Warning: Permanently added '10.128.1.38' (ECDSA) to the list of known hosts. [ 39.041838] random: sshd: uninitialized urandom read (32 bytes read) 2019/09/13 13:56:19 fuzzer started [ 39.237695] audit: type=1400 audit(1568382979.750:36): avc: denied { map } for pid=6799 comm="syz-fuzzer" path="/root/syz-fuzzer" dev="sda1" ino=16480 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 39.850993] random: cc1: uninitialized urandom read (8 bytes read) 2019/09/13 13:56:21 dialing manager at 10.128.0.105:35171 2019/09/13 13:56:21 syscalls: 2466 2019/09/13 13:56:21 code coverage: enabled 2019/09/13 13:56:21 comparison tracing: ioctl(KCOV_TRACE_CMP) failed: invalid argument 2019/09/13 13:56:21 extra coverage: extra coverage is not supported by the kernel 2019/09/13 13:56:21 setuid sandbox: enabled 2019/09/13 13:56:21 namespace sandbox: enabled 2019/09/13 13:56:21 Android sandbox: /sys/fs/selinux/policy does not exist 2019/09/13 13:56:21 fault injection: enabled 2019/09/13 13:56:21 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/09/13 13:56:21 net packet injection: enabled 2019/09/13 13:56:21 net device setup: enabled [ 41.753906] random: crng init done 13:57:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000280)="c3"}) 13:57:57 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000), 0x4) sendmmsg(r0, &(0x7f0000005440)=[{{0x0, 0x0, 0x0}}], 0x400000000000304, 0x0) 13:57:57 executing program 3: openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x10006, 0x80011, r0, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$TIOCGPTPEER(r1, 0x5441, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') process_vm_writev(0x0, &(0x7f00000000c0)=[{&(0x7f0000000100)=""/21, 0x4}], 0x1, 0x0, 0x2d8, 0x0) writev(r2, &(0x7f0000000080), 0x5b) creat(0x0, 0x0) setresuid(0x0, 0x0, 0x0) 13:57:57 executing program 1: r0 = gettid() ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x10003) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000540)=ANY=[], 0x0) stat(0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_PTRACER(0x59616d61, r0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) close(r1) fsetxattr$trusted_overlay_origin(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) ioctl$KVM_SET_XCRS(r1, 0x4188aea7, &(0x7f00000002c0)={0x4, 0x8, [{0x5, 0x0, 0x1f}, {0x9, 0x0, 0x7}, {0x1d, 0x0, 0xfffffffffffffffd}, {0x1000, 0x0, 0x3}]}) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) 13:57:57 executing program 2: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup\x00', 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000240), 0x12) 13:57:57 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000340)='/proc/sys/net/ip7\x9e\x13Nv4\x01\x00\x00\x00\x00\x00_dr\xedprate\x00', 0x2, 0x0) [ 137.395465] audit: type=1400 audit(1568383077.910:37): avc: denied { map } for pid=6799 comm="syz-fuzzer" path="/root/syzkaller-shm862319780" dev="sda1" ino=2233 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:file_t:s0 tclass=file permissive=1 [ 137.450126] audit: type=1400 audit(1568383077.930:38): avc: denied { map } for pid=6817 comm="syz-executor.5" path="/sys/kernel/debug/kcov" dev="debugfs" ino=13796 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1 [ 137.810910] IPVS: ftp: loaded support on port[0] = 21 [ 138.579288] IPVS: ftp: loaded support on port[0] = 21 [ 138.628972] chnl_net:caif_netlink_parms(): no params data found [ 138.679165] bridge0: port 1(bridge_slave_0) entered blocking state [ 138.685887] bridge0: port 1(bridge_slave_0) entered disabled state [ 138.693276] device bridge_slave_0 entered promiscuous mode [ 138.701627] IPVS: ftp: loaded support on port[0] = 21 [ 138.728054] bridge0: port 2(bridge_slave_1) entered blocking state [ 138.734466] bridge0: port 2(bridge_slave_1) entered disabled state [ 138.741801] device bridge_slave_1 entered promiscuous mode [ 138.762780] chnl_net:caif_netlink_parms(): no params data found [ 138.772093] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 138.784612] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 138.807452] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 138.815072] team0: Port device team_slave_0 added [ 138.821221] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 138.828331] team0: Port device team_slave_1 added [ 138.833949] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 138.844873] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 138.911902] device hsr_slave_0 entered promiscuous mode [ 138.970311] device hsr_slave_1 entered promiscuous mode [ 139.040738] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 139.047471] bridge0: port 1(bridge_slave_0) entered blocking state [ 139.053994] bridge0: port 1(bridge_slave_0) entered disabled state [ 139.061224] device bridge_slave_0 entered promiscuous mode [ 139.069199] bridge0: port 2(bridge_slave_1) entered blocking state [ 139.075628] bridge0: port 2(bridge_slave_1) entered disabled state [ 139.082639] device bridge_slave_1 entered promiscuous mode [ 139.088922] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 139.117749] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 139.128495] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 139.154268] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 139.161495] team0: Port device team_slave_0 added [ 139.167005] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 139.175018] team0: Port device team_slave_1 added [ 139.180456] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 139.188324] bridge0: port 2(bridge_slave_1) entered blocking state [ 139.194869] bridge0: port 2(bridge_slave_1) entered forwarding state [ 139.202045] bridge0: port 1(bridge_slave_0) entered blocking state [ 139.203140] IPVS: ftp: loaded support on port[0] = 21 [ 139.208423] bridge0: port 1(bridge_slave_0) entered forwarding state [ 139.222187] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 139.273533] device hsr_slave_0 entered promiscuous mode [ 139.310345] device hsr_slave_1 entered promiscuous mode [ 139.389544] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 139.398277] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 139.431945] chnl_net:caif_netlink_parms(): no params data found [ 139.442890] bridge0: port 2(bridge_slave_1) entered blocking state [ 139.449267] bridge0: port 2(bridge_slave_1) entered forwarding state [ 139.455901] bridge0: port 1(bridge_slave_0) entered blocking state [ 139.462289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 139.474389] IPVS: ftp: loaded support on port[0] = 21 [ 139.565251] chnl_net:caif_netlink_parms(): no params data found [ 139.591536] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 139.597632] 8021q: adding VLAN 0 to HW filter on device bond0 [ 139.608421] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 139.614736] bridge0: port 1(bridge_slave_0) entered blocking state [ 139.621740] bridge0: port 1(bridge_slave_0) entered disabled state [ 139.628588] device bridge_slave_0 entered promiscuous mode [ 139.636439] bridge0: port 2(bridge_slave_1) entered blocking state [ 139.642976] bridge0: port 2(bridge_slave_1) entered disabled state [ 139.650423] device bridge_slave_1 entered promiscuous mode [ 139.668829] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 139.689639] bridge0: port 1(bridge_slave_0) entered disabled state [ 139.706901] bridge0: port 2(bridge_slave_1) entered disabled state [ 139.713946] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 139.721729] bridge0: port 1(bridge_slave_0) entered disabled state [ 139.728557] bridge0: port 2(bridge_slave_1) entered disabled state [ 139.736640] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 139.745219] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 139.769705] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 139.776651] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 139.787483] bridge0: port 1(bridge_slave_0) entered blocking state [ 139.793945] bridge0: port 1(bridge_slave_0) entered disabled state [ 139.801469] device bridge_slave_0 entered promiscuous mode [ 139.813058] IPVS: ftp: loaded support on port[0] = 21 [ 139.828366] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 139.835300] 8021q: adding VLAN 0 to HW filter on device team0 [ 139.844096] bridge0: port 2(bridge_slave_1) entered