[....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

syzkaller login: [   31.861189] random: sshd: uninitialized urandom read (32 bytes read)
[   32.093506] kauditd_printk_skb: 9 callbacks suppressed
[   32.093514] audit: type=1400 audit(1568674174.511:35): avc:  denied  { map } for  pid=6803 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1
[   32.139212] random: sshd: uninitialized urandom read (32 bytes read)
[   32.715672] random: sshd: uninitialized urandom read (32 bytes read)
Warning: Permanently added '10.128.0.137' (ECDSA) to the list of known hosts.
[   38.175455] random: sshd: uninitialized urandom read (32 bytes read)
2019/09/16 22:49:40 fuzzer started
[   38.364400] audit: type=1400 audit(1568674180.781:36): avc:  denied  { map } for  pid=6813 comm="syz-fuzzer" path="/root/syz-fuzzer" dev="sda1" ino=16480 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
[   38.869719] random: cc1: uninitialized urandom read (8 bytes read)
2019/09/16 22:49:42 dialing manager at 10.128.0.105:38157
2019/09/16 22:49:42 syscalls: 2466
2019/09/16 22:49:42 code coverage: enabled
2019/09/16 22:49:42 comparison tracing: ioctl(KCOV_TRACE_CMP) failed: invalid argument
2019/09/16 22:49:42 extra coverage: extra coverage is not supported by the kernel
2019/09/16 22:49:42 setuid sandbox: enabled
2019/09/16 22:49:42 namespace sandbox: enabled
2019/09/16 22:49:42 Android sandbox: /sys/fs/selinux/policy does not exist
2019/09/16 22:49:42 fault injection: enabled
2019/09/16 22:49:42 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled
2019/09/16 22:49:42 net packet injection: enabled
2019/09/16 22:49:42 net device setup: enabled
[   40.521006] random: crng init done
22:51:38 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
sendto$inet(r0, &(0x7f0000000000)='>', 0x1, 0x0, &(0x7f0000000080)={0x2, 0x9, @local}, 0x10)

22:51:38 executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000480)=0x100000001, 0x4)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
r1 = dup2(r0, r0)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x2000021c)
getsockopt$inet_mtu(r1, 0x0, 0xa, 0x0, &(0x7f0000000280))
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0)

22:51:38 executing program 3:
creat(&(0x7f0000000240)='./file0\x00', 0x0)
mkdir(&(0x7f00000002c0)='./file1\x00', 0x0)
link(&(0x7f0000000000)='./file0\x00', &(0x7f00000007c0)='./file1/file0\x00')
unlink(&(0x7f0000000040)='./file1/file0\x00')

22:51:38 executing program 1:
socket$inet_udplite(0x2, 0x2, 0x88)
syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x3, 0x4401)
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000140)={0x0, {}, {0x2, 0x0, @multicast2}, {0x2, 0x0, @broadcast}})
ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000140)={0x0, {0x2, 0x0, @local}, {0x2, 0xfffffffffffffffc, @loopback}, {0x2, 0x800000, @broadcast}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0xfffffffffffffffe})

22:51:38 executing program 2:
r0 = socket$packet(0x11, 0x3, 0x300)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000000)=[{0x24}, {0x80000006}]}, 0x10)
r1 = socket$inet(0x2, 0x4000000000000001, 0x0)
connect$inet(r1, &(0x7f0000000040), 0x10)

22:51:38 executing program 4:
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
ioctl(0xffffffffffffffff, 0x0, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
ioctl$FS_IOC_GETFSMAP(0xffffffffffffffff, 0xc0c0583b, 0x0)
ptrace$setopts(0xffffffffffffffff, 0x0, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0)
setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000ad7000)={0x1, &(0x7f0000acbff8)=[{0x6, 0x0, 0x0, 0x6}]}, 0x10)
bind$inet6(r1, &(0x7f0000000080)={0xa, 0x4e22}, 0x1c)
sendto$inet6(r1, 0x0, 0x0, 0x200408d4, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
syz_open_pts(0xffffffffffffffff, 0x0)
ioctl$TCSETA(0xffffffffffffffff, 0x5406, 0x0)
sendto$inet6(r1, &(0x7f0000000000)="80", 0x1, 0x44080, 0x0, 0x0)
setsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f0000000180)={0x1, 0x8}, 0x8)
close(r1)

[  155.820891] audit: type=1400 audit(1568674298.241:37): avc:  denied  { map } for  pid=6813 comm="syz-fuzzer" path="/root/syzkaller-shm738520098" dev="sda1" ino=2233 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:file_t:s0 tclass=file permissive=1
[  155.862796] audit: type=1400 audit(1568674298.261:38): avc:  denied  { map } for  pid=6831 comm="syz-executor.5" path="/sys/kernel/debug/kcov" dev="debugfs" ino=62 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1
[  156.220951] IPVS: ftp: loaded support on port[0] = 21
[  157.027506] chnl_net:caif_netlink_parms(): no params data found
[  157.035694] IPVS: ftp: loaded support on port[0] = 21
[  157.069071] bridge0: port 1(bridge_slave_0) entered blocking state
[  157.075922] bridge0: port 1(bridge_slave_0) entered disabled state
[  157.082956] device bridge_slave_0 entered promiscuous mode
[  157.089721] bridge0: port 2(bridge_slave_1) entered blocking state
[  157.096137] bridge0: port 2(bridge_slave_1) entered disabled state
[  157.102978] device bridge_slave_1 entered promiscuous mode
[  157.125570] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  157.137772] bond0: Enslaving bond_slave_1 as an active interface with an up link
[  157.158153] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[  157.165312] team0: Port device team_slave_0 added
[  157.170982] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[  157.178077] team0: Port device team_slave_1 added
[  157.185120] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[  157.194064] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[  157.211510] IPVS: ftp: loaded support on port[0] = 21
[  157.252222] device hsr_slave_0 entered promiscuous mode
[  157.310408] device hsr_slave_1 entered promiscuous mode
[  157.377285] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready
[  157.396464] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready
[  157.450376] bridge0: port 2(bridge_slave_1) entered blocking state
[  157.456795] bridge0: port 2(bridge_slave_1) entered forwarding state
[  157.463580] bridge0: port 1(bridge_slave_0) entered blocking state
[  157.469906] bridge0: port 1(bridge_slave_0) entered forwarding state
[  157.488032] chnl_net:caif_netlink_parms(): no params data found
[  157.495732] IPVS: ftp: loaded support on port[0] = 21
[  157.545497] chnl_net:caif_netlink_parms(): no params data found
[  157.588421] bridge0: port 1(bridge_slave_0) entered blocking state
[  157.594961] bridge0: port 1(bridge_slave_0) entered disabled state
[  157.602435] device bridge_slave_0 entered promiscuous mode
[  157.612831] bridge0: port 2(bridge_slave_1) entered blocking state
[  157.619164] bridge0: port 2(bridge_slave_1) entered disabled state
[  157.626119] device bridge_slave_1 entered promiscuous mode
[  157.668645] bridge0: port 1(bridge_slave_0) entered blocking state
[  157.675191] bridge0: port 1(bridge_slave_0) entered disabled state
[  157.682150] device bridge_slave_0 entered promiscuous mode
[  157.690622] bridge0: port 2(bridge_slave_1) entered blocking state
[  157.696964] bridge0: port 2(bridge_slave_1) entered disabled state
[  157.704425] device bridge_slave_1 entered promiscuous mode
[  157.704745] IPVS: ftp: loaded support on port[0] = 21
[  157.731912] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  157.753452] bond0: Enslaving bond_slave_1 as an active interface with an up link
[  157.764480] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  157.789926] bond0: Enslaving bond_slave_1 as an active interface with an up link
[  157.812461] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready
[  157.818540] 8021q: adding VLAN 0 to HW filter on device bond0
[  157.826305] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[  157.833376] team0: Port device team_slave_0 added
[  157.840936] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[  157.847933] team0: Port device team_slave_1 added
[  157.876240] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[  157.883608] team0: Port device team_slave_0 added
[  157.889385] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[  157.897581] team0: Port device team_slave_1 added
[  157.904904] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[  157.912159] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[  157.919284] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[  157.930488] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  157.938912] chnl_net:caif_netlink_parms(): no params data found
[  157.953610] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[  158.033260] device hsr_slave_0 entered promiscuous mode
[  158.080353] device hsr_slave_1 entered promiscuous mode
[  158.120667] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready
[  158.127591] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  158.135918] bridge0: port 1(bridge_slave_0) entered disabled state
[  158.153181] bridge0: port 2(bridge_slave_1) entered disabled state
[  158.160640] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
[  158.172343] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready
[  158.178407] 8021q: adding VLAN 0 to HW filter on device team0
[  158.191741] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  158.198971] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready
[  158.213971] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  158.222396] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  158.229897] bridge0: port 1(bridge_slave_0) entered blocking state
[  158.236270] bridge0: port 1(bridge_slave_0) entered forwarding state
[  158.283153] device hsr_slave_0 entered promiscuous mode
[  158.350461] device hsr_slave_1 entered promiscuous mode
[  158.420712] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready
[  158.427780] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready
[  158.445416] bridge0: port 1(bridge_slave_0) entered blocking state
[  158.452105] bridge0: port 1(bridge_slave_0) entered disabled state
[  158.458954] device bridge_slave_0 entered promiscuous mode
[  158.468417] bridge0: port 2(bridge_slave_1) entered blocking state
[  158.474846] bridge0: port 2(bridge_slave_1) entered disabled state
[  158.482000] device bridge_slave_1 entered promiscuous mode
[  158.499523] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  158.520824] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  158.528487] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  158.536111] bridge0: port 2(bridge_slave_1) entered blocking state
[  158.542454] bridge0: port 2(bridge_slave_1) entered forwarding state
[  158.550348] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  158.592117] IPVS: ftp: loaded support on port[0] = 21
[  158.605213] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[  158.615032] bond0: Enslaving bond_slave_1 as an active interface with an up link
[  158.624700] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  158.634459] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  158.642064] chnl_net:caif_netlink_parms(): no params data found
[  158.674859] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  158.683126] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  158.691982] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[  158.699250] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  158.734078] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  158.742041] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  158.749753] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  158.764458] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[  158.771621] team0: Port device team_slave_0 added
[  158.777961] bridge0: port 1(bridge_slave_0) entered blocking state
[  158.787024] bridge0: port 1(bridge_slave_0) entered disabled state
[  158.794074] device bridge_slave_0 entered promiscuous mode
[  158.807983] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  158.816269] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[  158.823592] team0: Port device team_slave_1 added
[  158.829691] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[  158.837158] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[  158.854064] bridge0: port 2(bridge_slave_1) entered blocking state
[  158.862798] bridge0: port 2(bridge_slave_1) entered disabled state
[  158.869710] device bridge_slave_1 entered promiscuous mode
[  158.877078] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  158.884832] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  158.894335] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready
[  158.953899] device hsr_slave_0 entered promiscuous mode
[  158.992230] device hsr_slave_1 entered promiscuous mode
[  159.038101] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready
[  159.045083] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  159.054515] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  159.072585] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready
[  159.088447] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready
[  159.099728] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  159.107352] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  159.119991] 8021q: adding VLAN 0 to HW filter on device bond0
[  159.127107] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  159.136352] bond0: Enslaving bond_slave_1 as an active interface with an up link
[  159.145205] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready
[  159.151304] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  159.162053] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[  159.208036] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready
[  159.242609] chnl_net:caif_netlink_parms(): no params data found
[  159.256076] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  159.262960] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[  159.269961] team0: Port device team_slave_0 added
[  159.291847] 8021q: adding VLAN 0 to HW filter on device bond0
[  159.301359] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[  159.310855] team0: Port device team_slave_1 added
[  159.316524] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  159.325014] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready
[  159.331781] 8021q: adding VLAN 0 to HW filter on device team0
[  159.340517] 8021q: adding VLAN 0 to HW filter on device batadv0
[  159.347003] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[  159.358423] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  159.365926] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  159.375532] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  159.396252] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  159.403843] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[  159.413898] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  159.435288] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  159.443232] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  159.451056] bridge0: port 1(bridge_slave_0) entered blocking state
[  159.457377] bridge0: port 1(bridge_slave_0) entered forwarding state
[  159.464273] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  159.471161] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  159.478202] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  159.497259] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready
[  159.503449] 8021q: adding VLAN 0 to HW filter on device team0
[  159.509515] bridge0: port 1(bridge_slave_0) entered blocking state
[  159.517486] bridge0: port 1(bridge_slave_0) entered disabled state
[  159.524501] device bridge_slave_0 entered promiscuous mode
[  159.531252] bridge0: port 2(bridge_slave_1) entered blocking state
[  159.537583] bridge0: port 2(bridge_slave_1) entered disabled state
[  159.544842] device bridge_slave_1 entered promiscuous mode
[  159.561170] 8021q: adding VLAN 0 to HW filter on device bond0
[  159.570995] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  159.585695] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  159.593845] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  159.601685] bridge0: port 2(bridge_slave_1) entered blocking state
[  159.608044] bridge0: port 2(bridge_slave_1) entered forwarding state
[  159.616149] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  159.675718] device hsr_slave_0 entered promiscuous mode
[  159.730398] device hsr_slave_1 entered promiscuous mode
22:51:42 executing program 0:

