 0x7, 0xfffffffffffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) r2 = creat(0x0, 0xb1) r3 = getpgrp(0x0) ioctl$TCSETSW(r2, 0x5403, &(0x7f00000000c0)={0xfffffe01, 0x0, 0x0, 0x1, 0x13, 0x40, 0x0, 0x9, 0x0, 0x2, 0x0, 0x7f}) ioctl$sock_FIOSETOWN(r0, 0x8901, &(0x7f0000000100)=r3) sendto$inet(r1, 0x0, 0x0, 0x0, 0x0, 0xb2) gettid() r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) ioctl$FS_IOC_SETFLAGS(r4, 0x40086602, &(0x7f0000000080)) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, 0x0, &(0x7f0000001280)) fsetxattr$security_capability(r1, &(0x7f0000001140)='security.capability\x00', &(0x7f00000012c0)=@v3={0x3000000, [{0x800, 0x5}, {0x0, 0x6}]}, 0x18, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000004b40)=[{{&(0x7f0000000400)={0xa, 0x0, 0x0, @ipv4={[], [], @empty}}, 0x1c, 0x0}}], 0x1, 0x0) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='fd\x00') getdents64(r5, &(0x7f0000000140)=""/4096, 0x1000) gettid() openat$null(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000b34ff8), &(0x7f0000b34ffc)=0xc) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) socket(0xe, 0x8002, 0x10001) write(0xffffffffffffffff, &(0x7f0000000140)="240000001e0025eaa87865f51ef6bce90a04000200bff20182a9000c080009000b00", 0x22) syz_genetlink_get_family_id$ipvs(&(0x7f0000000480)='IPVS\x00') openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x0, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x0, 0x0) 07:35:57 executing program 4: syz_emit_ethernet(0x4a, &(0x7f0000000180)={@local, @random="192bce5e2dfb", [], {@ipv6={0x86dd, {0x0, 0x6, "d894b6", 0x14, 0x4, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd]}, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) 07:35:58 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) socket$inet6(0xa, 0x2, 0x0) pipe(&(0x7f0000001380)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) socket$inet6(0xa, 0x2, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)) 07:35:58 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000240)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000004c0)={0xc, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="066304400200000011634840"], 0x1, 0x0, &(0x7f0000000400)='T'}) 07:35:58 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0800b5055e0bcfe87b0071") r1 = syz_open_dev$binderN(&(0x7f0000000240)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000004c0)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="06630440"], 0x0, 0x0, 0x0}) 07:35:58 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000006c0)='/dev/net/tun\x00', 0x0, 0x0) r3 = fcntl$dupfd(r1, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) fchdir(r0) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) 07:35:58 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r1, &(0x7f0000000340)=ANY=[@ANYBLOB="ff5b"], 0x2) sendfile(r1, r1, &(0x7f0000000240), 0x7fff) 07:35:58 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) recvfrom$inet6(r0, 0x0, 0x0, 0x1f1, 0x0, 0x0) 07:35:58 executing program 0: perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x800000000001, 0x253a4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x20}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, &(0x7f00000012c0)='\x00\x00\x00\x00\x00egy\xc5\x8e\xcb\x1c\xf8\x8f\xca;\xa3?\xad\xae\x0f\xb5\x97ao3\xab\xcdY\x9a\xe3\xe5\xe1\xf4\x87\xac\xad\x80\xa3P\x8c\xea\x9c\xc7\x00\xeb\xedX#\xe34\x80O]\x87\xdd\x894\xdal;w\xf8\xf8\v?v\xf0\xb8\xda=|\xa4\xba\xbbiq!\xd8g\xb7I\x12\x80') 07:35:58 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) lstat(&(0x7f0000000080)='./file0\x00', &(0x7f0000000240)) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={'vlan0\x00', 0xd803}) r3 = socket$inet6(0xa, 0x80801, 0x0) perf_event_open(&(0x7f0000000100)={0x2000000005, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x201, 0x0) ioctl$TCSETS(r4, 0x40045431, &(0x7f0000000100)) syz_open_pts(r4, 0x0) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e20}, 0x1a) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000040)={'vlan0\x00\x00\xf6\xff\xff\xff\xff\xff\xff\xff\x00', {0x2, 0x0, @local}}) clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) pipe2(&(0x7f0000000100), 0x4000) socket(0x0, 0x0, 0x0) poll(0x0, 0x0, 0x8000000000000200) r5 = socket$inet(0x2, 0x2, 0x0) mount(&(0x7f0000000180)=@md0='/dev/md0\x00', &(0x7f0000000200)='./file0\x00', &(0x7f00000002c0)='erofs\x00', 0x9d85faa3c2da7135, &(0x7f0000000300)='ppp1\x00') setsockopt$inet_mreqsrc(r5, 0x0, 0x27, &(0x7f00000000c0)={@multicast1, @local, @local}, 0xc) dup(0xffffffffffffffff) dup3(r0, r2, 0x0) 07:35:58 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r0, 0x0, 0x0, 0xdf4c48908f93ea5c) 07:35:58 executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_RESET(r0, 0x2403, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000500), 0x12) [ 68.642250] binder: 2407:2409 Release 1 refcount change on invalid ref 2 ret -22 [ 68.655017] binder: 2406:2414 Release 1 refcount change on invalid ref 0 ret -22 [ 68.669328] binder: 2407:2409 transaction failed 29189/-22, size 0-0 line 3014 07:35:58 executing program 0: 07:35:58 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000080)={'eql\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00*', 0x4fff}) ioctl$sock_ifreq(r0, 0x8914, &(0x7f00000000c0)={'eql\x00\x00\x00\xa9[\x00', @ifru_mtu=0x1}) 