blocking state [ 139.850584] bridge0: port 2(bridge_slave_1) entered disabled state [ 139.861366] device bridge_slave_1 entered promiscuous mode [ 139.867490] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 139.874575] team0: Port device team_slave_0 added [ 139.882312] 8021q: adding VLAN 0 to HW filter on device bond0 [ 139.888549] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 139.895970] team0: Port device team_slave_1 added [ 139.921208] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 139.932201] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 139.940681] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 139.964568] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 139.975590] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 139.983110] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 139.991569] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 140.013136] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 140.021011] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 140.028643] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 140.036414] bridge0: port 1(bridge_slave_0) entered blocking state [ 140.042785] bridge0: port 1(bridge_slave_0) entered forwarding state [ 140.049525] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 140.057877] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 140.065573] bridge0: port 2(bridge_slave_1) entered blocking state [ 140.071994] bridge0: port 2(bridge_slave_1) entered forwarding state [ 140.078862] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 140.090691] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 140.101590] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 140.108404] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 140.193487] device hsr_slave_0 entered promiscuous mode [ 140.240557] device hsr_slave_1 entered promiscuous mode [ 140.300855] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 140.307978] team0: Port device team_slave_0 added [ 140.316688] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 140.325453] chnl_net:caif_netlink_parms(): no params data found [ 140.333601] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 140.342980] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 140.349038] 8021q: adding VLAN 0 to HW filter on device team0 [ 140.355616] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 140.363732] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 140.370880] team0: Port device team_slave_1 added [ 140.379460] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 140.391916] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 140.405742] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 140.413703] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 140.421564] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 140.429016] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 140.454909] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 140.463215] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 140.470616] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 140.478273] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 140.486027] bridge0: port 1(bridge_slave_0) entered blocking state [ 140.492407] bridge0: port 1(bridge_slave_0) entered forwarding state [ 140.505493] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 140.530785] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 140.603574] device hsr_slave_0 entered promiscuous mode [ 140.640494] device hsr_slave_1 entered promiscuous mode [ 140.700851] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 140.707831] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 140.715809] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 140.735357] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 140.744134] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 140.752357] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 140.759857] bridge0: port 2(bridge_slave_1) entered blocking state [ 140.766231] bridge0: port 2(bridge_slave_1) entered forwarding state [ 140.773403] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 140.782614] chnl_net:caif_netlink_parms(): no params data found [ 140.791408] bridge0: port 1(bridge_slave_0) entered blocking state [ 140.797762] bridge0: port 1(bridge_slave_0) entered disabled state [ 140.804674] device bridge_slave_0 entered promiscuous mode [ 140.811925] bridge0: port 2(bridge_slave_1) entered blocking state [ 140.818269] bridge0: port 2(bridge_slave_1) entered disabled state [ 140.825764] device bridge_slave_1 entered promiscuous mode [ 140.837893] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 140.854717] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 140.863839] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 140.876032] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 140.885604] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 140.896471] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 140.904804] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 140.913215] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 140.925063] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 140.932696] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 140.940468] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 140.965007] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 140.973118] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 140.994073] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 141.001185] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 141.008732] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 141.016444] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 141.029171] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 141.035946] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 141.051871] 8021q: adding VLAN 0 to HW filter on device bond0 [ 141.061310] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 141.068345] team0: Port device team_slave_0 added [ 141.074987] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 141.087969] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 141.098137] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 141.107028] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 141.115764] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 141.123165] team0: Port device team_slave_1 added [ 141.128549] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 141.136362] bridge0: port 1(bridge_slave_0) entered blocking state [ 141.145003] bridge0: port 1(bridge_slave_0) entered disabled state [ 141.152439] device bridge_slave_0 entered promiscuous mode [ 141.162083] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 141.172467] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 141.179186] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 141.186246] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 141.193777] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 141.202260] bridge0: port 2(bridge_slave_1) entered blocking state [ 141.208612] bridge0: port 2(bridge_slave_1) entered disabled state [ 141.215679] device bridge_slave_1 entered promiscuous mode [ 141.227021] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 141.235131] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 141.263684] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 141.272474] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 141.281669] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 141.287878] 8021q: adding VLAN 0 to HW filter on device team0 [ 141.301377] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 141.354288] device hsr_slave_0 entered promiscuous mode [ 141.390895] device hsr_slave_1 entered promiscuous mode [ 141.431357] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 141.441011] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 141.451100] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 141.461039] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 141.469072] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 141.481576] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 141.487728] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 141.494937] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 