22:51:42 executing program 0:
r0 = creat(&(0x7f0000000000)='./file0\x00', 0x0)
write$cgroup_type(r0, &(0x7f00000009c0)='threaded\x00', 0xf0d741)
r1 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0)
lseek(r1, 0xfffffffffffffffc, 0x4)
creat(&(0x7f0000000080)='./file0\x00', 0x0)

[  159.777260] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready
[  159.794730] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  159.804128] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  159.814973] bridge0: port 1(bridge_slave_0) entered blocking state
[  159.821361] bridge0: port 1(bridge_slave_0) entered forwarding state
[  159.823955] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  159.845426] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready
[  159.863185] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  159.872127] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  159.882829] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  159.891085] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  159.911888] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  159.919709] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  159.932296] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  159.939963] bridge0: port 2(bridge_slave_1) entered blocking state
[  159.946365] bridge0: port 2(bridge_slave_1) entered forwarding state
[  159.961666] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  159.977517] bond0: Enslaving bond_slave_1 as an active interface with an up link
[  159.987494] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  160.000849] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  160.009131] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  160.022265] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  160.030426] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  160.051158] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[  160.058249] team0: Port device team_slave_0 added
[  160.064565] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  160.073089] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  160.080793] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  160.087982] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  160.097374] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  160.106512] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready
[  160.113760] 8021q: adding VLAN 0 to HW filter on device team0
[  160.120388] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[  160.127284] audit: type=1804 audit(1568674302.541:39): pid=6875 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="invalid_pcr" cause="open_writers" comm="syz-executor.0" name="/root/syzkaller-testdir067481253/syzkaller.yhfAr0/2/file0" dev="sda1" ino=16519 res=1
[  160.158327] audit: type=1804 audit(1568674302.571:40): pid=6876 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="invalid_pcr" cause="ToMToU" comm="syz-executor.0" name="/root/syzkaller-testdir067481253/syzkaller.yhfAr0/2/file0" dev="sda1" ino=16519 res=1
[  160.171035] team0: Port device team_slave_1 added
[  160.190620] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[  160.197081] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[  160.205524] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  160.213197] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  160.220807] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  160.228463] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  160.236213] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  160.248481] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready
[  160.258697] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[  160.273866] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  160.281274] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  160.288784] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  160.294817] audit: type=1804 audit(1568674302.701:41): pid=6875 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="invalid_pcr" cause="open_writers" comm="syz-executor.0" name="/root/syzkaller-testdir067481253/syzkaller.yhfAr0/2/file0" dev="sda1" ino=16519 res=1
[  160.296350] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
22:51:42 executing program 0:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x0, 0x0)
ioctl$RTC_PIE_ON(r0, 0x7005)
socket$inet(0x2, 0x0, 0x0)
preadv(r0, &(0x7f0000000040)=[{&(0x7f00000000c0)=""/4, 0x4}], 0x1, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='status\x00B#g9\xc1m\x17\xf9\r\xc2#\"\xc9O\x135 x^\x91\xea\x85\xae\x10|\xc3\x81\x98\x19\xc2cT\v\x1d\xe1\xba \x1em\xe4\xb7ZP\x11P\x91\xee\xd50\xaaH.6YF\x01\xce\xb5\xd1i\xc5\xba\xf4\x1b5\xd8\xa5\xa0\x9a\x82If\x13\xd8`#\x86[W\xef&\x9f\x90\xd3\x04\x96\x9fh}\xf5;a\x1b@\xa4B\x91\xb5\xa8\x82 \x8f\xbb\x83^T\xa4\x13\x10\xa3\xb4\x81\xd5\xbd\xbb\t\x81t)\t\xa6;|\xd1\xa1\x8d@^[\x01\x1b\xfb\xe5\xa4\xd5\xbf)\x94G\xe4\xc0\xddKc\xa3g!\x1c\x00x#\x8bP\x9daA\x00\xd3KU\x84\xaa;<\xb9\xb9\x9en_\x84q\x92\x94\xd4\x1b\'\x11|G\xfbO++\xe4u\xeb%\xd5\x01\x00\x00\x00\xcf\x84\"\xca\xdeW\f\b{\x03\xf6\xb1\x81\x8b\xc9pw\xdb#,I\xee\x06\xd1\xad\xd2_\xa7\xf7U\xe1\x00O\xbc\x01\x93K\xc7\x99[\xf2\x87\x97\x86;\xbb\xca\xc0\x1c\xe05\xf6n\xc3\xa9\x83{xe\xdd\xc1\xe3!\xccS^\x9b\xc5\xe7\b\xad\xce')

[  160.325212] audit: type=1804 audit(1568674302.741:42): pid=6876 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="invalid_pcr" cause="ToMToU" comm="syz-executor.0" name="/root/syzkaller-testdir067481253/syzkaller.yhfAr0/2/file0" dev="sda1" ino=16519 res=1
[  160.362564] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  160.376800] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
22:51:42 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_GET_VCPU_EVENTS(r2, 0x4400ae8f, 0x0)

[  160.401369] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
22:51:42 executing program 0:
r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0)
write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000000c0)={0x3, 0x40, 0xfa00, {{0x3, 0x0, 0x0, @rand_addr="ffd722dce20f92597102784bad12b4ec"}, {0x2, 0x0, 0x0, @initdev={0xfe, 0x88, [], 0x0, 0x0}}}}, 0xfffffe11)

[  160.454537] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details.
[  160.481449] device hsr_slave_0 entered promiscuous mode
22:51:42 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000140)="11dca50d5e0bcfe47bf070")
mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mprotect(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x3)

[  160.515471] device hsr_slave_1 entered promiscuous mode
[  160.572319] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  160.579523] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready
[  160.586816] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  160.594616] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  160.602643] bridge0: port 1(bridge_slave_0) entered blocking state
[  160.608983] bridge0: port 1(bridge_slave_0) entered forwarding state
[  160.616062] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  160.623895] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  160.631506] bridge0: port 2(bridge_slave_1) entered blocking state
[  160.637849] bridge0: port 2(bridge_slave_1) entered forwarding state
[  160.644711] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  160.656526] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready
[  160.664923] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready
[  160.672422] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  160.687990] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  160.696538] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  160.709062] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  160.718453] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  160.726281] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  160.734596] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  160.745146] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready
[  160.751396] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  160.760774] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready
[  160.768200] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  160.778372] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  160.786127] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  160.793924] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  160.805604] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready
[  160.817474] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  160.824498] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  160.832481] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  160.839917] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  160.847964] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  160.855864] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  160.864653] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready
[  160.870894] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  160.882712] 8021q: adding VLAN 0 to HW filter on device bond0
[  160.892859] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[  160.905140] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready
[  160.913099] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  160.919600] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready
[  160.932329] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  160.943561] 8021q: adding VLAN 0 to HW filter on device batadv0
[  160.949955] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  160.961048] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  160.971228] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  160.984989] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready
[  160.991169] 8021q: adding VLAN 0 to HW filter on device team0
[  160.999690] 8021q: adding VLAN 0 to HW filter on device batadv0
[  161.007952] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready
[  161.018763] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  161.026179] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  161.036037] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  161.043822] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  161.063213] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  161.072724] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready
[  161.085099] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  161.097184] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  161.107671] bridge0: port 1(bridge_slave_0) entered blocking state
[  161.114028] bridge0: port 1(bridge_slave_0) entered forwarding state
[  161.121047] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  161.128442] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  161.136434] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  161.145382] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  161.158531] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready
[  161.164962] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  161.172198] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  161.182176] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  161.189670] bridge0: port 2(bridge_slave_1) entered blocking state
[  161.196039] bridge0: port 2(bridge_slave_1) entered forwarding state
[  161.207406] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  161.217946] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  161.228442] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready
[  161.236863] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  161.247006] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  161.255285] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  161.263726] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  161.271803] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  161.281734] 8021q: adding VLAN 0 to HW filter on device bond0
[  161.290871] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  161.299145] 8021q: adding VLAN 0 to HW filter on device batadv0
[  161.309047] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  161.317855] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  161.325876] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  161.335579] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready
[  161.345473] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  161.353380] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  161.361076] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  161.371062] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready
[  161.379084] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[  161.406447] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready
22:51:43 executing program 5:
r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/netfilter\x00')
getdents(r0, &(0x7f00000000c0)=""/31, 0x10000067f)

22:51:43 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/netfilter\x00')
execveat(r0, &(0x7f0000000300)='./file0\x00', 0x0, 0x0, 0x0)

22:51:43 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x0, 0x0)
ioctl$RTC_PIE_ON(r0, 0x7005)
preadv(0xffffffffffffffff, 0x0, 0x0, 0x0)
open(0x0, 0x101101, 0x0)
syz_open_procfs(0xffffffffffffffff, 0x0)
pread64(0xffffffffffffffff, 0x0, 0x0, 0x0)
ioctl$SNDRV_TIMER_IOCTL_GPARAMS(0xffffffffffffffff, 0x40485404, 0x0)
pread64(r0, &(0x7f0000000100)=""/155, 0x9b, 0x0)