07:35:59 executing program 3: 07:35:59 executing program 1: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) symlink(&(0x7f0000000080)='./file1\x00', &(0x7f0000000040)='./file0\x00') symlink(&(0x7f0000000100)='./file0/file0\x00', &(0x7f00000008c0)='./file1\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0x0, 0x0}) sendmmsg(r2, &(0x7f0000008600)=[{{0x0, 0x0, &(0x7f0000003140)}}, {{&(0x7f00000072c0)=@un=@file={0x1, './file0\x00'}, 0xa, &(0x7f0000007380), 0x0, &(0x7f0000000600)}}], 0x2, 0x0) 07:35:59 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x2000000000000074, 0x25d) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000080)='dctcp\x00', 0x6) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x210007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='bbr\x00', 0x3) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000240), 0x4) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="7f454c46000000040180000000000000000000000004000000000000000000004000000000000000000000000000000000000000000438000200000000007f000000000008000000000000000000000003000000000000007768000000000000000000ab2e0000000200000000000000ff0300000000000074f940cfc1e59841d9da552461b4cbfb66eca196752e14d0acf02614d2352effb6bb9624cd82c6413cf4777cc90e01ffde818d0e51ab4fa56a0493280c32c453804ced23b64d541fe1ae1230337cfb8078"], 0xc9) sendto$inet(r0, &(0x7f00000012c0)="03268a927f1f6587b967482841ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf9221a7511bf746bec66ba", 0xfe6a, 0x9, 0x0, 0x27) 07:35:59 executing program 0: write$P9_RATTACH(0xffffffffffffffff, 0x0, 0x0) mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') truncate(&(0x7f0000000100)='./file0\x00', 0x0) 07:35:59 executing program 5: perf_event_open(&(0x7f0000000000)={0x2, 0x176, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f00000002c0)='sysfs\x00', 0x0, 0x0) 07:35:59 executing program 2: 07:35:59 executing program 2: 07:35:59 executing program 5: 07:35:59 executing program 1: 07:35:59 executing program 0: 07:35:59 executing program 3: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xaa3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x401000000001, 0x0) close(r1) syz_open_procfs(0x0, &(0x7f00000002c0)='comm\x00') r2 = open(&(0x7f0000000400)='./bus\x00', 0x1141042, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x0) r3 = creat(&(0x7f0000000140)='./bus\x00', 0x0) ftruncate(r3, 0x2081ff) sendfile(r1, r2, 0x0, 0x8000fffffffe) 07:35:59 executing program 1: 07:35:59 executing program 2: 07:35:59 executing program 5: 07:36:00 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x2000000000000074, 0x25d) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000080)='dctcp\x00', 0x6) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x210007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='bbr\x00', 0x3) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000240), 0x4) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="7f454c46000000040180000000000000000000000004000000000000000000004000000000000000000000000000000000000000000438000200000000007f000000000008000000000000000000000003000000000000007768000000000000000000ab2e0000000200000000000000ff0300000000000074f940cfc1e59841d9da552461b4cbfb66eca196752e14d0acf02614d2352effb6bb9624cd82c6413cf4777cc90e01ffde818d0e51ab4fa56a0493280c32c453804ced23b64d541fe1ae1230337cfb8078"], 0xc9) sendto$inet(r0, &(0x7f00000012c0)="03268a927f1f6587b967482841ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf9221a7511bf746bec66ba", 0xfe6a, 0x9, 0x0, 0x27) 07:36:00 executing program 1: 07:36:00 executing program 2: 07:36:00 executing program 0: 07:36:00 executing program 5: 07:36:00 executing program 3: 07:36:00 executing program 0: 07:36:00 executing program 1: 07:36:00 executing program 3: 07:36:00 executing program 5: 07:36:00 executing program 2: 07:36:00 executing program 0: 07:36:00 executing program 4: 07:36:00 executing program 1: 07:36:00 executing program 3: 07:36:00 executing program 5: 07:36:00 executing program 0: 07:36:00 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) sendto$inet6(r1, 0x0, 0xffffffffffffffe3, 0x20000008, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet_tcp_int(r1, 0x6, 0x19, &(0x7f0000000000)=0x1, 0x4) 07:36:00 executing program 1: 07:36:00 executing program 5: 07:36:00 executing program 0: 07:36:00 executing program 3: 07:36:00 executing program 1: 07:36:00 executing program 5: 07:36:00 executing program 4: 07:36:00 executing program 2: 07:36:00 executing program 0: 07:36:01 executing program 3: r0 = socket$inet6(0xa, 0x801, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) listen(r0, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local, @random="192bce5e2dfb", [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd]}, @local, {[], @tcp={{0x0, 0x4e20, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) 07:36:01 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) write$nbd(r4, &(0x7f0000000380), 0x10) sendfile(r4, r4, &(0x7f0000000200), 0xa198) 07:36:01 executing program 5: 07:36:01 executing program 0: 07:36:01 executing program 2: 07:36:01 executing program 4: 07:36:01 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000013c0)='/dev/ptmx\x00', 0x1, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000080)) r1 = syz_open_pts(r0, 0x0) r2 = fcntl$dupfd(r0, 