141.502984] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 141.510510] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 141.518285] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 141.526267] bridge0: port 1(bridge_slave_0) entered blocking state [ 141.532632] bridge0: port 1(bridge_slave_0) entered forwarding state [ 141.540073] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 141.547866] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 141.555620] bridge0: port 2(bridge_slave_1) entered blocking state [ 141.562006] bridge0: port 2(bridge_slave_1) entered forwarding state [ 141.569071] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 141.577164] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 141.591725] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 141.610973] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 141.619993] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 141.633161] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 141.649895] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 141.658291] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 141.666364] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 141.675017] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 141.682800] team0: Port device team_slave_0 added [ 141.692138] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 141.703142] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 141.714940] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 141.722282] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready 13:58:02 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x10006, 0x80011, r0, 0x0) process_vm_writev(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_open_dev$swradio(&(0x7f0000000240)='/dev/swradio#\x00', 0x1, 0x2) read$FUSE(r1, &(0x7f0000000280), 0x1000) syz_open_dev$swradio(0x0, 0x1, 0x2) writev(0xffffffffffffffff, 0x0, 0x0) [ 141.729327] team0: Port device team_slave_1 added [ 141.745295] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 141.759772] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 141.774032] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 141.782580] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 141.794889] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 141.802401] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 141.811040] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 141.826012] 8021q: adding VLAN 0 to HW filter on device batadv0 13:58:02 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b6c, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') [ 141.833510] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 141.842633] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 141.868687] 8021q: adding VLAN 0 to HW filter on device bond0 [ 141.876205] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 141.943556] device hsr_slave_0 entered promiscuous mode [ 141.980344] device hsr_slave_1 entered promiscuous mode [ 142.029885] 8021q: adding VLAN 0 to HW filter on device bond0 [ 142.036480] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 142.044293] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 142.054971] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 142.067321] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready 13:58:02 executing program 5: r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r0, 0xae60) ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00') preadv(r1, &(0x7f00000017c0), 0x1f0, 0x3f00) [ 142.075241] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 142.083590] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 142.089594] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 142.104652] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 142.111803] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 142.119493] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 142.129435] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 142.138575] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 142.155365] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 142.163603] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 142.172729] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 142.178799] 8021q: adding VLAN 0 to HW filter on device team0 [ 142.192332] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 142.199405] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 142.208806] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 142.220373] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready 13:58:02 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000), 0x4) sendmmsg(r0, &(0x7f0000005440)=[{{0x0, 0x0, 0x0}}], 0x400000000000304, 0x0) 13:58:02 executing program 0: shmctl$SHM_INFO(0x0, 0xe, &(0x7f0000000000)=""/56) [ 142.232321] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 142.239893] bridge0: port 1(bridge_slave_0) entered blocking state [ 142.246295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 142.256683] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 142.265133] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 142.271964] 8021q: adding VLAN 0 to HW filter on device team0 13:58:02 executing program 0: r0 = memfd_create(&(0x7f0000000540)='\x00\x00\x89\x00\x00\x00\x00\x00\x00\x00,p\x10-\x8a*\xc6\x0ed\xfc*\x1eR\x84\xd7\\\x03\xda\x85\xcen\xc0\x84a\xd4\xd3\xf4\x90\x91$\xb6\x85\xb7\xb9\x96\xa7\x8f1\xde{I~\xcc\xddX\xd9B\xb56%\xedx\xaaq[{\xa7\x7f\xb1d\x15?P\xde\x1b\xa0\x12\xde\xed\xbe\x82<\x14\x7f\x86\x05\x9c\xbd\xd1W\xea\xb5N\x18\x82\x98xm\xbf\x13\xef,\xde\x13VOO\x12\xe5\x91l\x83Y5\x9a\xf1l\xc5\x0e\xbb\x01u2\x03\x03\x90\xce\x9b>\xba\x17\xa2O\x89\x8c\xf2w\xbd\xacu\x8d\xc6\x10\x03N\xdb\xfbWd\xb9\xb5\xf3]\x92D.\b\xdb\x14\xe6{\xd0\xe7\xfb$\xd8\x0f\xfa#{\x93\x9a{\x12\xeay\x93\xf89\xce\xa6\xdf\x81\xd0{\\\x1c\xfe\xed\xc8f\\qO]G_\'\xf4\xa9\x01\xba\xba\xe1\xb2gD\x10\xce\xaf\xec\xe3&\x98o\xa5\xd9l\x1c0\xbaO\x1d0\x04?\xa3S\t\xf2^\x99\b\xd6\xc0\xd5\xf0\xf1<\xc8\xa9\xafp\xe7\xc9\xc4\x0fBa\x8e\xddc\xd5\xf56j#\xe5E-wH\x0f\xd0\x8d\xfa|\xa6\xdd\xec\xca\x93\xee\x1a\xc2\x0f\x06FP\x993e\xa1R\xd7\x96z\xcf\xb8\xcaP\xc9\xe6\xa7>\x8e}\\\xe3aU\x8f\xd4\x149\xa3\"A\xd6\xa7\xfd*\x1f\x8c\xd9\x9ac\x18M9\x83\xa7\xb2\xf4\x1acfa\x92\xca\x17o\xd0\xe0\x82\x1b-\xfe\x8c\x80\x13\xd3xa\bzN$\x90\xd6\xb9g\x89\xd0\x04U\xf8z\x8a\xf5\xbd\x82\xa7f\xc6\xd0\xcfh\xaa\xa5\x14+\x1f\x98@g\x88j\xa6A\xfe\x92\xc5x', 0x0) write$binfmt_script(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="01"], 0x1) ioctl$void(r0, 0x5451) execveat(r0, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) [ 142.313653] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 142.324144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 142.333142] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 142.355165] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready 13:58:02 executing program 0: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc7724e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507daea1c09fc1fe6c"}, 0x20) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4009}) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$TUNSETVNETHDRSZ(r1, 0x400454d8, &(0x7f0000000200)=0xa7) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f00000018c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\a\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83CZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x98\x86\"R\x06\x00\x00\x00\x00\x00\x00\x00\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&\x014\x01\xf4\xb7\x83\x9a\xfa*\xa6\x06\xb7Pk7N\xc2\xd9\xee\xd0\xb0M\x00\xab\xc3\t\fc\xd8dx\xd5\x1dU*s)\x12[\x14\xb1\xc0\xd7\x1a\xa0\x16\xa2z\x9e\x93 \xddeF>29\v\x02\xa2b\x13R\xef\xffA,\xb9.$\xfa\x9f\xde[\x80\xd1=\xce\x1b\xeb\xf6\xf4\xe3z\x1f\x9dz\xa3\xc0\xe2\xa2\xb1\xeeq\xf5\xec0\x8e\xf4\xfb\xd9\x87\xf03\xdb\xae|\x10&V5c\xa6\xce\xcd\x8a\xdf\xe1\x89\"\xea\xde\xe7\xa3\xbe\xe7\xff\xf9 \x11\xfdY\xc6\xa1\xe8\xda\v\\?\xcb\x87\bn\x9b\x01\x1f\xf8\xe8\x1eV\xfaC\xdf\xc3Vv\x9b\x1a\xfc\x14.c\x94\xc9=\xb0\x0f!d\b\x18*@m\x7f\xaal\x17G\xd6?