[  161.425162] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  161.439974] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  161.450371] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  161.458418] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  161.486084] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  161.501129] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  161.519791] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready
[  161.537216] 8021q: adding VLAN 0 to HW filter on device team0
[  161.576197] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  161.595784] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  161.606705] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  161.614931] bridge0: port 1(bridge_slave_0) entered blocking state
[  161.614956] bridge0: port 1(bridge_slave_0) entered forwarding state
[  161.615410] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  161.617833] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready
[  161.622883] 8021q: adding VLAN 0 to HW filter on device batadv0
[  161.659320] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  161.672382] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  161.679265] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  161.688251] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
22:51:44 executing program 1:
mkdir(&(0x7f0000000500)='./file0\x00', 0x0)
r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0)
mkdir(&(0x7f0000000100)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0)
r1 = open(&(0x7f0000000180)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0, 0x0)
mkdirat(r1, &(0x7f0000000080)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0)
renameat2(r1, &(0x7f00000002c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', r0, &(0x7f0000000000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0)

[  161.696072] bridge0: port 2(bridge_slave_1) entered blocking state
[  161.702449] bridge0: port 2(bridge_slave_1) entered forwarding state
[  161.709286] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  161.742139] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  161.749184] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  161.762143] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  161.772029] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  161.779695] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  161.788548] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  161.798680] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready
[  161.808716] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  161.816115] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  161.824351] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  161.832354] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  161.839850] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  161.849402] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready
[  161.859040] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  161.866626] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  161.875076] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready
[  161.881353] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  161.902920] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready
[  161.919032] 8021q: adding VLAN 0 to HW filter on device batadv0
22:51:45 executing program 2:
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
fstat(r0, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r1=>0x0})
setfsgid(r1)

22:51:45 executing program 3:
r0 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c)
recvmmsg(r0, &(0x7f0000007fc0)=[{{&(0x7f0000002ac0)=@nfc_llcp, 0x80, 0x0}}], 0x1, 0x0, 0x0)
connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4e24}, 0x1c)
sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0)

22:51:45 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/netfilter\x00')
execveat(r0, &(0x7f0000000300)='./file0\x00', 0x0, 0x0, 0x0)

22:51:45 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
wait4(0x0, 0x0, 0x80000000, 0x0)
r0 = getpid()
tkill(r0, 0x9)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0)
getegid()
r1 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00')
getdents(r1, &(0x7f00000000c0)=""/31, 0x10000067f)

22:51:45 executing program 1:
prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000540)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x50000}]})
r0 = openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$sock_inet_SIOCGIFADDR(r0, 0x8915, 0x0)

22:51:45 executing program 4:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000015000/0x18000)=nil, &(0x7f0000000180)=[@text16={0x10, &(0x7f0000000040)="baa000ec3e3e3e0f2b75ee65f30f008f6300a6aff4660f3a62227d0f20e06635000040000f22e0260f0350000f01cf", 0x2f}], 0x1, 0x0, 0x0, 0x238)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_genetlink_get_family_id$nbd(&(0x7f0000000080)='nbd\x00')
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0)
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000001c0)={[0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x4cb]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_IRQ_LINE_STATUS(r1, 0xc008ae67, &(0x7f0000000280)={0xc, 0xba8e})
ioctl$KVM_RUN(r2, 0xae80, 0x0)

22:51:45 executing program 2:
pipe(&(0x7f0000000540)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4)
setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000000)='vcan0\x00', 0x10)
connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10)
setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf3, 0x21fc}, 0x14)
setsockopt$inet_mtu(r2, 0x0, 0xa, &(0x7f0000000140)=0x3, 0x4)
write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfffffd83)
splice(r0, 0x0, r2, 0x0, 0x4b40, 0x0)

[  162.971817] audit: type=1400 audit(1568674305.391:43): avc:  denied  { create } for  pid=6972 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
22:51:45 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/netfilter\x00')
execveat(r0, &(0x7f0000000300)='./file0\x00', 0x0, 0x0, 0x0)

[  163.049677] audit: type=1400 audit(1568674305.391:44): avc:  denied  { write } for  pid=6972 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
22:51:45 executing program 5:
r0 = socket(0x2, 0x1, 0x0)
r1 = open(&(0x7f0000000040)='./file0\x00', 0x60e, 0x0)
close(r0)
pwritev(r1, &(0x7f0000000400)=[{&(0x7f0000000180)="6406b7", 0x3}], 0x1, 0x0)
pwritev(r1, &(0x7f0000000140)=[{&(0x7f00000000c0)="4402", 0x2}], 0x1, 0x0)
socket(0x2, 0x2, 0x0)
mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x5, 0x10, r1, 0x0)
connect(r0, &(0x7f0000000000)=@un=@file={0x0, './file0/file0\x00'}, 0x10)

[  163.078852] audit: type=1400 audit(1568674305.391:45): avc:  denied  { read } for  pid=6972 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
[  163.110033] hrtimer: interrupt took 29124 ns
22:51:45 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/netfilter\x00')
execveat(r0, &(0x7f0000000300)='./file0\x00', 0x0, 0x0, 0x0)

22:51:45 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
getpid()
openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0)
connect$inet(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00')
getdents(r0, &(0x7f00000000c0)=""/31, 0x10000067f)

22:51:45 executing program 4:
r0 = creat(&(0x7f00000001c0)='./file0\x00', 0x0)
write$P9_RREMOVE(r0, &(0x7f0000000280)={0xfffffffffffffcd2}, 0xff7f)
r1 = creat(&(0x7f0000000700)='./bus\x00', 0x0)
r2 = creat(&(0x7f00000002c0)='./bus\x00', 0x0)
ftruncate(r2, 0x2081fc)
r3 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0)
mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r3, 0x0)
open(0x0, 0x0, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0)
write$FUSE_WRITE(0xffffffffffffffff, 0x0, 0x0)
fcntl$setstatus(r1, 0x4, 0x6100)
fdatasync(r0)
write$cgroup_type(r1, &(0x7f0000000200)='threaded\x00', 0xf642e7e)
r4 = syz_open_procfs(0x0, &(0x7f0000000180)='sched\x00')
preadv(r4, &(0x7f00000017c0), 0x333, 0x0)
ioctl$EXT4_IOC_MOVE_EXT(r3, 0xc028660f, &(0x7f0000000200)={0x0, r0})

22:51:45 executing program 5:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@updpolicy={0xb8, 0x19, 0x77d651799ded31b9, 0x0, 0x0, {{@in=@local, @in6=@rand_addr="b814d8a82918eeef50bc8e8e5c4e3ea7"}, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}}, 0xb8}}, 0x0)

22:51:45 executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0)
ioctl$DRM_IOCTL_ADD_MAP(0xffffffffffffffff, 0xc0286415, &(0x7f0000000000)={&(0x7f0000ffd000/0x3000)=nil, 0x0, 0x0, 0x0, &(0x7f0000ffe000/0x1000)=nil})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0x801c581f, 0x0)

22:51:45 executing program 0:
execveat(0xffffffffffffffff, &(0x7f0000000300)='./file0\x00', 0x0, 0x0, 0x0)

22:51:45 executing program 5:
io_setup(0x1, &(0x7f00000001c0)=<r0=>0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x101006, 0x0)
ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="11dca5")
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000004c0)={'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\r', 0x20000005002})
io_submit(0x0, 0x1, &(0x7f00000002c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000)="fa5baf44134a57ee6ab4372aa2191e76413d411574c1d666ca8f92012ff6fa8116ddd63fe6871b30eed3e665a90ef517246b1bb39f962305f98333dec4a8632d7f84", 0x42}])
io_submit(r0, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000040), 0xff66}])

22:51:45 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
getpid()
openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0)
connect$inet(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00')
getdents(r0, &(0x7f00000000c0)=""/31, 0x10000067f)

22:51:45 executing program 0:
execveat(0xffffffffffffffff, &(0x7f0000000300)='./file0\x00', 0x0, 0x0, 0x0)

22:51:46 executing program 2:
r0 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0)
symlinkat(&(0x7f0000000040)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', r0, &(0x7f00000000c0)='./file0\x00')
mkdirat(r0, &(0x7f0000000280)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0)
renameat2(r0, &(0x7f0000000140)='./file0/file0\x00', r0, &(0x7f0000000000)='./file0\x00', 0x0)

22:51:46 executing program 0:
execveat(0xffffffffffffffff, &(0x7f0000000300)='./file0\x00', 0x0, 0x0, 0x0)

22:51:46 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
getpid()
openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0)
connect$inet(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00')
getdents(r0, &(0x7f00000000c0)=""/31, 0x10000067f)

22:51:46 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x151)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
r1 = dup2(r0, r0)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x131f64)
setsockopt$inet_tcp_TLS_TX(r1, 0x6, 0x1, &(0x7f0000000040)=@ccm_128={{}, "25f89cd7daffe772", "a71e6e5353270f0c52eda25373fbbb2e", '\rjhm', "3b4d6afd7f011a43"}, 0x28)

22:51:46 executing program 3:
pipe(&(0x7f0000000340)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
r3 = socket(0x11, 0x800000003, 0x0)
bind(r3, &(0x7f0000000280)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfffffe14)
splice(r0, 0x0, r2, 0x0, 0x10005, 0x0)

22:51:46 executing program 5:
pipe2(&(0x7f0000000700)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x4000)
getsockopt$inet_mreqsrc(r1, 0x0, 0x2d, &(0x7f0000000040)={@initdev, @remote, @loopback}, &(0x7f0000000780)=0xfffffffffffffe3c)
sendmsg$IPVS_CMD_DEL_SERVICE(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x0)
mkdir(&(0x7f0000000000)='./file0\x00', 0x0)
mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001011, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$full(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/full\x00', 0x10000, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000d40)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x4004}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0)
ioctl$sock_inet_SIOCGIFBRDADDR(r4, 0x8919, &(0x7f0000000580)={'netdevsim0\x00', {0x2, 0x4e21, @multicast2}})
pivot_root(&(0x7f0000000740)='./file0\x00', &(0x7f0000000100)='./file0\x00')
perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bind$netlink(r0, &(0x7f00000003c0)={0x10, 0x0, 0x25dfdbfc, 0xcc002}, 0xc)
chroot(&(0x7f0000000080)='./file0\x00')
ioctl$sock_inet_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f00000001c0)={'dummy0\x00', {0x2, 0x4e20, @empty}})
ioctl$VT_GETMODE(r0, 0x5601, &(0x7f00000008c0))
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x9, 0x6d, 0x20000000000001, 0x0, 0x0}, 0x10)
ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000540)={'veth0\x00', 0x2000})
personality(0xffffffffffffffff)
openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mkdirat(r1, &(0x7f0000000840)='./file0\x00', 0x4)
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r2, &(0x7f0000000180)={0x20000000})
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f00000004c0)={0x0, <r5=>0x0}, &(0x7f0000000500)=0xc)
quotactl(0xd7, &(0x7f0000000480)='./file0\x00', r5, 0x0)
accept$inet6(r2, 0x0, &(0x7f0000000380))
ioctl$sock_inet_SIOCGIFNETMASK(r2, 0x891b, &(0x7f0000000140)={'veth1_to_bridge\x00', {0x2, 0x4e22, @local}})

22:51:46 executing program 0:
r0 = syz_open_procfs(0x0, 0x0)
execveat(r0, &(0x7f0000000300)='./file0\x00', 0x0, 0x0, 0x0)

22:51:46 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
connect(r0, &(0x7f0000000280)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @dev}}}, 0x80)

22:51:46 executing program 1:
r0 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/load\x00', 0x2, 0x0)
write$selinux_load(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="8cff7cf90800ff01"], 0x8)

