[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 36.026745][ T26] audit: type=1800 audit(1570191861.747:25): pid=7212 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2447 res=0 [ 36.049571][ T26] audit: type=1800 audit(1570191861.747:26): pid=7212 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2490 res=0 [ 36.049585][ T26] audit: type=1800 audit(1570191861.747:27): pid=7212 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2469 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.10.0' (ECDSA) to the list of known hosts. 2019/10/04 12:24:31 fuzzer started 2019/10/04 12:24:33 dialing manager at 10.128.0.105:38119 2019/10/04 12:24:33 syscalls: 2523 2019/10/04 12:24:33 code coverage: enabled 2019/10/04 12:24:33 comparison tracing: enabled 2019/10/04 12:24:33 extra coverage: extra coverage is not supported by the kernel 2019/10/04 12:24:33 setuid sandbox: enabled 2019/10/04 12:24:33 namespace sandbox: enabled 2019/10/04 12:24:33 Android sandbox: /sys/fs/selinux/policy does not exist 2019/10/04 12:24:33 fault injection: enabled 2019/10/04 12:24:33 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/10/04 12:24:33 net packet injection: enabled 2019/10/04 12:24:33 net device setup: enabled 2019/10/04 12:24:33 concurrency sanitizer: enabled 12:24:36 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080)='SEG6\x00') sendmsg$SEG6_CMD_SETHMAC(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x2c, r1, 0x811, 0x0, 0x0, {}, [@SEG6_ATTR_ALGID={0x8}, @SEG6_ATTR_SECRETLEN={0x8, 0x5, 0x60}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x2}]}, 0x2c}}, 0x0) syzkaller login: [ 51.389682][ T7387] IPVS: ftp: loaded support on port[0] = 21 12:24:37 executing program 1: setresgid(0x0, 0xee00, 0x0) setuid(0xee01) r0 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f00000002c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) r1 = getuid() keyctl$chown(0x4, r0, r1, 0x0) [ 51.476752][ T7387] chnl_net:caif_netlink_parms(): no params data found [ 51.540068][ T7387] bridge0: port 1(bridge_slave_0) entered blocking state [ 51.555191][ T7387] bridge0: port 1(bridge_slave_0) entered disabled state [ 51.575172][ T7387] device bridge_slave_0 entered promiscuous mode [ 51.595887][ T7387] bridge0: port 2(bridge_slave_1) entered blocking state [ 51.603405][ T7387] bridge0: port 2(bridge_slave_1) entered disabled state [ 51.612467][ T7387] device bridge_slave_1 entered promiscuous mode [ 51.634685][ T7387] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 51.645654][ T7387] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 51.669390][ T7387] team0: Port device team_slave_0 added [ 51.677348][ T7387] team0: Port device team_slave_1 added 12:24:37 executing program 2: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x2, [@struct={0x0, 0x1, 0x0, 0x4, 0x0, 0x0, [{0x0, 0x2}]}, @ptr={0x0, 0x0, 0x0, 0xa}]}}, &(0x7f0000000080)=""/236, 0x3e, 0xec, 0x1}, 0x20) [ 51.737935][ T7387] device hsr_slave_0 entered promiscuous mode [ 51.775477][ T7387] device hsr_slave_1 entered promiscuous mode [ 51.822420][ T7387] bridge0: port 2(bridge_slave_1) entered blocking state [ 51.829576][ T7387] bridge0: port 2(bridge_slave_1) entered forwarding state [ 51.837043][ T7387] bridge0: port 1(bridge_slave_0) entered blocking state [ 51.844131][ T7387] bridge0: port 1(bridge_slave_0) entered forwarding state [ 51.894256][ T7390] IPVS: ftp: loaded support on port[0] = 21 [ 51.984496][ T7387] 8021q: adding VLAN 0 to HW filter on device bond0 [ 52.035519][ T2633] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 52.044694][ T2633] bridge0: port 1(bridge_slave_0) entered disabled state 12:24:37 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000280)={0xf, 0x4, 0x4, 0x400, 0x0, 0x1}, 0x3c) socket$rxrpc(0x21, 0x2, 0x800000000a) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r0, &(0x7f0000000140), 0x1c) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x5}, 0xfffffffffffffdcb) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x10020000000, 0x0}, 0x2c) close(r0) [ 52.076316][ T2633] bridge0: port 2(bridge_slave_1) entered disabled state [ 52.095777][ T2633] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 52.113224][ T7387] 8021q: adding VLAN 0 to HW filter on device team0 [ 52.158405][ T2633] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 52.180629][ T2633] bridge0: port 1(bridge_slave_0) entered blocking state [ 52.187997][ T2633] bridge0: port 1(bridge_slave_0) entered forwarding state [ 52.232557][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 52.247933][ T17] bridge0: port 2(bridge_slave_1) entered blocking state [ 52.255173][ T17] bridge0: port 2(bridge_slave_1) entered forwarding state [ 52.338747][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 52.350120][ T7395] IPVS: ftp: loaded support on port[0] = 21 [ 52.357939][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 52.383898][ T7387] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 52.396162][ T7396] IPVS: ftp: loaded support on port[0] = 21 [ 52.396674][ T7387] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 52.428016][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 52.437652][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 52.447477][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 52.466891][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 52.477481][ T7390] chnl_net:caif_netlink_parms(): no params data found 12:24:38 executing program 4: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000002c0)={'veth0_to_bridge\x00', 0x0}) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f00000000c0)={r3, 0x1, 0x6, @remote}, 0x10) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000180)={r3, 0x1, 0x6, @dev}, 0x10) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f0000000040)={r3, 0x1, 0x6, @remote}, 0x10) [ 52.557990][ T7387] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 52.619854][ T7390] bridge0: port 1(bridge_slave_0) entered blocking state [ 52.629389][ T7390] bridge0: port 1(bridge_slave_0) entered disabled state [ 52.638115][ T7390] device bridge_slave_0 entered promiscuous mode [ 52.678631][ T7390] bridge0: port 2(bridge_slave_1) entered blocking state [ 52.695395][ T7390] bridge0: port 2(bridge_slave_1) entered disabled state [ 52.716831][ T7390] device bridge_slave_1 entered promiscuous mode [ 52.763266][ T7395] chnl_net:caif_netlink_parms(): no params data found [ 52.828578][ T7390] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 52.887805][ T7396] chnl_net:caif_netlink_parms(): no params data found [ 52.901787][ T7390] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 52.930437][ T7407] netlink: 'syz-executor.0': attribute type 6 has an invalid length. [ 52.952853][ T7407] netlink: 'syz-executor.0': attribute type 5 has an invalid length. [ 52.987156][ T7408] netlink: 'syz-executor.0': attribute type 6 has an invalid length. [ 52.996277][ T7395] bridge0: port 1(bridge_slave_0) entered blocking state [ 52.996332][ T7395] bridge0: port 1(bridge_slave_0) entered disabled state [ 53.019887][ T7395] device bridge_slave_0 entered promiscuous mode [ 53.027235][ T7408] netlink: 'syz-executor.0': attribute type 5 has an invalid length. [ 53.044683][ T7390] team0: Port device team_slave_0 added [ 53.054512][ T7395] bridge0: port 2(bridge_slave_1) entered blocking state [ 53.063012][ T7395] bridge0: port 2(bridge_slave_1) entered disabled state [ 53.074405][ T7395] device bridge_slave_1 entered promiscuous mode 12:24:38 executing program 5: r0 = socket$unix(0x1, 0x5, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) close(r0) openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/cuse\x00', 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) 12:24:38 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080)='SEG6\x00') sendmsg$SEG6_CMD_SETHMAC(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x2c, r1, 0x811, 0x0, 0x0, {}, [@SEG6_ATTR_ALGID={0x8}, @SEG6_ATTR_SECRETLEN={0x8, 0x5, 0x60}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x2}]}, 0x2c}}, 0x0) [ 53.090005][ T7390] team0: Port device team_slave_1 added [ 53.111312][ T7396] bridge0: port 1(bridge_slave_0) entered blocking state [ 53.118820][ T7396] bridge0: port 1(bridge_slave_0) entered disabled state [ 53.127794][ T7396] device bridge_slave_0 entered promiscuous mode [ 53.180209][ T7396] bridge0: port 2(bridge_slave_1) entered blocking state [ 53.187589][ T7396] bridge0: port 2(bridge_slave_1) entered disabled state [ 53.197765][ T7396] device bridge_slave_1 entered promiscuous mode 12:24:39 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080)='SEG6\x00') sendmsg$SEG6_CMD_SETHMAC(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x2c, r1, 0x811, 0x0, 0x0, {}, [@SEG6_ATTR_ALGID={0x8}, @SEG6_ATTR_SECRETLEN={0x8, 0x5, 0x60}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x2}]}, 0x2c}}, 0x0) [ 53.227326][ T7413] netlink: 'syz-executor.0': attribute type 6 has an invalid length. [ 53.235596][ T7413] netlink: 'syz-executor.0': attribute type 5 has an invalid length. [ 53.248140][ T7390] device hsr_slave_0 entered promiscuous mode [ 53.295469][ T7390] device hsr_slave_1 entered promiscuous mode [ 53.357960][ T7390] debugfs: Directory 'hsr0' with parent '/' already present! [ 53.367093][ T7395] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 53.378874][ T7417] netlink: 'syz-executor.0': attribute type 6 has an invalid length. [ 53.382409][ T7395] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 53.396313][ T7417] netlink: 'syz-executor.0': attribute type 5 has an invalid length. [ 53.419362][ T7409] IPVS: ftp: loaded support on port[0] = 21 [ 53.446940][ T7396] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 53.461422][ T7414] IPVS: ftp: loaded support on port[0] = 21 12:24:39 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080)='SEG6\x00') sendmsg$SEG6_CMD_SETHMAC(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x2c, r1, 0x811, 0x0, 0x0, {}, [@SEG6_ATTR_ALGID={0x8}, @SEG6_ATTR_SECRETLEN={0x8, 0x5, 0x60}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x2}]}, 0x2c}}, 0x0) [ 53.468095][ T7390] bridge0: port 2(bridge_slave_1) entered blocking state [ 53.475186][ T7390] bridge0: port 2(bridge_slave_1) entered forwarding state [ 53.482592][ T7390] bridge0: port 1(bridge_slave_0) entered blocking state [ 53.489766][ T7390] bridge0: port 1(bridge_slave_0) entered forwarding state [ 53.512167][ T7419] netlink: 'syz-executor.0': attribute type 6 has an invalid length. [ 53.521259][ T7395] team0: Port device team_slave_0 added [ 53.522153][ T7419] netlink: 'syz-executor.0': attribute type 5 has an invalid length. [ 53.539358][ T7392] bridge0: port 1(bridge_slave_0) entered disabled state [ 53.547424][ T7392] bridge0: port 2(bridge_slave_1) entered disabled state 12:24:39 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080)='SEG6\x00') sendmsg$SEG6_CMD_SETHMAC(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x2c, r1, 0x811, 0x0, 0x0, {}, [@SEG6_ATTR_ALGID={0x8}, @SEG6_ATTR_SECRETLEN={0x8, 0x5, 0x60}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x2}]}, 0x2c}}, 0x0) [ 53.573224][ T7396] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 53.604442][ T7395] team0: Port device team_slave_1 added 12:24:39 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080)='SEG6\x00') sendmsg$SEG6_CMD_SETHMAC(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x2c, r1, 0x811, 0x0, 0x0, {}, [@SEG6_ATTR_ALGID={0x8}, @SEG6_ATTR_SECRETLEN={0x8, 0x5, 0x60}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x2}]}, 0x2c}}, 0x0) [ 53.643622][ T7396] team0: Port device team_slave_0 added [ 53.683409][ T7396] team0: Port device team_slave_1 added 12:24:39 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080)='SEG6\x00') sendmsg$SEG6_CMD_SETHMAC(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x2c, r1, 0x811, 0x0, 0x0, {}, [@SEG6_ATTR_ALGID={0x8}, @SEG6_ATTR_SECRETLEN={0x8, 0x5, 0x60}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x2}]}, 0x2c}}, 0x0) [ 53.758928][ T7390] 8021q: adding VLAN 0 to HW filter on device bond0 [ 53.798594][ T7396] device hsr_slave_0 entered promiscuous mode 12:24:39 executing program 0: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$erofs(&(0x7f0000000340)='erofs\x00', &(0x7f0000000380)='./file0\x00', 0x0, 0x0, 0x0, 0x4000, &(0x7f0000000980)={[], [{@permit_directio='permit_directio'}, {@smackfsdef={'smackfsdef', 0x3d, '/dev/loop-control\x00'}}, {@fsmagic={'fsmagic', 0x3d, 0x100}}]}) [ 53.835742][ T7396] device hsr_slave_1 entered promiscuous mode [ 53.896562][ T7396] debugfs: Directory 'hsr0' with parent '/' already present! [ 53.947673][ T7395] device hsr_slave_0 entered promiscuous mode [ 53.963266][ T7434] erofs: read_super, device -> /dev/loop0 [ 53.971715][ T7434] erofs: options -> permit_directio,smackfsdef=/dev/loop-control [ 53.980039][ T7395] device hsr_slave_1 entered promiscuous mode [ 53.986882][ T7434] erofs: cannot find valid erofs superblock [ 54.035634][ T7395] debugfs: Directory 'hsr0' with parent '/' already present! [ 54.050871][ T7390] 8021q: adding VLAN 0 to HW filter on device team0 [ 54.082487][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 54.098275][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 54.192289][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 