0x0, r1) write$P9_RSYMLINK(r2, &(0x7f0000000180)={0x14}, 0xfe07) 07:36:01 executing program 5: r0 = open(&(0x7f0000000340)='./bus\x00', 0x40000141042, 0x0) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0x323) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = open(&(0x7f0000000240)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8fff) 07:36:01 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001bc0)={'eql\x00'}) 07:36:01 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000006c0)='/dev/net/tun\x00', 0x0, 0x0) r3 = fcntl$dupfd(r1, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) fchdir(r0) r4 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r4, &(0x7f0000000340)=ANY=[@ANYBLOB="ff5b"], 0x2) sendfile(r4, r4, &(0x7f0000000240), 0x7fff) 07:36:01 executing program 4: r0 = perf_event_open(&(0x7f00004e7000)={0x2, 0x70, 0xdf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, &(0x7f0000000dc0)='systemself(vboxnet0{md5sumppp0\x06)vmnet1self#.W~mime_type,$GPLsystem\x00') 07:36:01 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000013c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000080)) r1 = syz_open_pts(r0, 0x0) r2 = fcntl$dupfd(r0, 0x0, r1) ioctl$TCSETS(r2, 0x5402, &(0x7f00000000c0)) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000000)) 07:36:01 executing program 5: 07:36:01 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) 07:36:01 executing program 2: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x1e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000000340)='./bus\x00', 0x40000141042, 0x0) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0x323) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = open(&(0x7f0000000240)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8fff) 07:36:01 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000013c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000080)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETSF(r1, 0x5414, &(0x7f0000000000)) 07:36:01 executing program 4: clone(0x4000010006dfd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() r1 = gettid() tkill(r1, 0x3b) tkill(r0, 0x3b) 07:36:01 executing program 3: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0xa, 0x801, 0x84) sendmmsg$inet(r0, &(0x7f0000002340)=[{{&(0x7f0000000380)={0x2, 0x0, @loopback}, 0x10, &(0x7f0000000440)=[{&(0x7f00000003c0)="f7", 0x1}], 0x1}}], 0x1, 0x0) 07:36:01 executing program 4: syz_emit_ethernet(0x4e, &(0x7f0000000180)={@local, @link_local, [], {@ipv6={0x86dd, {0x0, 0x6, '\x00', 0x18, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd]}, @local, {[], @tcp={{0x0, 0x4e20, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0xc2, 0x0, 0x0, 0x0, {[@sack_perm={0x4, 0x2}]}}}}}}}}, 0x0) 07:36:01 executing program 5: fchdir(0xffffffffffffffff) pipe(&(0x7f0000000180)={0xffffffffffffffff}) openat$keychord(0xffffffffffffff9c, &(0x7f0000000280)='/dev/keychord\x00', 0x800, 0x0) read(r0, &(0x7f0000000000)=""/250, 0x128b9372) r1 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/mcfilter6\x00') readv(r1, &(0x7f0000002340)=[{&(0x7f0000002380)=""/4096, 0xbc1}], 0x2000000000000024) readv(r1, &(0x7f0000000580), 0x3c1) 07:36:01 executing program 1: r0 = socket(0x18, 0x400000002, 0x0) socket(0x0, 0x0, 0x0) getsockname(r0, 0xffffffffffffffff, &(0x7f0000000000)) 07:36:02 executing program 0: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000006500)='/dev/rtc0\x00', 0x0, 0x0) ppoll(&(0x7f00000000c0)=[{r0}], 0x1, 0x0, 0x0, 0x0) 07:36:02 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000080)={'vxcan1\x00', &(0x7f0000000040)=@ethtool_pauseparam}) 07:36:02 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/net/tun\x00', 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'\x00\x00\x00\xe6\xff\xff\xff\x00\x00\x00\x00\x00\x02\x00', 0x5002}) socket$nl_route(0x10, 0x3, 0x0) pipe(&(0x7f0000000140)) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x1ff}, 0x0, 0x0) 07:36:02 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='erspan0\x00', 0xff89) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet(r0, &(0x7f0000000100)={0x2, 0x0, @rand_addr=0x7fffffff}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x400000000000030, 0x0) 07:36:02 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000013c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000080)) r1 = syz_open_pts(r0, 0x0) r2 = fcntl$dupfd(r0, 0x0, r1) ioctl$TCSETS(r2, 0x5402, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1}) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000000)) 07:36:02 executing program 1: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x4007fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 07:36:02 executing program 2: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='/\x02roup.stap\x00', 0x2761, 0x0) r0 = openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000040), 0x2, 0x0) write$cgroup_int(r0, &(0x7f0000000000), 0xc5) sendfile(r0, r0, &(0x7f0000000100), 0xe08c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f00000000c0)="0800b5055e0bcfe87b0071") [ 72.335883] audit: type=1400 audit(1571988962.065:8): avc: denied { ioctl } for pid=2608 comm="syz-executor.2" path="socket:[8988]" dev="sockfs" ino=8988 ioctlcmd=8946 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 07:36:02 executing program 3: r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000080)={0x0, 0x7530}, 0xfe28) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r1, 0x0, 0xffffffffffffffe3, 0x20000008, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmsg$TIPC_NL_PEER_REMOVE(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB], 0x1}}, 0x4c080) r2 = open(&(0x7f0000000280)='./file0\x00', 0x110000141042, 0x0) ftruncate(r2, 0x10099b7) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) sendfile(r0, r2, 0x0, 0x88000fc000000) 07:36:02 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}, 0xd6c}], 0x1, 0x0, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) ioctl$sock_ifreq(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000180), 0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, &(0x7f0000000140)={0x0, 0x0, 0x4}) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(0x0, 0x0, 0x0, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x77359400}}, 0x0) timer_delete(r0) listxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f00000013c0)=""/196, 0xc4) r1 = socket$inet(0x10, 0x5, 0x20) sendmsg(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000100)="2400000015000703b45656986fa2830002200a0009000000741d85680c1ba3a20400ff7e", 0x24}], 0x1}, 0x0) 07:36:02 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='veth1_to_team\x00', 0x10) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000140)=0x140000916, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000000200)=0x7fff, 0x4) ioctl$int_in(r0, 0x5421, &(0x7f0000000100)=0x4) connect$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @loopback}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf5, 0xf087}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000013, &(0x7f0000000180), 0x4) sendto$inet(r0, &(0x7f0000000040)="b9", 0x1, 0x8000, 0x0, 0x0) write$binfmt_elf32(r0, &(0x7f0000000ec0)=ANY=[@ANYBLOB="db3f06f8ec83cf0324e87f454a9831056a4fa273d72477619e80d9ccbc0ad856350b03db35e5b64131f998f07834eb3bde2c4fb89d184bcdf26a5e06002b1e1bcb43b431c7cdd5050c9125b6072aafc1ad8c45eb70b0dd0a57aeab3dc53b235a317d17e00e495eb30a60e8d0122a207570edd060dfdfcb5f8dd9433f570c2b7d69ad7c167a897b7dc8467711d38902650c463d377af4508e9a12f48c249e141812ec6edcfdfd9657de6d2b729c39673e2d44aecb72f979edb1c74a8d2701ea82c7afc00bf0ab91b37863cad722a1220cc9ab1227719569e3a0ebc36de1e0e6aa1dacc54e9a5f1f206fe9e142773ce455f6183236fdd2b4449be23a3989488f2f4caa43533a09b6592ce208febbfb1c2ae455a3ef45736fafdc387eeff506254d9f9cc7381d9c15d6dcb93eff565281f34ce87a44d6c429fd6113cba4bea71692ec15ad99318affbb08217dd137565cfbdf3a942bd30903aa1162a466d8082cbff04c410c7f35c6b25ef209c9f4200df5a8df8632368876cc2c876f33595642ba50faf31f7894f8dff96f52f853c8d2d9c2f3a8faa01dc5f7305d91c64d0efda8b4af572ce47f21", @ANYPTR=&(0x7f0000000b00)=ANY=[@ANYRES32, @ANYRES64, @ANYBLOB="f364d959e080b125773818ac153bee79603f675fb842bc9f7cec1b43f244dfa34aae7ce70277eb17b97d66acb4bfd78b624ee32354746768eab624e026ba13d0494b91a86d548660e11805f33e20f08a4e1aaed0fd9510c887b24ff0faa9c5bacc59172bd560c6504f15d6706475cddfe9dbd36ce077279577d023ed8e875757133b743317135f7467caaec9d5525cb20563aaac6548e3b121c3", @ANYPTR=&(0x7f0000000740)=ANY=[@ANYBLOB="3e581d96bdbd718304a81120b23c1918380ea61b760362990fb6a5fe0d867b0c70503bb1e9c03485f38bc04b7de25070b879a23ff65e9a57c23f279faff5465f59b1156c591ee89b6326f96aaff8d20e4fd6e5987946f5410644efb02088ade12bbf2a795a8c1e800759544ecd5be1d34495de78efab8faa88d493ce49e21ad02053947f52875a0a4975979defe2d36cf48b96b3f34cb0a3b196dddb959ac525617c172bd76f4e4667c22e6c99f26c9efc89a5639caa0d41280987370ea50aa4cf16563afa02ab170a3019061cbda7af1610d24ee8039a3fbcf4ec64075d7bc341b30cec804f7fddbc92fe871367222444e798d594febc39621631e9f6c3182f3a3337e371968ea1669d99cc832e9d5fa89941113829e352697cd6446774b8135c557cb31433c1c6a736bed2b787844ea0fc60d0595358fa8db4b857ca247e09b1ac4e4aebf5449ae37cfaf81e4aa95140faa2392dbb79c8f066ee9242ffd733fb66c268db93d140701e78f2b4b4e42bd8f853f94e1dac1f07892d4050a5aa4355130b491a5d88eefc98df0d3eaffb118c4b343ca2fa8f07f4907b473ff7a861707849773017bf04cff8190bf1b23d448d9946e0b9c70e4847e4ddaf823ff11b7f4c17726d5842b76e8ec8a8f74d24e13be868003d886e47cebb35", @ANYRES16, @ANYRES16, @ANYRES64, @ANYRESDEC, @ANYRES32, @ANYRESHEX, @ANYPTR64, @ANYRES16, @ANYRESDEC], @ANYPTR64=&(0x7f00000009c0)=ANY=[@ANYPTR, @ANYRESHEX, @ANYBLOB="64fa41a860d3d28b386118c85673a693cb673c799e6c950486de85604179197a4cfe1dcc4737c583dc7cc2f5a1af8fef10e7c6e4ab341ae60010000000000000358b2b218db58a9ce3e7e1f319132ab8064224e3dc2b0c1d3e0d2c0508a2ec2ee743fbb33fad01fb0587eadd7c6dd1d985b324256c191b959b3b163cb72d21f018b403764034b8f7edd06d574d56b049ee700fd0e2a72b0699f75c566858526ae28fa63f9f41511bd5fa564dac534c4512bface3683f7756b9c82c56210f6d8c4d3802a93645b17620a5247ee0760000", @ANYRESOCT, @ANYPTR]], @ANYBLOB="b7e73a1d2edd3910dcaeab8c30d059d1eb1665345e000000030000800112130be48d7b1397f69b5aee61355b5ec3eea3c6a8395a8c5a833203757d4fc84e4bf0b72b148861e32ca695734ab0abab5a26801fa1efd10f4b8737e3750602d2721607a8bb4bee07eb95288c48d11e4c6cafad2067d98fd2c165ef0fa928881fa85e9e023fd6bbb74bece396aa022590ef45c7f4fa4d89ba531ad97c7a77fcece5b04214b12c00b972a44b0fe2fe2233d9fbf99667588930b3b36eb303000000c93050e20e0a27e9032ed8f207747c7cf6c870de9d800e74131be41d2ca3e0aacad4fb77ed12e6041404d3933f77f091980207359d67cfbbbce18c246bd082", @ANYPTR64=&(0x7f0000000440)=ANY=[@ANYRES64, @ANYRESHEX=0x0, @ANYRESDEC, @ANYBLOB="fdff34650a06d48c6bd1502be657bb1f27296b74128d3511f702a8958b96836fe7e0e4b0cb77a8bfaf66ce76817c83002eb3df56f646c6788cc3b7a4bc2d2a277469e2008e00"/79, @ANYRESDEC, @ANYRES32=0x0], @ANYRESHEX], 