[....] Starting OpenBSD Secure Shell server: sshd[ 51.485583] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. [ 51.843881] audit: type=1800 audit(1538968420.890:29): pid=5846 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 51.863459] audit: type=1800 audit(1538968420.890:30): pid=5846 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 [ 52.564241] random: sshd: uninitialized urandom read (32 bytes read) [ 52.998065] random: sshd: uninitialized urandom read (32 bytes read) Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 55.237492] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.0.124' (ECDSA) to the list of known hosts. [ 61.182600] random: sshd: uninitialized urandom read (32 bytes read) 2018/10/08 03:13:52 fuzzer started [ 65.805499] random: cc1: uninitialized urandom read (8 bytes read) 2018/10/08 03:13:56 dialing manager at 10.128.0.26:36867 2018/10/08 03:13:57 syscalls: 1 2018/10/08 03:13:57 code coverage: enabled 2018/10/08 03:13:57 comparison tracing: CONFIG_KCOV_ENABLE_COMPARISONS is not enabled 2018/10/08 03:13:57 setuid sandbox: enabled 2018/10/08 03:13:57 namespace sandbox: enabled 2018/10/08 03:13:57 Android sandbox: /sys/fs/selinux/policy does not exist 2018/10/08 03:13:57 fault injection: enabled 2018/10/08 03:13:57 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2018/10/08 03:13:57 net packed injection: enabled 2018/10/08 03:13:57 net device setup: enabled [ 70.397707] random: crng init done 03:15:49 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={&(0x7f0000000240), 0xc, &(0x7f0000000180)={&(0x7f0000009f80)=@delpolicy={0x50, 0x14, 0x231, 0x0, 0x0, {{@in6=@loopback, @in=@loopback}, 0x68}}, 0x50}, 0x8}, 0x0) [ 181.664227] IPVS: ftp: loaded support on port[0] = 21 [ 183.704677] bridge0: port 1(bridge_slave_0) entered blocking state [ 183.711135] bridge0: port 1(bridge_slave_0) entered disabled state [ 183.719385] device bridge_slave_0 entered promiscuous mode [ 183.858818] bridge0: port 2(bridge_slave_1) entered blocking state [ 183.865614] bridge0: port 2(bridge_slave_1) entered disabled state [ 183.875488] device bridge_slave_1 entered promiscuous mode [ 183.998269] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 184.130257] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 184.508834] bond0: Enslaving bond_slave_0 as an active interface with an up link 03:15:53 executing program 1: syz_open_procfs(0x0, &(0x7f0000000040)='net/raw\x00') recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000000140)=@ipx, 0x80, &(0x7f0000000280)}}], 0x1, 0x0, &(0x7f0000003280)={0x0, 0x1c9c380}) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') preadv(r0, &(0x7f00000017c0), 0x1a4, 0x0) [ 184.694019] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 185.131913] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 185.138950] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 185.258556] IPVS: ftp: loaded support on port[0] = 21 [ 185.607544] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 185.615542] team0: Port device team_slave_0 added [ 185.843125] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 185.851017] team0: Port device team_slave_1 added [ 186.094482] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 186.245217] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 186.252271] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 186.261011] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 186.487765] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 186.495429] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 186.504559] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 186.733248] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 186.740725] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 186.749727] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 188.750893] bridge0: port 1(bridge_slave_0) entered blocking state [ 188.757512] bridge0: port 1(bridge_slave_0) entered disabled state [ 188.765890] device bridge_slave_0 entered promiscuous mode [ 188.844261] bridge0: port 2(bridge_slave_1) entered blocking state [ 188.850772] bridge0: port 2(bridge_slave_1) entered forwarding state [ 188.857767] bridge0: port 1(bridge_slave_0) entered blocking state [ 188.864266] bridge0: port 1(bridge_slave_0) entered forwarding state [ 188.872927] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 189.002879] bridge0: port 2(bridge_slave_1) entered blocking state [ 189.009291] bridge0: port 2(bridge_slave_1) entered disabled state [ 189.017548] device bridge_slave_1 entered promiscuous mode [ 189.220255] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready 03:15:58 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$search(0xa, r0, &(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={'syz', 0x2}, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000100)={0x0, 0x3ff, 0x0, 0xffff, 