54.201129][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 54.210273][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.217626][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 54.225809][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 54.234852][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 54.243339][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.250558][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 54.258497][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 54.274355][ T7395] 8021q: adding VLAN 0 to HW filter on device bond0 [ 54.312542][ T7396] 8021q: adding VLAN 0 to HW filter on device bond0 [ 54.327465][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 54.338133][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 54.347044][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 54.356080][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 54.364674][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 54.373809][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 54.390403][ T7414] chnl_net:caif_netlink_parms(): no params data found [ 54.412157][ T7395] 8021q: adding VLAN 0 to HW filter on device team0 [ 54.424893][ T7409] chnl_net:caif_netlink_parms(): no params data found [ 54.438026][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 54.446787][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 54.455370][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 54.463367][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 54.471435][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 54.480216][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 54.489096][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 54.498174][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 54.508397][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.515662][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 54.523986][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 54.541345][ T7396] 8021q: adding VLAN 0 to HW filter on device team0 [ 54.558120][ T7390] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 54.567748][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 54.577101][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 54.585990][ T5] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.593135][ T5] bridge0: port 2(bridge_slave_1) entered forwarding state [ 54.601203][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 54.609116][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 54.616793][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 54.661965][ T7409] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.669266][ T7409] bridge0: port 1(bridge_slave_0) entered disabled state [ 54.677894][ T7409] device bridge_slave_0 entered promiscuous mode [ 54.685431][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 54.694344][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 54.703140][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 54.711846][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.718904][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 54.726748][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 54.735605][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 54.743994][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 54.755014][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 54.763670][ T5] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.770774][ T5] bridge0: port 2(bridge_slave_1) entered forwarding state [ 54.778773][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 54.787581][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 54.796675][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 54.806447][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 54.814747][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 54.823469][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 54.831565][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 54.849446][ T7409] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.856698][ T7409] bridge0: port 2(bridge_slave_1) entered disabled state [ 54.865146][ T7409] device bridge_slave_1 entered promiscuous mode [ 54.888014][ T7409] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 54.897402][ T7421] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 54.906889][ T7421] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 54.916014][ T7421] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 54.931663][ T7395] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 54.941835][ T7409] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 54.956785][ T7414] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.963839][ T7414] bridge0: port 1(bridge_slave_0) entered disabled state [ 54.972026][ T7414] device bridge_slave_0 entered promiscuous mode [ 54.979834][ T7414] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.987641][ T7414] bridge0: port 2(bridge_slave_1) entered disabled state [ 54.996071][ T7414] device bridge_slave_1 entered promiscuous mode [ 55.010359][ T7421] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 55.019063][ T7421] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 55.028337][ T7421] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 55.037188][ T7421] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 55.046840][ T7421] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 55.062343][ T7396] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 55.072924][ T7396] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 55.106411][ T7414] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 55.116149][ T7421] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 55.127514][ T7421] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 55.136445][ T7421] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 55.144655][ T7421] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 55.162297][ T7390] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 55.170558][ T7409] team0: Port device team_slave_0 added [ 55.178771][ T7414] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 55.191695][ T7395] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 55.200359][ T7421] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 55.210375][ T7409] team0: Port device team_slave_1 added [ 55.231736][ T7396] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 55.308173][ T7409] device hsr_slave_0 entered promiscuous mode [ 55.335618][ T7409] device hsr_slave_1 entered promiscuous mode [ 55.375332][ T7409] debugfs: Directory 'hsr0' with parent '/' already present! [ 55.384210][ T7414] team0: Port device team_slave_0 added [ 55.391261][ T7414] team0: Port device team_slave_1 added [ 55.441884][ T7409] bridge0: port 2(bridge_slave_1) entered blocking state [ 55.448994][ T7409] bridge0: port 2(bridge_slave_1) entered forwarding state [ 55.456319][ T7409] bridge0: port 1(bridge_slave_0) entered blocking state [ 55.463371][ T7409] bridge0: port 1(bridge_slave_0) entered forwarding state [ 55.572540][ T7414] device hsr_slave_0 entered promiscuous mode 12:24:41 executing program 1: setresgid(0x0, 0xee00, 0x0) setuid(0xee01) r0 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f00000002c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) r1 = getuid() keyctl$chown(0x4, r0, r1, 0x0) 12:24:41 executing program 0: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$erofs(&(0x7f0000000340)='erofs\x00', &(0x7f0000000380)='./file0\x00', 0x0, 0x0, 0x0, 0x4000, &(0x7f0000000980)={[], [{@permit_directio='permit_directio'}, {@smackfsdef={'smackfsdef', 0x3d, '/dev/loop-control\x00'}}, {@fsmagic={'fsmagic', 0x3d, 0x100}}]}) [ 55.636198][ T7414] device hsr_slave_1 entered promiscuous mode [ 55.685848][ T7414] debugfs: Directory 'hsr0' with parent '/' already present! [ 55.707458][ T7421] bridge0: port 1(bridge_slave_0) entered disabled state [ 55.719760][ T7421] bridge0: port 2(bridge_slave_1) entered disabled state [ 55.767994][ T7472] erofs: read_super, device -> /dev/loop0 [ 55.773755][ T7472] erofs: options -> permit_directio,smackfsdef=/dev/loop-control [ 55.782131][ T7472] erofs: cannot find valid erofs superblock [ 55.824336][ T7409] 8021q: adding VLAN 0 to HW filter on device bond0 12:24:41 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000280)={0xf, 0x4, 0x4, 0x400, 0x0, 0x1}, 0x3c) socket$rxrpc(0x21, 0x2, 0x800000000a) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r0, &(0x7f0000000140), 0x1c) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x5}, 0xfffffffffffffdcb) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x10020000000, 0x0}, 0x2c) close(r0) [ 55.873927][ T7421] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 55.888073][ T7421] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 55.931557][ T7409] 8021q: adding VLAN 0 to HW filter on device team0 [ 55.962452][ T7414] 8021q: adding VLAN 0 to HW filter on device bond0 [ 55.975020][ T2633] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 56.010806][ T2633] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 56.045750][ T2633] bridge0: port 1(bridge_slave_0) entered blocking state [ 56.052874][ T2633] bridge0: port 1(bridge_slave_0) entered forwarding state [ 56.083898][ T7414] 8021q: adding VLAN 0 to HW filter on device team0 [ 56.100802][ T7393] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 56.110640][ T7393] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 56.121004][ T7393] bridge0: port 2(bridge_slave_1) entered blocking state [ 56.128089][ T7393] bridge0: port 2(bridge_slave_1) entered forwarding state [ 56.136924][ T7393] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 56.146504][ T7393] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 56.155537][ T7393] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 56.164005][ T7393] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 56.173198][ T7393] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 56.182107][ T7393] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 56.191070][ T7393] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 56.199549][ T7393] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 56.208053][ T7393] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 56.218356][ T7393] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 56.228005][ T2633] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 56.236737][ T2633] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 56.245404][ T2633] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 56.272260][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 56.281057][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 56.289833][ T7392] bridge0: port 1(bridge_slave_0) entered blocking state [ 56.296940][ T7392] bridge0: port 1(bridge_slave_0) entered forwarding state [ 56.306895][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 56.315724][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 56.324020][ T7392] bridge0: port 2(bridge_slave_1) entered blocking state [ 56.331138][ T7392] bridge0: port 2(bridge_slave_1) entered forwarding state [ 56.339520][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 56.348658][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 56.357613][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 56.366720][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 56.375743][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 56.384284][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 56.393421][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 56.402104][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 56.410577][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 56.418942][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 56.427664][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 56.435779][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 56.445239][ T7414] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 56.456432][ T7409] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 56.480049][ T7414] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 56.499064][ T7409] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 56.624202][ T7494] device veth0_to_bridge entered promiscuous mode [ 56.657146][ T7493] device veth0_to_bridge left promiscuous mode [ 56.726458][ T7494] device veth0_to_bridge entered promiscuous mode [ 56.733685][ T7493] device veth0_to_bridge left promiscuous mode 12:24:42 executing program 4: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000002c0)={'veth0_to_bridge\x00', 0x0}) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f00000000c0)={r3, 0x1, 0x6, @remote}, 0x10) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000180)={r3, 0x1, 0x6, @dev}, 0x10) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f0000000040)={r3, 0x1, 0x6, @remote}, 0x10) 12:24:42 executing program 2: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x2, [@struct={0x0, 0x1, 0x0, 0x4, 0x0, 0x0, [{0x0, 0x2}]}, @ptr={0x0, 0x0, 0x0, 0xa}]}}, &(0x7f0000000080)=""/236, 0x3e, 0xec, 0x1}, 0x20) 12:24:42 executing program 1: setresgid(0x0, 0xee00, 0x0) setuid(0xee01) r0 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f00000002c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) r1 = getuid() keyctl$chown(0x4, r0, r1, 0x0) 12:24:42 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000280)={0xf, 