22:51:46 executing program 5:
pipe2(&(0x7f0000000700)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x4000)
getsockopt$inet_mreqsrc(r1, 0x0, 0x2d, &(0x7f0000000040)={@initdev, @remote, @loopback}, &(0x7f0000000780)=0xfffffffffffffe3c)
sendmsg$IPVS_CMD_DEL_SERVICE(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x0)
mkdir(&(0x7f0000000000)='./file0\x00', 0x0)
mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001011, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$full(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/full\x00', 0x10000, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000d40)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x4004}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0)
ioctl$sock_inet_SIOCGIFBRDADDR(r4, 0x8919, &(0x7f0000000580)={'netdevsim0\x00', {0x2, 0x4e21, @multicast2}})
pivot_root(&(0x7f0000000740)='./file0\x00', &(0x7f0000000100)='./file0\x00')
perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bind$netlink(r0, &(0x7f00000003c0)={0x10, 0x0, 0x25dfdbfc, 0xcc002}, 0xc)
chroot(&(0x7f0000000080)='./file0\x00')
ioctl$sock_inet_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f00000001c0)={'dummy0\x00', {0x2, 0x4e20, @empty}})
ioctl$VT_GETMODE(r0, 0x5601, &(0x7f00000008c0))
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x9, 0x6d, 0x20000000000001, 0x0, 0x0}, 0x10)
ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000540)={'veth0\x00', 0x2000})
personality(0xffffffffffffffff)
openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mkdirat(r1, &(0x7f0000000840)='./file0\x00', 0x4)
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r2, &(0x7f0000000180)={0x20000000})
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f00000004c0)={0x0, <r5=>0x0}, &(0x7f0000000500)=0xc)
quotactl(0xd7, &(0x7f0000000480)='./file0\x00', r5, 0x0)
accept$inet6(r2, 0x0, &(0x7f0000000380))
ioctl$sock_inet_SIOCGIFNETMASK(r2, 0x891b, &(0x7f0000000140)={'veth1_to_bridge\x00', {0x2, 0x4e22, @local}})

22:51:46 executing program 0:
r0 = syz_open_procfs(0x0, 0x0)
execveat(r0, &(0x7f0000000300)='./file0\x00', 0x0, 0x0, 0x0)

22:51:46 executing program 2:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
close(r0)
r1 = socket$inet(0x2, 0x3, 0x21)
bind$inet(r0, &(0x7f0000000040)={0x2, 0x0, @local}, 0x10)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10)
r2 = dup2(r0, r1)
write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f0000000080)={0xc}, 0x30)

22:51:46 executing program 0:
r0 = syz_open_procfs(0x0, 0x0)
execveat(r0, &(0x7f0000000300)='./file0\x00', 0x0, 0x0, 0x0)

[  164.080648] SELinux:  policydb string length 33488904 does not match expected length 8
[  164.100653] SELinux: failed to load policy
22:51:46 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup2(r1, r0)
sendmsg$TIPC_CMD_GET_MAX_PORTS(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0}}, 0x4000)

22:51:46 executing program 0:
syz_open_procfs(0x0, &(0x7f00000002c0)='net/netfilter\x00')
execveat(0xffffffffffffffff, &(0x7f0000000300)='./file0\x00', 0x0, 0x0, 0x0)

22:51:46 executing program 4:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
syz_emit_ethernet(0x300502, &(0x7f00000000c0)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000000000086dd60b4090000022b0000008000000000000000ffffe06f0002ff020000000000000000000000000001880090780009040060b680fa123803e6fc3e1031000000000000ffffffffffff00000000000000000000ffffac14ffbb96654a3b4b007f11325a53685644d78967aceae62fd8"], 0x0)

[  164.398860] audit: type=1400 audit(1568674306.811:46): avc:  denied  { map } for  pid=7086 comm="syz-executor.4" path="/dev/nullb0" dev="devtmpfs" ino=14462 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=blk_file permissive=1
22:51:47 executing program 3:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0)
r1 = epoll_create1(0x0)
r2 = epoll_create1(0x0)
epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000140))
epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000000))
close(r1)

22:51:47 executing program 2:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0)
setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYBLOB="6d047c005d52994c0afc21be2900000047e2252cb7882b9abb2a2f9fb9399e0400c33f00102b0200000089da006a001499b2d1b3a4952f36def66e54e4c909c01e8c4e61f8a0e814f7e2acdd0063c7caa49d5c0600000000000000dc10000000009796b966422ac67e307a1c75f954035ac283ff9d10305309658b8e060038e8941f9e1653e46a428657a686295981d565ed8b40b8382c58a17e2ee72ddd8e12402a08de7a022be9d4c732feee4ed546ef9724dfe2d43af9fe5bcd59bf9117673acfa22a2230ad43936500de7c065b8cc0b53b7f78e7505d8e2b53d167eeff070000000000000000ff01e55f"], 0x2)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
tkill(r1, 0x5)
wait4(0x0, 0x0, 0x0, 0x0)

22:51:47 executing program 1:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/ip6_mr_vif\x00')
readv(0xffffffffffffffff, &(0x7f0000002340)=[{&(0x7f0000002380)=""/4096, 0x1000}], 0x1)
readv(r0, &(0x7f0000000580), 0x3c1)

22:51:47 executing program 5:
perf_event_open(&(0x7f0000000440)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0xd, 0x0)
preadv(r0, &(0x7f0000000080)=[{&(0x7f0000000040)=""/19, 0x13}], 0x1, 0x0)
open(0x0, 0x0, 0x0)

22:51:47 executing program 0:
syz_open_procfs(0x0, &(0x7f00000002c0)='net/netfilter\x00')
execveat(0xffffffffffffffff, &(0x7f0000000300)='./file0\x00', 0x0, 0x0, 0x0)

22:51:47 executing program 4:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000280)='/dev/ptmx\x00', 0x0, 0x0)
r1 = fcntl$dupfd(r0, 0x0, r0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000480)=0x100000001, 0x4)
connect$inet6(r2, &(0x7f0000000080), 0x1c)
r3 = dup2(r2, r1)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000440), 0x2000021c)
setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000040), 0x14)

[  164.823144] ptrace attach of "/root/syz-executor.2"[7100] was attempted by "/root/syz-executor.2"[7102]
22:51:47 executing program 3:
creat(0x0, 0x0)
setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0)
socket(0x0, 0x0, 0x0)
ioprio_set$uid(0x3, 0x0, 0x0)

22:51:47 executing program 0:
syz_open_procfs(0x0, &(0x7f00000002c0)='net/netfilter\x00')
execveat(0xffffffffffffffff, &(0x7f0000000300)='./file0\x00', 0x0, 0x0, 0x0)

22:51:47 executing program 1:
syz_emit_ethernet(0x2a, &(0x7f0000000000)=ANY=[@ANYBLOB="0180c2000000ffffffffffff08060006080006040001aaaaaaaaaa00ac14e98deb5de09d9520ac141406"], 0x0)

[  164.926426] ptrace attach of ""[7108] was attempted by ""[7102]
22:51:47 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/netfilter\x00')
execveat(r0, 0x0, 0x0, 0x0, 0x0)

22:51:47 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f00004f9fe4)={0x11, 0x4, 0x4, 0x10000, 0x0, 0xffffffffffffffff, 0x0, [0xe]}, 0x3c)

22:51:47 executing program 1:
r0 = openat$selinux_validatetrans(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/validatetrans\x00', 0x1, 0x0)
writev(r0, &(0x7f0000001500)=[{&(0x7f0000000040)='r', 0x20000041}], 0x1)

22:51:47 executing program 3:
socket$caif_stream(0x25, 0x1, 0x4000000fffffffd)

22:51:47 executing program 3:
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'eql\x00\x00\x04\x00\x00\x00\x03\x00\x00\x00\xf2\a\x00', 0x2ee6bc40dbce6995})
ioctl$sock_ifreq(r0, 0x8914, &(0x7f0000000200)={'eql\x00`\x00\xa9[,\x00\x14\x01\x03\x03\xf0\x00', @ifru_mtu=0x1})

[  165.072275] device bridge_slave_1 left promiscuous mode
[  165.078181] bridge0: port 2(bridge_slave_1) entered disabled state
22:51:47 executing program 1:
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000002}}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x3cc}, 0x48)

[  165.108064] audit: type=1400 audit(1568674307.521:47): avc:  denied  { validate_trans } for  pid=7127 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:security_t:s0 tclass=security permissive=1
[  165.204608] device bridge_slave_0 left promiscuous mode
[  165.224588] bridge0: port 1(bridge_slave_0) entered disabled state
[  165.373528] device hsr_slave_1 left promiscuous mode
[  165.413840] device hsr_slave_0 left promiscuous mode
[  165.454691] team0 (unregistering): Port device team_slave_1 removed
[  165.491427] team0 (unregistering): Port device team_slave_0 removed
[  165.524080] bond0 (unregistering): Releasing backup interface bond_slave_1
[  165.574388] bond0 (unregistering): Releasing backup interface bond_slave_0
[  165.717613] bond0 (unregistering): Released all slaves
[  168.250917] IPVS: ftp: loaded support on port[0] = 21
[  169.227680] chnl_net:caif_netlink_parms(): no params data found
[  169.260008] bridge0: port 1(bridge_slave_0) entered blocking state
[  169.266513] bridge0: port 1(bridge_slave_0) entered disabled state
[  169.273562] device bridge_slave_0 entered promiscuous mode
[  169.280545] bridge0: port 2(bridge_slave_1) entered blocking state
[  169.286934] bridge0: port 2(bridge_slave_1) entered disabled state
[  169.293924] device bridge_slave_1 entered promiscuous mode
[  169.310906] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  169.319618] bond0: Enslaving bond_slave_1 as an active interface with an up link
[  169.337444] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[  169.344695] team0: Port device team_slave_0 added
[  169.350110] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[  169.357143] team0: Port device team_slave_1 added
[  169.362417] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[  169.369551] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[  169.423523] device hsr_slave_0 entered promiscuous mode
[  169.460424] device hsr_slave_1 entered promiscuous mode
[  169.500671] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready
[  169.507557] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready
[  169.519780] bridge0: port 2(bridge_slave_1) entered blocking state
[  169.526276] bridge0: port 2(bridge_slave_1) entered forwarding state
[  169.532862] bridge0: port 1(bridge_slave_0) entered blocking state
[  169.539235] bridge0: port 1(bridge_slave_0) entered forwarding state
[  169.565684] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready
[  169.572149] 8021q: adding VLAN 0 to HW filter on device bond0
[  169.579737] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  169.587891] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  169.595546] bridge0: port 1(bridge_slave_0) entered disabled state
[  169.602340] bridge0: port 2(bridge_slave_1) entered disabled state
[  169.613409] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready
[  169.619474] 8021q: adding VLAN 0 to HW filter on device team0
[  169.627549] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  169.635105] bridge0: port 1(bridge_slave_0) entered blocking state
[  169.641461] bridge0: port 1(bridge_slave_0) entered forwarding state
[  169.650647] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  169.658150] bridge0: port 2(bridge_slave_1) entered blocking state
[  169.664516] bridge0: port 2(bridge_slave_1) entered forwarding state
[  169.677159] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  169.685638] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  169.694480] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  169.705568] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  169.714998] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  169.724676] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready
[  169.730911] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  169.743375] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready
[  169.753246] 8021q: adding VLAN 0 to HW filter on device batadv0
[  170.220912] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
22:51:53 executing program 5:
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
setsockopt$inet6_group_source_req(r1, 0x29, 0x2e, &(0x7f0000000400)={0x1, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108)
r2 = syz_open_procfs(0x0, &(0x7f000012bff2)='net/mcfilter6\x00')
read$eventfd(r2, &(0x7f00000000c0), 0x2c3)
readv(r2, &(0x7f0000000000)=[{&(0x7f0000000200)=""/181, 0xb5}], 0x1)