0x7}, &(0x7f0000000140)=0x18) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000180)={r1, 0x80}, &(0x7f00000001c0)=0x8) [ 189.461487] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 189.703290] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 190.217727] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 190.244725] IPVS: ftp: loaded support on port[0] = 21 [ 190.534996] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 190.802872] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 190.809850] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 191.033373] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 191.040378] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 191.717696] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 191.725681] team0: Port device team_slave_0 added [ 192.024704] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 192.032804] team0: Port device team_slave_1 added [ 192.319771] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 192.327059] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 192.335822] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 192.638037] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 192.645146] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 192.653899] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 192.921863] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 192.929467] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 192.938432] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 193.169599] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 193.177272] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 193.186151] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 194.264585] bridge0: port 1(bridge_slave_0) entered blocking state [ 194.271062] bridge0: port 1(bridge_slave_0) entered disabled state [ 194.279477] device bridge_slave_0 entered promiscuous mode [ 194.622238] bridge0: port 2(bridge_slave_1) entered blocking state [ 194.628664] bridge0: port 2(bridge_slave_1) entered disabled state [ 194.636953] device bridge_slave_1 entered promiscuous mode [ 194.921872] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 195.175673] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 195.826703] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 196.031385] bridge0: port 2(bridge_slave_1) entered blocking state [ 196.037877] bridge0: port 2(bridge_slave_1) entered forwarding state [ 196.044846] bridge0: port 1(bridge_slave_0) entered blocking state [ 196.051305] bridge0: port 1(bridge_slave_0) entered forwarding state [ 196.060023] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 196.076603] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 196.357110] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 196.364251] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 196.579667] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 196.586827] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready 03:16:05 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_QUERY(r0, &(0x7f0000000240)={0x13, 0x10, 0xfa00, {0xfffffffffffffffd}}, 0x18) [ 196.842126] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 197.447403] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 197.455367] team0: Port device team_slave_0 added [ 197.785770] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 197.793762] team0: Port device team_slave_1 added [ 197.877205] IPVS: ftp: loaded support on port[0] = 21 [ 198.093333] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 198.100254] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 198.108986] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 198.386843] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 198.393971] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 198.402709] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 198.677838] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 198.685511] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 198.694161] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 198.990391] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 198.998691] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 199.007591] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 199.758623] 8021q: adding VLAN 0 to HW filter on device bond0 [ 200.923700] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 201.901316] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 201.908089] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 201.916085] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 202.658707] bridge0: port 2(bridge_slave_1) entered blocking state [ 202.665287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 202.672429] bridge0: port 1(bridge_slave_0) entered blocking state [ 202.678864] bridge0: port 1(bridge_slave_0) entered forwarding state [ 