\x81\x16P\x03\x10e\xc3\xcd\xb1B\xeb\x01B\\\x91A\xa1\x8an\xb4#\xadr\x1e\x81v\xa2\x0e6x\xca\x8b\xa6\xd8\x81\x10:\x0e(\xdd\xfc\xc9\xc6\xb4\xf0\'f:\xbd\xfe\x11\xf8\xc8W\x81s^\xd9W\xf1\x94\xaf\xc5\x8a\xb4f\x1b\x17E\xb23\x12\xb0\xeb\xef\x8c\xb24h\xd7}\x7f\x92Hgej\x957\xe2A') write$cgroup_subtree(r1, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd', 0x7}]}, 0x90ad) [ 142.368985] bridge0: port 2(bridge_slave_1) entered blocking state [ 142.375416] bridge0: port 2(bridge_slave_1) entered forwarding state [ 142.394724] device nr0 entered promiscuous mode 13:58:02 executing program 5: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000140)="40c74adc7724e27d876f441d952bf111375896d876c4ed0f2e703cd5f8b64ff3cd946b507daea1c09fc1fe6c"}, 0x20) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4009}) r1 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f0000000200)=0xa7) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000c00)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x0e\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xfeu\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$kcm(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x7c, 0x0}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$cgroup_subtree(r0, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd', 0xa}]}, 0x90ad) [ 142.413742] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 142.424326] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 142.441794] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 142.460785] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 142.468371] bridge0: port 1(bridge_slave_0) entered blocking state [ 142.474753] bridge0: port 1(bridge_slave_0) entered forwarding state [ 142.483671] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 142.493521] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 142.512604] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 142.521150] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 142.529463] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 142.551326] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 142.558898] bridge0: port 2(bridge_slave_1) entered blocking state [ 142.565295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 142.572574] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 142.586680] 8021q: adding VLAN 0 to HW filter on device bond0 [ 142.599745] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 142.612833] device nr0 entered promiscuous mode [ 142.618300] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 142.627781] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 142.641099] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 142.648740] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 142.655678] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 142.664268] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 142.672763] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 142.680087] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 142.689052] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 142.704048] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 142.710034] hrtimer: interrupt took 29738 ns 13:58:03 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_LISTEN(r0, &(0x7f0000000240)={0x7, 0x8}, 0x10) [ 142.747349] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 142.770582] 8021q: adding VLAN 0 to HW filter on device team0 [ 142.776900] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 142.788207] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 142.796982] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 142.809589] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 142.820914] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 142.829719] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 142.842789] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 142.856663] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 142.865272] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 142.877792] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 142.887052] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 142.895835] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 142.903936] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 142.911866] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 142.919436] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 142.927626] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 142.935323] bridge0: port 1(bridge_slave_0) entered blocking state [ 142.941715] bridge0: port 1(bridge_slave_0) entered forwarding state [ 142.972046] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 142.978092] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 142.997572] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 143.007103] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 143.021426] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 143.028371] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 143.050595] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 143.058256] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 143.080984] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 143.088840] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 143.110830] bridge0: port 2(bridge_slave_1) entered blocking state [ 143.117262] bridge0: port 2(bridge_slave_1) entered forwarding state [ 143.145778] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 143.155321] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 143.175865] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 143.190705] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 143.201441] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 143.229219] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 143.244895] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 143.270882] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 143.279188] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 143.292281] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 143.303979] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 143.312549] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 143.326850] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 143.339916] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 143.352860] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 143.363417] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 143.375971] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 143.382328] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 143.401110] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 143.419430] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 143.426927] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 143.435363] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 143.447740] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 143.455558] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 143.473533] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 143.483959] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 143.501538] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 143.509129] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 143.523729] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 143.537681] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 143.544986] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 143.562341] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 143.579569] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 143.661294] device bridge_slave_1 left promiscuous mode [ 143.667176] bridge0: port 2(bridge_slave_1) entered disabled state [ 143.726702] device bridge_slave_0 left promiscuous mode [ 143.739857] bridge0: port 1(bridge_slave_0) entered disabled state [ 143.874220] device hsr_slave_1 left promiscuous mode [ 143.944678] device hsr_slave_0 left promiscuous mode [ 143.986095] team0 (unregistering): Port device team_slave_1 removed [ 143.996470] team0 (unregistering): Port device team_slave_0 removed [ 144.006815] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 144.055115] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 144.122589] bond0 (unregistering): Released all slaves [ 145.920941] IPVS: ftp: loaded support on port[0] = 21 13:58:07 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) getsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, 0x0, &(0x7f0000000140)) connect$can_bcm(r0, &(0x7f0000000380)={0x1d, r1}, 0x10) sendmsg$can_raw(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f000000a000)=@canfd={{0x1}, 