0x4, 0x4, 0x400, 0x0, 0x1}, 0x3c) socket$rxrpc(0x21, 0x2, 0x800000000a) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r0, &(0x7f0000000140), 0x1c) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x5}, 0xfffffffffffffdcb) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x10020000000, 0x0}, 0x2c) close(r0) 12:24:42 executing program 0: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$erofs(&(0x7f0000000340)='erofs\x00', &(0x7f0000000380)='./file0\x00', 0x0, 0x0, 0x0, 0x4000, &(0x7f0000000980)={[], [{@permit_directio='permit_directio'}, {@smackfsdef={'smackfsdef', 0x3d, '/dev/loop-control\x00'}}, {@fsmagic={'fsmagic', 0x3d, 0x100}}]}) 12:24:42 executing program 5: r0 = socket$unix(0x1, 0x5, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) close(r0) openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/cuse\x00', 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) 12:24:42 executing program 2: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x2, [@struct={0x0, 0x1, 0x0, 0x4, 0x0, 0x0, [{0x0, 0x2}]}, @ptr={0x0, 0x0, 0x0, 0xa}]}}, &(0x7f0000000080)=""/236, 0x3e, 0xec, 0x1}, 0x20) [ 56.938530][ T7512] erofs: read_super, device -> /dev/loop0 [ 56.944365][ T7512] erofs: options -> permit_directio,smackfsdef=/dev/loop-control 12:24:42 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000280)={0xf, 0x4, 0x4, 0x400, 0x0, 0x1}, 0x3c) socket$rxrpc(0x21, 0x2, 0x800000000a) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r0, &(0x7f0000000140), 0x1c) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x5}, 0xfffffffffffffdcb) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x10020000000, 0x0}, 0x2c) close(r0) 12:24:42 executing program 5: r0 = socket$unix(0x1, 0x5, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) close(r0) openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/cuse\x00', 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) 12:24:42 executing program 1: setresgid(0x0, 0xee00, 0x0) setuid(0xee01) r0 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f00000002c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) r1 = getuid() keyctl$chown(0x4, r0, r1, 0x0) [ 57.016800][ T7512] erofs: cannot find valid erofs superblock [ 57.025647][ T7516] device veth0_to_bridge entered promiscuous mode [ 57.045128][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 57.045239][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 57.050924][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 57.056696][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 57.109412][ T7514] device veth0_to_bridge left promiscuous mode 12:24:43 executing program 0: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$erofs(&(0x7f0000000340)='erofs\x00', &(0x7f0000000380)='./file0\x00', 0x0, 0x0, 0x0, 0x4000, &(0x7f0000000980)={[], [{@permit_directio='permit_directio'}, {@smackfsdef={'smackfsdef', 0x3d, '/dev/loop-control\x00'}}, {@fsmagic={'fsmagic', 0x3d, 0x100}}]}) 12:24:43 executing program 4: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000002c0)={'veth0_to_bridge\x00', 0x0}) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f00000000c0)={r3, 0x1, 0x6, @remote}, 0x10) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000180)={r3, 0x1, 0x6, @dev}, 0x10) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f0000000040)={r3, 0x1, 0x6, @remote}, 0x10) 12:24:43 executing program 3: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000002c0)={'veth0_to_bridge\x00', 0x0}) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f00000000c0)={r3, 0x1, 0x6, @remote}, 0x10) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000180)={r3, 0x1, 0x6, @dev}, 0x10) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f0000000040)={r3, 0x1, 0x6, @remote}, 0x10) 12:24:43 executing program 2: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x2, [@struct={0x0, 0x1, 0x0, 0x4, 0x0, 0x0, [{0x0, 0x2}]}, @ptr={0x0, 0x0, 0x0, 0xa}]}}, &(0x7f0000000080)=""/236, 0x3e, 0xec, 0x1}, 0x20) 12:24:43 executing program 5: r0 = socket$unix(0x1, 0x5, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) close(r0) openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/cuse\x00', 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) 12:24:43 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000002c0)={'veth0_to_bridge\x00', 0x0}) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f00000000c0)={r3, 0x1, 0x6, @remote}, 0x10) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000180)={r3, 0x1, 0x6, @dev}, 0x10) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f0000000040)={r3, 0x1, 0x6, @remote}, 0x10) [ 57.464620][ T7539] device veth0_to_bridge entered promiscuous mode [ 57.497249][ T7538] erofs: read_super, device -> /dev/loop0 [ 57.511549][ T7537] device veth0_to_bridge left promiscuous mode [ 57.552560][ T7538] erofs: options -> permit_directio,smackfsdef=/dev/loop-control [ 57.594413][ T7538] erofs: cannot find valid erofs superblock [ 57.605164][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 57.610956][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 57.626777][ T7543] device veth0_to_bridge entered promiscuous mode 12:24:43 executing program 4: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000002c0)={'veth0_to_bridge\x00', 0x0}) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f00000000c0)={r3, 0x1, 0x6, @remote}, 0x10) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000180)={r3, 0x1, 0x6, @dev}, 0x10) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f0000000040)={r3, 0x1, 0x6, @remote}, 0x10) [ 57.669005][ T7550] device veth0_to_bridge entered promiscuous mode [ 57.689441][ T7541] device veth0_to_bridge left promiscuous mode [ 57.719132][ T7549] device veth0_to_bridge left promiscuous mode 12:24:43 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000002c0)={'veth0_to_bridge\x00', 0x0}) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f00000000c0)={r3, 0x1, 0x6, @remote}, 0x10) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000180)={r3, 0x1, 0x6, @dev}, 0x10) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f0000000040)={r3, 0x1, 0x6, @remote}, 0x10) [ 57.869110][ T7558] device veth0_to_bridge entered promiscuous mode 12:24:43 executing program 5: r0 = socket$unix(0x1, 0x5, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) close(r0) openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/cuse\x00', 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) 12:24:43 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) close(r0) openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/cuse\x00', 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) 12:24:43 executing program 3: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000002c0)={'veth0_to_bridge\x00', 0x0}) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f00000000c0)={r3, 0x1, 0x6, @remote}, 0x10) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000180)={r3, 0x1, 0x6, @dev}, 0x10) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f0000000040)={r3, 0x1, 0x6, @remote}, 0x10) [ 57.944868][ T7557] device veth0_to_bridge left promiscuous mode 12:24:43 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000002c0)={'veth0_to_bridge\x00', 0x0}) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f00000000c0)={r3, 0x1, 0x6, @remote}, 0x10) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000180)={r3, 0x1, 0x6, @dev}, 0x10) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f0000000040)={r3, 0x1, 0x6, @remote}, 0x10) [ 58.014747][ T7564] device veth0_to_bridge entered promiscuous mode [ 58.032847][ T7560] device veth0_to_bridge left promiscuous mode 12:24:43 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) close(r0) openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/cuse\x00', 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) 12:24:43 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000002c0)={'veth0_to_bridge\x00', 0x0}) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f00000000c0)={r3, 0x1, 0x6, @remote}, 0x10) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000180)={r3, 0x1, 0x6, @dev}, 0x10) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f0000000040)={r3, 0x1, 0x6, @remote}, 0x10) [ 58.192200][ T7575] device veth0_to_bridge entered promiscuous mode [ 58.213743][ T7574] device veth0_to_bridge entered promiscuous mode 12:24:43 executing program 5: r0 = socket$unix(0x1, 0x5, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) close(r0) openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/cuse\x00', 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) [ 58.241941][ T7573] device veth0_to_bridge left promiscuous mode [ 58.251326][ T7572] device veth0_to_bridge left promiscuous mode 12:24:44 executing program 4: r0 = socket$unix(0x1, 0x5, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) close(r0) openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/cuse\x00', 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) 12:24:44 executing program 3: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000002c0)={'veth0_to_bridge\x00', 0x0}) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f00000000c0)={r3, 0x1, 0x6, @remote}, 0x10) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000180)={r3, 0x1, 0x6, @dev}, 0x10) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f0000000040)={r3, 0x1, 0x6, @remote}, 0x10) [ 58.347925][ T7582] device veth0_to_bridge entered promiscuous mode [ 58.444149][ T7579] device veth0_to_bridge left promiscuous mode 12:24:44 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000002c0)={'veth0_to_bridge\x00', 0x0}) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f00000000c0)={r3, 0x1, 0x6, @remote}, 0x10) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000180)={r3, 0x1, 0x6, @dev}, 0x10) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f0000000040)={r3, 0x1, 0x6, @remote}, 0x10) [ 58.512915][ T7590] device veth0_to_bridge entered promiscuous mode 12:24:44 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) close(r0) openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/cuse\x00', 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) 12:24:44 executing program 4: r0 = socket$unix(0x1, 0x5, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) close(r0) openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/cuse\x00', 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) [ 58.609045][ T7585] device veth0_to_bridge left promiscuous mode 12:24:44 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000002c0)={'veth0_to_bridge\x00', 0x0}) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f00000000c0)={r3, 0x1, 0x6, @remote}, 0x10) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000180)={r3, 0x1, 0x6, @dev}, 0x10) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f0000000040)={r3, 0x1, 0x6, @remote}, 0x10) 12:24:44 executing program 5: r0 = socket$unix(0x1, 0x5, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) close(r0) openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/cuse\x00', 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) [ 58.799528][ T7604] device veth0_to_bridge entered promiscuous mode [ 58.829170][ T7598] device veth0_to_bridge entered promiscuous mode 12:24:44 executing program 3: r0 = socket$unix(0x1, 0x5, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) close(r0) openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/cuse\x00', 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) [ 58.858191][ T7600] device veth0_to_bridge left promiscuous mode [ 58.871162][ T7597] device veth0_to_bridge left promiscuous mode 12:24:44 executing program 5: bpf$MAP_CREATE(0x0, &(0x7f0000000280)={0xf, 0x4, 0x4, 0x400, 0x0, 0x1}, 0x3c) socket$rxrpc(0x21, 0x2, 0x800000000a) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r0, &(0x7f0000000140), 0x1c) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x5}, 0xfffffffffffffdcb) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x10020000000, 0x0}, 0x2c) close(r0) 12:24:44 executing program 2: setresgid(0x0, 0xee00, 0x0) setuid(0xee01) r0 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f00000002c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) r1 = getuid() keyctl$chown(0x4, r0, r1, 0x0) 12:24:44 executing program 4: r0 = socket$unix(0x1, 0x5, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) close(r0) openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/cuse\x00', 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) 12:24:44 executing program 1: setresgid(0x0, 0xee00, 0x0) setuid(0xee01) r0 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f00000002c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) r1 = getuid() keyctl$chown(0x4, r0, r1, 0x0) 12:24:44 executing program 0: setresgid(0x0, 0xee00, 0x0) setuid(0xee01) r0 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f00000002c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) r1 = getuid() keyctl$chown(0x4, r0, r1, 0x0) 12:24:45 executing program 5: bpf$MAP_CREATE(0x0, &(0x7f0000000280)={0xf, 0x4, 0x4, 0x400, 0x0, 0x1}, 0x3c) socket$rxrpc(0x21, 0x2, 0x800000000a) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r0, &(0x7f0000000140), 0x1c) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x5}, 0xfffffffffffffdcb) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x10020000000, 