0xffffff1d) 07:36:02 executing program 5: socketpair$unix(0x1, 0x80001, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xaa3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$inet6(0xa, 0x401000000001, 0x0) close(r4) syz_open_procfs(0x0, &(0x7f00000002c0)='comm\x00') r5 = open(&(0x7f0000000400)='./bus\x00', 0x1141042, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) r6 = creat(&(0x7f0000000140)='./bus\x00', 0x0) getresuid(&(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)) ftruncate(r6, 0x2081ff) sendfile(r4, r5, 0x0, 0x8000fffffffe) 07:36:02 executing program 1: r0 = socket$inet6(0xa, 0x801, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) listen(r0, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000200)={@local, @link_local, [], {@ipv6={0x86dd, {0x0, 0x6, '\x00', 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd]}, @local, {[], @tcp={{0x0, 0x4e20, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10}}}}}}}, 0x0) 07:36:02 executing program 0: r0 = socket$inet6(0xa, 0x801, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) listen(r0, 0xffeffffefffffffb) syz_emit_ethernet(0x4a, &(0x7f0000000180)={@local, @link_local, [], {@ipv6={0x86dd, {0x0, 0x6, '\x00', 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd]}, @local, {[], @tcp={{0x0, 0x4e20, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0xc2}}}}}}}, 0x0) 07:36:02 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/net/tun\x00', 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'\x00\x00\x00\xe6\xff\xff\xff\x00\x00\x00\x00\x00\x02\x00', 0x5002}) socket$nl_route(0x10, 0x3, 0x0) pipe(&(0x7f0000000140)) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x1ff}, &(0x7f0000000200), 0x0) 07:36:03 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x5402, &(0x7f00000000c0)={0x0, 0x0, 0xfffffc00}) 07:36:03 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}, 0xd6c}], 0x1, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000180), 0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, 0x0) socket$inet6(0xa, 0x2, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x77359400}}, 0x0) timer_delete(r1) listxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f00000013c0)=""/196, 0xc4) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000001fc0)='mem\x00\x01y7swaS.cur\x89\xc9B\xab\xe3\xfarent\x00\x1aw\xb7\xc3B\xef\xf0\xd5\xf34|\x98.\x857Y\xab[d\xfa\x83\xdf\xc6\xf3\xb5\xab\xbb\x98y\xe7\xff\x87o\xb2\xfe\xd0\x9d\x9a\x89\xfe\xc4\x1d\x92|z\xbc\nl%\x97,#\xab3aEW\x18A3@\x94\x05%Y\x1d\x90\xf3\xc8\x89\x9a.\x7fm5\xaa\b\xceo\t\xcc\x98\xb7\x18\x90\x1cM\x91\x0fzb\x85\xb5$\x86\xe4\xd9\x1bJ\x1f\xf0>\x18\xed\xb0\r.8\xaa\x92\xc7cw\xd6\xaf\xbe\x1d\x04$\xecAb\b\xcf\xd40\xe8qg\xc5\x18\xd1\x8f\xe6D\xa8\x00\xf6H|y\xa1\x0f\xde\xe3\xbb\'\xb1\x02\x00\xc8p\xbfQh\"\n=\x90\xf9vUo9\x85\xb3\xa9\xec\xda\xc2\x99\xbe8\x9f[*\x80\xb7%\x9d33\xb9\xc3\xf0\x11!\x11\xc3\xa5$<\xcf\x00\x00\x00\x00\x1aO\xb4\xf0_\xbd>\xf3\x1b\xbb[\x058\x01\xf4\xca\xf4(\xab8\x87R\xc8\xe0l\xce\x930\xec\xf5\x8f\xb0%I\xb7\x7f[\\i\xfb\x96d\xa1aA\x97j\xc3\xef\xb65\xc0e\xb2%\x1f\xba\xa9\x0e$\x16\xbcw\xff&DRYp\xb8\xdb\x00\x00\x00\x00\x00\x00\x00\x18i\xffHw\xea\x9d\x86\x0e\bl5\x945\xab\xd3\xef\x11\xbd\"\xbcs\x8b\xf2.:\x8c\xe2\xb2\a\xac\x8b\x19\x80\x8b\xa3&\x19\x16\x80\xa1\x88\xbe\xc3\x00\xf3\xb7V]\x89e\xf2D\xf6T\xc0\xb8/\xa5\x11\x15\x8cqV/\x94 J\xc8x\xb6#a\xa5[\xbe\x0f\xe1\xf1=\xdd\xfb\xcb\xb0\xe5\xfd\x10wxF\x93\x03cK\r\xb6%\xa6\x0e\xfa\xcd\x18\xe0\x1e\xae\xc5\xa2\xe1*)\xb7]\x99\x83\xe8\xc3\xc1\xb9\x1d0\x9c\x98\xadRm', 0x0, 0x0) socket$inet(0x10, 0x5, 0x0) 07:36:03 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr(0x0, &(0x7f00000001c0)=@random={'os2.', '/selinux/avc/cache_threshold\x00'}, 0x0, 0x0, 0x1) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000740)=0x200, 0x4) bind$inet(r0, &(0x7f0000000480)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x24e23, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000100), 0x4) openat(0xffffffffffffff9c, 0x0, 0x101000, 0x0) recvmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x1000}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) write$binfmt_elf64(r0, &(0x7f00000000c0)=ANY=[@ANYRES64], 0xc63b9e35) shutdown(r0, 0x1) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000340)='TIPCv2\x00') sendmsg$TIPC_NL_NET_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x22812000}, 0xc, &(0x7f0000000380)={&(0x7f00000004c0)={0x10c, r1, 0x400, 0x70bd25, 0x25dfdbff, {}, [@TIPC_NLA_LINK={0xf8, 0x4, [@TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffff}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80000000}]}, @TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}]}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}]}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x39def83e}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1000}]}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xa7e2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x401}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x918c}]}]}]}, 0x10c}, 0x1, 0x0, 0x0, 0x4000}, 0x100080f1) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 07:36:03 executing program 5: pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) openat$keychord(0xffffffffffffff9c, &(0x7f0000000280)='/dev/keychord\x00', 0x800, 0x0) write(r1, &(0x7f00000001c0), 0xfffffef3) read(r0, &(0x7f0000000000)=""/250, 0x128b9372) r2 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/mcfilter6\x00') readv(0xffffffffffffffff, 0x0, 0x0) readv(r2, &(0x7f0000002340)=[{&(0x7f0000002380)=""/4096, 0xbc1}], 0x2000000000000024) readv(r2, &(0x7f0000000580), 0x3c1) setxattr$security_smack_transmute(0x0, 0x0, 0x0, 0x0, 0x0) getsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x27, 0x0, &(0x7f0000000240)) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x0) 07:36:03 executing program 0: accept4$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000300), 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) getpid() r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) write(r2, &(0x7f0000000340), 0x41395527) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x4000082) write$nbd(r3, &(0x7f0000000380), 0x10) sendfile(r3, r3, &(0x7f0000000200), 0xa198) 07:36:03 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000240)) ioctl$TCSETSF(r0, 0x5412, &(0x7f0000000100)) 07:36:03 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000013c0)='/dev/ptmx\x00', 0x1, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000080)) r1 = syz_open_pts(r0, 0x0) r2 = fcntl$dupfd(r0, 0x0, r1) ioctl$TCSETS(r2, 0x5402, &(0x7f00000000c0)={0x8}) write$P9_RSYMLINK(r2, &(0x7f0000000180)={0x14}, 0x10000015a) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000000)) 07:36:03 executing program 4: 07:36:03 executing program 3: 07:36:03 executing program 4: 07:36:03 executing program 3: 07:36:03 executing program 4: 07:36:03 executing program 3: 07:36:03 executing program 4: 07:36:03 executing program 1: 07:36:03 executing program 5: pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) openat$keychord(0xffffffffffffff9c, &(0x7f0000000280)='/dev/keychord\x00', 0x800, 0x0) write(r1, &(0x7f00000001c0), 0xfffffef3) read(r0, &(0x7f0000000000)=""/250, 0x128b9372) r2 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/mcfilter6\x00') readv(0xffffffffffffffff, 0x0, 0x0) readv(r2, &(0x7f0000002340)=[{&(0x7f0000002380)=""/4096, 0xbc1}], 0x2000000000000024) readv(r2, &(0x7f0000000580), 0x3c1) setxattr$security_smack_transmute(0x0, 0x0, 0x0, 0x0, 0x0) getsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x27, 0x0, &(0x7f0000000240)) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x0) 07:36:03 executing program 0: 07:36:03 executing program 3: 07:36:03 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000013c0)='/dev/ptmx\x00', 0x1, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000080)) r1 = syz_open_pts(r0, 0x0) r2 = fcntl$dupfd(r0, 0x0, r1) ioctl$TCSETS(r2, 0x5402, &(0x7f00000000c0)={0x8}) write$P9_RSYMLINK(r2, &(0x7f0000000180)={0x14}, 0x10000015a) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000000)) 07:36:03 executing program 4: 07:36:03 executing program 1: 07:36:03 executing program 5: 07:36:03 executing program 3: 07:36:03 executing program 5: 07:36:03 executing program 4: 07:36:03 executing program 3: 07:36:03 executing program 1: 07:36:03 executing program 0: 07:36:03 executing program 3: 07:36:03 executing program 4: 07:36:04 executing program 2: 07:36:04 executing program 5: 07:36:04 executing program 0: 07:36:04 executing program 3: 07:36:04 executing program 4: 07:36:04 executing program 1: 07:36:04 executing program 5: 07:36:04 executing program 4: 07:36:04 executing program 0: 07:36:04 executing program 3: 07:36:04 executing program 2: 07:36:04 executing program 1: 07:36:04 executing program 5: 07:36:04 executing program 3: 07:36:04 executing program 4: 07:36:04 executing program 1: 07:36:04 executing program 2: 07:36:04 executing program 0: 07:36:04 executing program 4: 07:36:04 executing program 3: 07:36:04 executing program 5: 07:36:04 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x3, 0x2, {0x7, 0x1d}}, 0x50) 07:36:04 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00007d9fc8)={0x0, 0x0, &(0x7f0000a40000)={&(0x7f0000000000)=@migrate={0xac, 0x21, 0x411, 0x0, 0x0, {{@in=@multicast1, @in6=@mcast1}, 0x0, 0x3}, [@migrate={0x5c, 0x11, [{@in6=@loopback, @in=@multicast2}, {@in=@empty, @in6=@mcast1}]}]}, 0xac}}, 0x0) 07:36:05 executing program 3: r0 = socket$inet6(0xa, 0x801, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) listen(r0, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000040)={@local, @link_local, [], {@ipv6={0x86dd, {0x0, 0x6, '\x00', 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd]}, @local, {[], @tcp={{0x0, 0x4e20, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) 07:36:05 executing program 4: r0 = socket$inet6(0xa, 0x40000000000001, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @ipv4}, 0x1c) listen(r0, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000080)={@local, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @rand_addr, @empty}, @tcp={{0x0, 0x4e20, 0x42424242, 0x41424344, 0x0, 0x0, 0x5, 0x1a}}}}}}, 0x0) 07:36:05 executing program 5: 07:36:05 executing program 2: 07:36:05 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'eql\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00*', 0x4fff}) ioctl$sock_ifreq(r1, 