[ 32.306883] kauditd_printk_skb: 9 callbacks suppressed [ 32.306891] audit: type=1800 audit(1564297717.432:33): pid=6909 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op="collect_data" cause="failed(directio)" comm="startpar" name="rc.local" dev="sda1" ino=2465 res=0 [ 32.335578] audit: type=1800 audit(1564297717.432:34): pid=6909 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op="collect_data" cause="failed(directio)" comm="startpar" name="rmnologin" dev="sda1" ino=2456 res=0 Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 36.827567] random: sshd: uninitialized urandom read (32 bytes read) [ 37.155641] audit: type=1400 audit(1564297722.282:35): avc: denied { map } for pid=7083 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 37.207671] random: sshd: uninitialized urandom read (32 bytes read) [ 37.886627] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.0.2' (ECDSA) to the list of known hosts. [ 43.475192] random: sshd: uninitialized urandom read (32 bytes read) 2019/07/28 07:08:48 fuzzer started [ 43.675950] audit: type=1400 audit(1564297728.802:36): avc: denied { map } for pid=7092 comm="syz-fuzzer" path="/root/syz-fuzzer" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 45.650998] random: cc1: uninitialized urandom read (8 bytes read) 2019/07/28 07:08:51 dialing manager at 10.128.0.105:45179 2019/07/28 07:08:51 syscalls: 2461 2019/07/28 07:08:51 code coverage: enabled 2019/07/28 07:08:51 comparison tracing: ioctl(KCOV_TRACE_CMP) failed: invalid argument 2019/07/28 07:08:51 extra coverage: extra coverage is not supported by the kernel 2019/07/28 07:08:51 setuid sandbox: enabled 2019/07/28 07:08:51 namespace sandbox: enabled 2019/07/28 07:08:51 Android sandbox: /sys/fs/selinux/policy does not exist 2019/07/28 07:08:51 fault injection: enabled 2019/07/28 07:08:51 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/07/28 07:08:51 net packet injection: enabled 2019/07/28 07:08:51 net device setup: enabled [ 48.020895] random: crng init done 07:10:54 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f00000000c0)='notify_on_release\x00', 0x2, 0x0) sendfile(r1, r1, 0x0, 0xffff) 07:10:54 executing program 5: r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x100, 0x0) ioctl$KVM_ASSIGN_SET_INTX_MASK(0xffffffffffffffff, 0x4040aea4, &(0x7f0000000100)={0x1, 0x79e0bb99, 0x100, 0x0, 0x8}) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000300)='./cgroup.cpu\x00', 0x200002, 0x0) ioctl$TIOCSSERIAL(r0, 0x541f, &(0x7f00000001c0)={0x3, 0x20, 0xfff, 0x9, 0xfffffffffffffffc, 0x3ff, 0x8, 0x2, 0x2, 0x0, 0x9, 0x20, 0x7, 0x8000, &(0x7f0000000140)=""/91, 0x4, 0x6, 0x4}) openat$cgroup_int(r1, &(0x7f0000000000)='cpuset.cpus\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, 0x0) r2 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x1fe, 0x0, 0xfffffffffffffffe, &(0x7f0000000280), 0xffffffffffffffff) add_key(&(0x7f0000000000)='asymmetric\x00', 0x0, &(0x7f00000000c0)="3058020af10cb8b56c96d27c44d58e94ea51a7dfc59e92e80d9482ca7839173a8f1143a711f5a939b4fd0072693a46c08df6616dd21be3453ecf73039a20f43acbc5376139a9070ae27dd847474d1e59b2697863e6ebd80f75ca", 0x5a, 0xfffffffffffffffd) ioctl$FS_IOC_SETVERSION(r2, 0x40087602, &(0x7f00000002c0)=0x10000) 07:10:54 executing program 1: socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket(0x1e, 0x2, 0x0) bind(r1, &(0x7f0000d80f80)=@generic={0x1e, "0103000000000000000000000000000009a979f321b30c7bc8790405c7bad62e0a43a632ed4938d36d73fb8f8401a3ff59829a2b0afe7ce43a4b2470a0c5216669ca021f6f65dcf160e7e58f358c0002f0000158d19bcb31f1314a8ef151622ca5bdb9c8ead2000077aeb81c90001d6d7c980ee590c8b9f70dc136cb184a"}, 0x80) bind$tipc(r1, &(0x7f0000000000)=@name={0x1e, 0x2, 0x0, {{0x0, 0x2}}}, 0x10) 07:10:54 executing program 2: symlink(&(0x7f0000000180)='./file0\x00', &(0x7f0000000100)='./file0\x00') symlink(&(0x7f0000000080)='./file0/file0\x00', &(0x7f0000000040)='./file0/file0\x00') 07:10:54 executing program 3: 07:10:54 executing program 4: [ 169.281027] audit: type=1400 audit(1564297854.412:37): avc: denied { map } for pid=7092 comm="syz-fuzzer" path="/root/syzkaller-shm434419415" dev="sda1" ino=2233 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:file_t:s0 tclass=file permissive=1 [ 169.330193] audit: type=1400 audit(1564297854.442:38): avc: denied { map } for pid=7110 comm="syz-executor.0" path="/sys/kernel/debug/kcov" dev="debugfs" ino=24 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1 [ 169.463615] IPVS: ftp: loaded support on port[0] = 21 [ 169.778778] chnl_net:caif_netlink_parms(): no params data found [ 169.788154] IPVS: ftp: loaded support on port[0] = 21 [ 169.844559] bridge0: port 1(bridge_slave_0) entered blocking state [ 169.851404] bridge0: port 1(bridge_slave_0) entered disabled state [ 169.858911] device bridge_slave_0 entered promiscuous mode [ 169.868552] bridge0: port 2(bridge_slave_1) entered blocking state [ 169.875743] bridge0: port 2(bridge_slave_1) entered disabled state [ 169.882905] device bridge_slave_1 entered promiscuous mode [ 169.905830] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 169.915089] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 169.937518] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 169.945145] team0: Port device team_slave_0 added [ 169.951686] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 169.958962] team0: Port device team_slave_1 added [ 169.964474] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 169.972162] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 169.992762] IPVS: ftp: loaded support on port[0] = 21 [ 170.052483] device hsr_slave_0 entered promiscuous mode [ 170.090784] device hsr_slave_1 entered promiscuous mode [ 170.130784] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 170.140335] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 170.199830] chnl_net:caif_netlink_parms(): no params data found [ 170.213405] bridge0: port 2(bridge_slave_1) entered blocking state [ 170.220149] bridge0: port 2(bridge_slave_1) entered forwarding state [ 170.227060] bridge0: port 1(bridge_slave_0) entered blocking state [ 170.233494] bridge0: port 1(bridge_slave_0) entered forwarding state [ 170.257294] IPVS: ftp: loaded support on port[0] = 21 [ 170.291631] bridge0: port 1(bridge_slave_0) entered blocking state [ 170.298060] bridge0: port 1(bridge_slave_0) entered disabled state [ 170.307119] device bridge_slave_0 entered promiscuous mode [ 170.316299] bridge0: port 2(bridge_slave_1) entered blocking state [ 170.323333] bridge0: port 2(bridge_slave_1) entered disabled state [ 170.330694] device bridge_slave_1 entered promiscuous mode [ 170.367903] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 170.409045] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 170.447410] chnl_net:caif_netlink_parms(): no params data found [ 170.461034] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 170.468365] team0: Port device team_slave_0 added [ 170.476919] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 170.484575] team0: Port device team_slave_1 added [ 170.490338] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 170.498444] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 170.532699] IPVS: ftp: loaded support on port[0] = 21 [ 170.613301] device hsr_slave_0 entered promiscuous mode [ 170.650700] device hsr_slave_1 entered promiscuous mode [ 170.692024] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 170.700434] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 170.742099] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 170.748480] 8021q: adding VLAN 0 to HW filter on device bond0 [ 170.818414] bridge0: port 1(bridge_slave_0) entered disabled state [ 170.836348] bridge0: port 2(bridge_slave_1) entered disabled state [ 170.843827] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 170.854477] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 170.873701] bridge0: port 1(bridge_slave_0) entered blocking state [ 170.880152] bridge0: port 1(bridge_slave_0) entered disabled state [ 