202.687383] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 202.713416] ip (6483) used greatest stack depth: 53056 bytes left [ 202.954929] bridge0: port 1(bridge_slave_0) entered blocking state [ 202.961377] bridge0: port 1(bridge_slave_0) entered disabled state [ 202.969806] device bridge_slave_0 entered promiscuous mode [ 203.056922] 8021q: adding VLAN 0 to HW filter on device team0 [ 203.328627] bridge0: port 2(bridge_slave_1) entered blocking state [ 203.335214] bridge0: port 2(bridge_slave_1) entered disabled state [ 203.343486] device bridge_slave_1 entered promiscuous mode [ 203.381884] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 203.653060] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 203.896422] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 204.818268] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 205.083403] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 205.403031] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 205.417664] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 205.654859] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 205.662182] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready 03:16:15 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000009c0)='/dev/input/event#\x00', 0x0, 0x5) write$binfmt_elf64(r0, &(0x7f00000000c0)=ANY=[], 0xffffffe8) r1 = gettid() syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) r2 = fcntl$dupfd(r0, 0x0, r0) timer_create(0x0, &(0x7f0000000300)={0x0, 0x12}, &(0x7f0000000340)) timer_settime(0x0, 0x0, &(0x7f00000000c0)={{0x0, 0x8}, {0x0, 0x1c9c380}}, &(0x7f0000000040)) tkill(r1, 0x401004000000016) ioctl$TUNSETVNETLE(r2, 0x400454dc, &(0x7f0000000100)) [ 206.568269] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 206.576148] team0: Port device team_slave_0 added [ 206.963199] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 206.971097] team0: Port device team_slave_1 added [ 207.363447] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 207.370482] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 207.379233] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 207.617384] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 207.624543] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 207.633229] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 207.688897] IPVS: ftp: loaded support on port[0] = 21 [ 207.954417] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 207.962174] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 207.971141] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 208.325116] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 208.332728] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 208.341555] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 208.972410] 8021q: adding VLAN 0 to HW filter on device bond0 [ 210.434638] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready 03:16:20 executing program 0: r0 = socket$inet6(0xa, 0x5, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r1, 0xc0305302, &(0x7f0000dc5f98)) 03:16:20 executing program 0: unshare(0x8020400) r0 = creat(&(0x7f0000000100)='./file0\x00', 0x8) r1 = syz_open_dev$vcsn(&(0x7f00000001c0)='/dev/vcs#\x00', 0x8, 0x20000) renameat2(r0, &(0x7f0000000140)='./file0\x00', r1, &(0x7f0000000200)='./file0\x00', 0x4) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r2, 0x4008af60, &(0x7f0000000040)) fgetxattr(r2, &(0x7f0000000000)=@known='user.syz\x00', &(0x7f0000000080)=""/67, 0x43) [ 211.958573] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 211.965127] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 211.973088] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 03:16:21 executing program 0: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) unshare(0x20400) poll(&(0x7f0000000040)=[{r0}], 0x1, 0x0) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/sys/net/ipv4/vs/ignore_tunneled\x00', 0x2, 0x0) [ 212.468650] bridge0: port 2(bridge_slave_1) entered blocking state [ 212.475244] bridge0: port 2(bridge_slave_1) entered forwarding state [ 212.482177] bridge0: port 1(bridge_slave_0) entered blocking state [ 212.488601] bridge0: port 1(bridge_slave_0) entered forwarding state [ 212.496744] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready 03:16:21 executing program 0: socketpair$unix(0x1, 0x100000000005, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x101280, 0x100) ioctl$sock_inet_SIOCGIFPFLAGS(r2, 0x8935, &(0x7f0000000100)={'erspan0\x00', 0x2}) getsockname$netlink(r2, &(0x7f0000000040), &(0x7f00000000c0)=0xc) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$sock_ifreq(r0, 0x891e, &(0x7f0000000140)={'veth1\x00', @ifru_names='ip6_vti0\x00'}) [ 212.982499] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready 03:16:22 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$RDS_GET_MR_FOR_DEST(r0, 0x114, 