0x8914, &(0x7f00000000c0)={'eql\x00\x00\x00\xa9[\x00', @ifru_mtu=0x1}) lstat(0x0, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'eql\x00'}) dup3(r0, r2, 0x0) 07:36:05 executing program 1: r0 = creat(&(0x7f0000000100)='./file1\x00', 0x0) r1 = creat(&(0x7f0000000100)='./file1\x00', 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) write$cgroup_type(r1, &(0x7f0000000040)='threaded\x00', 0x198) fallocate(r0, 0x0, 0x0, 0xbc1e) 07:36:05 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$P9_RATTACH(0xffffffffffffffff, &(0x7f0000000080)={0x14, 0x69, 0x0, {0x20}}, 0x14) r0 = getpgid(0xffffffffffffffff) r1 = open(0x0, 0x2, 0x0) write$P9_RATTACH(r1, &(0x7f0000000080)={0x14}, 0xfffffff4) perf_event_open(0x0, r0, 0x0, r1, 0x8) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x8}, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r3, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r5, 0x407, 0x0) write(r5, &(0x7f0000000480)="b0a3cdef47f59ec515de0fcb5dfc761cf7120c4312b2054efdc0cf574f65329a05d03a24674b1d94d072b4bd702c576dc1d6e4fef97bdd899d359dadcfe32ba24fb1e152533e4df2c20324dda85d95c102000000d81d2b9bea7f9e468b3da19d62e9913b2f7cd488de25886811470818af91afd3bce1422670d6f2d054d8b16374e3617a22b1c70e7e3104b814e24e6e7b62256ae8faaae5f59f840c029418a34c", 0xffffff47) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000200)={0x30, 0x2, 0x0, 0x2000, 0x3, 0x8, 0x0, 0xdf}, 0x0) mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) truncate(&(0x7f0000000100)='./file0\x00', 0x0) unlink(&(0x7f0000000040)='./file0\x00') open(&(0x7f00000000c0)='./file0\x00', 0x3fd, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KDGKBTYPE(r6, 0x4b33, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$lock(r7, 0x26, &(0x7f0000000080)={0x0, 0x0, 0xffffffff}) fcntl$lock(r7, 0x26, 0x0) fcntl$getownex(r7, 0x10, &(0x7f00000001c0)={0x0, 0x0}) getpgrp(r8) 07:36:05 executing program 4: ioctl(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_elf64(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000001, 0x13, 0xffffffffffffffff, 0x0) close(r2) r3 = socket$inet6(0xa, 0x2000000000801, 0x0) setsockopt$inet6_opts(r3, 0x29, 0x3b, &(0x7f0000000100)=ANY=[@ANYBLOB="0900000000000000fe8d"], 0x8) setsockopt$inet6_int(r3, 0x29, 0x33, &(0x7f00000001c0)=0x1, 0x4) bind$inet6(r3, &(0x7f0000402000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) socket$inet(0x10, 0x0, 0x0) sendmsg(0xffffffffffffffff, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) sendto$inet6(r3, 0x0, 0x0, 0x20000000, &(0x7f0000f62fe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) syz_genetlink_get_family_id$fou(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x80000001, 0x0) 07:36:05 executing program 5: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x2000000000000074, 0x25d) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000080)='dctcp\x00', 0x6) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x210007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='bbr\x00', 0x3) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000240), 0x4) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000140)=ANY=[@ANYRES64, @ANYRESOCT]], 0x2c2) sendto$inet(r0, &(0x7f00000012c0)="03", 0x1, 0x9, 0x0, 0x0) 07:36:05 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000480)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x24e23, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x1000}], 0x1}, 0x0) write$binfmt_elf64(r0, &(0x7f00000000c0)=ANY=[@ANYRES64], 0xc63b9e35) 07:36:05 executing program 5: poll(0x0, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, 0xffffffffffffffff) perf_event_open(&(0x7f0000000140)={0x2, 0xbe, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x30882100, 0x0, 0x0, 0x0, 0x0) creat(0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) setitimer(0x0, 0x0, 0x0) 07:36:05 executing program 1: pipe(0x0) r0 = creat(&(0x7f0000000040)='./bus\x00', 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000a80), 0xfffffffffffffffd) r1 = socket$inet(0x2, 0x0, 0x0) r2 = creat(0x0, 0xb1) r3 = getpgrp(0x0) ioctl$TCSETSW(r2, 0x5403, 0x0) ioctl$sock_FIOSETOWN(r0, 0x8901, &(0x7f0000000100)=r3) sendto$inet(r1, 0x0, 0x0, 0x0, 0x0, 0xb2) gettid() ioctl$EXT4_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000004b40), 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='fd\x00') getdents64(r4, &(0x7f0000000140)=""/4096, 0x1000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000b34ff8), &(0x7f0000b34ffc)=0xc) 07:36:05 executing program 1: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000400)='./cgroup.cpu\x00E\xab\xcbw\x83.