170.887454] device bridge_slave_0 entered promiscuous mode [ 170.894655] bridge0: port 2(bridge_slave_1) entered blocking state [ 170.901199] bridge0: port 2(bridge_slave_1) entered disabled state [ 170.908140] device bridge_slave_1 entered promiscuous mode [ 170.933676] chnl_net:caif_netlink_parms(): no params data found [ 170.943744] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 170.955621] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 170.969167] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 170.977848] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 170.993255] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 171.001263] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 171.014670] IPVS: ftp: loaded support on port[0] = 21 [ 171.024942] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 171.031101] 8021q: adding VLAN 0 to HW filter on device team0 [ 171.067707] bridge0: port 1(bridge_slave_0) entered blocking state [ 171.074617] bridge0: port 1(bridge_slave_0) entered disabled state [ 171.081799] device bridge_slave_0 entered promiscuous mode [ 171.088580] bridge0: port 2(bridge_slave_1) entered blocking state [ 171.096062] bridge0: port 2(bridge_slave_1) entered disabled state [ 171.103092] device bridge_slave_1 entered promiscuous mode [ 171.123541] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 171.131079] team0: Port device team_slave_0 added [ 171.139593] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 171.146914] team0: Port device team_slave_1 added [ 171.154045] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 171.169766] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 171.179224] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 171.195088] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 171.206431] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 171.213950] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 171.222009] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 171.229691] bridge0: port 1(bridge_slave_0) entered blocking state [ 171.236088] bridge0: port 1(bridge_slave_0) entered forwarding state [ 171.257684] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 171.276595] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 171.284360] team0: Port device team_slave_0 added [ 171.298220] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 171.305643] team0: Port device team_slave_1 added [ 171.315328] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 171.323740] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 171.331718] bridge0: port 2(bridge_slave_1) entered blocking state [ 171.338078] bridge0: port 2(bridge_slave_1) entered forwarding state [ 171.348302] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 171.362730] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 171.376997] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 171.404238] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 171.452511] device hsr_slave_0 entered promiscuous mode [ 171.490521] device hsr_slave_1 entered promiscuous mode [ 171.559719] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 171.600833] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 171.663784] device hsr_slave_0 entered promiscuous mode [ 171.710431] device hsr_slave_1 entered promiscuous mode [ 171.752069] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 171.759067] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 171.766805] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 171.779056] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 171.788997] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 171.803599] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 171.816545] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 171.825712] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 171.833364] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 171.842334] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 171.849912] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 171.858801] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 171.869786] chnl_net:caif_netlink_parms(): no params data found [ 171.882026] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 171.889618] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 171.902409] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 171.926220] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 171.933935] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 171.942102] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 171.951404] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 171.957444] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 171.996628] bridge0: port 1(bridge_slave_0) entered blocking state [ 172.003438] bridge0: port 1(bridge_slave_0) entered disabled state [ 172.011119] device bridge_slave_0 entered promiscuous mode [ 172.072862] bridge0: port 2(bridge_slave_1) entered blocking state [ 172.079282] bridge0: port 2(bridge_slave_1) entered disabled state [ 172.086540] device bridge_slave_1 entered promiscuous mode [ 172.104438] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 172.112523] 8021q: adding VLAN 0 to HW filter on device bond0 [ 172.143684] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 172.163766] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 172.173219] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 172.183983] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 172.191362] chnl_net:caif_netlink_parms(): no params data found [ 172.204931] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 172.232093] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 172.239034] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 172.249487] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 172.257913] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 172.264582] 8021q: adding VLAN 0 to HW filter on device team0 [ 172.281791] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 172.289066] team0: Port device team_slave_0 added [ 172.307965] 8021q: adding VLAN 0 to HW filter on device bond0 [ 172.316238] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 172.327395] team0: Port device team_slave_1 added [ 172.333729] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 172.343942] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 172.365102] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 172.377422] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 172.401448] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 172.409256] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 172.417440] bridge0: port 1(bridge_slave_0) entered blocking state [ 172.423837] bridge0: port 1(bridge_slave_0) entered forwarding state [ 172.439729] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 172.484391] device hsr_slave_0 entered promiscuous mode [ 172.520478] device hsr_slave_1 entered promiscuous mode [ 172.560714] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 172.577276] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 172.592192] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 172.599148] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 172.608291] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 172.618356] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 172.625397] bridge0: port 1(bridge_slave_0) entered blocking state [ 172.632265] bridge0: port 1(bridge_slave_0) entered disabled state [ 172.639638] device bridge_slave_0 entered promiscuous mode [ 172.655665] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 172.664255] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 172.672092] bridge0: port 2(bridge_slave_1) entered blocking state [ 172.678527] bridge0: port 2(bridge_slave_1) entered forwarding state [ 172.698384] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 172.706778] 8021q: adding VLAN 0 to HW filter on device team0 [ 172.717631] bridge0: port 2(bridge_slave_1) entered blocking state [ 