22:51:53 executing program 2:
r0 = creat(&(0x7f0000000000)='./file0\x00', 0x0)
write$cgroup_type(r0, &(0x7f00000009c0)='threaded\x00', 0xf0d741)
r1 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0)
lseek(r1, 0x0, 0x4)
creat(&(0x7f0000000080)='./file0\x00', 0x0)

22:51:53 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/netfilter\x00')
execveat(r0, 0x0, 0x0, 0x0, 0x0)

22:51:53 executing program 1:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000040)=@delpolicy={0x5c, 0x14, 0x1, 0x0, 0x0, {{@in=@empty, @in=@broadcast}}, [@mark={0xc}]}, 0x5c}}, 0x0)

22:51:53 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000bc0)="0800a1695e1dcfe87b1071")
perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0x9e, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mknod(&(0x7f0000000200)='./file0\x00', 0x1120, 0x0)
r1 = open$dir(&(0x7f0000000040)='./file0\x00', 0x27e, 0x0)
write$binfmt_elf64(r1, &(0x7f0000000240)=ANY=[@ANYBLOB="cf"], 0x1)
close(r1)

22:51:53 executing program 4:
gettid()
ioctl$TIOCLINUX3(0xffffffffffffffff, 0x541c, 0x0)
pipe2(&(0x7f0000000000)={<r0=>0xffffffffffffffff}, 0x0)
ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x5, 0xc45})
timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x2, @thr={0xfffffffffffffffd, &(0x7f00000000c0)="c723d1ae084cf4a80fcb749742c7a6ef1eac42e9ec3fcaf43eb246805d994f85b884cd256bf841ad88891223fc057e3d2f657e17ae1f9d5d5b53b24381e755b3f091c21282c022ecf49c614c8a9427aa0b6290ccb9ad124d90662082e7577c70bee96b2e66f82882f6b66b7729f36e161636951a7b566905da2f71728fb7f37259283c5569d999f4b8499f69ed8b17e1e7aea9bef2f3e2b9ba4da4761d6dda1619988f441efaaa417a9e7bdb50a3173a656f27f7fcb62e69ab8bf8d82462f7dea1497e113c615a606c6a9561001632859645c73e7fe92cbaa21df2e06216414461199bc849cb3bc98c9532f10f4dcfa4d8428edc1ed0823c34"}}, &(0x7f0000044000))
fcntl$setpipe(r0, 0x407, 0x40a2a84b)

22:51:53 executing program 1:
r0 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/load\x00', 0x2, 0x0)
write$selinux_load(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="8c"], 0x1)

22:51:53 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/netfilter\x00')
execveat(r0, 0x0, 0x0, 0x0, 0x0)

22:51:53 executing program 4:

22:51:53 executing program 5:

[  171.178057] SELinux: failed to load policy
22:51:53 executing program 4:

22:51:53 executing program 3:

22:51:53 executing program 0:

[  171.430105] audit: type=1804 audit(1568674313.841:48): pid=7187 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="invalid_pcr" cause="open_writers" comm="syz-executor.2" name="/root/syzkaller-testdir193980146/syzkaller.7QXDG3/8/file0" dev="sda1" ino=16589 res=1
[  171.457901] audit: type=1804 audit(1568674313.881:49): pid=7194 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="invalid_pcr" cause="ToMToU" comm="syz-executor.2" name="/root/syzkaller-testdir193980146/syzkaller.7QXDG3/8/file0" dev="sda1" ino=16589 res=1
[  171.516260] audit: type=1804 audit(1568674313.931:50): pid=7187 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="invalid_pcr" cause="open_writers" comm="syz-executor.2" name="/root/syzkaller-testdir193980146/syzkaller.7QXDG3/8/file0" dev="sda1" ino=16589 res=1
22:51:54 executing program 2:

22:51:54 executing program 1:

22:51:54 executing program 3:

22:51:54 executing program 5:

22:51:54 executing program 4:

22:51:54 executing program 0:

22:51:54 executing program 3:

[  171.562456] audit: type=1804 audit(1568674313.981:51): pid=7194 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="invalid_pcr" cause="ToMToU" comm="syz-executor.2" name="/root/syzkaller-testdir193980146/syzkaller.7QXDG3/8/file0" dev="sda1" ino=16589 res=1
22:51:54 executing program 1:

22:51:54 executing program 3:

22:51:54 executing program 2:

22:51:54 executing program 5:

22:51:54 executing program 0:

22:51:54 executing program 4:

22:51:54 executing program 1:

22:51:54 executing program 0:

22:51:54 executing program 3:

22:51:54 executing program 2:

22:51:54 executing program 4:

22:51:54 executing program 5:

22:51:54 executing program 1:

22:51:54 executing program 0:

22:51:54 executing program 3:

22:51:54 executing program 2:

22:51:54 executing program 4:

22:51:54 executing program 5:

22:51:54 executing program 1:

22:51:54 executing program 2:

22:51:54 executing program 4:

22:51:54 executing program 0:

22:51:54 executing program 5:

22:51:54 executing program 1:

22:51:54 executing program 3:

22:51:54 executing program 4:

22:51:54 executing program 0:

22:51:54 executing program 2:

22:51:54 executing program 5:

22:51:54 executing program 0:

22:51:54 executing program 3:

22:51:54 executing program 1:

22:51:54 executing program 4:

22:51:54 executing program 1:

22:51:54 executing program 2:

22:51:54 executing program 5:

22:51:54 executing program 4:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000400)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_VAPIC_ADDR(r2, 0x8004ae98, &(0x7f0000000040))

22:51:54 executing program 0:
r0 = creat(&(0x7f0000000300)='./file0\x00', 0x0)
write(r0, &(0x7f00000000c0), 0xfffffe13)
r1 = socket(0x2, 0x3, 0xff)
connect$inet(r1, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x29}}, 0x10)
r2 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0)
sendfile(r1, r2, 0x0, 0xffff)

22:51:54 executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_PIT(r1, 0xae64, 0x0)

22:51:54 executing program 1:
clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pipe(&(0x7f0000000240))
mmap(&(0x7f0000bfd000/0x400000)=nil, 0x400000, 0x100000, 0x10, 0xffffffffffffffff, 0x0)
write$P9_RREADDIR(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x11}}, 0x10)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netstat\x00')
preadv(r1, &(0x7f0000001640)=[{&(0x7f00000000c0)=""/178, 0xb2}], 0x1, 0x2)
socket$inet6_tcp(0xa, 0x1, 0x0)
getsockopt$IP_VS_SO_GET_TIMEOUT(0xffffffffffffffff, 0x0, 0x486, 0x0, 0x0)
setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x0, 0x0, 0x0)
connect$inet(0xffffffffffffffff, 0x0, 0x0)

22:51:54 executing program 5:
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r2 = dup2(r1, r0)
fsetxattr$trusted_overlay_opaque(r2, 0x0, 0x0, 0x0, 0x0)

22:51:54 executing program 2:
clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pipe(&(0x7f0000000240))
mmap(&(0x7f0000bfd000/0x400000)=nil, 0x400000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
write$P9_RREADDIR(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x11}}, 0x10)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netstat\x00')
preadv(r1, &(0x7f0000001640)=[{&(0x7f00000000c0)=""/178, 0xb2}], 0x1, 0x2)
syz_open_pts(0xffffffffffffffff, 0x0)
setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x0, &(0x7f0000000000)=0x2, 0x4)

22:51:54 executing program 4:
syz_mount_image$msdos(&(0x7f0000000080)='msdos\x00', &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000008c0)={[{@fat=@flush='flush'}]})

22:51:54 executing program 5:
pipe(&(0x7f0000000140)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket(0x10, 0x2, 0x0)
setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000040), 0x4)
write(r1, &(0x7f00000001c0), 0xfffffef3)
mq_open(0x0, 0x0, 0x0, 0x0)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000340)={'nr0\x01\x00', 0x1002})
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r4=>0x0})
pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200)={0x0, r4+30000000}, 0x0)
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000000480), 0x2e9, 0xffd8)
socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(0xffffffffffffffff, &(0x7f0000008ff0)={0x2, 0x0, @empty}, 0x10)
ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000000))

22:51:54 executing program 1:
clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pipe(&(0x7f0000000240))
mmap(&(0x7f0000bfd000/0x400000)=nil, 0x400000, 0x100000, 0x10, 0xffffffffffffffff, 0x0)
write$P9_RREADDIR(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x11}}, 0x10)
r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netstat\x00')
preadv(r1, &(0x7f0000001640)=[{&(0x7f00000000c0)=""/178, 0xb2}], 0x1, 0x2)
socket$inet6_tcp(0xa, 0x1, 0x0)
getsockopt$IP_VS_SO_GET_TIMEOUT(0xffffffffffffffff, 0x0, 0x486, 0x0, 0x0)
setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x0, 0x0, 0x0)
connect$inet(0xffffffffffffffff, 0x0, 0x0)

22:51:54 executing program 3:
mkdir(&(0x7f0000000240)='./file0\x00', 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0)
mount$fuseblk(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x50010, 0x0)

22:51:54 executing program 2:
r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0)
ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f0000003700)={0x0, 0x0, 0x0, 0x0, 0xca})

[  172.448486] FAT-fs (loop4): bogus number of reserved sectors
[  172.486010] FAT-fs (loop4): Can't find a valid FAT filesystem
22:51:55 executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0x8010aebb)

22:51:55 executing program 3:
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$packet(0x11, 0x2, 0x300)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000bc0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'vat\x00\x00\x00\x00\x00\x00\x00\xa8\x03\xa4h\x04\x00', 0x43732e5398416f1a})
ioctl$TIOCSISO7816(0xffffffffffffffff, 0xc0285443, 0x0)
r2 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r1, &(0x7f0000000200)=""/39, 0x27, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0xfffffffffffffe5d, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="2800000010005fba000000000000000000010000", @ANYRES32=0x0, @ANYBLOB="030000000000000008001b0000000000"], 0x28}}, 0x0)
dup2(r0, r1)
ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x402c5828, 0x0)

[  172.552345] FAT-fs (loop4): bogus number of reserved sectors
[  172.576145] FAT-fs (loop4): Can't find a valid FAT filesystem
[  172.864281] audit: type=1804 audit(1568674315.281:52): pid=7300 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="invalid_pcr" cause="open_writers" comm="syz-executor.0" name="/root/syzkaller-testdir067481253/syzkaller.yhfAr0/31/file0" dev="sda1" ino=16577 res=1
[  172.923914] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  172.936150] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  173.000351] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
22:51:55 executing program 0:
r0 = creat(&(0x7f0000000300)='./file0\x00', 0x0)
write(r0, &(0x7f00000000c0), 0xfffffe13)
r1 = socket(0x2, 0x3, 0xff)
connect$inet(r1, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x29}}, 0x10)
r2 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0)
sendfile(r1, r2, 0x0, 0xffff)

22:51:55 executing program 1:
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e23, @broadcast}, 0x10)
sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10)

22:51:55 executing program 2:
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r2 = dup2(r1, r0)
fcntl$lock(r2, 0x6, &(0x7f0000000080)={0x0, 0x4})