\xf3\x8a\xf6\xb3\xac\xfe\x9ek9\xcd\"\x84\x18/~[{\xfb\xc2\t}\xaaCSM^Z\x98\x0eZ\xfca5b\xd6\x92\a\xd6*\xd8v\xd0\xb1\x00=k|\xf1P\xbf\x17\x1b\x8f\xd6LT`V\\\xaeuJ[:\xcd<\xa1L\xec\x9fU\xe9\x14_g=\xfc\x7f\xbd-\xb2\xfa\xee\xe3\a~\x90\xd4\x90\a\x83\x81\xac\x1bWE_\x05;\xefk\x1e\xed:\x90\xc1\xba\x96\xde\xfac\xf0\'&:dn`\xe8\xa6-\x1dh\xb07#T\xa6\xa3\x9c\x91_jM@\x06\x8c\xf5\xbb\x81G\xb9\xa9\x8b\xf3\x8f\xa2\xee', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000000)='cpuset.mems\x00', 0x2, 0x0) write$cgroup_int(r1, &(0x7f00000000c0), 0x12) 07:36:05 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/net/tun\x00', 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r1, 0x0, r1) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'\x00\x00\x00\xe6\xff\xff\xff\x00\x00\x00\x00\x00\x02\x00', 0x5002}) socket$nl_route(0x10, 0x3, 0x0) pipe(&(0x7f0000000140)) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x1ff}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) [ 75.498829] syz-executor.5 calls setitimer() with new_value NULL pointer. Misfeature support will be removed 07:36:05 executing program 1: pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) openat$ppp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp\x00', 0x0, 0x0) creat(&(0x7f0000000140)='./file0\x00', 0x0) syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) write(r0, &(0x7f00000001c0), 0xfffffef3) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0800b5055e0bcfe87b0071") pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x1ff}, 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 07:36:05 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4009}) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="07000000000000000000018d1c88"], 0xe) [ 75.708012] ================================================================== [ 75.715420] BUG: KASAN: stack-out-of-bounds in iov_iter_advance+0x4b3/0x4f0 [ 75.722528] Read of size 8 at addr ffff8801d65e7d60 by task syz-executor.0/2857 [ 75.730054] [ 75.731687] CPU: 1 PID: 2857 Comm: syz-executor.0 Not tainted 4.4.174+ #4 [ 75.738864] 0000000000000000 cc4d4a75583c2812 ffff8801d65e7a10 ffffffff81aad1a1 [ 75.746960] 0000000000000000 ffffea00075979c0 ffff8801d65e7d60 0000000000000008 [ 75.755025] ffff8801d65e7d58 ffff8801d65e7a48 ffffffff81490120 0000000000000000 [ 75.763082] Call Trace: [ 75.765706] [] dump_stack+0xc1/0x120 [ 75.771068] [] print_address_description+0x6f/0x21b [ 75.777831] [] kasan_report.cold+0x8c/0x2be [ 75.783803] [] ? iov_iter_advance+0x4b3/0x4f0 [ 75.789971] [] __asan_report_load8_noabort+0x14/0x20 [ 75.796779] [] iov_iter_advance+0x4b3/0x4f0 [ 75.802763] [] tun_get_user+0x2c6/0x2640 [ 75.808590] [] ? tun_free_netdev+0xb0/0xb0 [ 75.814715] [] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 75.822430] [] ? check_preemption_disabled+0x3c/0x200 [ 75.829270] [] ? check_preemption_disabled+0x3c/0x200 [ 75.836114] [] ? __tun_get+0x126/0x230 [ 75.841754] [] tun_chr_write_iter+0xda/0x190 [ 75.847813] [] __vfs_write+0x2e8/0x3d0 [ 75.853354] [] ? __vfs_read+0x3c0/0x3c0 [ 75.858977] [] ? check_preemption_disabled+0x3c/0x200 [ 75.865837] [] ? selinux_file_permission+0x2f5/0x450 [ 75.872590] [] ? rw_verify_area+0x103/0x2f0 [ 75.878566] [] vfs_write+0x182/0x4e0 [ 75.883932] [] SyS_write+0xdc/0x1c0 [ 75.889190] [] ? SyS_read+0x1c0/0x1c0 [ 75.894633] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 75.901122] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 75.907778] [ 75.909381] The buggy address belongs to the page: [ 75.914296] page:ffffea00075979c0 count:0 mapcount:0 mapping: (null) index:0x0 [ 75.922512] flags: 0x4000000000000000() [ 75.927049] page dumped because: kasan: bad access detected [ 75.933003] [ 75.934669] Memory state around the buggy address: [ 75.939667] ffff8801d65e7c00: f2 f2 f2 f2 f2 00 00 00 00 00 00 00 f3 f3 f3 f3 [ 75.948261] ffff8801d65e7c80: f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 75.955776] >ffff8801d65e7d00: 00 00 00 00 00 f1 f1 f1 f1 00 00 f2 f2 00 00 00 [ 75.963214] ^ [ 75.969782] ffff8801d65e7d80: 00 00 f2 f2 f2 f2 f2 00 00 00 00 00 f3 f3 f3 f3 [ 75.977125] ffff8801d65e7e00: f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 75.984670] ================================================================== [ 75.992015] Disabling lock debugging due to kernel taint [ 76.000978] Kernel panic - not syncing: panic_on_warn set ... [ 76.000978] [ 76.008345] CPU: 1 PID: 2857 Comm: syz-executor.0 Tainted: G B 4.4.174+ #4 [ 76.016470] 0000000000000000 cc4d4a75583c2812 ffff8801d65e7950 ffffffff81aad1a1 [ 76.024575] ffff8801d65e7a60 ffffffff82c5cf1b ffff8801d65e7d60 0000000000000008 [ 76.033169] ffff8801d65e7d58 ffff8801d65e7a30 ffffffff813a48c2 0000000041b58ab3 [ 76.041184] Call Trace: [ 76.044631] [] dump_stack+0xc1/0x120 [ 76.050001] [] panic+0x1b9/0x37b [ 76.055037] [] ? add_taint.cold+0x16/0x16 [ 76.060817] [] ? preempt_schedule+0x24/0x30 [ 76.066795] [] ? ___preempt_schedule+0x12/0x14 [ 76.073013] [] kasan_end_report+0x47/0x4f [ 76.078803] [] kasan_report.cold+0xa9/0x2be [ 76.084778] [] ? iov_iter_advance+0x4b3/0x4f0 [ 76.090905] [] __asan_report_load8_noabort+0x14/0x20 [ 76.097730] [] iov_iter_advance+0x4b3/0x4f0 [ 76.103781] [] tun_get_user+0x2c6/0x2640 [ 76.109488] [] ? tun_free_netdev+0xb0/0xb0 [ 76.115622] [] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 76.122371] [] ? check_preemption_disabled+0x3c/0x200 [ 76.129202] [] ? check_preemption_disabled+0x3c/0x200 [ 76.136020] [] ? __tun_get+0x126/0x230 [ 76.141552] [] tun_chr_write_iter+0xda/0x190 [ 76.147603] [] __vfs_write+0x2e8/0x3d0 [ 76.153135] [] ? __vfs_read+0x3c0/0x3c0 [ 76.158805] [] ? check_preemption_disabled+0x3c/0x200 [ 76.165745] [] ? selinux_file_permission+0x2f5/0x450 [ 76.172506] [] ? rw_verify_area+0x103/0x2f0 [ 76.178478] [] vfs_write+0x182/0x4e0 [ 76.183832] [] SyS_write+0xdc/0x1c0 [ 76.189182] [] ? SyS_read+0x1c0/0x1c0 [ 76.194717] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 76.201201] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 76.208549] Kernel Offset: disabled [ 76.212353] Rebooting in 86400 seconds..