0x0}, 0x2c) close(r0) 12:24:45 executing program 2: setresgid(0x0, 0xee00, 0x0) setuid(0xee01) r0 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f00000002c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) r1 = getuid() keyctl$chown(0x4, r0, r1, 0x0) 12:24:45 executing program 3: r0 = socket$unix(0x1, 0x5, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) close(r0) openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/cuse\x00', 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) 12:24:45 executing program 1: setresgid(0x0, 0xee00, 0x0) setuid(0xee01) r0 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f00000002c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) r1 = getuid() keyctl$chown(0x4, r0, r1, 0x0) 12:24:45 executing program 4: setresgid(0x0, 0xee00, 0x0) setuid(0xee01) r0 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f00000002c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) r1 = getuid() keyctl$chown(0x4, r0, r1, 0x0) 12:24:45 executing program 0: setresgid(0x0, 0xee00, 0x0) setuid(0xee01) r0 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f00000002c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) r1 = getuid() keyctl$chown(0x4, r0, r1, 0x0) 12:24:45 executing program 1: setresgid(0x0, 0xee00, 0x0) setuid(0xee01) r0 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f00000002c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) r1 = getuid() keyctl$chown(0x4, r0, r1, 0x0) 12:24:45 executing program 5: bpf$MAP_CREATE(0x0, &(0x7f0000000280)={0xf, 0x4, 0x4, 0x400, 0x0, 0x1}, 0x3c) socket$rxrpc(0x21, 0x2, 0x800000000a) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r0, &(0x7f0000000140), 0x1c) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x5}, 0xfffffffffffffdcb) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x10020000000, 0x0}, 0x2c) close(r0) 12:24:45 executing program 2: setresgid(0x0, 0xee00, 0x0) setuid(0xee01) r0 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f00000002c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) r1 = getuid() keyctl$chown(0x4, r0, r1, 0x0) 12:24:45 executing program 3: r0 = socket$unix(0x1, 0x5, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) close(r0) openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/cuse\x00', 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) 12:24:45 executing program 4: setresgid(0x0, 0xee00, 0x0) setuid(0xee01) r0 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f00000002c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) r1 = getuid() keyctl$chown(0x4, r0, r1, 0x0) 12:24:45 executing program 5: seccomp(0x1, 0x8, &(0x7f0000000080)={0x1, &(0x7f00000000c0)=[{0x100000006}]}) socket$inet6_tcp(0xa, 0x1, 0x0) socket$netlink(0x10, 0x3, 0x0) pipe(&(0x7f0000000540)) clock_gettime(0x0, &(0x7f0000000600)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0xff}, &(0x7f0000000200)={0x0, r0+30000000}, 0x0) 12:24:45 executing program 0: setresgid(0x0, 0xee00, 0x0) setuid(0xee01) r0 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f00000002c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) r1 = getuid() keyctl$chown(0x4, r0, r1, 0x0) 12:24:45 executing program 2: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r0, 0x4, 0x42000) socket$inet(0xa, 0x0, 0x0) mkdirat$cgroup(0xffffffffffffffff, 0x0, 0x1ff) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000000)=@broute={'\n\x00oute\x00', 0x20, 0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20d9f000], 0x0, 0x0, 0x0}, 0xa8) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) ioctl$KVM_GET_NR_MMU_PAGES(r0, 0xae45, 0x5) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000280)='/dev/full\x00', 0x30402, 0x0) syz_open_dev$vbi(&(0x7f0000000640)='/dev/vbi#\x00', 0x3, 0x2) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000680)='/dev/dlm_plock\x00', 0x802, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000006c0)={0xffffffffffffffff, 0xffff7fff, 0x1, r2}) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$kcm(0xa, 0x0, 0x73) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) msgget(0x3, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) chdir(0x0) r3 = socket$kcm(0xa, 0x2, 0x73) bind(r3, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0xf}, 0x3}, 0x80) r4 = syz_init_net_socket$rose(0xb, 0x5, 0x0) recvfrom(r4, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffcd0) r5 = socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f0000000040)={'bridge0\x00h\x00\x01\xd8\x00H\x00'}) getsockname$packet(r2, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0xffffffffffffff92) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) 12:24:45 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x2, 0x73) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x69) connect(r0, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @empty}, 0x80) sendmmsg$inet_sctp(r0, &(0x7f00000003c0), 0x3a301e0909ff6cd, 0x934) [ 60.176412][ C0] hrtimer: interrupt took 27704 ns [ 60.198884][ T26] kauditd_printk_skb: 3 callbacks suppressed [ 60.198908][ T26] audit: type=1326 audit(1570191885.917:31): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=7660 comm="syz-executor.5" exe="/root/syz-executor.5" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45c89a code=0x0 12:24:46 executing program 3: syz_mount_image$minix(&(0x7f0000000080)='minix\x00', &(0x7f0000000100)='./file0\x00', 0x4940, 0x1, &(0x7f0000000000)=[{&(0x7f0000000280)="600b42e006000a0090040300001af5c97f13", 0x12, 0x400}], 0x8004, 0x0) 12:24:46 executing program 0: sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={0x14, 0x41000000000013, 0xfffffffffffdfaeb}, 0x14}, 0x1, 0x68}, 0x0) r0 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r0, &(0x7f0000000080), 0x492492492492751, 0x0) [ 60.312403][ T7676] bridge0: port 2(bridge_slave_1) entered disabled state [ 60.319654][ T7676] bridge0: port 1(bridge_slave_0) entered disabled state 12:24:46 executing program 4: setresgid(0x0, 0xee00, 0x0) setuid(0xee01) r0 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f00000002c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) r1 = getuid() keyctl$chown(0x4, r0, r1, 0x0) [ 60.504701][ T7681] Unable to read inode block 12:24:46 executing program 2: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r0, 0x4, 0x42000) socket$inet(0xa, 0x0, 0x0) mkdirat$cgroup(0xffffffffffffffff, 0x0, 0x1ff) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000000)=@broute={'\n\x00oute\x00', 0x20, 0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20d9f000], 0x0, 0x0, 0x0}, 0xa8) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) ioctl$KVM_GET_NR_MMU_PAGES(r0, 0xae45, 0x5) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000280)='/dev/full\x00', 0x30402, 0x0) syz_open_dev$vbi(&(0x7f0000000640)='/dev/vbi#\x00', 0x3, 0x2) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000680)='/dev/dlm_plock\x00', 0x802, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000006c0)={0xffffffffffffffff, 0xffff7fff, 0x1, r2}) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$kcm(0xa, 0x0, 0x73) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) msgget(0x3, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) chdir(0x0) r3 = socket$kcm(0xa, 0x2, 0x73) bind(r3, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0xf}, 0x3}, 0x80) r4 = syz_init_net_socket$rose(0xb, 0x5, 0x0) recvfrom(r4, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffcd0) r5 = socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f0000000040)={'bridge0\x00h\x00\x01\xd8\x00H\x00'}) getsockname$packet(r2, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0xffffffffffffff92) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) 12:24:46 executing program 4: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r0, 0x4, 0x42000) socket$inet(0xa, 0x0, 0x0) mkdirat$cgroup(0xffffffffffffffff, 0x0, 0x1ff) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000000)=@broute={'\n\x00oute\x00', 0x20, 0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20d9f000], 0x0, 0x0, 0x0}, 0xa8) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) ioctl$KVM_GET_NR_MMU_PAGES(r0, 0xae45, 0x5) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000280)='/dev/full\x00', 0x30402, 0x0) syz_open_dev$vbi(&(0x7f0000000640)='/dev/vbi#\x00', 0x3, 0x2) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000680)='/dev/dlm_plock\x00', 0x802, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000006c0)={0xffffffffffffffff, 0xffff7fff, 0x1, r2}) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$kcm(0xa, 0x0, 0x73) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) msgget(0x3, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) chdir(0x0) r3 = socket$kcm(0xa, 0x2, 0x73) bind(r3, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0xf}, 0x3}, 0x80) r4 = syz_init_net_socket$rose(0xb, 0x5, 0x0) recvfrom(r4, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffcd0) r5 = socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f0000000040)={'bridge0\x00h\x00\x01\xd8\x00H\x00'}) getsockname$packet(r2, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0xffffffffffffff92) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) [ 60.808349][ T7681] Unable to read inode block [ 60.863463][ T26] audit: type=1326 audit(1570191886.577:32): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=7660 comm="syz-executor.5" exe="/root/syz-executor.5" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45c89a code=0x0 12:24:46 executing program 3: syz_mount_image$minix(&(0x7f0000000080)='minix\x00', &(0x7f0000000100)='./file0\x00', 0x4940, 0x1, &(0x7f0000000000)=[{&(0x7f0000000280)="600b42e006000a0090040300001af5c97f13", 0x12, 0x400}], 0x8004, 0x0) 12:24:46 executing program 0: sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={0x14, 0x41000000000013, 0xfffffffffffdfaeb}, 0x14}, 0x1, 0x68}, 0x0) r0 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r0, &(0x7f0000000080), 0x492492492492751, 0x0) 12:24:46 executing program 5: seccomp(0x1, 0x8, &(0x7f0000000080)={0x1, &(0x7f00000000c0)=[{0x100000006}]}) socket$inet6_tcp(0xa, 0x1, 0x0) socket$netlink(0x10, 0x3, 0x0) pipe(&(0x7f0000000540)) clock_gettime(0x0, &(0x7f0000000600)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0xff}, &(0x7f0000000200)={0x0, r0+30000000}, 0x0) 12:24:46 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x2, 0x73) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x69) connect(r0, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @empty}, 0x80) sendmmsg$inet_sctp(r0, &(0x7f00000003c0), 0x3a301e0909ff6cd, 0x934) [ 61.233159][ T7711] Unable to read inode block [ 61.270232][ T26] audit: type=1326 audit(1570191886.987:33): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=7716 comm="syz-executor.5" exe="/root/syz-executor.5" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45c89a code=0x0 [ 61.305787][ T7705] bridge0: port 2(bridge_slave_1) entered disabled state [ 61.313026][ T7705] bridge0: port 1(bridge_slave_0) entered disabled state 12:24:47 executing program 2: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r0, 0x4, 0x42000) socket$inet(0xa, 0x0, 0x0) mkdirat$cgroup(0xffffffffffffffff, 0x0, 0x1ff) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000000)=@broute={'\n\x00oute\x00', 0x20, 0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20d9f000], 0x0, 0x0, 0x0}, 0xa8) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) ioctl$KVM_GET_NR_MMU_PAGES(r0, 0xae45, 0x5) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000280)='/dev/full\x00', 0x30402, 0x0) syz_open_dev$vbi(&(0x7f0000000640)='/dev/vbi#\x00', 0x3, 0x2) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000680)='/dev/dlm_plock\x00', 0x802, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000006c0)={0xffffffffffffffff, 0xffff7fff, 0x1, r2}) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$kcm(0xa, 0x0, 0x73) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) msgget(0x3, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) chdir(0x0) r3 = socket$kcm(0xa, 0x2, 0x73) bind(r3, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0xf}, 0x3}, 0x80) r4 = syz_init_net_socket$rose(0xb, 0x5, 0x0) recvfrom(r4, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffcd0) r5 = socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f0000000040)={'bridge0\x00h\x00\x01\xd8\x00H\x00'}) getsockname$packet(r2, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0xffffffffffffff92) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) 12:24:47 executing program 3: syz_mount_image$minix(&(0x7f0000000080)='minix\x00', &(0x7f0000000100)='./file0\x00', 0x4940, 0x1, &(0x7f0000000000)=[{&(0x7f0000000280)="600b42e006000a0090040300001af5c97f13", 0x12, 0x400}], 0x8004, 0x0) 12:24:47 executing program 0: sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={0x14, 0x41000000000013, 0xfffffffffffdfaeb}, 0x14}, 0x1, 0x68}, 0x0) r0 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r0, &(0x7f0000000080), 0x492492492492751, 0x0) 12:24:47 executing program 4: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r0, 0x4, 0x42000) socket$inet(0xa, 0x0, 0x0) mkdirat$cgroup(0xffffffffffffffff, 0x0, 0x1ff) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000000)=@broute={'\n\x00oute\x00', 0x20, 0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20d9f000], 