0x0, 0x0, 0x0, 0x0, "0327e1b22b5fcef700580f02000000003f420f000000000000580f02000000003f420f0000000000856b76b5ee00000000000000004e2f9663a918fa1efd9b0b"}, 0x2000a048}}, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 13:58:07 executing program 3: openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x10006, 0x80011, r0, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$TIOCGPTPEER(r1, 0x5441, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') process_vm_writev(0x0, &(0x7f00000000c0)=[{&(0x7f0000000100)=""/21, 0x4}], 0x1, 0x0, 0x2d8, 0x0) writev(r2, &(0x7f0000000080), 0x5b) creat(0x0, 0x0) setresuid(0x0, 0x0, 0x0) 13:58:07 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x10006, 0x80011, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') writev(r1, &(0x7f0000000080), 0x5b) 13:58:07 executing program 4: add_key(&(0x7f00000005c0)='dns_resolver\x00', 0x0, &(0x7f0000000640), 0x0, 0xffffffffffffffff) keyctl$instantiate(0xc, 0x0, &(0x7f0000000580)=@encrypted_update={'update ', 'ecryptfs', 0x20, 'trusted:', 'system)\''}, 0x21, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={0x0, 0x0}, 0x20) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$md(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1000, &(0x7f0000015000/0x1000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r4, 0x4008ae8a, &(0x7f0000000600)={0x8, 0x0, [{0xc0000000, 0xa4, 0x100000000, 0x0, 0xffff}, {0x80000000, 0x1, 0x2, 0x0, 0x800}, {0xc0000007, 0x5}, {0x40000001, 0x0, 0x0, 0x81}, {0xd, 0x0, 0x100, 0x1000}, {0x80000019, 0x0, 0x3f80000, 0x0, 0x400000000009}, {0x80000001, 0x3, 0x8}, {0x0, 0x6, 0x100, 0x0, 0x8a8}]}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x1f004}) ioctl$KVM_NMI(r4, 0xae9a) fsetxattr$trusted_overlay_upper(r3, 0x0, &(0x7f00000002c0)={0x0, 0xfb, 0x15, 0x0, 0x0, "9dd4c014436dcb31d945a9f8bbc45938"}, 0x15, 0x3) fsetxattr$trusted_overlay_nlink(r2, &(0x7f0000000000)='trusted.overlay.nlink\x00', &(0x7f00000001c0)={'L+', 0xffff}, 0x28, 0x2) prctl$PR_GET_UNALIGN(0x5, 0x0) ioctl$KVM_SET_CPUID(r4, 0x4008ae8a, &(0x7f0000000300)={0x7, 0x0, [{0x80000008, 0x1ff, 0x9, 0x1ff}, {0x2, 0x53, 0x1, 0x0, 0x81}, {0xa, 0x7ff, 0x9, 0x8, 0x6}, {0x0, 0x0, 0x0, 0x100000000}, {0x80000000, 0xabb}, {0x0, 0x5209, 0x3d, 0x0, 0x9}, {0x0, 0x7, 0xfd, 0x377, 0x7}]}) 13:58:07 executing program 1: r0 = gettid() ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x10003) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000540)=ANY=[], 0x0) stat(0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_PTRACER(0x59616d61, r0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) close(r1) fsetxattr$trusted_overlay_origin(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) ioctl$KVM_SET_XCRS(r1, 0x4188aea7, &(0x7f00000002c0)={0x4, 0x8, [{0x5, 0x0, 0x1f}, {0x9, 0x0, 0x7}, {0x1d, 0x0, 0xfffffffffffffffd}, {0x1000, 0x0, 0x3}]}) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) 13:58:07 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x10006, 0x80011, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') writev(r1, &(0x7f0000000080), 0x5b) [ 146.605524] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. 13:58:07 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) getsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, 0x0, &(0x7f0000000140)) connect$can_bcm(r0, &(0x7f0000000380)={0x1d, r1}, 0x10) sendmsg$can_raw(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f000000a000)=@canfd={{0x1}, 0x0, 0x0, 0x0, 0x0, "0327e1b22b5fcef700580f02000000003f420f000000000000580f02000000003f420f0000000000856b76b5ee00000000000000004e2f9663a918fa1efd9b0b"}, 0x2000a048}}, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 13:58:07 executing program 3: openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x10006, 0x80011, r0, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$TIOCGPTPEER(r1, 0x5441, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') process_vm_writev(0x0, &(0x7f00000000c0)=[{&(0x7f0000000100)=""/21, 0x4}], 0x1, 0x0, 0x2d8, 0x0) writev(r2, &(0x7f0000000080), 0x5b) creat(0x0, 0x0) setresuid(0x0, 0x0, 0x0) 13:58:07 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x10006, 0x80011, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') writev(r1, &(0x7f0000000080), 0x5b) 13:58:07 executing program 4: r0 = socket(0x10, 0x3, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") sendmsg$nl_route_sched(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000001c0)=@getqdisc={0x28, 0x26, 0xfeb87ce84b97b671, 0x0, 0x0, {}, [{0x4}]}, 0x28}}, 0x0) 13:58:07 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x1e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x2, 0x3, 0x84) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.s\x01@\x00\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x3e, &(0x7f0000000280)=r1, 0x4) sendmsg$kcm(r0, &(0x7f0000003d00)={&(0x7f0000000380)=@un=@abs={0x0, 0x0, 0xffffff7f}, 0xff3a, 0x0, 0x0, 0x0, 0x0, 0xfd}, 0x0) [ 146.936714] raw_sendmsg: syz-executor.0 forgot to set AF_INET. Fix it! [ 147.058721] chnl_net:caif_netlink_parms(): no params data found [ 147.096560] bridge0: port 1(bridge_slave_0) entered blocking state [ 147.103078] bridge0: port 1(bridge_slave_0) entered disabled state [ 147.110277] device bridge_slave_0 entered promiscuous mode [ 147.118128] bridge0: port 2(bridge_slave_1) entered blocking state [ 147.125753] bridge0: port 2(bridge_slave_1) entered disabled state [ 147.133658] device bridge_slave_1 entered promiscuous mode [ 147.150196] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 147.158937] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 147.176816] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 147.184150] team0: Port device team_slave_0 added [ 147.189482] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 147.197017] team0: Port device team_slave_1 added [ 147.202304] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 147.209533] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 147.272171] device hsr_slave_0 entered promiscuous mode [ 147.310332] device hsr_slave_1 entered promiscuous mode [ 147.351008] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 147.358026] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 147.370532] bridge0: port 2(bridge_slave_1) entered blocking state [ 147.376899] bridge0: port 2(bridge_slave_1) entered forwarding state [ 147.383556] bridge0: port 1(bridge_slave_0) entered blocking state [ 147.389901] bridge0: port 1(bridge_slave_0) entered forwarding state [ 147.441421] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 147.447515] 8021q: adding VLAN 0 to HW filter on device bond0 [ 147.458779] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 147.467954] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 147.475074] bridge0: port 1(bridge_slave_0) entered disabled state [ 147.481874] bridge0: port 2(bridge_slave_1) entered disabled state [ 147.493097] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 147.499204] 8021q: adding VLAN 0 to HW filter on device team0 [ 147.507402] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 147.515418] bridge0: port 1(bridge_slave_0) entered blocking state [ 147.521812] bridge0: port 1(bridge_slave_0) entered forwarding state [ 147.531191] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 147.538717] bridge0: port 2(bridge_slave_1) entered blocking state [ 147.545113] bridge0: port 2(bridge_slave_1) entered forwarding state [ 147.557888] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 147.566446] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 147.576441] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 147.589493] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 147.599978] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 147.610891] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 147.617256] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 147.624845] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 147.632439] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 147.645401] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 147.654990] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 148.060718] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready 13:58:09 