172.724445] bridge0: port 2(bridge_slave_1) entered disabled state [ 172.731831] device bridge_slave_1 entered promiscuous mode [ 172.747065] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 172.749234] hrtimer: interrupt took 26455 ns 07:10:57 executing program 5: [ 172.767213] 8021q: adding VLAN 0 to HW filter on device bond0 [ 172.779020] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 172.796299] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready 07:10:57 executing program 5: perf_event_open(&(0x7f000001d000)={0x20000000000005, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x40, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'eql\x00', 0x2}) [ 172.810473] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 172.818547] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 172.831812] bridge0: port 1(bridge_slave_0) entered blocking state [ 172.838216] bridge0: port 1(bridge_slave_0) entered forwarding state [ 172.846612] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 172.860855] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 172.877261] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 172.886474] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 172.903757] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 172.913436] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 172.922214] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 172.929241] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 172.936401] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 172.944423] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 172.952453] bridge0: port 2(bridge_slave_1) entered blocking state [ 172.958953] bridge0: port 2(bridge_slave_1) entered forwarding state [ 172.972875] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 172.995672] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 173.003736] team0: Port device team_slave_0 added [ 173.009994] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 173.019074] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 173.026261] 8021q: adding VLAN 0 to HW filter on device team0 [ 173.034889] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 173.046363] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 173.053774] team0: Port device team_slave_1 added [ 173.059685] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 173.067634] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 173.088125] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 173.095894] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 173.104714] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 173.122679] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 173.132506] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 173.142213] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 173.150627] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 173.157819] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 173.166688] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 173.174570] bridge0: port 1(bridge_slave_0) entered blocking state [ 173.180993] bridge0: port 1(bridge_slave_0) entered forwarding state [ 173.188074] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 173.195966] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 173.205515] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 173.217679] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 173.225116] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 173.244753] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 173.261986] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 173.269126] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 173.277053] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 173.285235] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 173.293672] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 173.301924] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 173.309539] bridge0: port 2(bridge_slave_1) entered blocking state [ 173.315963] bridge0: port 2(bridge_slave_1) entered forwarding state [ 173.323346] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready 07:10:58 executing program 5: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xe2w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11+4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) [ 173.342584] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 173.351851] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 173.359656] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 173.370596] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 173.432952] device hsr_slave_0 entered promiscuous mode 07:10:58 executing program 5: r0 = socket(0x8000000010, 0x2, 0x0) write(r0, &(0x7f0000000000)="fc0000001c000705ab092506016807000a0100000000000000020993210001c0f0000000000700000300000000039815fa2c1ec28648000000b9d95662070000bc000c00f0036cdf0d11512fd633d440000400600720f2d5bbc91a3e2e80772c05dafd5a32e273fc83ab82d718f74cec18444ef90d475ef8b21d3ef3d92c83170e5bba2e177312e081bea05d44021e8ca062914a463ae4f5d077bc4cb102b2b8f5566791cf190201ded815b2ccd243f395ed94e0ad91bd0734ba3dffe5f5aa1dd1890058a10000c880ac801fe4af000041f0d48f6f0000080548deac279cc4848e3825924509260e26429fbe11017d627403050efaddd3254395c500", 0xfc) [ 173.480791] device hsr_slave_1 entered promiscuous mode [ 173.520782] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 173.527786] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 173.538078] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 173.546026] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 173.553695] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 173.561217] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 173.568940] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready 07:10:58 executing program 5: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000040)={{0x2}}) [ 173.579241] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 173.596096] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 173.604227] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 173.621242] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready 07:10:58 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc}}, 0xe8) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) write$binfmt_elf32(0xffffffffffffffff, 0x0, 0x0) [ 173.634012] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 173.642572] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 173.651333] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 173.669272] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 173.679336] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 173.692672] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 173.704291] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 173.714019] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 173.727552] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 173.737239] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 173.750706] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 173.756762] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 173.773989] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 173.784125] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 173.794471] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 173.807646] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 173.815679] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 173.828791] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 173.844270] 8021q: adding VLAN 0 to HW filter on device bond0 [ 173.854951] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 173.862202] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 173.875878] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 173.886031] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 173.898033] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 173.906317] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 173.914658] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 