0x7, &(0x7f00000002c0)={@generic={0x0, "50b3daf0cd8a029de6e3ec6c436de87ec3f21d1dd767e7bd19bd5bb579033bfed147274b6eb1761b9233de8567a559d0e757d1845153ab41f2c503d92859617b8d171c88f5f0e1fdd81d79013ae5d705a9f32e6454c1b09fe211ebb381277b8f7bbe8dcf25992aa71076ffcdea5940621bff813769959572143f741f7b12"}, {&(0x7f0000000040)=""/108, 0x6c}, &(0x7f00000000c0)}, 0xa0) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000380)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20010011}, 0xc, &(0x7f0000000480)={&(0x7f00000003c0)={0xb4, r1, 0x410, 0x70bd28, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_DEST={0x24, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x6}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x5}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}, @IPVS_CMD_ATTR_DAEMON={0x60, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipddp0\x00'}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0xd1e}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast2}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @rand_addr=0x6}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x20}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @broadcast}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @broadcast}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @broadcast}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x8000}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x100000001}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x7}]}]}, 0xb4}, 0x1, 0x0, 0x0, 0x40000}, 0x4000) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f00000001c0)=[@in={0x2, 0x4e24, @local}, @in={0x2, 0x4e21, @broadcast}, @in6={0xa, 0x4e20, 0x100000001, @loopback}, @in={0x2, 0x4e21, @remote}, @in={0x2, 0x4e22, @broadcast}, @in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1c}}, @in6={0xa, 0x4e21, 0x0, @loopback, 0xfffffffffffffffc}], 0x88) [ 213.577823] 8021q: adding VLAN 0 to HW filter on device team0 03:16:22 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0xe, &(0x7f0000001000)=ANY=[@ANYBLOB="b70000000080fcd82028eb645c4100000703000020feffff7a0af0fff8ffffff79a4f0ff00000000b7060000000000012d6bbb3858c5cf3a3004040001ed0ebb1c04000000000000b7050000000000000f03000000000000850000002e000000b7000000000000009500000000000000"], &(0x7f0000000100)='GPL\x00'}, 0x48) r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/qat_adf_ctl\x00', 0x0, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80040000000002, &(0x7f00000000c0)=0x65, 0x4) bind$inet(r1, &(0x7f0000000200)={0x2, 0x4e23, @broadcast}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000100)='illinois\x00', 0xd470041877f0fcc9) sendto$inet(r1, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20004000, &(0x7f0000e68000)={0x2, 0x4004e23, @local, [0x0, 0x0, 0x1802000000000000]}, 0x10) shutdown(r1, 0x1) getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f00000000c0)=""/53, &(0x7f0000000140)=0x35) setsockopt$inet_MCAST_LEAVE_GROUP(r1, 0x0, 0x2d, &(0x7f0000000240)={0x7, {{0x2, 0x4e21, @multicast1}}}, 0x88) [ 214.209909] bridge0: port 1(bridge_slave_0) entered blocking state [ 214.216525] bridge0: port 1(bridge_slave_0) entered disabled state [ 214.224993] device bridge_slave_0 entered promiscuous mode 03:16:23 executing program 0: r0 = syz_open_dev$sndpcmp(&(0x7f0000000200)='/dev/snd/pcmC#D#p\x00', 0x5, 0x0) ioctl$KIOCSOUND(r0, 0x4b2f, 0x6) r1 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r1, 0x84, 0x6e, &(0x7f0000961fe4)=[@in={0x2, 0x0, @dev}], 0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000380)=ANY=[@ANYBLOB="010058471040c00ca1fad4ae8c804f4e3542529e4466ea1a91d03bf372c39198c8d2d3e22176b73722de2e4d97ff2e60cdde7dd1b7a3e4e5711db67f501b5201eac2871315ce6fc95eef374c2ac2eeb8e1340350ef52b4a69b0000f4f7f84837c7e385a8289ca11529a2dea55c7683fa0e7e210d27caf52dd66b22e75ea1663ce2c54ad0b5f71dc5f557dfc5194f1bd0746106000000197af3c5cc1169f9b8270abcac8aa8d36faac01ef36f6c995ade33300a04791b0700000000000000e8b29a60df94642f937087a845f1c02027a797b69171c314942e3916", @ANYRES32=0x0], &(0x7f0000000240)=0x2) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000300)='/dev/zero\x00', 0x8080, 0x0) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f0000000340)=0x3, 0x4) ioctl$SG_GET_VERSION_NUM(r3, 0x2282, &(0x7f0000000280)) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6d, &(0x7f0000000040)={r2, @in={{0x2, 0x0, @multicast1}}}, &(0x7f0000000000)=0x84) ioctl$TIOCLINUX7(r3, 0x541c, &(0x7f00000002c0)={0x7, 0x9}) [ 214.681059] bridge0: port 2(bridge_slave_1) entered blocking state [ 214.687620] bridge0: port 2(bridge_slave_1) entered disabled state [ 214.695775] device bridge_slave_1 entered promiscuous mode [ 214.987359] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 215.285394] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready 03:16:24 executing program 0: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x8912, &(0x7f00000000c0)="153f6234418dd25d766070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sync_file_range(0xffffffffffffffff, 