22:51:55 executing program 4:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_CLOCK(r1, 0x4038ae7a, &(0x7f0000000240))

22:51:55 executing program 5:
pipe(&(0x7f0000000140)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket(0x10, 0x2, 0x0)
setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000040), 0x4)
write(r1, &(0x7f00000001c0), 0xfffffef3)
mq_open(0x0, 0x0, 0x0, 0x0)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000340)={'nr0\x01\x00', 0x1002})
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r4=>0x0})
pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200)={0x0, r4+30000000}, 0x0)
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000000480), 0x2e9, 0xffd8)
socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(0xffffffffffffffff, &(0x7f0000008ff0)={0x2, 0x0, @empty}, 0x10)
ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000000))

[  173.072790] audit: type=1804 audit(1568674315.491:53): pid=7308 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="invalid_pcr" cause="open_writers" comm="syz-executor.0" name="/root/syzkaller-testdir067481253/syzkaller.yhfAr0/31/file0" dev="sda1" ino=16577 res=1
22:51:55 executing program 2:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x0)

22:51:55 executing program 1:
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e23, @broadcast}, 0x10)
sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10)
shutdown(r0, 0x1)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x6b2, 0x0, &(0x7f00000000c0))

22:51:55 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0x1f}, 0x5}, 0x1c)

22:51:55 executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000400)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4010aefd, &(0x7f0000000040))

22:51:55 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0)
fremovexattr(r0, 0x0)

22:51:55 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
connect$inet6(r0, &(0x7f0000000080), 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5)
clone(0x2000000002100100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
setsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, 0x0, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
tkill(r1, 0x2f)
fcntl$setstatus(r0, 0x4, 0x80000000002c00)

[  173.400587] ptrace attach of "/root/syz-executor.4"[7390] was attempted by "/root/syz-executor.4"[7391]
[  173.605900] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  173.620440] audit: type=1804 audit(1568674316.041:54): pid=7369 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="invalid_pcr" cause="open_writers" comm="syz-executor.0" name="/root/syzkaller-testdir067481253/syzkaller.yhfAr0/32/file0" dev="sda1" ino=16608 res=1
[  173.652121] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
22:51:56 executing program 1:
syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x0)

22:51:56 executing program 4:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000400)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)

22:51:56 executing program 0:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000700)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000006c0)={0x14, 0x19, 0xffffffffffffffff, 0x0, 0x0, {0x6}}, 0x14}}, 0x0)

22:51:56 executing program 2:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc))
ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0)
r1 = syz_open_pts(r0, 0x0)
r2 = dup3(r1, r0, 0x0)
read(r2, 0x0, 0x0)

22:51:56 executing program 3:
openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$packet(0x11, 0x2, 0x300)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000bc0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'vat\x00\x00\x00\x00\x00\x00\x00\xa8\x03\xa4h\x04\x00', 0x43732e5398416f1a})
ioctl$TIOCSISO7816(0xffffffffffffffff, 0xc0285443, 0x0)
r2 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r1, &(0x7f0000000200)=""/39, 0x27, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0xfffffffffffffe5d, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="2800000010005fba000000000000000000010000", @ANYRES32=0x0, @ANYBLOB="030000000000000008001b0000000000"], 0x28}}, 0x0)
dup2(r0, r1)
ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x402c5828, 0x0)

[  173.895492] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  173.950339] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
22:51:56 executing program 5:
pipe(&(0x7f0000000140)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket(0x10, 0x2, 0x0)
setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000040), 0x4)
write(r1, &(0x7f00000001c0), 0xfffffef3)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0)
openat$full(0xffffffffffffff9c, 0x0, 0x400000, 0x0)
ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000340)={'nr0\x01\x00', 0x1002})
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r5=>0x0})
pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200)={0x0, r5+30000000}, 0x0)
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pwritev(r4, &(0x7f0000002e40)=[{&(0x7f0000000300)="87afe6da0529d252997f8c35e88bf5ecc223c21be651a17095f987df00a9762635b7013602", 0x25}, {&(0x7f0000001680)="3ae8930c9d64c46083bfb2d55e90ef40b1d486ecb00392316764daadb33f56589ce89522936aad82fa8e2bd72c8809e84a27359f59b3ad8b012a1811bbd811f804f28acf6e8cbc73cf33de4ab45f497dfdbd4575add5c14e8840000726a6d71fc4c1171a7f9a29fbcd852b03cc2c911ac3a849542f17b66b86e647e510bd4c48073676281468ccc5f707d281404215915e927ced4ed18e0964109c4895c50c8165dc9e62657b305ba7fa4ea2235d2e7577b6", 0xb2}, {&(0x7f0000000380)="ee0e2198f77729764b7f23ad1f51b40ed28d39ded89acfee659fb499182ce212a38c2326c67606184b18e8de", 0x2c}, {&(0x7f0000002c80)="b7984092c9359eaaa2fefcd4e407a5cbf5af5fe21e91a24fd27faf2c20ccd8891644a45fb23c44a2bc94813e42574342d17d013f382f43cf135db2f8db3affcca88268aecc6d99a474e0cad377bc4caa50ef86dbe4f4fdb09c67897e4b861839b73e9af94d2bd84c9107bff330d3f8befb111bb091c35248827ba421a612a479f81d12423825d7de75900f4952b4d874d8e3fd2e709c", 0x96}, {0x0}], 0x5, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c)
sendmmsg(0xffffffffffffffff, &(0x7f0000000480), 0x2e9, 0xffd8)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, &(0x7f0000000100)=0x4, 0x4)
bind$inet(r6, &(0x7f0000008ff0)={0x2, 0x0, @empty}, 0x10)
ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, 0x0, 0x0, 0x0)

22:51:56 executing program 1:
clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x0, 0x0)
ioctl(r0, 0x8000000000009374, &(0x7f0000000400)="020000000000000018")

22:51:56 executing program 2:
unshare(0x0)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)

22:51:56 executing program 4:
r0 = add_key(&(0x7f0000000140)='user\x00', &(0x7f0000000180)={'\xfb\xff\x00', 0x3}, &(0x7f00000001c0)="ee", 0x1, 0xfffffffffffffffd)
keyctl$describe(0x6, r0, 0x0, 0x0)

22:51:56 executing program 0:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r0, 0x29, 0x43, &(0x7f0000000100)=0xdf4, 0x4)

22:51:56 executing program 1:
r0 = socket$inet6(0xa, 0x3, 0x4)
connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1a)

22:51:56 executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c)
socket$inet6(0xa, 0x0, 0x0)
connect$inet6(0xffffffffffffffff, 0x0, 0x0)
sendmmsg(r0, &(0x7f0000000200), 0x29e, 0xfffffffffffffffc)
socketpair(0x18, 0x2, 0x0, 0x0)
getpeername$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f00000003c0)=0x14)
listen(r0, 0x0)
r1 = open(&(0x7f0000000080)='./file0\x00', 0x500, 0x8c)
mknodat(r1, 0x0, 0x0, 0x0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
inotify_init1(0x800)
sendto$inet6(r2, 0x0, 0xfffffffffffffdc6, 0x20000004, &(0x7f0000000280)={0xa, 0x4e22}, 0x1c)
syz_genetlink_get_family_id$ipvs(0x0)
sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, 0x0, 0x0)
recvfrom$inet6(r2, &(0x7f0000001840)=""/31, 0xfffffe0e, 0x100, &(0x7f0000001880), 0x1c)
r3 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000000)={'lo\x00'})
ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000140)={'lo\x00\x00\x00$\x00\x00\x00\x00\x00\x00\b\x00\x00\x11', 0xff})
r4 = accept4(r0, 0x0, 0x0, 0x0)
sendto$inet6(r4, &(0x7f00000000c0), 0x1000000ae, 0x0, 0x0, 0x1f1)

[  174.041551] autofs4:pid:7418:check_dev_ioctl_version: ioctl control interface version mismatch: kernel(1.1), user(2.0), cmd(0x00009374)
[  174.067429] autofs4:pid:7418:validate_dev_ioctl: invalid device control module version supplied for cmd(0x00009374)
[  174.078189] protocol 88fb is buggy, dev hsr_slave_0
[  174.078253] protocol 88fb is buggy, dev hsr_slave_1
22:51:56 executing program 4:
pipe(&(0x7f0000000140))
socket(0x10, 0x2, 0x0)
mq_open(0x0, 0x0, 0x0, 0x0)
openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000340)={'nr0\x01\x00'})
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r0=>0x0})
pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200)={0x0, r0+30000000}, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c)

22:51:56 executing program 2:
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_open_procfs(0x0, 0x0)

[  174.150119] protocol 88fb is buggy, dev hsr_slave_0
[  174.155414] protocol 88fb is buggy, dev hsr_slave_1
22:51:56 executing program 1:
creat(&(0x7f00000000c0)='./file1\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r2 = dup2(r1, r0)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='./file1\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000007c0)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r3}})

[  174.193799] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies.  Check SNMP counters.
22:51:56 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f0000000140)='oom_score_adj\x00\x9f\xc5r\x0e8J\xdb@\xf8\xbfj1\xe8\xce\x88\x02^\xb2\xf4hTR2\xf1\x89\x1e~m\x19\xc9lG^l\x13c7\xf7$\x7f?9>b\xe8/<\xdbj>:\xd9\x10\x04r\x18\x15\xdc)\x10I<\xd0:\x0f\x18\xec\x00\xc2w\x8a0K\xf8\xa9\xeaa\x16\x8c\xe6C\xf5\xcb\xdc\x1c\xea`\x9c\xe1\x8e\xdd\x8e\xaa\x1f\xf4\xaf\xa3Z\xbf\x17M\x1a\xff\xb1\x8dP]<\x9e\xe1B[y\xe6\xae\xe9I\xdb)\x9b\xcb\xa3Wlt\xe9\xa9\xfc\xf8\xde\xf0]\n\xa5S\x16\x1dh\x88\xc5\xea\xcf\xca5\xd2.\x93\xfd\t\x90#hq\r\x9b;\x83\xdd\x0fs\x80\x12\xc6\x8e~\xd4\xef\xc7:\xee4cu\xb2\x03\xd5\xd5)\xc9\xf1/\xea\x95_\'\xfb\xb9\xa94\xca\x9e\xf3\xfb\xc9\xd6~\xd5\xb7}B\xe5.\x86\xbf\xbb#\xb9\xf7N\xb3\xfe?x\xccX\xfc\xff\xff\xff\"\x8a\xa45\x10t\xbb\xb7\xca\xa7\xcc\xde_\xdc\xab\xf2\xb8\xc7\xb3\xd3&$\xbb4\x81\t\xbb\xe3\xbfB(ln\xbc\xe9E<6$\x8f)\xb0\x1a\xc9\xe3\xad\xe2\\\xcb,!\x13\rv)r\xf1\x00E\xcccgr\xbf\xd4uB\x9f\xa5\x8c8\xe4D\x0f\xd3Vtd\x89\xc8V\x14\x17=\xd9\xcf*\xc8\xc7\xb7\xcc\x182/Jm\x8c5\x93\x14\xfd\x02\'\xe3\xc9\x12~\xc3\x10\xb7\xc7\xae\xcfA\x823|\xfd\xba2\xbd\xc6-\xe0E_x\xc7i\x8dV\xd9!\xc51\xd6\x8a\xebx\\_l\xfb\xd8xX.N\x9bd\x91\xd5\xc1\xa1\xbahL\x95wF\x13{\xfd\xc8P\x1f\xe1)h\a\xe8Wn]\xe4Jd\x97YF\xc6\x88;\xc7\xee\xecy\xba\xb3\xfd\x1c?\xdc\x97V\xed\xf8;S$\xdf\xef3\xd4Z\x16\x94\xd9K!P\'\xa43$%n\x8bU*\x8f\xc5\xab\r1>\xfefE\xd5V5|s\xff\xdd{\xb1\x83\xc3\tj\xcd\r\xea\x1d\x86u\xe5Z\x92\xdc*\x06p\xa2i\xc6\x88\xfe1\xe4\xfen\x1a\xfb\xd8\xa9j~\xcf:?iq{\x9d\x82\xd6\x03\t\x8dO\xad\r\f\xcdB\xa5\xf8XU\xf7VW@d\xb8*\xb4\x1b[\xfb\xed\x0f\x85`\x1e1\x96\x9ao\xa6\xe3MT\xd9_\x01\xa4\xe5\x9b\xff\xcc\x83\xcdd\xd2\x11i\v\xe1\x17O\"\xdd \x06\x8a\xf1\xb4\xe7\xaa\x8c\xa8\f\x99K{\xf7\xf0\xa4\xbb\xcd\xc4\xe7\xd8$y\xf6\xdb\xfd0\xbf\xd6H6\x052\x94\xaaQ\x89<\xd4B`E\xc9u\x87B\xedl\x90%\xf4\x88\xa8\xd3\xd6\xf3*\xb5\xd2\xe0\xa3D@\xe0\x16\xe8S*\xe93\x9b1\xf9\x8dEibI=\"`\xd0\x12d\xf1F$\xf6y\xa2\xfd\"\x12u\x94i\x96\x8c\xe5\xb7\x9f[\x9c0\xbb\xf5\xa2\x96\x94\x83*\xfb%^')
epoll_wait(r0, &(0x7f0000000000)=[{}], 0x1, 0x0)