0x0, 0x0, 0x0}, 0xa8) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) ioctl$KVM_GET_NR_MMU_PAGES(r0, 0xae45, 0x5) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000280)='/dev/full\x00', 0x30402, 0x0) syz_open_dev$vbi(&(0x7f0000000640)='/dev/vbi#\x00', 0x3, 0x2) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000680)='/dev/dlm_plock\x00', 0x802, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000006c0)={0xffffffffffffffff, 0xffff7fff, 0x1, r2}) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$kcm(0xa, 0x0, 0x73) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) msgget(0x3, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) chdir(0x0) r3 = socket$kcm(0xa, 0x2, 0x73) bind(r3, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0xf}, 0x3}, 0x80) r4 = syz_init_net_socket$rose(0xb, 0x5, 0x0) recvfrom(r4, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffcd0) r5 = socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f0000000040)={'bridge0\x00h\x00\x01\xd8\x00H\x00'}) getsockname$packet(r2, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0xffffffffffffff92) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) [ 61.751829][ T7728] Unable to read inode block 12:24:47 executing program 2: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r0, 0x4, 0x42000) socket$inet(0xa, 0x0, 0x0) mkdirat$cgroup(0xffffffffffffffff, 0x0, 0x1ff) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000000)=@broute={'\n\x00oute\x00', 0x20, 0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20d9f000], 0x0, 0x0, 0x0}, 0xa8) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) ioctl$KVM_GET_NR_MMU_PAGES(r0, 0xae45, 0x5) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000280)='/dev/full\x00', 0x30402, 0x0) syz_open_dev$vbi(&(0x7f0000000640)='/dev/vbi#\x00', 0x3, 0x2) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000680)='/dev/dlm_plock\x00', 0x802, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000006c0)={0xffffffffffffffff, 0xffff7fff, 0x1, r2}) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$kcm(0xa, 0x0, 0x73) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) msgget(0x3, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) chdir(0x0) r3 = socket$kcm(0xa, 0x2, 0x73) bind(r3, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0xf}, 0x3}, 0x80) r4 = syz_init_net_socket$rose(0xb, 0x5, 0x0) recvfrom(r4, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffcd0) r5 = socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f0000000040)={'bridge0\x00h\x00\x01\xd8\x00H\x00'}) getsockname$packet(r2, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0xffffffffffffff92) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) 12:24:47 executing program 3: syz_mount_image$minix(&(0x7f0000000080)='minix\x00', &(0x7f0000000100)='./file0\x00', 0x4940, 0x1, &(0x7f0000000000)=[{&(0x7f0000000280)="600b42e006000a0090040300001af5c97f13", 0x12, 0x400}], 0x8004, 0x0) [ 62.182109][ T7736] Unable to read inode block 12:24:47 executing program 0: sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={0x14, 0x41000000000013, 0xfffffffffffdfaeb}, 0x14}, 0x1, 0x68}, 0x0) r0 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r0, &(0x7f0000000080), 0x492492492492751, 0x0) 12:24:47 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x2, 0x73) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x69) connect(r0, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @empty}, 0x80) sendmmsg$inet_sctp(r0, &(0x7f00000003c0), 0x3a301e0909ff6cd, 0x934) 12:24:47 executing program 5: seccomp(0x1, 0x8, &(0x7f0000000080)={0x1, &(0x7f00000000c0)=[{0x100000006}]}) socket$inet6_tcp(0xa, 0x1, 0x0) socket$netlink(0x10, 0x3, 0x0) pipe(&(0x7f0000000540)) clock_gettime(0x0, &(0x7f0000000600)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0xff}, &(0x7f0000000200)={0x0, r0+30000000}, 0x0) 12:24:48 executing program 4: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r0, 0x4, 0x42000) socket$inet(0xa, 0x0, 0x0) mkdirat$cgroup(0xffffffffffffffff, 0x0, 0x1ff) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000000)=@broute={'\n\x00oute\x00', 0x20, 0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20d9f000], 0x0, 0x0, 0x0}, 0xa8) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) ioctl$KVM_GET_NR_MMU_PAGES(r0, 0xae45, 0x5) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000280)='/dev/full\x00', 0x30402, 0x0) syz_open_dev$vbi(&(0x7f0000000640)='/dev/vbi#\x00', 0x3, 0x2) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000680)='/dev/dlm_plock\x00', 0x802, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000006c0)={0xffffffffffffffff, 0xffff7fff, 0x1, r2}) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$kcm(0xa, 0x0, 0x73) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) msgget(0x3, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) chdir(0x0) r3 = socket$kcm(0xa, 0x2, 0x73) bind(r3, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0xf}, 0x3}, 0x80) r4 = syz_init_net_socket$rose(0xb, 0x5, 0x0) recvfrom(r4, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffcd0) r5 = socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f0000000040)={'bridge0\x00h\x00\x01\xd8\x00H\x00'}) getsockname$packet(r2, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0xffffffffffffff92) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) [ 62.351161][ T26] audit: type=1326 audit(1570191888.067:34): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=7739 comm="syz-executor.5" exe="/root/syz-executor.5" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45c89a code=0x0 12:24:48 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x2, 0x73) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x69) connect(r0, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @empty}, 0x80) sendmmsg$inet_sctp(r0, &(0x7f00000003c0), 0x3a301e0909ff6cd, 0x934) 12:24:48 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x2, 0x73) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x69) connect(r0, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @empty}, 0x80) sendmmsg$inet_sctp(r0, &(0x7f00000003c0), 0x3a301e0909ff6cd, 0x934) 12:24:48 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x2, 0x73) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x69) connect(r0, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @empty}, 0x80) sendmmsg$inet_sctp(r0, &(0x7f00000003c0), 0x3a301e0909ff6cd, 0x934) 12:24:48 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x2, 0x73) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x69) connect(r0, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @empty}, 0x80) sendmmsg$inet_sctp(r0, &(0x7f00000003c0), 0x3a301e0909ff6cd, 0x934) 12:24:48 executing program 5: seccomp(0x1, 0x8, &(0x7f0000000080)={0x1, &(0x7f00000000c0)=[{0x100000006}]}) socket$inet6_tcp(0xa, 0x1, 0x0) socket$netlink(0x10, 0x3, 0x0) pipe(&(0x7f0000000540)) clock_gettime(0x0, &(0x7f0000000600)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0xff}, &(0x7f0000000200)={0x0, r0+30000000}, 0x0) [ 63.455991][ T26] audit: type=1326 audit(1570191889.177:35): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=7761 comm="syz-executor.5" exe="/root/syz-executor.5" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45c89a code=0x0 [ 63.566220][ T7] device bridge_slave_1 left promiscuous mode [ 63.572514][ T7] bridge0: port 2(bridge_slave_1) entered disabled state 12:24:49 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x2, 0x73) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x69) connect(r0, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @empty}, 0x80) sendmmsg$inet_sctp(r0, &(0x7f00000003c0), 0x3a301e0909ff6cd, 0x934) [ 63.656139][ T7] device bridge_slave_0 left promiscuous mode [ 63.662631][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 64.695301][ T7] device hsr_slave_0 left promiscuous mode [ 64.745317][ T7] device hsr_slave_1 left promiscuous mode [ 64.822474][ T7] team0 (unregistering): Port device team_slave_1 removed [ 64.834734][ T7] team0 (unregistering): Port device team_slave_0 removed [ 64.848542][ T7] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 64.899742][ T7] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 64.959938][ T7] bond0 (unregistering): Released all slaves [ 65.063776][ T7764] IPVS: ftp: loaded support on port[0] = 21 [ 65.078152][ T7772] IPVS: ftp: loaded support on port[0] = 21 [ 65.178016][ T7764] chnl_net:caif_netlink_parms(): no params data found [ 65.279454][ T7772] chnl_net:caif_netlink_parms(): no params data found [ 65.299294][ T7764] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.306537][ T7764] bridge0: port 1(bridge_slave_0) entered disabled state [ 65.314616][ T7764] device bridge_slave_0 entered promiscuous mode [ 65.337285][ T7764] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.344357][ T7764] bridge0: port 2(bridge_slave_1) entered disabled state [ 65.352722][ T7764] device bridge_slave_1 entered promiscuous mode [ 65.373275][ T7772] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.380536][ T7772] bridge0: port 1(bridge_slave_0) entered disabled state [ 65.388901][ T7772] device bridge_slave_0 entered promiscuous mode [ 65.412113][ T7764] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 65.426017][ T7772] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.433298][ T7772] bridge0: port 2(bridge_slave_1) entered disabled state [ 65.441397][ T7772] device bridge_slave_1 entered promiscuous mode [ 65.450278][ T7764] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 65.496225][ T7772] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 65.506329][ T7764] team0: Port device team_slave_0 added [ 65.513690][ T7772] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 65.537968][ T7764] team0: Port device team_slave_1 added [ 65.544932][ T7772] team0: Port device team_slave_0 added [ 65.552403][ T7772] team0: Port device team_slave_1 added [ 65.628123][ T7764] device hsr_slave_0 entered promiscuous mode [ 65.675596][ T7764] device hsr_slave_1 entered promiscuous mode [ 65.725181][ T7764] debugfs: Directory 'hsr0' with parent '/' already present! [ 65.798552][ T7772] device hsr_slave_0 entered promiscuous mode [ 65.845659][ T7772] device hsr_slave_1 entered promiscuous mode [ 65.895246][ T7772] debugfs: Directory 'hsr0' with parent '/' already present! [ 65.910953][ T7772] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.918050][ T7772] bridge0: port 2(bridge_slave_1) entered forwarding state [ 65.925377][ T7772] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.932408][ T7772] bridge0: port 1(bridge_slave_0) entered forwarding state [ 65.958519][ T7764] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.965730][ T7764] bridge0: port 2(bridge_slave_1) entered forwarding state [ 65.973006][ T7764] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.980111][ T7764] bridge0: port 1(bridge_slave_0) entered forwarding state [ 66.057322][ T7772] 8021q: adding VLAN 0 to HW filter on device bond0 [ 66.067826][ T7764] 8021q: adding VLAN 0 to HW filter on device bond0 [ 66.084322][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 66.093319][ T5] bridge0: port 1(bridge_slave_0) entered disabled state [ 66.101577][ T5] bridge0: port 2(bridge_slave_1) entered disabled state [ 66.110577][ T5] bridge0: port 1(bridge_slave_0) entered disabled state [ 66.118745][ T5] bridge0: port 2(bridge_slave_1) entered disabled state [ 66.134479][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 66.143076][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 66.153238][ T7764] 8021q: adding VLAN 0 to HW filter on device team0 [ 66.161936][ T7772] 8021q: adding VLAN 0 to HW filter on device team0 [ 66.171832][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 66.181362][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 66.190387][ T7392] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.197487][ T7392] bridge0: port 1(bridge_slave_0) entered forwarding state [ 66.218234][ T2633] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 66.235812][ T2633] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 66.244287][ T2633] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.251580][ T2633] bridge0: port 2(bridge_slave_1) entered forwarding state [ 66.261694][ T2633] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 66.271523][ T2633] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 66.280626][ T2633] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 66.289953][ T2633] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 66.299202][ T2633] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 66.308246][ T2633] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 66.317000][ T2633] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.324281][ T2633] bridge0: port 1(bridge_slave_0) entered forwarding state [ 66.332984][ T2633] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 66.346880][ T7421] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 66.356141][ T7421] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 66.364980][ T7421] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.372310][ T7421] bridge0: port 2(bridge_slave_1) entered forwarding state [ 66.380504][ T7421] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 66.389456][ T7421] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 