173.927458] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 173.938529] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 173.955950] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 173.969308] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 173.977064] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 173.986078] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 173.994159] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 174.004112] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 174.021520] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 174.028585] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 174.042734] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 174.048832] 8021q: adding VLAN 0 to HW filter on device team0 [ 174.057113] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 174.073021] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 174.083724] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 174.092151] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 174.099929] bridge0: port 1(bridge_slave_0) entered blocking state [ 174.106365] bridge0: port 1(bridge_slave_0) entered forwarding state [ 174.117474] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 174.128863] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 174.136577] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 174.144765] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 174.153205] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 174.161280] bridge0: port 2(bridge_slave_1) entered blocking state [ 174.167645] bridge0: port 2(bridge_slave_1) entered forwarding state [ 174.189573] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 174.208763] 8021q: adding VLAN 0 to HW filter on device bond0 [ 174.219186] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 174.227566] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 174.238752] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 174.265706] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 174.272643] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 174.281377] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 174.288271] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 174.298116] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready 07:10:59 executing program 0: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) add_key(&(0x7f0000000400)='encrypted\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)='b', 0x1, 0xfffffffffffffffb) add_key$user(&(0x7f0000000580)='user\x00', &(0x7f00000005c0)={'syz', 0x3}, &(0x7f0000000600)="14", 0x1, 0xfffffffffffffffb) 07:10:59 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f00000008c0)='io\x00') preadv(r0, &(0x7f00000003c0)=[{&(0x7f0000000200)=""/246, 0xf6}], 0x1, 0x0) [ 174.319891] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 174.335986] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 174.344863] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 174.385990] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 174.399871] encrypted_key: insufficient parameters specified [ 174.411934] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 174.415924] encrypted_key: insufficient parameters specified [ 174.427212] 8021q: adding VLAN 0 to HW filter on device team0 07:10:59 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000500)='./bus\x00', 0x0) io_setup(0x4, &(0x7f00000004c0)=0x0) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fdatasync(r2) [ 174.447237] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 174.472010] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready 07:10:59 executing program 2: pipe(0x0) accept4$inet(0xffffffffffffffff, 0x0, 0x0, 0x0) getpgrp(0x0) io_setup(0x0, 0x0) io_cancel(0x0, 0x0, 0x0) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000600)={0x2, 0x4e20, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20008800, &(0x7f00000000c0)={0x2, 0x4e20, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000000180), 0x144, 0x0, 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) recvmmsg(r0, &(0x7f0000003a40)=[{{&(0x7f0000002500)=@hci, 0x80, &(0x7f0000003700)=[{&(0x7f00000002c0)=""/225, 0xe1}], 0x1, &(0x7f0000003780)=""/232, 0xe8}}, {{&(0x7f0000003880)=@xdp, 0x80, &(0x7f0000000040), 0x8a, &(0x7f00000039c0)=""/111, 0x6f}}], 0x8000078, 0x2, &(0x7f0000003bc0)={0x0, r1+30000000}) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x0) write$selinux_context(0xffffffffffffffff, 0x0, 0x0) [ 174.499796] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 174.517565] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 174.530572] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 174.538245] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 174.586947] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 174.607007] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 174.618165] bridge0: port 1(bridge_slave_0) entered blocking state [ 174.624653] bridge0: port 1(bridge_slave_0) entered forwarding state [ 174.647987] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 174.662545] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 174.676427] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 174.695251] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 174.703269] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 174.715921] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 174.725605] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 174.737709] bridge0: port 2(bridge_slave_1) entered blocking state [ 174.744160] bridge0: port 2(bridge_slave_1) entered forwarding state [ 174.757701] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 174.764515] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 174.791821] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 174.815616] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 174.822925] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 174.835954] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 174.840802] FAT-fs (loop1): error, fat_free_clusters: deleting FAT entry beyond EOF [ 174.848156] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 174.862181] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 174.869655] FAT-fs (loop1): Filesystem has been set read-only [ 174.877944] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 174.886681] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 174.895385] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 174.903993] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 174.914881] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 174.923275] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 174.931483] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 174.941684] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 174.956084] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 174.965594] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 174.983379] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 174.992266] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 175.003680] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 175.009767] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 175.017149] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 175.025216] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 175.039735] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 175.055526] 8021q: adding VLAN 0 to HW filter on device batadv0 07:11:01 executing program 3: clone(0x1fe, 0x0, 0xfffffffffffffffe, &(0x7f0000000280), 0xffffffffffffffff) add_key(&(0x7f0000000000)='asymmetric\x00', 0x0, &(0x7f00000000c0)="3058020af10cb8b56c96d27c44d58e94ea51a7dfc59e92e80d9482ca7839173a8f1143a711f5a939b4fd0072693a46c08df6616dd21be3453ecf73039a20f43acbc5376139a9070ae27dd847474d1e59b2697863e6ebd80f75ca", 0x5a, 0xfffffffffffffffd) 07:11:01 executing program 4: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000100)={0x1, &(0x7f0000000040)=[{0x10006, 0x0, 0x0, 