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f0000005400)=[{{&(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10, 0x0, 0x0, &(0x7f0000000640)=[@ip_ttl={{0x14, 0x0, 0x2, 0x4}}, @ip_tos_u8={{0x11}}, @ip_retopts={{0x18, 0x0, 0x7, {[@end, @timestamp={0x44, 0x4}]}}}], 0x48}}, {{0x0, 0x0, 0x0}}], 0x2, 0x0) 13:58:09 executing program 3: io_setup(0x0, &(0x7f0000000000)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffff9c, 0x0, 0x0, 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000040)='./bus\x00', 0x0) lseek(0xffffffffffffffff, 0x800002, 0x0) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, &(0x7f00000000c0)) ioctl$EXT4_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f00000001c0)) write$binfmt_elf64(r0, &(0x7f00000005c0)=ANY=[@ANYBLOB="03"], 0x1) fallocate(r0, 0x3, 0x0, 0x8020003) creat(&(0x7f0000000040)='./bus\x00', 0x0) 13:58:09 executing program 4: bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000400)={0xffffffffffffffff, 0x100000000}, 0xc) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xe172, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000014d40)={0xa, 0x1, &(0x7f0000000600)=ANY=[@ANYBLOB="00000000000000003f26ad0a3ca53eae590f2088b8a10d355e044017b93bdc94629f36605caf115f16cd69b3f96a395eb0c8c98542c6e468c14e81c432b6fd64387f4391b3a36abd033fd40d38daf3296a545a3303ef8f658efee83766ccf0d5783cadee6620dfbbf2fce52b130d100a91cc9e94a6f93279d12446a1fb0a2df9e20aacceeba0b8cc935424ce075bacecb3e47be25662c99b7494dba42cd1ba6b5948253f7f2a88b372c07c423b934657368ef20c634a1ebdaa1be04113f4a6ef68821c24002c1a8686b42e064fccbed975135363e18b11d02d2cdcbe5c82cdb688ec"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0xffffffffffffff51) recvmsg$kcm(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) r0 = socket$kcm(0x11, 0xa, 0x300) recvmsg$kcm(r0, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) recvmsg$kcm(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000240)=@rc, 0x80, &(0x7f0000000580)=[{&(0x7f00000002c0)=""/6, 0x6}, {&(0x7f0000000300)=""/211, 0xd3}, {&(0x7f0000000440)=""/179, 0xb3}, {&(0x7f0000000540)=""/25, 0x19}], 0x4}, 0x0) close(r0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'lo\x00'}) close(0xffffffffffffffff) socket$kcm(0x2, 0xa, 0x2) ioctl$TUNSETNOCSUM(0xffffffffffffffff, 0x400454c8, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8916, 0x0) 13:58:09 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x10006, 0x80011, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') writev(r1, &(0x7f0000000080), 0x5b) 13:58:09 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x10006, 0x80011, r0, 0x0) process_vm_writev(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_open_dev$swradio(&(0x7f0000000240)='/dev/swradio#\x00', 0x1, 0x2) read$FUSE(r1, &(0x7f0000000280), 0x1000) ioctl$UI_DEV_CREATE(r1, 0x5501) ioctl$VIDIOC_S_FREQUENCY(0xffffffffffffffff, 0x402c5639, &(0x7f00000012c0)) syz_open_dev$swradio(0x0, 0x1, 0x2) syz_open_dev$swradio(&(0x7f0000000240)='/dev/swradio#\x00', 0x1, 0x2) writev(0xffffffffffffffff, &(0x7f0000000080), 0x5b) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000cab000)) [ 149.021383] syz-executor.4 uses obsolete (PF_INET,SOCK_PACKET) 13:58:10 executing program 3: r0 = open(&(0x7f0000000080)='./file0\x00', 0x98940, 0x0) fcntl$setlease(r0, 0x400, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f00000000c0)) rt_sigprocmask(0x0, &(0x7f0000032ff8)={0xfffffbfffffffffe}, 0x0, 0x8) rt_sigtimedwait(&(0x7f00005a1000)={0x7aad5e5a}, 0x0, 0x0, 0x8) open(&(0x7f0000000040)='./file0\x00', 0x8802, 0x0) 13:58:10 executing program 1: 13:58:10 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x10006, 0x80011, r0, 0x0) writev(0xffffffffffffffff, &(0x7f0000000080), 0x5b) 13:58:10 executing program 5: getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000a05000/0x400000)=nil, 0x400300, 0x0, 0x10, 0xffffffffffffffff, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000040)={0x2, &(0x7f0000000000)=[{0x28, 0x0, 0x0, 0xffeff034}, {0x80000006}]}, 0x10) r1 = socket$inet_udp(0x2, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(r1, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000180)=0x4, 0x4) connect$inet(r1, &(0x7f0000000380)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r1, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 13:58:10 executing program 0: 13:58:10 executing program 4: 13:58:10 executing program 4: 13:58:10 executing program 0: 13:58:10 executing program 1: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x10006, 0x80011, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') process_vm_writev(0x0, &(0x7f00000000c0)=[{&(0x7f0000000100)=""/21, 0x4}], 0x1, 0x0, 0x2d8, 0x0) writev(r1, &(0x7f0000000080), 0x5b) 13:58:10 executing program 4: 13:58:10 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x10006, 0x80011, r0, 0x0) writev(0xffffffffffffffff, &(0x7f0000000080), 0x5b) 13:58:10 executing program 3: 13:58:10 executing program 0: 13:58:10 executing program 4: [ 150.070308] protocol 88fb is buggy, dev hsr_slave_0 [ 150.075653] protocol 88fb is buggy, dev hsr_slave_1 [ 150.080815] protocol 88fb is buggy, dev hsr_slave_0 [ 150.085911] protocol 88fb is buggy, dev hsr_slave_1 13:58:10 executing program 5: getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000a05000/0x400000)=nil, 0x400300, 0x0, 0x10, 0xffffffffffffffff, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000040)={0x2, &(0x7f0000000000)=[{0x28, 0x0, 0x0, 0xffeff034}, {0x80000006}]}, 0x10) r1 = socket$inet_udp(0x2, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(r1, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000180)=0x4, 0x4) connect$inet(r1, &(0x7f0000000380)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r1, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 13:58:10 executing program 3: 13:58:10 executing program 1: 13:58:10 executing program 0: 13:58:10 executing program 4: 13:58:10 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x10006, 0x80011, r0, 0x0) writev(0xffffffffffffffff, &(0x7f0000000080), 0x5b) 13:58:10 executing program 3: 13:58:10 executing program 4: 13:58:10 executing program 1: 13:58:10 executing program 0: 13:58:10 executing program 4: 13:58:10 executing program 3: 13:58:11 executing program 5: getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000a05000/0x400000)=nil, 0x400300, 0x0, 0x10, 0xffffffffffffffff, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000040)={0x2, &(0x7f0000000000)=[{0x28, 0x0, 0x0, 0xffeff034}, {0x80000006}]}, 0x10) r1 = socket$inet_udp(0x2, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(r1, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000180)=0x4, 0x4) connect$inet(r1, &(0x7f0000000380)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r1, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 13:58:11 executing program 0: 13:58:11 executing program 1: 13:58:11 executing program 4: 13:58:11 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') writev(r0, &(0x7f0000000080), 0x5b) 13:58:11 executing program 3: 13:58:11 executing program 3: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) listen(r0, 0x3ea) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmmsg$inet_sctp(r0, &(0x7f0000000080)=[{&(0x7f0000000180)=@in={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10, &(0x7f0000562000), 0x0, &(0x7f00000c3000)=[@sndinfo={0x20, 0x84, 0x2, {0x0, 0x241}}], 0x20}], 0x4924924924924d0, 0x0) 13:58:11 executing program 4: mknod$loop(&(0x7f0000000400)='./file0\x00', 0x0, 0xffffffffffffffff) r0 = socket$inet_tcp(0x2, 0x1, 0x0) fstat(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) chown(&(0x7f0000000000)='./file0\x00', 0x0, r1) 13:58:11 executing program 1: clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x400002100001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20010001, &(0x7f0000000280)={0xa, 0x0, 0x0, @remote, 0x2}, 0x1c) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r2 = dup2(r0, r0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) sendmsg$TIPC_NL_NET_GET(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0}}, 0x0) close(r0) socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = gettid() tkill(r3, 0x1400000000015) tkill(r1, 0x1000000000016) 13:58:11 executing program 0: clone(0x204, 0x0, 0x0, 0x0, 0x0) execve(0x0, 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000000)=""/11, 