66.401824][ T7772] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 66.413198][ T7772] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 66.432380][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 66.441272][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 66.450054][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 66.458695][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 66.467207][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 66.476895][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 66.486064][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 66.494721][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 66.509548][ T7764] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 66.520265][ T7764] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 66.535643][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 66.543883][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 66.552301][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 66.561604][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 66.571270][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 66.580162][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 66.589295][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 66.598016][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 66.653578][ T7772] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 66.663756][ T7392] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 66.678658][ T7764] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 66.963873][ T7785] bridge0: port 2(bridge_slave_1) entered disabled state [ 66.972468][ T7785] bridge0: port 1(bridge_slave_0) entered disabled state 12:24:53 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x2, 0x73) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x69) connect(r0, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @empty}, 0x80) sendmmsg$inet_sctp(r0, &(0x7f00000003c0), 0x3a301e0909ff6cd, 0x934) 12:24:53 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x2, 0x73) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x69) connect(r0, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @empty}, 0x80) sendmmsg$inet_sctp(r0, &(0x7f00000003c0), 0x3a301e0909ff6cd, 0x934) 12:24:53 executing program 1: seccomp(0x1, 0x8, &(0x7f0000000080)={0x1, &(0x7f00000000c0)=[{0x100000006}]}) socket$inet6_tcp(0xa, 0x1, 0x0) socket$netlink(0x10, 0x3, 0x0) pipe(&(0x7f0000000540)) clock_gettime(0x0, &(0x7f0000000600)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0xff}, &(0x7f0000000200)={0x0, r0+30000000}, 0x0) 12:24:53 executing program 2: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r0, 0x4, 0x42000) socket$inet(0xa, 0x0, 0x0) mkdirat$cgroup(0xffffffffffffffff, 0x0, 0x1ff) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000000)=@broute={'\n\x00oute\x00', 0x20, 0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20d9f000], 0x0, 0x0, 0x0}, 0xa8) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) ioctl$KVM_GET_NR_MMU_PAGES(r0, 0xae45, 0x5) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000280)='/dev/full\x00', 0x30402, 0x0) syz_open_dev$vbi(&(0x7f0000000640)='/dev/vbi#\x00', 0x3, 0x2) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000680)='/dev/dlm_plock\x00', 0x802, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000006c0)={0xffffffffffffffff, 0xffff7fff, 0x1, r2}) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$kcm(0xa, 0x0, 0x73) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) msgget(0x3, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) chdir(0x0) r3 = socket$kcm(0xa, 0x2, 0x73) bind(r3, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0xf}, 0x3}, 0x80) r4 = syz_init_net_socket$rose(0xb, 0x5, 0x0) recvfrom(r4, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffcd0) r5 = socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f0000000040)={'bridge0\x00h\x00\x01\xd8\x00H\x00'}) getsockname$packet(r2, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0xffffffffffffff92) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) 12:24:53 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x2, 0x73) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x69) connect(r0, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @empty}, 0x80) sendmmsg$inet_sctp(r0, &(0x7f00000003c0), 0x3a301e0909ff6cd, 0x934) 12:24:53 executing program 5: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r0, 0x4, 0x42000) socket$inet(0xa, 0x0, 0x0) mkdirat$cgroup(0xffffffffffffffff, 0x0, 0x1ff) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000000)=@broute={'\n\x00oute\x00', 0x20, 0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20d9f000], 0x0, 0x0, 0x0}, 0xa8) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) ioctl$KVM_GET_NR_MMU_PAGES(r0, 0xae45, 0x5) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000280)='/dev/full\x00', 0x30402, 0x0) syz_open_dev$vbi(&(0x7f0000000640)='/dev/vbi#\x00', 0x3, 0x2) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000680)='/dev/dlm_plock\x00', 0x802, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000006c0)={0xffffffffffffffff, 0xffff7fff, 0x1, r2}) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$kcm(0xa, 0x0, 0x73) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) msgget(0x3, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) chdir(0x0) r3 = socket$kcm(0xa, 0x2, 0x73) bind(r3, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0xf}, 0x3}, 0x80) r4 = syz_init_net_socket$rose(0xb, 0x5, 0x0) recvfrom(r4, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffcd0) r5 = socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f0000000040)={'bridge0\x00h\x00\x01\xd8\x00H\x00'}) getsockname$packet(r2, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0xffffffffffffff92) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) [ 67.686343][ T26] audit: type=1326 audit(1570191893.407:36): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=7797 comm="syz-executor.1" exe="/root/syz-executor.1" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45c89a code=0x0 [ 68.264810][ T7808] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.272070][ T7808] bridge0: port 1(bridge_slave_0) entered disabled state 12:24:54 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x2, 0x73) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x69) connect(r0, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @empty}, 0x80) sendmmsg$inet_sctp(r0, &(0x7f00000003c0), 0x3a301e0909ff6cd, 0x934) 12:24:54 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x2, 0x73) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x69) connect(r0, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @empty}, 0x80) sendmmsg$inet_sctp(r0, &(0x7f00000003c0), 0x3a301e0909ff6cd, 0x934) 12:24:54 executing program 0: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r0, 0x4, 0x42000) socket$inet(0xa, 0x0, 0x0) mkdirat$cgroup(0xffffffffffffffff, 0x0, 0x1ff) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000000)=@broute={'\n\x00oute\x00', 0x20, 0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20d9f000], 0x0, 0x0, 0x0}, 0xa8) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) ioctl$KVM_GET_NR_MMU_PAGES(r0, 0xae45, 0x5) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000280)='/dev/full\x00', 0x30402, 0x0) syz_open_dev$vbi(&(0x7f0000000640)='/dev/vbi#\x00', 0x3, 0x2) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000680)='/dev/dlm_plock\x00', 0x802, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000006c0)={0xffffffffffffffff, 0xffff7fff, 0x1, r2}) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$kcm(0xa, 0x0, 0x73) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) msgget(0x3, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) chdir(0x0) r3 = socket$kcm(0xa, 0x2, 0x73) bind(r3, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0xf}, 0x3}, 0x80) r4 = syz_init_net_socket$rose(0xb, 0x5, 0x0) recvfrom(r4, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffcd0) r5 = socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f0000000040)={'bridge0\x00h\x00\x01\xd8\x00H\x00'}) getsockname$packet(r2, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0xffffffffffffff92) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) 12:24:54 executing program 1: seccomp(0x1, 0x8, &(0x7f0000000080)={0x1, &(0x7f00000000c0)=[{0x100000006}]}) socket$inet6_tcp(0xa, 0x1, 0x0) socket$netlink(0x10, 0x3, 0x0) pipe(&(0x7f0000000540)) clock_gettime(0x0, &(0x7f0000000600)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0xff}, &(0x7f0000000200)={0x0, r0+30000000}, 0x0) 12:24:54 executing program 5: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r0, 0x4, 0x42000) socket$inet(0xa, 0x0, 0x0) mkdirat$cgroup(0xffffffffffffffff, 0x0, 0x1ff) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000000)=@broute={'\n\x00oute\x00', 0x20, 0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20d9f000], 0x0, 0x0, 0x0}, 0xa8) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) ioctl$KVM_GET_NR_MMU_PAGES(r0, 0xae45, 0x5) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000280)='/dev/full\x00', 0x30402, 0x0) syz_open_dev$vbi(&(0x7f0000000640)='/dev/vbi#\x00', 0x3, 0x2) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000680)='/dev/dlm_plock\x00', 0x802, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000006c0)={0xffffffffffffffff, 0xffff7fff, 0x1, r2}) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$kcm(0xa, 0x0, 0x73) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) msgget(0x3, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) chdir(0x0) r3 = socket$kcm(0xa, 0x2, 0x73) bind(r3, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0xf}, 0x3}, 0x80) r4 = syz_init_net_socket$rose(0xb, 0x5, 0x0) recvfrom(r4, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffcd0) r5 = socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f0000000040)={'bridge0\x00h\x00\x01\xd8\x00H\x00'}) getsockname$packet(r2, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0xffffffffffffff92) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) 12:24:54 executing program 2: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r0, 0x4, 0x42000) socket$inet(0xa, 0x0, 0x0) mkdirat$cgroup(0xffffffffffffffff, 0x0, 0x1ff) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000000)=@broute={'\n\x00oute\x00', 0x20, 0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20d9f000], 0x0, 0x0, 0x0}, 0xa8) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) ioctl$KVM_GET_NR_MMU_PAGES(r0, 0xae45, 0x5) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000280)='/dev/full\x00', 0x30402, 0x0) syz_open_dev$vbi(&(0x7f0000000640)='/dev/vbi#\x00', 0x3, 0x2) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000680)='/dev/dlm_plock\x00', 0x802, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000006c0)={0xffffffffffffffff, 0xffff7fff, 0x1, r2}) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$kcm(0xa, 0x0, 0x73) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) msgget(0x3, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) chdir(0x0) r3 = socket$kcm(0xa, 0x2, 0x73) bind(r3, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0xf}, 0x3}, 0x80) r4 = syz_init_net_socket$rose(0xb, 0x5, 0x0) recvfrom(r4, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffcd0) r5 = socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f0000000040)={'bridge0\x00h\x00\x01\xd8\x00H\x00'}) getsockname$packet(r2, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0xffffffffffffff92) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) [ 68.847502][ T26] audit: type=1326 audit(1570191894.567:37): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=7824 comm="syz-executor.1" exe="/root/syz-executor.1" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45c89a code=0x0 12:24:54 executing program 2: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r0, 0x4, 0x42000) socket$inet(0xa, 0x0, 0x0) mkdirat$cgroup(0xffffffffffffffff, 0x0, 0x1ff) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000000)=@broute={'\n\x00oute\x00', 0x20, 0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20d9f000], 0x0, 0x0, 0x0}, 0xa8) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) ioctl$KVM_GET_NR_MMU_PAGES(r0, 0xae45, 0x5) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000280)='/dev/full\x00', 0x30402, 0x0) syz_open_dev$vbi(&(0x7f0000000640)='/dev/vbi#\x00', 0x3, 0x2) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000680)='/dev/dlm_plock\x00', 0x802, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000006c0)={0xffffffffffffffff, 0xffff7fff, 0x1, r2}) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$kcm(0xa, 0x0, 0x73) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) msgget(0x3, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) chdir(0x0) r3 = socket$kcm(0xa, 0x2, 0x73) bind(r3, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0xf}, 0x3}, 0x80) r4 = syz_init_net_socket$rose(0xb, 0x5, 0x0) recvfrom(r4, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffcd0) r5 = socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f0000000040)={'bridge0\x00h\x00\x01\xd8\x00H\x00'}) getsockname$packet(r2, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0xffffffffffffff92) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) 