0x50000}]}) recvfrom$inet(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x4000003c, 0x0, 0x0) 07:11:01 executing program 5: r0 = syz_open_dev$loop(&(0x7f0000000140)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000000)) 07:11:01 executing program 0: clone(0x7fd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="d3d2b93c38f1870410cd8048"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="2c000000000000000100090001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32=r1], 0x2c}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab56ad8e39808e0b61a0bf7a301ffe8dac0726906da58a5d1ab066f24351eda628c0e9e1b754fd65d2e4769d37cbcb5c0c5d", @ANYRESHEX, @ANYRESOCT, @ANYRES32, @ANYRESHEX, @ANYBLOB="e6c55c669eb82eec512200019b3d7280437a7462010000000000000029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c960d2bc40dd887fc8dc4872bf5b65c87e940b30eecd4f9ad4cf8d1b12b1894ef983d0c1118c5ae060bb6ae2af877735be7b03b5278b53fe125393d6b6adf7f7d0734bc1e5566b4d1447a982f0b0b061ef05d38f5ddd795e0b31aa0a9709836e23ecee4c4a77c6da57914a5040000", @ANYRESHEX], 0x0, 0x15d}, 0x20) tkill(r0, 0x38) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 07:11:01 executing program 2: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000040)={{0x100000001, 0x0, 0x0, 0x0, 0x40000}}) 07:11:01 executing program 1: r0 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x4, &(0x7f00000000c0)='em0\x00'}, 0x30) r2 = perf_event_open$cgroup(&(0x7f0000000480)={0x1, 0x70, 0x0, 0x3, 0xd6, 0xffffffff, 0x0, 0xfff, 0x800, 0x8, 0x8, 0x8, 0x7fffffff, 0x3, 0x3, 0x3, 0x9, 0x9, 0x1, 0xfffffffffffffff7, 0x7ff, 0x7, 0x0, 0x1edc, 0x1000, 0x6, 0xb505, 0x6, 0x2, 0x6, 0x9, 0x4, 0x8, 0xffffffff, 0xffff, 0xd40d, 0x3, 0xffffffff, 0x0, 0xfffffffffffffff7, 0x4, @perf_bp={&(0x7f0000000140), 0x2}, 0x800, 0x1, 0xa6a6, 0x4, 0x4, 0x7fff, 0x8}, r0, 0x6, r0, 0x4) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x1, 0x80, 0x81, 0xa976, 0x0, 0x0, 0x10000, 0x8, 0x9, 0x9a, 0x2, 0x3, 0x432, 0x7fff, 0x6, 0x262b, 0x7, 0x9f5e, 0x9, 0x5, 0x1b04, 0x8, 0x5, 0x7, 0x4, 0x4, 0x0, 0x100, 0x0, 0x80000000, 0x2, 0x5, 0xcc5, 0x4, 0x20, 0xfffffffffffffffb, 0x0, 0x40, 0x5, @perf_bp, 0x0, 0x6c, 0x800, 0x4, 0x10001, 0x80000000, 0x1ff}, r1, 0x7, r2, 0x3) r3 = openat$cgroup(0xffffffffffffff9c, 0x0, 0x200002, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x200000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000200)="a0706f6a79e35e4e84d65b5081eef8b4c61a610b0de572876d0b4d5e2e1a43e5cd9ce2012156eb726a95188720ac30d0c7ecbfaa8636bca7433f39ab7603f705006612b99fee71", 0x47}, {&(0x7f0000000280)="690b7863abfa04076ee4e9d420db535901889bc7a54ea6d5b8d6a7948dae854426ac0c1bff9a1d917bd578c5059ce4a58ff5a6e5bc65b24d7a9baf15f25525b34b2fcc0b3e96fbaf66132aeb8bbd420d9e4304b5b4e1cd6d17d16cb5b9315364fd61f0a37b126377e5c29251adc10bdc8ea50256663eb1b8900e86e884cfdd46b0fd7dbc84f7f7dda5c04a1a3d2fb598fa9d", 0x92}, {&(0x7f0000000340)}], 0x3}, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000740)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, 0xffffffffffffffff) gettid() perf_event_open(0x0, 0x0, 0xa, 0xffffffffffffff9c, 0x9) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x89f1, &(0x7f0000000580)='ip6_vti0\x00') 07:11:01 executing program 3: write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) io_cancel(0x0, 0x0, &(0x7f0000000500)) fadvise64(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000600)={0x2, 0x4e20, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20008800, &(0x7f00000000c0)={0x2, 0x4e20, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000000180), 0x144, 0x0, 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) recvmmsg(r0, &(0x7f0000003a40)=[{{&(0x7f0000002500)=@hci, 0x80, &(0x7f0000003700)=[{&(0x7f00000002c0)=""/225, 0xe1}], 0x1, &(0x7f0000003780)=""/232, 0xe8}}, {{&(0x7f0000003880)=@xdp, 0x80, &(0x7f0000000040), 0x8a, &(0x7f00000039c0)=""/111, 0x6f}}], 0x8000078, 0x2, &(0x7f0000003bc0)={0x0, r1+30000000}) ioctl$sock_ifreq(0xffffffffffffffff, 0x0, 0x0) 07:11:01 executing program 5: ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x1fe, 0x0, 0xfffffffffffffffe, &(0x7f0000000280), 0xffffffffffffffff) add_key(&(0x7f0000000000)='asymmetric\x00', 0x0, &(0x7f00000000c0)="3058020af10cb8b56c96d27c44d58e94ea51a7dfc59e92e80d9482ca7839173a8f1143a711f5a939b4fd0072693a46c08df6616dd21be3453ecf73039a20f43acbc5376139a9070ae27dd847474d1e59b2697863e6ebd80f75ca", 0x5a, 0xfffffffffffffffd) 07:11:01 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000140)={0x7, 0x4, 0x200, 0x80000000000004, 0x0, 0x0}, 0x2c) [ 176.153586] ptrace attach of "/root/syz-executor.0"[7254] was attempted by "/root/syz-executor.0"[7258] 07:11:01 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x2000007, 0x6031, 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) munlockall() 07:11:01 executing program 3: ioctl$KVM_ASSIGN_SET_INTX_MASK(0xffffffffffffffff, 0x4040aea4, &(0x7f0000000100)={0x1, 0x79e0bb99, 0x0, 0x0, 0x8}) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000000)='asymmetric\x00', 0x0, &(0x7f00000000c0), 0x0, 0xfffffffffffffffd) 07:11:01 executing program 5: ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x1fe, 0x0, 0xfffffffffffffffe, &(0x7f0000000280), 0xffffffffffffffff) add_key(&(0x7f0000000000)='asymmetric\x00', 0x0, &(0x7f00000000c0)="3058020af10cb8b56c96d27c44d58e94ea51a7dfc59e92e80d9482ca7839173a8f1143a711f5a939b4fd0072693a46c08df6616dd21be3453ecf73039a20f43acbc5376139a9070ae27dd847474d1e59b2697863e6ebd80f75ca", 0x5a, 0xfffffffffffffffd) 07:11:01 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='\x00\x00\x00\x00\x00egy\xc5\x8e\xcb\x1c\xf8\x8f\xca;\xa3?\xad\xae\x0f\xb5\x97ao3\xab\xcdY\x9a\xe3\xe5\xe1\xf4\x87\xac\xad\x80\xa3P\x8c\xea\x9c\xc7\x00\xeb\xf4X#\xe34\x80O]\x87\xdd\x894\xdal;w\xf8\xf8\v?v\xf0\xb8\xda=|\xa4\xba\xbbiq!\xd8g\xb7I\x12\x80') r1 = openat$cgroup_ro(r0, &(0x7f0000000480)='mem\x00\x01y7SwaS.\x06ur\x89\xc9B\xab\xe3\xfarent\x00\xaa\x1a\xfd\xae\v\xbf\xd8d\xbb\xaf9Q\xde\xfb\x1fY\xfb\x8do\xd1\x16\xce(\x82\xf1\xbf{5Z\x13\x15\x14\xd7\xb8\xce\xf20\x1e\xc0\xc2\xed0x0, 0x1c, &(0x7f0000000380)=[@in6={0xa, 0x0, 0x0, @local, 0x1}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, &(0x7f0000000080)={r1}, &(0x7f00000000c0)=0x8) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r0, 0x84, 0x7d, &(0x7f0000000000)={r2}, 0x8) 07:11:01 executing program 1: r0 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x4, &(0x7f00000000c0)='em0\x00'}, 0x30) r2 = perf_event_open$cgroup(&(0x7f0000000480)={0x1, 0x70, 0x0, 0x3, 0xd6, 0xffffffff, 0x0, 0xfff, 0x800, 0x8, 0x8, 0x8, 0x7fffffff, 0x3, 0x3, 0x3, 0x9, 0x9, 0x1, 0xfffffffffffffff7, 0x7ff, 0x7, 0x0, 0x1edc, 0x1000, 0x6, 0xb505, 0x6, 0x2, 0x6, 0x9, 0x4, 0x8, 0xffffffff, 0xffff, 0xd40d, 0x3, 0xffffffff, 0x0, 0xfffffffffffffff7, 0x4, @perf_bp={&(0x7f0000000140), 0x2}, 0x800, 0x1, 0xa6a6, 0x4, 0x4, 0x7fff, 0x8}, r0, 0x6, r0, 0x4) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x1, 0x80, 0x81, 0xa976, 0x0, 0x0, 0x10000, 0x8, 0x9, 0x9a, 0x2, 0x3, 0x432, 0x7fff, 0x6, 0x262b, 0x7, 0x9f5e, 0x9, 0x5, 0x1b04, 0x8, 0x5, 0x7, 0x4, 0x4, 0x0, 0x100, 0x0, 0x80000000, 0x2, 0x5, 0xcc5, 0x4, 0x20, 0xfffffffffffffffb, 0x0, 0x40, 0x5, @perf_bp, 0x0, 0x6c, 0x800, 0x4, 0x10001, 0x80000000, 0x1ff}, r1, 0x7, r2, 0x3) r3 = openat$cgroup(0xffffffffffffff9c, 0x0, 0x200002, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x200000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000200)="a0706f6a79e35e4e84d65b5081eef8b4c61a610b0de572876d0b4d5e2e1a43e5cd9ce2012156eb726a95188720ac30d0c7ecbfaa8636bca7433f39ab7603f705006612b99fee71", 0x47}, {&(0x7f0000000280)="690b7863abfa04076ee4e9d420db535901889bc7a54ea6d5b8d6a7948dae854426ac0c1bff9a1d917bd578c5059ce4a58ff5a6e5bc65b24d7a9baf15f25525b34b2fcc0b3e96fbaf66132aeb8bbd420d9e4304b5b4e1cd6d17d16cb5b9315364fd61f0a37b126377e5c29251adc10bdc8ea50256663eb1b8900e86e884cfdd46b0fd7dbc84f7f7dda5c04a1a3d2fb598fa9d", 0x92}, {&(0x7f0000000340)}], 0x3}, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000740)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, 0xffffffffffffffff) gettid() perf_event_open(0x0, 0x0, 0xa, 0xffffffffffffff9c, 0x9) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x89f1, &(0x7f0000000580)='ip6_vti0\x00') 07:11:01 executing program 5: ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x1fe, 0x0, 0xfffffffffffffffe, &(0x7f0000000280), 0xffffffffffffffff) add_key(&(0x7f0000000000)='asymmetric\x00', 0x0, &(0x7f00000000c0)="3058020af10cb8b56c96d27c44d58e94ea51a7dfc59e92e80d9482ca7839173a8f1143a711f5a939b4fd0072693a46c08df6616dd21be3453ecf73039a20f43acbc5376139a9070ae27dd847474d1e59b2697863e6ebd80f75ca", 0x5a, 0xfffffffffffffffd) 07:11:01 executing program 2: syz_open_dev$dmmidi(&(0x7f0000000040)='/dev/dmmidi#\x00', 0x0, 0x8200) 07:11:01 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r1 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r2 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r2) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8943, &(0x7f0000000440)='nr0\x01\x00\x00\xc3\x00\xa7\x82\xbaQl\xf1m_\xe9P#\x108g\x9a\xd4\x92\xf2Lc\xdb\xa0/\x18e!