[  174.310139] protocol 88fb is buggy, dev hsr_slave_0
[  174.315307] protocol 88fb is buggy, dev hsr_slave_1
[  174.320098] protocol 88fb is buggy, dev hsr_slave_0
22:51:57 executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000bc0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'vat\x00\x00\x00\x00\x00\x00\x00\xa8\x03\xa4h\x04\x00', 0x43732e5398416f1a})
pread64(r0, 0x0, 0x0, 0x0)

22:51:57 executing program 5:
r0 = socket(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8948, &(0x7f0000000700)={'bond0\x00\x19\x00\x00\x00\x00\x00\x00\x00\x00\x03'})

22:51:57 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x1fe, 0x0)
write$binfmt_aout(r1, &(0x7f0000000440)=ANY=[@ANYBLOB="ef207456ef637615d304c4f004000000000000002deb7ab5be4650b0398cf8ebbac02023fd19b6629fa878ca6a5cf269ab090d8a9d104de89b6542ea805280810b9059e8b4ed16d0f2dc88d0483cb5fd1cbdea9194edf546eb0b8b0f0a46291b011cb656933144728f44b3e720e7772e8dcb39c39b52251e6d28bf1e27c24b4ddd27d13831777c4e45ffdda0a0350f2d53431092cde4e99f55f1911c8353624cded56b0185dea900f226c04f"], 0xac)
unlink(&(0x7f0000001e00)='./bus\x00')
creat(&(0x7f0000000000)='./file0\x00', 0x0)
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)

22:51:57 executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_SREGS(r2, 0x4138ae84, 0x0)

[  174.935549] ==================================================================
[  174.943061] BUG: KASAN: use-after-free in tcp_ack+0x414f/0x4760
[  174.943069] Read of size 4 at addr ffff8880920d3a2c by task syz-executor.0/7433
[  174.943071] 
[  174.943080] CPU: 1 PID: 7433 Comm: syz-executor.0 Not tainted 4.14.144 #0
[  174.943084] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  174.943087] Call Trace:
[  174.943091]  <IRQ>
[  174.943100]  dump_stack+0x138/0x197
22:51:57 executing program 5:
unshare(0x40400)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
r1 = open(&(0x7f0000000100)='.\x00', 0x0, 0x0)
sendfile(r0, r1, 0x0, 0x0)

[  174.943109]  ? tcp_ack+0x414f/0x4760
[  174.943120]  print_address_description.cold+0x7c/0x1dc
[  174.943127]  ? tcp_ack+0x414f/0x4760
[  174.943134]  kasan_report.cold+0xa9/0x2af
[  174.943143]  __asan_report_load4_noabort+0x14/0x20
[  174.943151]  tcp_ack+0x414f/0x4760
[  174.943159]  ? _raw_spin_unlock_irqrestore+0x6b/0xe0
[  174.943172]  ? trace_hardirqs_on+0x10/0x10
[  174.943187]  ? tcp_fastretrans_alert+0x2620/0x2620
[  174.958287]  ? lock_downgrade+0x6e0/0x6e0
[  174.958306]  tcp_rcv_established+0x3e9/0x1650
[  175.030991]  ? trace_hardirqs_on+0xd/0x10
22:51:57 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000400)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4048ae9b, &(0x7f0000000040))