12:24:55 executing program 4: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r0, 0x4, 0x42000) socket$inet(0xa, 0x0, 0x0) mkdirat$cgroup(0xffffffffffffffff, 0x0, 0x1ff) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000000)=@broute={'\n\x00oute\x00', 0x20, 0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20d9f000], 0x0, 0x0, 0x0}, 0xa8) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) ioctl$KVM_GET_NR_MMU_PAGES(r0, 0xae45, 0x5) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000280)='/dev/full\x00', 0x30402, 0x0) syz_open_dev$vbi(&(0x7f0000000640)='/dev/vbi#\x00', 0x3, 0x2) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000680)='/dev/dlm_plock\x00', 0x802, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000006c0)={0xffffffffffffffff, 0xffff7fff, 0x1, r2}) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$kcm(0xa, 0x0, 0x73) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) msgget(0x3, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) chdir(0x0) r3 = socket$kcm(0xa, 0x2, 0x73) bind(r3, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0xf}, 0x3}, 0x80) r4 = syz_init_net_socket$rose(0xb, 0x5, 0x0) recvfrom(r4, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffcd0) r5 = socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f0000000040)={'bridge0\x00h\x00\x01\xd8\x00H\x00'}) getsockname$packet(r2, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0xffffffffffffff92) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) [ 69.304739][ T7820] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.313357][ T7820] bridge0: port 1(bridge_slave_0) entered disabled state 12:24:55 executing program 3: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r0, 0x4, 0x42000) socket$inet(0xa, 0x0, 0x0) mkdirat$cgroup(0xffffffffffffffff, 0x0, 0x1ff) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000000)=@broute={'\n\x00oute\x00', 0x20, 0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20d9f000], 0x0, 0x0, 0x0}, 0xa8) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) ioctl$KVM_GET_NR_MMU_PAGES(r0, 0xae45, 0x5) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000280)='/dev/full\x00', 0x30402, 0x0) syz_open_dev$vbi(&(0x7f0000000640)='/dev/vbi#\x00', 0x3, 0x2) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000680)='/dev/dlm_plock\x00', 0x802, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000006c0)={0xffffffffffffffff, 0xffff7fff, 0x1, r2}) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$kcm(0xa, 0x0, 0x73) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) msgget(0x3, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) chdir(0x0) r3 = socket$kcm(0xa, 0x2, 0x73) bind(r3, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0xf}, 0x3}, 0x80) r4 = syz_init_net_socket$rose(0xb, 0x5, 0x0) recvfrom(r4, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffcd0) r5 = socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f0000000040)={'bridge0\x00h\x00\x01\xd8\x00H\x00'}) getsockname$packet(r2, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0xffffffffffffff92) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) [ 69.599785][ T7] device bridge_slave_1 left promiscuous mode [ 69.617278][ T7] bridge0: port 2(bridge_slave_1) entered disabled state 12:24:55 executing program 0: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r0, 0x4, 0x42000) socket$inet(0xa, 0x0, 0x0) mkdirat$cgroup(0xffffffffffffffff, 0x0, 0x1ff) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000000)=@broute={'\n\x00oute\x00', 0x20, 0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20d9f000], 0x0, 0x0, 0x0}, 0xa8) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) ioctl$KVM_GET_NR_MMU_PAGES(r0, 0xae45, 0x5) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000280)='/dev/full\x00', 0x30402, 0x0) syz_open_dev$vbi(&(0x7f0000000640)='/dev/vbi#\x00', 0x3, 0x2) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000680)='/dev/dlm_plock\x00', 0x802, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000006c0)={0xffffffffffffffff, 0xffff7fff, 0x1, r2}) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$kcm(0xa, 0x0, 0x73) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) msgget(0x3, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) chdir(0x0) r3 = socket$kcm(0xa, 0x2, 0x73) bind(r3, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0xf}, 0x3}, 0x80) r4 = syz_init_net_socket$rose(0xb, 0x5, 0x0) recvfrom(r4, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffcd0) r5 = socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f0000000040)={'bridge0\x00h\x00\x01\xd8\x00H\x00'}) getsockname$packet(r2, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0xffffffffffffff92) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) 12:24:55 executing program 1: seccomp(0x1, 0x8, &(0x7f0000000080)={0x1, &(0x7f00000000c0)=[{0x100000006}]}) socket$inet6_tcp(0xa, 0x1, 0x0) socket$netlink(0x10, 0x3, 0x0) pipe(&(0x7f0000000540)) clock_gettime(0x0, &(0x7f0000000600)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0xff}, &(0x7f0000000200)={0x0, r0+30000000}, 0x0) [ 69.756719][ T7] device bridge_slave_0 left promiscuous mode [ 69.764232][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.819627][ T26] audit: type=1326 audit(1570191895.537:38): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=7847 comm="syz-executor.1" exe="/root/syz-executor.1" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45c89a code=0x0 [ 70.430143][ T7] device hsr_slave_0 left promiscuous mode [ 70.485292][ T7] device hsr_slave_1 left promiscuous mode [ 70.534118][ T7] team0 (unregistering): Port device team_slave_1 removed [ 70.545538][ T7] team0 (unregistering): Port device team_slave_0 removed [ 70.556497][ T7] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface 12:24:56 executing program 1: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r0, 0x4, 0x42000) socket$inet(0xa, 0x0, 0x0) mkdirat$cgroup(0xffffffffffffffff, 0x0, 0x1ff) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000000)=@broute={'\n\x00oute\x00', 0x20, 0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20d9f000], 0x0, 0x0, 0x0}, 0xa8) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) ioctl$KVM_GET_NR_MMU_PAGES(r0, 0xae45, 0x5) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000280)='/dev/full\x00', 0x30402, 0x0) syz_open_dev$vbi(&(0x7f0000000640)='/dev/vbi#\x00', 0x3, 0x2) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000680)='/dev/dlm_plock\x00', 0x802, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000006c0)={0xffffffffffffffff, 0xffff7fff, 0x1, r2}) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$kcm(0xa, 0x0, 0x73) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) msgget(0x3, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) chdir(0x0) r3 = socket$kcm(0xa, 0x2, 0x73) bind(r3, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0xf}, 0x3}, 0x80) r4 = syz_init_net_socket$rose(0xb, 0x5, 0x0) recvfrom(r4, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffcd0) r5 = socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f0000000040)={'bridge0\x00h\x00\x01\xd8\x00H\x00'}) getsockname$packet(r2, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0xffffffffffffff92) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) [ 70.631617][ T7] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 70.730205][ T7] bond0 (unregistering): Released all slaves 12:24:56 executing program 5: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r0, 0x4, 0x42000) socket$inet(0xa, 0x0, 0x0) mkdirat$cgroup(0xffffffffffffffff, 0x0, 0x1ff) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000000)=@broute={'\n\x00oute\x00', 0x20, 0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20d9f000], 0x0, 0x0, 0x0}, 0xa8) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) ioctl$KVM_GET_NR_MMU_PAGES(r0, 0xae45, 0x5) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000280)='/dev/full\x00', 0x30402, 0x0) syz_open_dev$vbi(&(0x7f0000000640)='/dev/vbi#\x00', 0x3, 0x2) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000680)='/dev/dlm_plock\x00', 0x802, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000006c0)={0xffffffffffffffff, 0xffff7fff, 0x1, r2}) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$kcm(0xa, 0x0, 0x73) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) msgget(0x3, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) chdir(0x0) r3 = socket$kcm(0xa, 0x2, 0x73) bind(r3, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0xf}, 0x3}, 0x80) r4 = syz_init_net_socket$rose(0xb, 0x5, 0x0) recvfrom(r4, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffcd0) r5 = socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f0000000040)={'bridge0\x00h\x00\x01\xd8\x00H\x00'}) getsockname$packet(r2, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0xffffffffffffff92) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) [ 70.819054][ T7832] bridge0: port 2(bridge_slave_1) entered disabled state [ 70.826304][ T7832] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.900913][ T7839] bridge0: port 2(bridge_slave_1) entered disabled state [ 70.908384][ T7839] bridge0: port 1(bridge_slave_0) entered disabled state 12:24:56 executing program 4: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r0, 0x4, 0x42000) socket$inet(0xa, 0x0, 0x0) mkdirat$cgroup(0xffffffffffffffff, 0x0, 0x1ff) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000000)=@broute={'\n\x00oute\x00', 0x20, 0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20d9f000], 0x0, 0x0, 0x0}, 0xa8) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) ioctl$KVM_GET_NR_MMU_PAGES(r0, 0xae45, 0x5) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000280)='/dev/full\x00', 0x30402, 0x0) syz_open_dev$vbi(&(0x7f0000000640)='/dev/vbi#\x00', 0x3, 0x2) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000680)='/dev/dlm_plock\x00', 0x802, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000006c0)={0xffffffffffffffff, 0xffff7fff, 0x1, r2}) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$kcm(0xa, 0x0, 0x73) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) msgget(0x3, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) chdir(0x0) r3 = socket$kcm(0xa, 0x2, 0x73) bind(r3, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0xf}, 0x3}, 0x80) r4 = syz_init_net_socket$rose(0xb, 0x5, 0x0) recvfrom(r4, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffcd0) r5 = socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f0000000040)={'bridge0\x00h\x00\x01\xd8\x00H\x00'}) getsockname$packet(r2, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0xffffffffffffff92) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) 12:24:56 executing program 5: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r0, 0x4, 0x42000) socket$inet(0xa, 0x0, 0x0) mkdirat$cgroup(0xffffffffffffffff, 0x0, 0x1ff) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000000)=@broute={'\n\x00oute\x00', 0x20, 0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20d9f000], 0x0, 0x0, 0x0}, 0xa8) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) ioctl$KVM_GET_NR_MMU_PAGES(r0, 0xae45, 0x5) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000280)='/dev/full\x00', 0x30402, 0x0) syz_open_dev$vbi(&(0x7f0000000640)='/dev/vbi#\x00', 0x3, 0x2) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000680)='/dev/dlm_plock\x00', 0x802, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000006c0)={0xffffffffffffffff, 0xffff7fff, 0x1, r2}) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$kcm(0xa, 0x0, 0x73) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) msgget(0x3, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) chdir(0x0) r3 = socket$kcm(0xa, 0x2, 0x73) bind(r3, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0xf}, 0x3}, 0x80) r4 = syz_init_net_socket$rose(0xb, 0x5, 0x0) recvfrom(r4, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffcd0) r5 = socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f0000000040)={'bridge0\x00h\x00\x01\xd8\x00H\x00'}) getsockname$packet(r2, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0xffffffffffffff92) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) 12:24:56 executing program 3: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r0, 0x4, 0x42000) socket$inet(0xa, 0x0, 0x0) mkdirat$cgroup(0xffffffffffffffff, 0x0, 0x1ff) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000000)=@broute={'\n\x00oute\x00', 0x20, 0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20d9f000], 0x0, 0x0, 0x0}, 0xa8) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) ioctl$KVM_GET_NR_MMU_PAGES(r0, 0xae45, 0x5) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000280)='/dev/full\x00', 0x30402, 0x0) syz_open_dev$vbi(&(0x7f0000000640)='/dev/vbi#\x00', 0x3, 0x2) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000680)='/dev/dlm_plock\x00', 0x802, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000006c0)={0xffffffffffffffff, 0xffff7fff, 0x1, r2}) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$kcm(0xa, 0x0, 0x73) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) msgget(0x3, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) chdir(0x0) r3 = socket$kcm(0xa, 0x2, 0x73) bind(r3, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0xf}, 0x3}, 0x80) r4 = syz_init_net_socket$rose(0xb, 0x5, 0x0) recvfrom(r4, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffcd0) r5 = socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f0000000040)={'bridge0\x00h\x00\x01\xd8\x00H\x00'}) getsockname$packet(r2, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0xffffffffffffff92) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) [ 71.210109][ T7854] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.210351][ T7851] IPVS: ftp: loaded support on port[0] = 21 [ 71.231994][ T7854] bridge0: port 1(bridge_slave_0) entered disabled state 12:24:57 executing program 1: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r0, 0x4, 0x42000) socket$inet(0xa, 0x0, 0x0) mkdirat$cgroup(0xffffffffffffffff, 0x0, 0x1ff) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000000)=@broute={'\n\x00oute\x00', 0x20, 0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20d9f000], 0x0, 0x0, 0x0}, 0xa8) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) ioctl$KVM_GET_NR_MMU_PAGES(r0, 0xae45, 0x5) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000280)='/dev/full\x00', 0x30402, 0x0) syz_open_dev$vbi(&(0x7f0000000640)='/dev/vbi#\x00', 0x3, 0x2) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000680)='/dev/dlm_plock\x00', 0x802, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000006c0)={0xffffffffffffffff, 0xffff7fff, 0x1, r2}) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$kcm(0xa, 0x0, 0x73) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) msgget(0x3, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) chdir(0x0) r3 = socket$kcm(0xa, 0x2, 0x73) bind(r3, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0xf}, 0x3}, 0x80) r4 = syz_init_net_socket$rose(0xb, 0x5, 0x0) recvfrom(r4, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffcd0) r5 = socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f0000000040)={'bridge0\x00h\x00\x01\xd8\x00H\x00'}) getsockname$packet(r2, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0xffffffffffffff92) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) 12:24:57 executing program 0: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r0, 0x4, 0x42000) socket$inet(0xa, 0x0, 0x0) mkdirat$cgroup(0xffffffffffffffff, 0x0, 0x1ff) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000000)=@broute={'\n\x00oute\x00', 0x20, 0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20d9f000], 0x0, 0x0, 0x0}, 0xa8) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) ioctl$KVM_GET_NR_MMU_PAGES(r0, 0xae45, 0x5) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000280)='/dev/full\x00', 0x30402, 0x0) syz_open_dev$vbi(&(0x7f0000000640)='/dev/vbi#\x00', 0x3, 0x2) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000680)='/dev/dlm_plock\x00', 0x802, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000006c0)={0xffffffffffffffff, 0xffff7fff, 0x1, r2}) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') socket$kcm(0xa, 0x0, 0x73) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) msgget(0x3, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) chdir(0x0) r3 = socket$kcm(0xa, 0x2, 0x73) bind(r3, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0xf}, 0x3}, 0x80) r4 = syz_init_net_socket$rose(0xb, 0x5, 0x0) recvfrom(r4, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffcd0) r5 = socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f0000000040)={'bridge0\x00h\x00\x01\xd8\x00H\x00'}) getsockname$packet(r2, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0xffffffffffffff92) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) [ 72.106140][ T7851] chnl_net:caif_netlink_parms(): no params data found [ 72.183520][ T7851] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.219182][ T7851] bridge0: port 1(bridge_slave_0) entered disabled state [ 72.240231][ T7851] device bridge_slave_0 entered promiscuous mode [ 72.279574][ T7851] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.298839][ T7851] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.326130][ T7851] device bridge_slave_1 entered promiscuous mode [ 72.353667][ T7870] IPVS: ftp: loaded support on port[0] = 21 [ 72.368260][ T7851] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 72.398095][ T7851] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 72.434707][ T7851] team0: Port device team_slave_0 added [ 72.444360][ T7851] team0: Port device team_slave_1 added [ 72.538524][ T7851] device hsr_slave_0 entered promiscuous mode [ 72.580256][ T7851] device hsr_slave_1 entered promiscuous mode [ 72.635677][ T7851] debugfs: Directory 'hsr0' with parent '/' already present! [ 72.690792][ T7870] chnl_net:caif_netlink_parms(): no params data found [ 72.743480][ T7870] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.750867][ T7870] bridge0: port 1(bridge_slave_0) entered disabled state [ 72.765689][ T7870] device bridge_slave_0 entered promiscuous mode [ 72.783546][ T7851] 8021q: adding VLAN 0 to HW filter on device bond0 [ 72.794610][ T7870] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.801726][ T7870] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.809955][ T7870] device bridge_slave_1 entered promiscuous mode [ 72.831537][ T7870] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 72.842708][ T7870] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 72.868301][ T7870] team0: Port device team_slave_0 added [ 72.876915][ T7870] team0: Port device team_slave_1 added [ 72.884123][ T7393] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 72.894545][ T7393] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 72.902894][ T7393] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 72.911592][ T7851] 8021q: adding VLAN 0 to HW filter on device team0 [ 72.978714][ T7870] device hsr_slave_0 entered promiscuous mode [ 73.025558][ T7870] device hsr_slave_1 entered promiscuous mode [ 73.065231][ T7870] debugfs: Directory 'hsr0' with parent '/' already present! [ 73.075558][ T7421] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 73.083989][ T7421] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 73.092401][ T7421] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.099583][ T7421] bridge0: port 1(bridge_slave_0) entered forwarding state [ 73.107573][ T7421] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 73.141751][ T7393] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 73.150879][ T7393] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 73.159972][ T7393] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.167070][ T7393] bridge0: port 2(bridge_slave_1) entered forwarding state [ 73.179519][ T7393] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 73.188672][ T7393] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 73.197042][ T7393] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 73.217921][ T7393] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 73.226195][ T7393] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 73.242326][ T7870] 8021q: adding VLAN 0 to HW filter on device bond0 [ 73.251115][ T7851] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 73.268675][ T7870] 8021q: adding VLAN 0 to HW filter on device team0 [ 73.277248][ T2633] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 73.294611][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 73.304934][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 73.313702][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.320890][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 73.328653][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 73.337454][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 73.345902][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.352925][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 73.361133][ T7421] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 73.375478][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 73.384170][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 73.393578][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 73.402595][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 73.411855][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 73.424956][ T7851] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 73.437680][ T7870] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 73.449753][ T7870] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 73.463387][ T2633] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 73.478275][ T2633] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 73.487707][ T2633] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 73.496763][ T2633] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 73.506079][ T2633] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 73.514841][ T2633] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 73.524051][ T2633] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 73.541482][ T7870] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 74.021898][ T7880] bridge0: port 2(bridge_slave_1) entered disabled state [ 74.035212][ T7880] bridge0: port 1(bridge_slave_0) entered disabled state [ 74.075084][ C0] ================================================================== [ 74.083369][ C0] BUG: KCSAN: data-race in __hrtimer_run_queues+0x1f2/0x600 and hrtimer_active+0x84/0x1a0 [ 74.093258][ C0] [ 74.095692][ C0] read to 0xffff88812be1d818 of 8 bytes by interrupt on cpu 1: [ 74.103239][ C0] hrtimer_active+0x84/0x1a0 [ 74.107831][ C0] task_tick_fair+0x4c/0x920 [ 74.112428][ C0] scheduler_tick+0x5c/0xe0 [ 74.116931][ C0] update_process_times+0x5f/0x80 [ 74.121961][ C0] tick_sched_handle+0x75/0x100 [ 74.127086][ C0] tick_sched_timer+0x58/0xe0 [ 74.131854][ C0] __hrtimer_run_queues+0x288/0x600 [ 74.137050][ C0] hrtimer_interrupt+0x22a/0x480 [ 74.141986][ C0] smp_apic_timer_interrupt+0xdc/0x280 [ 74.147438][ C0] apic_timer_interrupt+0xf/0x20 [ 74.152371][ C0] __kcsan_check_watchpoint+0x7c/0x180 [ 74.157823][ C0] __tsan_read8+0x15/0x30 [ 74.162146][ C0] _raw_spin_unlock+0x1d/0x60 [ 74.166819][ C0] nf_ct_iterate_cleanup+0x113/0x2e0 [ 74.172271][ C0] [ 74.174607][ C0] write to 0xffff88812be1d818 of 8 bytes by interrupt on cpu 0: [ 74.182238][ C0] __hrtimer_run_queues+0x1f2/0x600 [ 74.187521][ C0] hrtimer_interrupt+0x22a/0x480 [ 74.192460][ C0] smp_apic_timer_interrupt+0xdc/0x280 [ 74.197930][ C0] apic_timer_interrupt+0xf/0x20 [ 74.202868][ C0] native_safe_halt+0xe/0x10 [ 74.207456][ C0] arch_cpu_idle+0x1f/0x30 [ 74.211870][ C0] default_idle_call+0x1e/0x40 [ 74.216633][ C0] do_idle+0x1ea/0x2c0 [ 74.220696][ C0] cpu_startup_entry+0x1b/0x20 [ 74.225451][ C0] rest_init+0xec/0xf6 [ 74.229867][ C0] arch_call_rest_init+0x17/0x37 [ 74.234799][ C0] start_kernel+0x83e/0x864 [ 74.239301][ C0] x86_64_start_reservations+0x29/0x2b [ 74.244739][ C0] [ 74.247066][ C0] Reported by Kernel Concurrency Sanitizer on: [ 74.253228][ C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.3.0+ #0 [ 74.260068][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 74.270138][ C0] ================================================================== [ 74.278203][ C0] Kernel panic - not syncing: panic_on_warn set ... [ 74.284810][ C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.3.0+ #0 [ 74.291572][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 74.301630][ C0] Call Trace: [ 74.304909][ C0] [ 74.307778][ C0] dump_stack+0xf5/0x159 [ 74.312141][ C0] panic+0x209/0x639 [ 74.316033][ C0] ? vprintk_func+0x8d/0x140 [ 74.320624][ C0] kcsan_report.cold+0x57/0xeb [ 74.325386][ C0] __kcsan_setup_watchpoint+0x342/0x500 [ 74.331021][ C0] __tsan_write8+0x32/0x40 [ 74.335439][ C0] __hrtimer_run_queues+0x1f2/0x600 [ 74.340636][ C0] ? ktime_get_update_offsets_now+0x28f/0x2f0 [ 74.346702][ C0] hrtimer_interrupt+0x22a/0x480 [ 74.351659][ C0] smp_apic_timer_interrupt+0xdc/0x280 [ 74.357134][ C0] ? smp_reschedule_interrupt+0x71/0x1d0 [ 74.362762][ C0] apic_timer_interrupt+0xf/0x20 [ 74.367699][ C0] [ 74.370639][ C0] RIP: 0010:native_safe_halt+0xe/0x10 [ 74.376006][ C0] Code: 90 90 90 90 90 90 90 90 90 90 90 90 e9 07 00 00 00 0f 00 2d 8c d2 4e 00 f4 c3 66 90 e9 07 00 00 00 0f 00 2d 7c d2 4e 00 fb f4 90 55 48 89 e5 41 55 41 54 53 e8 82 78 a7 fc e8 5d 4e b9 fd 0f [ 74.395615][ C0] RSP: 0018:ffffffff85a03de0 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13 [ 74.404027][ C0] RAX: f1a9fbe76ca04bde RBX: 0000000000000000 RCX: 000000000000076c [ 74.411993][ C0] RDX: 000000001241d400 RSI: 020c49ba5e353f7d RDI: ffffffff85a55a28 [ 74.419957][ C0] RBP: ffffffff85a03e18 R08: 0000000000000000 R09: 0000ffff85a55a2f [ 74.427938][ C0] R10: 00000000aaaaaaab R11: ffffffff86042cc0 R12: ffffffff85a2b780 [ 74.435906][ C0] R13: ffffffff85a2b780 R14: 0000000000000000 R15: 0000000000000000 [ 74.444028][ C0] ? default_idle+0x50/0x230 [ 74.448659][ C0] arch_cpu_idle+0x1f/0x30 [ 74.453080][ C0] default_idle_call+0x1e/0x40 [ 74.457993][ C0] do_idle+0x1ea/0x2c0 [ 74.462060][ C0] cpu_startup_entry+0x1b/0x20 [ 74.466820][ C0] rest_init+0xec/0xf6 [ 74.470894][ C0] ? trace_event_define_fields_vector_free_moved+0xce/0xce [ 74.478100][ C0] arch_call_rest_init+0x17/0x37 [ 74.483061][ C0] start_kernel+0x83e/0x864 [ 74.487575][ C0] x86_64_start_reservations+0x29/0x2b [ 74.493036][ C0] x86_64_start_kernel+0x72/0x76 [ 74.498003][ C0] secondary_startup_64+0xa4/0xb0 [ 74.504727][ C0] Kernel Offset: disabled [ 74.509069][ C0] Rebooting in 86400 seconds..