0xb) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000200)) r1 = creat(&(0x7f0000000180)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000000c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) open$dir(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK/file0\x00', 0x0, 0x0) ioctl$LOOP_SET_STATUS64(r2, 0x4c04, 0x0) 13:58:11 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') writev(r0, &(0x7f0000000080), 0x5b) 13:58:11 executing program 4: 13:58:11 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) readv(r0, &(0x7f0000000500)=[{&(0x7f00000000c0)=""/54, 0x36}], 0x1) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, 0x0) r2 = syz_open_pts(r0, 0x2) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00003b9fdc)) syz_open_pts(0xffffffffffffffff, 0x0) dup3(r2, r0, 0x0) write(r0, &(0x7f0000c34fff), 0xffffff0b) 13:58:11 executing program 4: 13:58:11 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') writev(r0, &(0x7f0000000080), 0x5b) 13:58:11 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4020ae46, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) [ 150.870134] protocol 88fb is buggy, dev hsr_slave_0 13:58:11 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000380)='memory.swap.current\x00', 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000280), &(0x7f0000000300)=0xc) stat(&(0x7f0000000340)='./file0\x00', &(0x7f00000003c0)) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f00000005c0)) fstat(r0, &(0x7f0000000680)) fcntl$getown(r0, 0x9) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x615, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 13:58:11 executing program 2: mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x10006, 0x80011, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') writev(r0, &(0x7f0000000080), 0x5b) 13:58:11 executing program 2: mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x10006, 0x80011, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') writev(r0, &(0x7f0000000080), 0x5b) 13:58:11 executing program 4: r0 = socket$inet6(0xa, 0x100800000000002, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) ioctl$sock_inet_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f0000000600)={0x0, {0x2, 0x4e22, @loopback}, {0x2, 0x4e20, @multicast1}, {0x2, 0x4e21, @loopback}, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f00000005c0)='bond_slave_0\x00', 0x5, 0x8, 0x7fffffff}) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @rand_addr="ac021c0158eab1caa6e4f4989e3495ca"}, 0x1c) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='sched\x00') sendfile(r0, r1, 0x0, 0x88001) sendmmsg(r0, &(0x7f00000003c0), 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) read(r0, &(0x7f00000004c0)=""/119, 0x77) bind$inet6(r2, &(0x7f0000000200)={0xa, 0x4e22, 0xe5e, @loopback, 0x3}, 0x1c) setsockopt$sock_timeval(r2, 0x1, 0x1b, 0x0, 0xffffffffffffffc8) listen(r2, 0x80) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@empty, @in6=@mcast1}}, {{@in6=@remote}, 0x0, @in=@broadcast}}, &(0x7f0000000100)=0xe8) write$P9_RWRITE(0xffffffffffffffff, &(0x7f00000000c0)={0xb, 0x77, 0x1, 0x4}, 0xb) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r3, 0x0, 0xffffffffffffffe3, 0x20000004, &(0x7f00000003c0)={0xa, 0x4e22}, 0x1c) openat$zero(0xffffffffffffff9c, &(0x7f0000000440)='/dev/zero\x00', 0x200000, 0x0) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) recvfrom$inet6(r3, &(0x7f0000001840)=""/31, 0xfffffe0e, 0x100, &(0x7f0000001880), 0x1c) r4 = accept4(r2, 0x0, 0x0, 0x0) sendto$inet6(r4, &(0x7f00000000c0), 0xfffffdda, 0x0, 0x0, 0x0) [ 151.845786] ================================================================== [ 151.853292] BUG: KASAN: use-after-free in tcp_ack+0x414f/0x4760 [ 151.859338] Read of size 4 at addr ffff888090a095ac by task syz-executor.4/7154 [ 151.866773] [ 151.868384] CPU: 1 PID: 7154 Comm: syz-executor.4 Not tainted 4.14.143 #0 [ 151.875287] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 151.884622] Call Trace: [ 151.887186] [ 151.889321] dump_stack+0x138/0x197 [ 151.892962] ? tcp_ack+0x414f/0x4760 [ 151.896657] print_address_description.cold+0x7c/0x1dc [ 151.901915] ? tcp_ack+0x414f/0x4760 [ 151.905610] kasan_report.cold+0xa9/0x2af [ 151.909809] __asan_report_load4_noabort+0x14/0x20 [ 151.914979] tcp_ack+0x414f/0x4760 [ 151.918508] ? tcp_fastretrans_alert+0x2620/0x2620 [ 151.923417] ? save_trace+0x290/0x290 [ 151.927208] tcp_rcv_established+0x3e9/0x1650 [ 151.931696] ? rt6_check_expired+0xa5/0x160 [ 151.935999] ? tcp_data_queue+0x3730/0x3730 [ 151.940311] ? ip6_dst_check+0x16a/0x2c0 [ 151.944366] tcp_v6_do_rcv+0x417/0x1190 [ 151.948338] tcp_v6_rcv+0x2446/0x2ed0 [ 151.952122] ? save_trace+0x290/0x290 [ 151.955917] ip6_input_finish+0x300/0x15a0 [ 151.960150] ip6_input+0xd5/0x340 [ 151.963582] ? ip6_input_finish+0x15a0/0x15a0 [ 151.968056] ? ipv6_rcv+0x16aa/0x1d20 [ 151.971837] ? ip6_rcv_finish+0x7a0/0x7a0 [ 151.975975] ip6_rcv_finish+0x23f/0x7a0 [ 151.979940] ipv6_rcv+0xe4d/0x1d20 [ 151.983463] ? put_prev_task_stop+0x358/0x400 [ 151.987937] ? ip6_input+0x340/0x340 [ 151.991634] ? __lock_is_held+0xb6/0x140 [ 151.995674] ? check_preemption_disabled+0x3c/0x250 [ 152.000670] ? ip6_make_skb+0x410/0x410 [ 152.004638] ? rcu_lockdep_current_cpu_online+0xf2/0x140 [ 152.010070] ? ip6_input+0x340/0x340 [ 152.013766] __netif_receive_skb_core+0x1eae/0x2ca0 [ 152.018762] ? trace_hardirqs_on+0x10/0x10 [ 152.022979] ? enqueue_to_backlog+0xcc0/0xcc0 [ 152.027454] ? process_backlog+0x43e/0x730 [ 152.031670] ? lock_acquire+0x16f/0x430 [ 152.035626] __netif_receive_skb+0x2c/0x1b0 [ 152.039926] ? __netif_receive_skb+0x2c/0x1b0 [ 152.044488] process_backlog+0x21f/0x730 [ 152.048528] ? mark_held_locks+0xb1/0x100 [ 152.052665] net_rx_action+0x490/0xf80 [ 152.056536] ? napi_complete_done+0x4f0/0x4f0 [ 152.061020] ? rcu_lockdep_current_cpu_online+0xf2/0x140 [ 152.066453] __do_softirq+0x244/0x9a0 [ 152.070237] ? ip6_finish_output2+0x9c0/0x21b0 [ 152.074801] do_softirq_own_stack+0x2a/0x40 [ 152.079103] [ 152.081320] do_softirq.part.0+0x10e/0x160 [ 152.085548] __local_bh_enable_ip+0x154/0x1a0 [ 152.090045] ip6_finish_output2+0x9f3/0x21b0 [ 152.094447] ? ip6_forward_finish+0x480/0x480 [ 152.098944] ? __lock_is_held+0xb6/0x140 [ 152.102990] ? check_preemption_disabled+0x3c/0x250 [ 152.107995] ip6_finish_output+0x4f4/0xb50 [ 152.112227] ? ip6_finish_output+0x4f4/0xb50 [ 152.116622] ip6_output+0x20f/0x6d0 [ 152.120231] ? ip6_finish_output+0xb50/0xb50 [ 152.124624] ? __lock_is_held+0xb6/0x140 [ 152.128669] ? check_preemption_disabled+0x3c/0x250 [ 152.133665] ? ip6_fragment+0x32c0/0x32c0 [ 152.137797] ? rcu_lockdep_current_cpu_online+0xf2/0x140 [ 152.143263] ip6_xmit+0xd53/0x1eb0 [ 152.146820] ? ip6_finish_output2+0x21b0/0x21b0 [ 152.151492] ? ip6_dst_check+0x116/0x2c0 [ 152.155541] ? save_trace+0x290/0x290 [ 152.159343] ? ip6_append_data+0x2f0/0x2f0 [ 152.163565] ? __lock_is_held+0xb6/0x140 [ 152.167610] ? check_preemption_disabled+0x3c/0x250 [ 152.172613] inet6_csk_xmit+0x286/0x4d0 [ 152.176576] ? inet6_csk_update_pmtu+0x140/0x140 [ 152.181315] ? tcp_md5_do_lookup+0x1d3/0x530 [ 152.185727] __tcp_transmit_skb+0x172c/0x2fe0 [ 152.190213] ? __tcp_select_window+0x6e0/0x6e0 [ 152.194788] ? kvm_clock_read+0x23/0x40 [ 152.198761] ? sched_clock_cpu+0x1b/0x1c0 [ 152.202900] ? tcp_small_queue_check+0x184/0x1e0 [ 152.207642] tcp_write_xmit+0x523/0x4960 [ 152.211695] ? tcp_v6_md5_lookup+0x23/0x30 [ 152.215913] ? tcp_established_options+0x2c5/0x420 [ 152.220824] ? tcp_current_mss+0x1b1/0x2f0 [ 152.225063] __tcp_push_pending_frames+0xa6/0x260 [ 152.229893] tcp_send_fin+0x17e/0xc40 [ 152.233678] tcp_close+0xcc8/0xfb0 [ 152.237205] ? lock_acquire+0x16f/0x430 [ 152.241184] ? ip_mc_drop_socket+0x1d6/0x230 [ 152.245634] inet_release+0xec/0x1c0 [ 152.249363] inet6_release+0x53/0x80 [ 152.253070] __sock_release+0xce/0x2b0 [ 152.256939] ? __sock_release+0x2b0/0x2b0 [ 152.261069] sock_close+0x1b/0x30 [ 152.264504] __fput+0x275/0x7a0 [ 152.267774] ____fput+0x16/0x20 [ 152.271036] task_work_run+0x114/0x190 [ 152.274906] exit_to_usermode_loop+0x1da/0x220 [ 152.279483] do_syscall_64+0x4bc/0x640 [ 152.283348] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 152.288175] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 152.293366] RIP: 0033:0x4135d1 [ 152.296555] RSP: 