[  175.035138]  ? save_trace+0x290/0x290
[  175.038942]  ? tcp_data_queue+0x3730/0x3730
[  175.043262]  tcp_v6_do_rcv+0x417/0x1190
[  175.043274]  tcp_v6_rcv+0x2446/0x2ed0
[  175.043283]  ? save_trace+0x290/0x290
[  175.043305]  ip6_input_finish+0x300/0x15a0
[  175.043322]  ip6_input+0xd5/0x340
[  175.043331]  ? ip6_input_finish+0x15a0/0x15a0
[  175.043337]  ? ipv6_rcv+0x16aa/0x1d20
[  175.043346]  ? ip6_rcv_finish+0x7a0/0x7a0
[  175.043356]  ip6_rcv_finish+0x23f/0x7a0
[  175.043365]  ipv6_rcv+0xe4d/0x1d20
[  175.043372]  ? put_prev_task_stop+0x348/0x400
[  175.043381]  ? ip6_input+0x340/0x340
[  175.043387]  ? __lock_is_held+0xb6/0x140
[  175.043397]  ? check_preemption_disabled+0x3c/0x250
[  175.043406]  ? ip6_make_skb+0x410/0x410
[  175.043415]  ? rcu_lockdep_current_cpu_online+0xf2/0x140
[  175.043420]  ? ip6_input+0x340/0x340
[  175.043431]  __netif_receive_skb_core+0x1eae/0x2ca0
[  175.043439]  ? trace_hardirqs_on+0x10/0x10
[  175.043451]  ? enqueue_to_backlog+0xcc0/0xcc0
[  175.043460]  ? process_backlog+0x43e/0x730
[  175.043469]  ? lock_acquire+0x16f/0x430
[  175.043477]  __netif_receive_skb+0x2c/0x1b0
[  175.043483]  ? __netif_receive_skb+0x2c/0x1b0
[  175.043489]  process_backlog+0x21f/0x730
[  175.043495]  ? mark_held_locks+0xb1/0x100
[  175.043506]  net_rx_action+0x490/0xf80
[  175.043517]  ? napi_complete_done+0x4f0/0x4f0
[  175.043525]  ? rcu_lockdep_current_cpu_online+0xf2/0x140
[  175.043536]  __do_softirq+0x244/0x9a0
[  175.043547]  ? ip6_finish_output2+0x9c0/0x21b0
[  175.043554]  do_softirq_own_stack+0x2a/0x40
[  175.043557]  </IRQ>
[  175.043564]  do_softirq.part.0+0x10e/0x160
[  175.043570]  __local_bh_enable_ip+0x154/0x1a0
[  175.043577]  ip6_finish_output2+0x9f3/0x21b0
[  175.043588]  ? ip6_forward_finish+0x480/0x480
[  175.043594]  ? __lock_is_held+0xb6/0x140
[  175.043600]  ? check_preemption_disabled+0x3c/0x250
[  175.043613]  ip6_finish_output+0x4f4/0xb50
[  175.043620]  ? ip6_finish_output+0x4f4/0xb50
[  175.043630]  ip6_output+0x20f/0x6d0
[  175.043640]  ? ip6_finish_output+0xb50/0xb50
[  175.051392]  ? __lock_is_held+0xb6/0x140
[  175.051403]  ? check_preemption_disabled+0x3c/0x250
[  175.051415]  ? ip6_fragment+0x32c0/0x32c0
[  175.051425]  ? rcu_lockdep_current_cpu_online+0xf2/0x140
[  175.051434]  ip6_xmit+0xd53/0x1eb0
[  175.245529]  ? ip6_finish_output2+0x21b0/0x21b0
[  175.250179]  ? ip6_dst_check+0x136/0x2c0
[  175.254225]  ? save_trace+0x290/0x290
[  175.258007]  ? ip6_append_data+0x2f0/0x2f0
[  175.262227]  ? __lock_is_held+0xb6/0x140
[  175.266272]  ? check_preemption_disabled+0x3c/0x250
[  175.271283]  inet6_csk_xmit+0x286/0x4d0
[  175.275239]  ? inet6_csk_update_pmtu+0x140/0x140
[  175.279974]  ? tcp_md5_do_lookup+0x1d3/0x530
[  175.284375]  __tcp_transmit_skb+0x172c/0x2fe0
[  175.288859]  ? __tcp_select_window+0x6e0/0x6e0
[  175.293427]  ? kvm_clock_read+0x23/0x40
[  175.297399]  ? sched_clock_cpu+0x1b/0x1c0
[  175.301527]  ? tcp_small_queue_check+0x184/0x1e0
[  175.306353]  tcp_write_xmit+0x523/0x4960
[  175.310396]  ? tcp_v6_md5_lookup+0x23/0x30
[  175.314615]  ? tcp_established_options+0x2c5/0x420
[  175.319528]  ? tcp_current_mss+0x1b1/0x2f0
[  175.323752]  __tcp_push_pending_frames+0xa6/0x260
[  175.328577]  tcp_send_fin+0x17e/0xc40
[  175.332361]  tcp_close+0xcc8/0xfb0
[  175.335881]  ? lock_acquire+0x16f/0x430
[  175.339838]  ? ip_mc_drop_socket+0x1d6/0x230
[  175.344232]  inet_release+0xec/0x1c0
[  175.347926]  inet6_release+0x53/0x80
[  175.351620]  __sock_release+0xce/0x2b0
[  175.355485]  ? __sock_release+0x2b0/0x2b0
[  175.359610]  sock_close+0x1b/0x30
[  175.363130]  __fput+0x275/0x7a0
[  175.366392]  ____fput+0x16/0x20
[  175.369657]  task_work_run+0x114/0x190
[  175.373526]  exit_to_usermode_loop+0x1da/0x220
[  175.378088]  do_syscall_64+0x4bc/0x640
[  175.381953]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  175.386778]  entry_SYSCALL_64_after_hwframe+0x42/0xb7
[  175.391946] RIP: 0033:0x4135d1
[  175.395114] RSP: 002b:00007ffe60b6c5a0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
[  175.402799] RAX: 0000000000000000 RBX: 0000000000000008 RCX: 00000000004135d1
[  175.410050] RDX: 0000000000000000 RSI: 0000000000001adb RDI: 0000000000000007
[  175.417298] RBP: 0000000000000001 R08: 000000009aa89adb R09: 000000009aa89adf
[  175.424550] R10: 00007ffe60b6c680 R11: 0000000000000293 R12: 000000000075c9a0
[  175.431798] R13: 000000000075c9a0 R14: 0000000000760d08 R15: ffffffffffffffff
[  175.439084] 
[  175.440703] Allocated by task 7443:
[  175.444311]  save_stack_trace+0x16/0x20
[  175.448267]  save_stack+0x45/0xd0
[  175.451699]  kasan_kmalloc+0xce/0xf0
[  175.455392]  kasan_slab_alloc+0xf/0x20
[  175.459259]  kmem_cache_alloc_node+0x144/0x780
[  175.463826]  __alloc_skb+0x9c/0x500
[  175.467442]  sk_stream_alloc_skb+0xb3/0x780
[  175.471745]  tcp_sendmsg_locked+0xf61/0x3200
[  175.476130]  tcp_sendmsg+0x30/0x50
[  175.479648]  inet_sendmsg+0x122/0x500
[  175.483431]  sock_sendmsg+0xce/0x110
[  175.487123]  SYSC_sendto+0x206/0x310
[  175.490831]  SyS_sendto+0x40/0x50
[  175.494273]  do_syscall_64+0x1e8/0x640
[  175.498154]  entry_SYSCALL_64_after_hwframe+0x42/0xb7
[  175.503324] 
[  175.504936] Freed by task 7443:
[  175.508210]  save_stack_trace+0x16/0x20
[  175.512180]  save_stack+0x45/0xd0
[  175.515618]  kasan_slab_free+0x75/0xc0
[  175.519484]  kmem_cache_free+0x83/0x2b0
[  175.523450]  kfree_skbmem+0x8d/0x120
[  175.527142]  __kfree_skb+0x1e/0x30
[  175.530663]  tcp_remove_empty_skb.part.0+0x231/0x2e0
[  175.535747]  tcp_sendmsg_locked+0x1ced/0x3200
[  175.540228]  tcp_sendmsg+0x30/0x50
[  175.543748]  inet_sendmsg+0x122/0x500
[  175.547534]  sock_sendmsg+0xce/0x110
[  175.551228]  SYSC_sendto+0x206/0x310
[  175.554922]  SyS_sendto+0x40/0x50
[  175.558368]  do_syscall_64+0x1e8/0x640
[  175.562237]  entry_SYSCALL_64_after_hwframe+0x42/0xb7
[  175.567402] 
[  175.569010] The buggy address belongs to the object at ffff8880920d3a00
[  175.569010]  which belongs to the cache skbuff_fclone_cache of size 472
[  175.582342] The buggy address is located 44 bytes inside of
[  175.582342]  472-byte region [ffff8880920d3a00, ffff8880920d3bd8)
[  175.594109] The buggy address belongs to the page:
[  175.599020] page:ffffea00024834c0 count:1 mapcount:0 mapping:ffff8880920d3000 index:0x0
[  175.607145] flags: 0x1fffc0000000100(slab)
[  175.611362] raw: 01fffc0000000100 ffff8880920d3000 0000000000000000 0000000100000006
[  175.619225] raw: ffffea00020f3ce0 ffffea000225bf60 ffff8880a9e19a80 0000000000000000
[  175.627086] page dumped because: kasan: bad access detected
[  175.632777] 
[  175.634385] Memory state around the buggy address:
[  175.639295]  ffff8880920d3900: fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc
[  175.646636]  ffff8880920d3980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  175.653977] >ffff8880920d3a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  175.661326]                                   ^
[  175.666060]  ffff8880920d3a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  175.673482]  ffff8880920d3b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  175.680818] ==================================================================
[  175.688166] Disabling lock debugging due to kernel taint
[  175.693706] Kernel panic - not syncing: panic_on_warn set ...
[  175.693706] 
[  175.701089] CPU: 1 PID: 7433 Comm: syz-executor.0 Tainted: G    B           4.14.144 #0
[  175.709225] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  175.718573] Call Trace:
[  175.721146]  <IRQ>
[  175.723302]  dump_stack+0x138/0x197
[  175.726932]  ? tcp_ack+0x414f/0x4760
[  175.730644]  panic+0x1f2/0x426
[  175.733829]  ? add_taint.cold+0x16/0x16
[  175.737802]  kasan_end_report+0x47/0x4f
[  175.741770]  kasan_report.cold+0x130/0x2af
[  175.746002]  __asan_report_load4_noabort+0x14/0x20
[  175.750929]  tcp_ack+0x414f/0x4760
[  175.754461]  ? _raw_spin_unlock_irqrestore+0x6b/0xe0
[  175.759563]  ? trace_hardirqs_on+0x10/0x10
[  175.763803]  ? tcp_fastretrans_alert+0x2620/0x2620
[  175.768730]  ? lock_downgrade+0x6e0/0x6e0
[  175.772877]  tcp_rcv_established+0x3e9/0x1650
[  175.777372]  ? trace_hardirqs_on+0xd/0x10
[  175.781517]  ? save_trace+0x290/0x290
[  175.785317]  ? tcp_data_queue+0x3730/0x3730
[  175.789642]  tcp_v6_do_rcv+0x417/0x1190
[  175.793609]  tcp_v6_rcv+0x2446/0x2ed0
[  175.797402]  ? save_trace+0x290/0x290
[  175.801204]  ip6_input_finish+0x300/0x15a0
[  175.805434]  ip6_input+0xd5/0x340
[  175.808884]  ? ip6_input_finish+0x15a0/0x15a0
[  175.813374]  ? ipv6_rcv+0x16aa/0x1d20
[  175.817158]  ? ip6_rcv_finish+0x7a0/0x7a0
[  175.821290]  ip6_rcv_finish+0x23f/0x7a0
[  175.825244]  ipv6_rcv+0xe4d/0x1d20
[  175.828768]  ? put_prev_task_stop+0x348/0x400
[  175.833243]  ? ip6_input+0x340/0x340
[  175.836935]  ? __lock_is_held+0xb6/0x140
[  175.840975]  ? check_preemption_disabled+0x3c/0x250
[  175.845970]  ? ip6_make_skb+0x410/0x410
[  175.849927]  ? rcu_lockdep_current_cpu_online+0xf2/0x140
[  175.855358]  ? ip6_input+0x340/0x340
[  175.859061]  __netif_receive_skb_core+0x1eae/0x2ca0
[  175.864059]  ? trace_hardirqs_on+0x10/0x10
[  175.868274]  ? enqueue_to_backlog+0xcc0/0xcc0
[  175.872747]  ? process_backlog+0x43e/0x730
[  175.876963]  ? lock_acquire+0x16f/0x430
[  175.880916]  __netif_receive_skb+0x2c/0x1b0
[  175.885218]  ? __netif_receive_skb+0x2c/0x1b0
[  175.889707]  process_backlog+0x21f/0x730
[  175.893757]  ? mark_held_locks+0xb1/0x100
[  175.897888]  net_rx_action+0x490/0xf80
[  175.901761]  ? napi_complete_done+0x4f0/0x4f0
[  175.906243]  ? rcu_lockdep_current_cpu_online+0xf2/0x140
[  175.911684]  __do_softirq+0x244/0x9a0
[  175.915549]  ? ip6_finish_output2+0x9c0/0x21b0
[  175.920128]  do_softirq_own_stack+0x2a/0x40
[  175.924423]  </IRQ>
[  175.926640]  do_softirq.part.0+0x10e/0x160
[  175.930851]  __local_bh_enable_ip+0x154/0x1a0
[  175.935324]  ip6_finish_output2+0x9f3/0x21b0
[  175.939710]  ? ip6_forward_finish+0x480/0x480
[  175.944186]  ? __lock_is_held+0xb6/0x140
[  175.948313]  ? check_preemption_disabled+0x3c/0x250
[  175.953311]  ip6_finish_output+0x4f4/0xb50
[  175.957524]  ? ip6_finish_output+0x4f4/0xb50
[  175.961913]  ip6_output+0x20f/0x6d0
[  175.965521]  ? ip6_finish_output+0xb50/0xb50
[  175.969909]  ? __lock_is_held+0xb6/0x140
[  175.973950]  ? check_preemption_disabled+0x3c/0x250
[  175.978946]  ? ip6_fragment+0x32c0/0x32c0
[  175.983073]  ? rcu_lockdep_current_cpu_online+0xf2/0x140
[  175.988504]  ip6_xmit+0xd53/0x1eb0
[  175.992024]  ? ip6_finish_output2+0x21b0/0x21b0
[  175.996670]  ? ip6_dst_check+0x136/0x2c0
[  176.000711]  ? save_trace+0x290/0x290
[  176.004502]  ? ip6_append_data+0x2f0/0x2f0
[  176.008714]  ? __lock_is_held+0xb6/0x140
[  176.012756]  ? check_preemption_disabled+0x3c/0x250
[  176.017757]  inet6_csk_xmit+0x286/0x4d0
[  176.021713]  ? inet6_csk_update_pmtu+0x140/0x140
[  176.026459]  ? tcp_md5_do_lookup+0x1d3/0x530
[  176.030849]  __tcp_transmit_skb+0x172c/0x2fe0
[  176.035324]  ? __tcp_select_window+0x6e0/0x6e0
[  176.039886]  ? kvm_clock_read+0x23/0x40
[  176.043844]  ? sched_clock_cpu+0x1b/0x1c0
[  176.048072]  ? tcp_small_queue_check+0x184/0x1e0
[  176.052824]  tcp_write_xmit+0x523/0x4960
[  176.056863]  ? tcp_v6_md5_lookup+0x23/0x30
[  176.061081]  ? tcp_established_options+0x2c5/0x420
[  176.066014]  ? tcp_current_mss+0x1b1/0x2f0
[  176.070231]  __tcp_push_pending_frames+0xa6/0x260
[  176.075055]  tcp_send_fin+0x17e/0xc40
[  176.078834]  tcp_close+0xcc8/0xfb0
[  176.082356]  ? lock_acquire+0x16f/0x430
[  176.086306]  ? ip_mc_drop_socket+0x1d6/0x230
[  176.090705]  inet_release+0xec/0x1c0
[  176.094398]  inet6_release+0x53/0x80
[  176.098098]  __sock_release+0xce/0x2b0
[  176.101966]  ? __sock_release+0x2b0/0x2b0
[  176.106093]  sock_close+0x1b/0x30
[  176.109524]  __fput+0x275/0x7a0
[  176.112782]  ____fput+0x16/0x20
[  176.116041]  task_work_run+0x114/0x190
[  176.119908]  exit_to_usermode_loop+0x1da/0x220
[  176.124482]  do_syscall_64+0x4bc/0x640
[  176.128360]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  176.133188]  entry_SYSCALL_64_after_hwframe+0x42/0xb7
[  176.138367] RIP: 0033:0x4135d1
[  176.141532] RSP: 002b:00007ffe60b6c5a0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
[  176.149220] RAX: 0000000000000000 RBX: 0000000000000008 RCX: 00000000004135d1
[  176.156471] RDX: 0000000000000000 RSI: 0000000000001adb RDI: 0000000000000007
[  176.163721] RBP: 0000000000000001 R08: 000000009aa89adb R09: 000000009aa89adf
[  176.170969] R10: 00007ffe60b6c680 R11: 0000000000000293 R12: 000000000075c9a0
[  176.178216] R13: 000000000075c9a0 R14: 0000000000760d08 R15: ffffffffffffffff
[  176.186718] Kernel Offset: disabled
[  176.190335] Rebooting in 86400 seconds..