|\x01\x96nUv\x00\xd5\xaf}\xdb\xc2A\xe0\x81\xe6\xe8\xf5\xf5;\xf4B\xbb<\xd7\xc0\x80\x12\x86\x14\xd9\xc7\x17\xf6n\xf2\x1e\xcd\xcd)\xd4\x97\xad[\xaf$\xcfe\xc3\xa2\x88\x893\x8d\xeef\xd8/-#\xe4[') 07:11:01 executing program 1: r0 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x4, &(0x7f00000000c0)='em0\x00'}, 0x30) r2 = perf_event_open$cgroup(&(0x7f0000000480)={0x1, 0x70, 0x0, 0x3, 0xd6, 0xffffffff, 0x0, 0xfff, 0x800, 0x8, 0x8, 0x8, 0x7fffffff, 0x3, 0x3, 0x3, 0x9, 0x9, 0x1, 0xfffffffffffffff7, 0x7ff, 0x7, 0x0, 0x1edc, 0x1000, 0x6, 0xb505, 0x6, 0x2, 0x6, 0x9, 0x4, 0x8, 0xffffffff, 0xffff, 0xd40d, 0x3, 0xffffffff, 0x0, 0xfffffffffffffff7, 0x4, @perf_bp={&(0x7f0000000140), 0x2}, 0x800, 0x1, 0xa6a6, 0x4, 0x4, 0x7fff, 0x8}, r0, 0x6, r0, 0x4) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x1, 0x80, 0x81, 0xa976, 0x0, 0x0, 0x10000, 0x8, 0x9, 0x9a, 0x2, 0x3, 0x432, 0x7fff, 0x6, 0x262b, 0x7, 0x9f5e, 0x9, 0x5, 0x1b04, 0x8, 0x5, 0x7, 0x4, 0x4, 0x0, 0x100, 0x0, 0x80000000, 0x2, 0x5, 0xcc5, 0x4, 0x20, 0xfffffffffffffffb, 0x0, 0x40, 0x5, @perf_bp, 0x0, 0x6c, 0x800, 0x4, 0x10001, 0x80000000, 0x1ff}, r1, 0x7, r2, 0x3) r3 = openat$cgroup(0xffffffffffffff9c, 0x0, 0x200002, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x200000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000200)="a0706f6a79e35e4e84d65b5081eef8b4c61a610b0de572876d0b4d5e2e1a43e5cd9ce2012156eb726a95188720ac30d0c7ecbfaa8636bca7433f39ab7603f705006612b99fee71", 0x47}, {&(0x7f0000000280)="690b7863abfa04076ee4e9d420db535901889bc7a54ea6d5b8d6a7948dae854426ac0c1bff9a1d917bd578c5059ce4a58ff5a6e5bc65b24d7a9baf15f25525b34b2fcc0b3e96fbaf66132aeb8bbd420d9e4304b5b4e1cd6d17d16cb5b9315364fd61f0a37b126377e5c29251adc10bdc8ea50256663eb1b8900e86e884cfdd46b0fd7dbc84f7f7dda5c04a1a3d2fb598fa9d", 0x92}, {&(0x7f0000000340)}], 0x3}, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000740)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, 0xffffffffffffffff) gettid() perf_event_open(0x0, 0x0, 0xa, 0xffffffffffffff9c, 0x9) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x89f1, &(0x7f0000000580)='ip6_vti0\x00') 07:11:02 executing program 0: ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f0000000080)=ANY=[@ANYBLOB], 0x8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0xa00000000000000) syz_genetlink_get_family_id$nbd(0x0) 07:11:02 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_DEASSIGN_PCI_DEVICE(0xffffffffffffffff, 0x4040ae72, &(0x7f0000000040)={0x0, 0x5, 0xffff}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x119000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) perf_event_open(&(0x7f000001d000)={0x1, 0x2ba, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 07:11:02 executing program 1: r0 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x4, &(0x7f00000000c0)='em0\x00'}, 0x30) r2 = perf_event_open$cgroup(&(0x7f0000000480)={0x1, 0x70, 0x0, 0x3, 0xd6, 0xffffffff, 0x0, 0xfff, 0x800, 0x8, 0x8, 0x8, 0x7fffffff, 0x3, 0x3, 0x3, 0x9, 0x9, 0x1, 0xfffffffffffffff7, 0x7ff, 0x7, 0x0, 0x1edc, 0x1000, 0x6, 0xb505, 0x6, 0x2, 0x6, 0x9, 0x4, 0x8, 0xffffffff, 0xffff, 0xd40d, 0x3, 0xffffffff, 0x0, 0xfffffffffffffff7, 0x4, @perf_bp={&(0x7f0000000140), 0x2}, 0x800, 0x1, 0xa6a6, 0x4, 0x4, 0x7fff, 0x8}, r0, 0x6, r0, 0x4) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x1, 0x80, 0x81, 0xa976, 0x0, 0x0, 0x10000, 0x8, 0x9, 0x9a, 0x2, 0x3, 0x432, 0x7fff, 0x6, 0x262b, 0x7, 0x9f5e, 0x9, 0x5, 0x1b04, 0x8, 0x5, 0x7, 0x4, 0x4, 0x0, 0x100, 0x0, 0x80000000, 0x2, 0x5, 0xcc5, 0x4, 0x20, 0xfffffffffffffffb, 0x0, 0x40, 0x5, @perf_bp, 0x0, 0x6c, 0x800, 0x4, 0x10001, 0x80000000, 0x1ff}, r1, 0x7, r2, 0x3) r3 = openat$cgroup(0xffffffffffffff9c, 0x0, 0x200002, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x200000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000200)="a0706f6a79e35e4e84d65b5081eef8b4c61a610b0de572876d0b4d5e2e1a43e5cd9ce2012156eb726a95188720ac30d0c7ecbfaa8636bca7433f39ab7603f705006612b99fee71", 0x47}, {&(0x7f0000000280)="690b7863abfa04076ee4e9d420db535901889bc7a54ea6d5b8d6a7948dae854426ac0c1bff9a1d917bd578c5059ce4a58ff5a6e5bc65b24d7a9baf15f25525b34b2fcc0b3e96fbaf66132aeb8bbd420d9e4304b5b4e1cd6d17d16cb5b9315364fd61f0a37b126377e5c29251adc10bdc8ea50256663eb1b8900e86e884cfdd46b0fd7dbc84f7f7dda5c04a1a3d2fb598fa9d", 0x92}, {&(0x7f0000000340)}], 0x3}, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000740)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, 0xffffffffffffffff) gettid() perf_event_open(0x0, 0x0, 0xa, 0xffffffffffffff9c, 0x9) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x89f1, &(0x7f0000000580)='ip6_vti0\x00') 07:11:02 executing program 2: r0 = socket$kcm(0xa, 0x2, 0x73) r1 = dup2(r0, r0) sendmmsg$inet6(r1, &(0x7f0000007cc0)=[{{&(0x7f0000000140)={0xa, 0x0, 0x0, @local}, 0x1c, 0x0, 0x0, &(0x7f0000000280)=[@dstopts={{0x18}}, @flowinfo={{0x14, 0x29, 0xb, 0x6}}], 0x30}}], 0x1, 0x0) [ 176.926434] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 177.007682] audit: type=1400 audit(1564297862.132:39): avc: denied { create } for pid=7330 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 177.034879] audit: type=1400 audit(1564297862.132:40): avc: denied { write } for pid=7330 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 177.060011] audit: type=1400 audit(1564297862.132:41): avc: denied { read } for pid=7330 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 07:11:02 executing program 4: setsockopt$netlink_NETLINK_RX_RING(0xffffffffffffffff, 0x10e, 0x6, &(0x7f0000000000)={0x7, 0x3, 0x23}, 0x161ac83420c750b8) flock(0xffffffffffffffff, 0x4) openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000700)='/selinux/avc/hash_stats\x00', 0x0, 0x0) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000340)='/dev/vga_arbiter\x00', 0x200, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000004c0)={0x1}) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) mount$fuse(0x0, 0x0, &(0x7f0000000500)='fuse\x00', 0x0, &(0x7f0000000580)=ANY=[]) ioctl$KDSIGACCEPT(0xffffffffffffffff, 0x4b4e, 0x0) getsockname$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000300)=0xc) openat$selinux_policy(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = perf_event_open(&(0x7f0000000440)={0x1, 0x70, 0x8, 0x1, 0x0, 0x1, 0x0, 0xfa, 0x1, 0x9, 0x9, 0x0, 0x8, 0x6, 0x3f, 0x73, 0x7, 0x5, 0x80, 0xffffffff, 0x6, 0x7, 0x10001, 0x0, 0xb8e6, 0x1f, 0xa8, 0xffffffffffffffe0, 0x0, 0x9, 0x190000000, 0x8, 0x5, 0x0, 0x6, 0x1, 0x8001, 0x3f, 0x0, 0x4, 0x6, @perf_bp={&(0x7f0000000180), 0x2}, 0x1080, 0x29, 0x800, 0x0, 0x1000, 0x8, 0x100}, 0xffffffffffffffff, 0xa, 0xffffffffffffffff, 0x8) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, r1, &(0x7f00000003c0)={0x20000000}) setns(0xffffffffffffffff, 0x48000000) sendmsg(0xffffffffffffffff, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc, 0x80, &(0x7f0000002000)}, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) read(r2, &(0x7f0000000200)=""/250, 0x50c7e3e3) sendfile(r2, r2, &(0x7f0000000400)=0x37, 