002b:00007ffd51c591e0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 [ 152.304255] RAX: 0000000000000000 RBX: 0000000000000008 RCX: 00000000004135d1 [ 152.311510] RDX: 0000000000000000 RSI: 000000000000033f RDI: 0000000000000007 [ 152.318766] RBP: 0000000000000001 R08: 000000008beec33f R09: 000000008beec343 [ 152.326018] R10: 00007ffd51c592c0 R11: 0000000000000293 R12: 000000000075c9a0 [ 152.333281] R13: 000000000075c9a0 R14: 0000000000761580 R15: ffffffffffffffff [ 152.340545] [ 152.342150] Allocated by task 7159: [ 152.345782] save_stack_trace+0x16/0x20 [ 152.349735] save_stack+0x45/0xd0 [ 152.353198] kasan_kmalloc+0xce/0xf0 [ 152.356903] kasan_slab_alloc+0xf/0x20 [ 152.360830] kmem_cache_alloc_node+0x144/0x780 [ 152.365412] __alloc_skb+0x9c/0x500 [ 152.369029] sk_stream_alloc_skb+0xb3/0x780 [ 152.373334] tcp_sendmsg_locked+0xf61/0x3200 [ 152.377813] tcp_sendmsg+0x30/0x50 [ 152.381341] inet_sendmsg+0x122/0x500 [ 152.385213] sock_sendmsg+0xce/0x110 [ 152.388984] SYSC_sendto+0x206/0x310 [ 152.392682] SyS_sendto+0x40/0x50 [ 152.396138] do_syscall_64+0x1e8/0x640 [ 152.400024] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 152.405243] [ 152.406884] Freed by task 7159: [ 152.410149] save_stack_trace+0x16/0x20 [ 152.414106] save_stack+0x45/0xd0 [ 152.417539] kasan_slab_free+0x75/0xc0 [ 152.421406] kmem_cache_free+0x83/0x2b0 [ 152.425367] kfree_skbmem+0x8d/0x120 [ 152.429062] __kfree_skb+0x1e/0x30 [ 152.432583] tcp_remove_empty_skb.part.0+0x231/0x2e0 [ 152.437668] tcp_sendmsg_locked+0x1ced/0x3200 [ 152.442142] tcp_sendmsg+0x30/0x50 [ 152.445663] inet_sendmsg+0x122/0x500 [ 152.449473] sock_sendmsg+0xce/0x110 [ 152.453194] SYSC_sendto+0x206/0x310 [ 152.456892] SyS_sendto+0x40/0x50 [ 152.461022] do_syscall_64+0x1e8/0x640 [ 152.464899] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 152.470081] [ 152.471689] The buggy address belongs to the object at ffff888090a09580 [ 152.471689] which belongs to the cache skbuff_fclone_cache of size 472 [ 152.485019] The buggy address is located 44 bytes inside of [ 152.485019] 472-byte region [ffff888090a09580, ffff888090a09758) [ 152.496786] The buggy address belongs to the page: [ 152.501725] page:ffffea0002428240 count:1 mapcount:0 mapping:ffff888090a09080 index:0x0 [ 152.509868] flags: 0x1fffc0000000100(slab) [ 152.514096] raw: 01fffc0000000100 ffff888090a09080 0000000000000000 0000000100000006 [ 152.521961] raw: ffffea000257b120 ffffea000234de60 ffff8880a9e19a80 0000000000000000 [ 152.529848] page dumped because: kasan: bad access detected [ 152.535544] [ 152.537165] Memory state around the buggy address: [ 152.542086] ffff888090a09480: fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc [ 152.549437] ffff888090a09500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 152.556782] >ffff888090a09580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 152.564122] ^ [ 152.568769] ffff888090a09600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 152.576106] ffff888090a09680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 152.583441] ================================================================== [ 152.590791] Disabling lock debugging due to kernel taint [ 152.596290] Kernel panic - not syncing: panic_on_warn set ... [ 152.596290] [ 152.604783] CPU: 1 PID: 7154 Comm: syz-executor.4 Tainted: G B 4.14.143 #0 [ 152.612937] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 152.622285] Call Trace: [ 152.624849] [ 152.626983] dump_stack+0x138/0x197 [ 152.630704] ? tcp_ack+0x414f/0x4760 [ 152.634414] panic+0x1f2/0x426 [ 152.637597] ? add_taint.cold+0x16/0x16 [ 152.641623] kasan_end_report+0x47/0x4f [ 152.645676] kasan_report.cold+0x130/0x2af [ 152.649907] __asan_report_load4_noabort+0x14/0x20 [ 152.654855] tcp_ack+0x414f/0x4760 [ 152.658389] ? tcp_fastretrans_alert+0x2620/0x2620 [ 152.663334] ? save_trace+0x290/0x290 [ 152.667130] tcp_rcv_established+0x3e9/0x1650 [ 152.671611] ? rt6_check_expired+0xa5/0x160 [ 152.675920] ? tcp_data_queue+0x3730/0x3730 [ 152.680221] ? ip6_dst_check+0x16a/0x2c0 [ 152.684272] tcp_v6_do_rcv+0x417/0x1190 [ 152.688232] tcp_v6_rcv+0x2446/0x2ed0 [ 152.692024] ? save_trace+0x290/0x290 [ 152.695806] ip6_input_finish+0x300/0x15a0 [ 152.700052] ip6_input+0xd5/0x340 [ 152.703498] ? ip6_input_finish+0x15a0/0x15a0 [ 152.707999] ? ipv6_rcv+0x16aa/0x1d20 [ 152.711778] ? ip6_rcv_finish+0x7a0/0x7a0 [ 152.715973] ip6_rcv_finish+0x23f/0x7a0 [ 152.719991] ipv6_rcv+0xe4d/0x1d20 [ 152.723523] ? put_prev_task_stop+0x358/0x400 [ 152.728009] ? ip6_input+0x340/0x340 [ 152.731728] ? __lock_is_held+0xb6/0x140 [ 152.735777] ? check_preemption_disabled+0x3c/0x250 [ 152.740783] ? ip6_make_skb+0x410/0x410 [ 152.744746] ? rcu_lockdep_current_cpu_online+0xf2/0x140 [ 152.750178] ? ip6_input+0x340/0x340 [ 152.753889] __netif_receive_skb_core+0x1eae/0x2ca0 [ 152.758887] ? trace_hardirqs_on+0x10/0x10 [ 152.763120] ? enqueue_to_backlog+0xcc0/0xcc0 [ 152.767609] ? process_backlog+0x43e/0x730 [ 152.772091] ? lock_acquire+0x16f/0x430 [ 152.776057] __netif_receive_skb+0x2c/0x1b0 [ 152.780372] ? __netif_receive_skb+0x2c/0x1b0 [ 152.784850] process_backlog+0x21f/0x730 [ 152.789093] ? mark_held_locks+0xb1/0x100 [ 152.793578] net_rx_action+0x490/0xf80 [ 152.797456] ? napi_complete_done+0x4f0/0x4f0 [ 152.801942] ? rcu_lockdep_current_cpu_online+0xf2/0x140 [ 152.807387] __do_softirq+0x244/0x9a0 [ 152.811178] ? ip6_finish_output2+0x9c0/0x21b0 [ 152.815743] do_softirq_own_stack+0x2a/0x40 [ 152.820053] [ 152.822269] do_softirq.part.0+0x10e/0x160 [ 152.826518] __local_bh_enable_ip+0x154/0x1a0 [ 152.831005] ip6_finish_output2+0x9f3/0x21b0 [ 152.835400] ? ip6_forward_finish+0x480/0x480 [ 152.839904] ? __lock_is_held+0xb6/0x140 [ 152.843957] ? check_preemption_disabled+0x3c/0x250 [ 152.848962] ip6_finish_output+0x4f4/0xb50 [ 152.853182] ? ip6_finish_output+0x4f4/0xb50 [ 152.857571] ip6_output+0x20f/0x6d0 [ 152.861177] ? ip6_finish_output+0xb50/0xb50 [ 152.865565] ? __lock_is_held+0xb6/0x140 [ 152.869604] ? check_preemption_disabled+0x3c/0x250 [ 152.874600] ? ip6_fragment+0x32c0/0x32c0 [ 152.878727] ? rcu_lockdep_current_cpu_online+0xf2/0x140 [ 152.884169] ip6_xmit+0xd53/0x1eb0 [ 152.887704] ? ip6_finish_output2+0x21b0/0x21b0 [ 152.892352] ? ip6_dst_check+0x116/0x2c0 [ 152.896407] ? save_trace+0x290/0x290 [ 152.900187] ? ip6_append_data+0x2f0/0x2f0 [ 152.904406] ? __lock_is_held+0xb6/0x140 [ 152.908461] ? check_preemption_disabled+0x3c/0x250 [ 152.913468] inet6_csk_xmit+0x286/0x4d0 [ 152.917423] ? inet6_csk_update_pmtu+0x140/0x140 [ 152.922179] ? tcp_md5_do_lookup+0x1d3/0x530 [ 152.926573] __tcp_transmit_skb+0x172c/0x2fe0 [ 152.931060] ? __tcp_select_window+0x6e0/0x6e0 [ 152.935619] ? kvm_clock_read+0x23/0x40 [ 152.939620] ? sched_clock_cpu+0x1b/0x1c0 [ 152.943849] ? tcp_small_queue_check+0x184/0x1e0 [ 152.948593] tcp_write_xmit+0x523/0x4960 [ 152.952653] ? tcp_v6_md5_lookup+0x23/0x30 [ 152.956922] ? tcp_established_options+0x2c5/0x420 [ 152.961847] ? tcp_current_mss+0x1b1/0x2f0 [ 152.966066] __tcp_push_pending_frames+0xa6/0x260 [ 152.970918] tcp_send_fin+0x17e/0xc40 [ 152.974713] tcp_close+0xcc8/0xfb0 [ 152.978230] ? lock_acquire+0x16f/0x430 [ 152.982189] ? ip_mc_drop_socket+0x1d6/0x230 [ 152.986588] inet_release+0xec/0x1c0 [ 152.990280] inet6_release+0x53/0x80 [ 152.993969] __sock_release+0xce/0x2b0 [ 152.997852] ? __sock_release+0x2b0/0x2b0 [ 153.001975] sock_close+0x1b/0x30 [ 153.005414] __fput+0x275/0x7a0 [ 153.008678] ____fput+0x16/0x20 [ 153.011946] task_work_run+0x114/0x190 [ 153.015816] exit_to_usermode_loop+0x1da/0x220 [ 153.020382] do_syscall_64+0x4bc/0x640 [ 153.024273] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 153.029109] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 153.034280] RIP: 0033:0x4135d1 [ 153.037464] RSP: 002b:00007ffd51c591e0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 [ 153.045197] RAX: 0000000000000000 RBX: 0000000000000008 RCX: 00000000004135d1 [ 153.052486] RDX: 0000000000000000 RSI: 000000000000033f RDI: 0000000000000007 [ 153.059735] RBP: 0000000000000001 R08: 000000008beec33f R09: 000000008beec343 [ 153.067026] R10: 00007ffd51c592c0 R11: 0000000000000293 R12: 000000000075c9a0 [ 153.074294] R13: 000000000075c9a0 R14: 0000000000761580 R15: ffffffffffffffff [ 153.083068] Kernel Offset: disabled [ 153.086697] Rebooting in 86400 seconds..