0x80) socket$netlink(0x10, 0x3, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r4, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) getsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f0000000a00)={{{@in6=@ipv4={[], [], @remote}, @in6=@local}}, {{@in6=@mcast2}, 0x0, @in=@broadcast}}, &(0x7f0000000b00)=0xe8) getresgid(&(0x7f0000000b40), &(0x7f0000000b80), &(0x7f0000000bc0)) getpgid(0x0) fstat(r4, &(0x7f0000000680)) geteuid() stat(&(0x7f0000001580)='./file0\x00', &(0x7f0000000c00)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000001640)) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000001680)={{{@in=@local, @in=@multicast1}}, {{@in=@multicast2}, 0x0, @in6=@remote}}, &(0x7f0000001780)=0xe8) lstat(&(0x7f0000000080)='./file0\x00', 0x0) ioctl$sock_FIOGETOWN(r2, 0x8903, &(0x7f0000001f80)) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000000580)={{{@in=@loopback, @in6=@local}}, {{@in=@initdev}, 0x0, @in6=@initdev}}, &(0x7f00000020c0)=0xe8) getegid() fstat(r3, &(0x7f0000002100)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000002180), &(0x7f00000021c0)=0xc) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000002200)) connect$inet6(r4, &(0x7f0000000380)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000880)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000000000000000003000000003030000ff3f00000000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e000000100000000000000004cebfb3815a5b1b1fed6ea04987a2e0f56664f63d0e0adc2d15a096ce8f923624bd3de00fbcbc9ebe52efae43ab93f7d84b3910def6f6ba852530229b9b1446202b8388ebd5d8c9d7f50fef70d00311ebcba3ef32a6bc028e051f1c351a11fc0dc1533f60510aa4444976ba8dc60cd6ee06913c75ed6cc7a23cf47da861b956744b19cf451e57549fc17ad2420977fb714891e1dd1c77e90eb753d39ede99a795e4095eb46e07e780fc474394e59d038332f1faaa96e6db2680e61522eab90a9116a1ffcd363b043d94402999b71d2d4b77ecc"], 0x153}}, 0x0) sendmmsg(r4, &(0x7f00000092c0), 0x4ff, 0x0) 07:11:02 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=@acquire={0x128, 0x17, 0x1, 0x0, 0x0, {{@in=@multicast1}, @in6=@ipv4={[], [], @dev}, {@in=@loopback, @in6=@local}, {{@in, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x2}}}}, 0x128}}, 0x0) 07:11:02 executing program 5: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000001200)="fa0c000016008152915a655267d7d137ab2ff96e27bf28b285fe3903a44a6017edcaa3a2b4dade3baee72569b51366463fedf5e787c05b0cb5927a3a7edfb4d078e9ae1504d489e058be9fafaa633705b6d4bf6a01f2cd9ebf19724a1b0b9760612582bccd3983ce4474844c065e914dab8bbd52a45f431678bfe28633bf7c8dc83df809238ed87f1e393883ef750ce79c6f84e5e5de176e2f26024e4e3a3d8fbdaf3254022f265d8ccc5fd7205d9d9c2c407ec58162523082d81a39c43f782332ba8e82b4107a049cb82bba8b5edd80473844291437b8d22edca68047582e6be601e9df5e60a32c7cd202c5a30b8b606e43362739551cbb013b65e238f41cc00d7900140cf06b7bc9030f2563bcf9d4f4b7f48c79ec1a323d06276a0a3f8846b7c62b66f9709cabcaad234c53f3bc9b11165a6321f1db1057f076cfaebf8fbfa033fdc1dc2c3e314b36b3b3dd50425447da8bc5938ff7a17361100ab0b1ffeab7ac487411824224781eb9cdd4edef57ae91cd61f56a56c0599cfc3a491447207610f242da6cd6b030ae5f35e3181c44ae68665a023759b9ef4358db46107edc49194aed72b62600ec0ae4fc9065be059fc010cd6e6c9ea77c666b5e25693fbcf595e3e57113ff3a0e0c63d0604a16ea5adb8b7b54d47d4d8804612fde571863064528a49bf684d8a880a11afd819f186c177c49cac3ba1e9d1aa7ad0ff36b9e36d73c05b8abcaf96df0bacd2c9653f30ec29e1284af8749a9b2803c2727e992a6e65df192e1875c3e6d3553ffb7cb34ffee8f8ac0123c390454b42a0316952cbc9949376d9320ec207f77c2d5eb9e86d720cf8e9008a9a51932b45cd4cab21414c92d1c20f9e15e3fc16c7ce181e9ab19b01b70343934c823b1215e173405dd225233823cd4a604a77f06b14eb05b860e6cf8790335788c43abe9de1598e9952e5c7e6b2f8b17b1008ff3033e7d1635b008834bdf4054e6195e55000827c6202b227dde06f23ae21c00b371bdb6b7ea47b2e78844b52a77f9f0929790dcd7df2752e4af092d539c87c18751a5eb3eb4d38a2a0e070064b4ffaacff0543b115cc89f6c7e78f12147ebfcf1c80bac8f98deb59cbe670adb4cd1882a7e0ca4ba85ae9d445223ffb32301d46c0c9b05a830cbea0f72294ab3b539e4ed7cac2e22b235e8ceedeb643fb90b061a58368e76036ff3c1828d8a4e21288662afb6f2acab00d734db7ffc8373a928571819ce9ea6cb0956a6093b2b1f65662b76bc6ac8a171451714e1d0e4ff76470c7651d3cf16f37cb5547317e4fef51e4fb471de6ffbb90c2dd4a64266c4c2f75fc62e58ec306fb92212fb262d8b138899a3b53e67cde2f97d94cd2265cc04d32b29edf77e75b1f88372495cb2937f183bfc8604d72efb3af5c1f41b665b25592676b0ad2185478eade7e663e743e0e09cce6224c787ce1d789d421a62a7bedae76b39bac4a9b350bfe3a75f551341b11dd96cdaea17989dad565b16324a69842dc29a0ed16744ea5935598ac8238e146139189927a14d3b2863044b63b468ae75f48fab68ad235c36daffebfe4b468fc9b13198b1a683dcd3b3b4294ba22caddbacf8792d5783bc12e2538e4609e6bb6e9eeab98a06452c252a657f400260458c29fae8879097698c9aba2b2d889fc78f00d0d8271e09e8542b71018be6ff8cb03cb423e79303047d6ce124a00f64461b899bbddc4fe87ff677533391e16c01fa9cd6420bdc856c4c7f057b249ee9817efd6ab2cd02eb887d2631435ef2d5a1c7e57ac046ef615a1285ca89ade18ae69af3b3f8f76ca8aa060e373c0f99424fe1c5fadc72fe145fd2d4e4da4b78597890516857de188fcdaf15e3b0871b346cd39ab772cc25fab49e60c818cde934b137144adfc4fbde3ddbeccce9679f02b66746e822c67b3ed5fdafb4a936a2683b39a002115ecd62220605ca542610a80f2e3530aa89d3ed6ed9c57bbfd5db3a0b62786a608309a355443c616032008f9458b2f10db93e29470192370084e9322c309c9b23333b46d04e79176659503ad4b05deebb3c67d715ee6e84a89002ea6f7f71bf41ad36b42c8ae01c97174dbb641e50641aba60c291a84e906c013087370a5043e07d36fcead378f6c1e6ed3f5ac695124b82b20261cf7c9b82172e09c81d7d39eed72aee5678613a3c671ddd44f2c7c75a3b5d316aa165d56594fccab20903d7f503a08928e76c779918b2463b720ee6367a43e494a1db3ed1a80690e665570c01ce7eb979cdd95d4e1ca51730eb2cd63ffb2a56049601627c9788254945142dce85adbe1eb5997d16cdfe2a3758b13dc6bb121e2206ae64206868c1c5e89a101bc121719ac435dcad093f5f67cefd863cc7c8f3fc8a9dc62a83c115f1ce714b18af067951aa06dd9bb4ed98a820bf4704d156977caa4e6415b2a0df0386e2f6a061bf44abc8a397cf4abdafc51b78ebec9831f3c60fde6e62a1fd082903080aef20ff8de8bc0dced06f627514600539ca7114a088848da4244a85b4cf5b976d3a698c9a568d417e276917baba05d1a02181db2e6cc35986da4ccc63f8cd8e85a4a923dd27e2f499664601fdc44fdf46e2d2880cd5a7ece89c370234c438dcc0b43865cc62bad21e9dc37da758cbe01752f02fd9cbfe98630a30a78bb1239e25cdaba3d45d13cd3e7216d9d8070f3ff1a0cd9a0c91f29974c98f2677ba88c1091bde4be0cd37ea5eeb3b9cd59560a00ddd40bbd60ffb8d4daa973ef0977c18dd4b38a605cee957872dca85787c37b6931293eddb77015faf143d1d28d24822d1a5d134799e8175a38b255aaf0e39b68c7f734e2e1e7044626daa84c9113e86d86ef63c86010000000000000061dcf516c32d49478f7af30d52baa18ea6b0fc286c06b7e4ee019bf3fe74845a652d4a52aaa241a189c411e90e2953863a2bc4124e573607b94cdff19e280709004931a83f056cb5857672619b97ce38081592c0c319ce72e04e9eadce89775cfb5a4b2842663bc79bde565435cbcd46c4d505ceef7dde86512d39d4cb270deb7e79ebf8602bdc0d76c3e833d36ee08be10be634f44056c2f3fd6a328c7cd562e9c96ff7845fc3df81a876bb07f1cc833bed6ca1dc5cf935a4e959db6a4fae6edbc45357d8758faa9cd04cd41eb6efcfbd91658519bf520b90107f767d126854818485e98cb7ef56804de6950bf4e72098a949d14ea0e4e9f2534cf16cac0aeb970fc5c39f37e93910d5c99ac163792260d2280ec5c9a79bf295588ec23f524aae65f800f9c39e338f3d66b1a69e5488e04823eab36ae6ec6a2c5ce133ccd819a2b217b1ab7f4afd1697bb42929b3131358b5421c83f925571934442d0fd0ce3990d4e5d31d8b956f76df3c2f8533e46b892c88692ce009155dd5c7dbe4c86874b95762650f63e4b4aabb41320978b05b80cfe8fa2830904ef6b5c4f7ad46ca5dac151c9077c4d2c6adfe5066a8eb09a9bc6892330ea2b259a53c7137f8498254e1b04bf920c35c5333d4d640b11da60917ae921037b4aedbd6a0fbeeaf88ef6defc830552b4cbe3fe2a844806a48923dd428ea1c8d797bd8e6aabd1d1a8c97c8038b627120a77f4e47fa1f788aa9da268b0ec10fc453cb722685df76547dbf55a16663aa2b2a51e9c52456cccdf682592d1369dd12e3d3cb504e0f2d7004e62c297d5a25d0298045dae8fca8cb795ea57288b85a7e705820087d55ca6c42e920e2aa1174e128622cf64a197fd728cb2949536ba63e8bda8589261f1377caea37302e47228d3708a5666c66ba711d3c0b310a8c47e86d26597299d523c28c90e4feab43e950f398f7b61ccf7e6490d75ba6d8214e2d5ef2d7a088db490e1ebacf4e6eecc896cb1c704f0a8fcdf4ccb5dfa53eaf43d709287f36c10188c19fd59da7d73494de089c1b0a69ee22dcb847001c5317846a876bee1685d11c4db0673ec4c3a12008bb719650525b3c39e2b0469edda93830b3f1bde3e5b0b4637197866bb08c5858cf0d9876e3c7cad54169887bf9c80f9f4be362e1bc8c27f3434e9a918bac355c184bd899b9aebe6be20e70c0c69234342eb8b57aa9ffb7797a32df91cec2bbc90201658ca2297bf1fe68e65363867e1f6ad79b827f363d64fbd3b188d95307d011c4ce5bf4407908c058eeb97ec98dd0ebfdab6b348fa387f2a7573cac25344c983e8fd526c30ee6d59fe99a30c7d7e2864aa22bfa49df5f32da68309cab3ed9c2ce69b6ecb8508ce28a43ebd6c809b8afd07a4606e664965d316f3707a3abee9bcdc32a78031b0171fb565d90c16cd56e5792c0cf618b799715f32538e38f493d4e19ec76fc8a07576a13975706bfc2bb1516c2d18a4385cc37a206eac6c9fb8d073576a1f56d529e407154fdd0c40d079ae44962c26743b4bf5950ac5ee34c5d7bd60b364ce670958112c37b9829bed7e1327356d6b94af3ba020c2337b2dba37d00af8a128a614390cdde62ce871f948427fb5c187df9a1540a5cc71da1a86144acbfd94bf433f744f0c4f2a675eba3ed251c5b11b08dfefc726c0394a9b75121d88467ed4b2cd69819dfe50693a4a4c8370d3af12f41c0067283bbb5a90044a340fc357a11081a6c13bb9c32d9caa448479fd5f0302b6729ca7233094540b14546d6bcc15771c2686279b34f9c0914f5306d0fabd5979266ea01a17a22507e560dbf904dd62c40e2bcc", 0xcfa}], 0x1}, 0x0) 07:11:02 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_DEASSIGN_PCI_DEVICE(0xffffffffffffffff, 0x4040ae72, &(0x7f0000000040)={0x0, 0x5, 0xffff}) ioctl$KVM_REGISTER_COALESCED_MMIO(0xffffffffffffffff, 0x4010ae67, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) perf_event_open(&(0x7f000001d000)={0x1, 0x2ba, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 07:11:02 executing program 2: unshare(0x600) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000008000)={0x1, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000000007c9c07000000000000019500000000000000"], &(0x7f0000000140)='GPL\x00', 0x1, 0xc3, &(0x7f0000000240)=""/195}, 0x48) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000009000)=r0, 0x4) 07:11:02 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r1, &(0x7f0000000080)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x1e}}}, 0x24) sendmmsg(r1, &(0x7f0000005c00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[{0x18, 0x110, 0x1, 'w'}], 0x18}}], 0x1, 0x0) recvmmsg(r1, &(0x7f00000031c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 07:11:02 executing program 5: r0 = socket$kcm(0xa, 0x2, 0x73) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x69) connect(r0, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @dev, 0x6}, 0x80) r1 = dup2(r0, r0) write$USERIO_CMD_REGISTER(r1, 0x0, 0x20480) 07:11:02 executing program 2: r0 = syz_open_dev$evdev(&(0x7f0000000500)='/dev/input/event#\x00', 0x0, 0x0) r1 = dup(r0) ioctl$TIOCSBRK(r1, 0x40044591) [ 177.344733] kasan: CONFIG_KASAN_INLINE enabled [ 177.356932] kasan: GPF could be caused by NULL-ptr deref or user memory access [ 177.383698] general protection fault: 0000 [#1] PREEMPT SMP KASAN [ 177.390059] Modules linked in: [ 177.393275] CPU: 1 PID: 7361 Comm: syz-executor.0 Not tainted 4.14.134 #30 [ 177.400292] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 177.409656] task: ffff8880a5ef8380 task.stack: ffff888058518000 [ 177.411499] kvm: emulating exchange as write [ 177.415732] RIP: 0010:rxrpc_connect_call+0xc9/0x41a0 [ 177.415737] RSP: 0018:ffff88805851f738 EFLAGS: 00010206 [ 177.415756] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffc90005e45000 [ 177.423390] kobject: 'kvm' (ffff8880a6e8c2d0): kobject_uevent_env [ 177.425280] RDX: 0000000000000003 RSI: ffffffff8593c089 RDI: 0000000000000018 [ 177.425287] RBP: ffff88805851f880 R08: 0000000000000001 R09: ffff8880a5ef8c20 [ 177.425292] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88808a299c00 [ 177.425297] R13: ffff88805dfa84a0 R14: ffff88805dfa8490 R15: ffff88805851f998 [ 177.425308] FS: 00007f01189ad700(0000) GS:ffff8880aef00000(0000) knlGS:0000000000000000 [ 177.431339] kobject: 'kvm' (ffff8880a6e8c2d0): fill_kobj_path: path = '/devices/virtual/misc/kvm' [ 177.437937] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 177.437944] CR2: 00007f1ae4865000 CR3: 00000000938ee000 CR4: 00000000001426e0 [ 177.437955] Call Trace: [ 177.506174] ? release_sock+0x14a/0x1b0 [ 177.510154] ? rxrpc_discard_expired_client_conns+0x7e0/0x7e0 [ 177.516037] ? __local_bh_enable_ip+0x99/0x1a0 [ 177.520790] ? trace_hardirqs_on_caller+0x400/0x590 [ 177.525828] ? release_sock+0x14a/0x1b0 [ 177.529808] ? trace_hardirqs_on+0xd/0x10 [ 177.533969] ? __local_bh_enable_ip+0x99/0x1a0 [ 177.538554] ? _raw_spin_unlock_bh+0x31/0x40 [ 177.543048] rxrpc_new_client_call+0x8f7/0x1420 [ 177.547719] ? rxrpc_do_sendmsg+0x91a/0x1103 [ 177.552120] rxrpc_do_sendmsg+0x91a/0x1103 [ 177.556359] ? rxrpc_kernel_send_data+0x470/0x470 [ 177.561202] ? __local_bh_enable_ip+0x99/0x1a0 [ 177.565957] rxrpc_sendmsg+0x48a/0x650 [ 177.569839] ? security_socket_sendmsg+0x89/0xb0 [ 177.574620] ? rxrpc_sock_destructor+0x130/0x130 [ 177.579370] sock_sendmsg+0xce/0x110 [ 177.583077] ___sys_sendmsg+0x349/0x840 [ 177.587065] ? copy_msghdr_from_user+0x3f0/0x3f0 [ 177.591819] ? __fget+0x210/0x370 [ 177.595280] ? lock_downgrade+0x6e0/0x6e0 [ 177.599424] ? __fget+0x237/0x370 [ 177.602877] ? __fget_light+0x172/0x1f0 [ 177.606852] ? __fdget+0x1b/0x20 [ 177.610229] ? sockfd_lookup_light+0xb4/0x160 [ 177.614740] __sys_sendmmsg+0x152/0x3a0 [ 177.618712] ? SyS_sendmsg+0x50/0x50 [ 177.622426] ? kasan_check_read+0x11/0x20 [ 177.626568] ? _copy_to_user+0x87/0xd0 [ 177.630455] ? put_timespec64+0xb4/0x100 [ 177.634517] ? nsecs_to_jiffies+0x30/0x30 [ 177.638664] ? SyS_clock_gettime+0xf8/0x180 [ 177.642983] SyS_sendmmsg+0x35/0x60 [ 177.646601] ? __sys_sendmmsg+0x3a0/0x3a0 [ 177.650745] do_syscall_64+0x1e8/0x640 [ 177.654628] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 177.659503] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 177.664688] RIP: 0033:0x459829 [ 177.667871] RSP: 002b:00007f01189acc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 177.675576] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000459829 [ 177.682839] RDX: 0000000000000001 RSI: 0000000020005c00 RDI: 0000000000000004 07:11:02 executing program 3: write(0xffffffffffffffff, 0x0, 0x0) fsetxattr(0xffffffffffffffff, 0x0, &(0x7f0000000300)='\x00', 0x1, 0x0) r0 = gettid() r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = memfd_create(&(0x7f0000000380)='\x00', 0x0) ftruncate(r2, 0x1000000) sendfile(r1, r2, 0x0, 0xfffffdef) getpgrp(r0) r3 = syz_open_dev$sndtimer(&(0x7f00000004c0)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r3, 0x40345410, 0x0) ioctl$SNDRV_TIMER_IOCTL_PAUSE(0xffffffffffffffff, 0x54a1) keyctl$get_security(0x11, 0x0, &(0x7f00000003c0)=""/243, 0xf3) [ 177.690110] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 177.697384] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f01189ad6d4 [ 177.704655] R13: 00000000004c6fe8 R14: 00000000004dc518 R15: 00000000ffffffff [ 177.711933] Code: e8 03 80 3c 18 00 0f 85 6f 39 00 00 48 8b 85 28 ff ff ff 48 8b 18 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 18 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 8a 39 00 00 48 8b 5b 18 48 8d bb 00 02 00 00 [ 177.732684] RIP: rxrpc_connect_call+0xc9/0x41a0 RSP: ffff88805851f738 07:11:02 executing program 5: r0 = open$dir(&(0x7f00000001c0)='.\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000000040)='./file1\x00', 0x0) renameat2(r0, &(0x7f0000000080)='./file1\x00', r0, &(0x7f0000000100)='./file0\x00', 0x4) futimesat(r0, &(0x7f0000000000)='./file1\x00', 0x0) [ 177.745078] kobject: 'loop3' (ffff8880a4a2ef20): kobject_uevent_env [ 177.761114] kobject: 'loop3' (ffff8880a4a2ef20): fill_kobj_path: path = '/devices/virtual/block/loop3' [ 177.764580] kobject: 'kvm' (ffff8880a6e8c2d0): kobject_uevent_env [ 177.779134] kobject: 'kvm' (ffff8880a6e8c2d0): fill_kobj_path: path = '/devices/virtual/misc/kvm' 07:11:02 executing program 5: perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = creat(&(0x7f0000000300)='./file0\x00', 0x0) r2 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r1}) [ 177.806511] kobject: 'loop5' (ffff8880a4ad09a0): kobject_uevent_env [ 177.832911] ---[ end trace 7d091a6400301bdd ]--- [ 177.837907] Kernel panic - not syncing: Fatal exception [ 177.844347] Kernel Offset: disabled [ 177.848071] Rebooting in 86400 seconds..