0x0, 0xfffffffffffffffc, 0x0) recvmsg(r0, &(0x7f0000002240)={&(0x7f0000000040)=@xdp={0x2c, 0x0, 0x0}, 0x80, &(0x7f0000000100)=[{&(0x7f00000001c0)=""/95, 0x5f}, {&(0x7f0000000240)=""/4096, 0x1000}], 0x2, &(0x7f0000001240)=""/4096, 0x1000, 0x7}, 0x1) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000002280)={'team0\x00', r1}) [ 216.329258] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 216.628054] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 216.639848] 8021q: adding VLAN 0 to HW filter on device bond0 [ 216.881721] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 216.888709] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 217.157823] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 217.164911] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 217.784503] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 217.985385] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 217.993412] team0: Port device team_slave_0 added [ 218.277426] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 218.285566] team0: Port device team_slave_1 added [ 218.530202] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 218.537439] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 218.546074] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 218.740399] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 218.746851] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 218.754575] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 218.839496] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 218.846656] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 218.855627] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 219.065516] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 219.073041] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 219.081540] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 219.309053] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 219.317573] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 219.326272] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 219.690975] 8021q: adding VLAN 0 to HW filter on device team0 03:16:30 executing program 1: [ 221.895100] bridge0: port 2(bridge_slave_1) entered blocking state [ 221.901569] bridge0: port 2(bridge_slave_1) entered forwarding state [ 221.908570] bridge0: port 1(bridge_slave_0) entered blocking state [ 221.915073] bridge0: port 1(bridge_slave_0) entered forwarding state [ 221.923148] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 221.929631] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 223.669285] 8021q: adding VLAN 0 to HW filter on device bond0 [ 224.363045] hrtimer: interrupt took 63847 ns [ 224.487445] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 225.255338] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 225.261818] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 225.269467] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 03:16:34 executing program 2: [ 225.956972] 8021q: adding VLAN 0 to HW filter on device team0 [ 228.166028] 8021q: adding VLAN 0 to HW filter on device bond0 [ 228.636445] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready 03:16:37 executing program 3: [ 229.050830] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 229.057262] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 229.065678] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 229.331459] 8021q: adding VLAN 0 to HW filter on device team0 03:16:42 executing program 4: 03:16:42 executing program 0: r0 = socket$inet6(0xa, 0x5, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0xc96, 0x101001) write$P9_RLERROR(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="0d00b2000701000000"], 0x9) 03:16:42 executing program 5: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0xa000, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000040)={{{@in=@multicast2, @in6=@loopback}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in=@multicast1}}, &(0x7f0000000140)=0xe8) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000180)=0x0) wait4(r1, &(0x7f00000001c0), 0x9, &(0x7f0000000200)) setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f00000002c0)={@in={{0x2, 0x4e21}}, 0x3f, 0x1ff, 0x7, "4e112c8bddf57c6a5d7104c68021417579148623e6641cd0a5c39dde44ba7fec6c9d0362e0cefc3c9f739acc70f61151cc5b1b54ffbe31f92e3b872827f31b6b7d38cf2e9eaabcbd022262e2b2c0ec69"}, 0xd8) getpeername$unix(r0, &(0x7f00000003c0)=@abs, &(0x7f0000000440)=0x6e) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r0, 0xc04c5349, &(0x7f0000000480)={0x695, 0x400, 0x1f}) write$P9_RLOCK(r0, &(0x7f0000000500)={0x8, 0x35, 0x1, 0x3}, 0x8) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000540)={r0}) ioctl$sock_SIOCBRDELBR(r0, 0x89a1, &(0x7f0000000580)='veth0_to_bond\x00') setsockopt$inet_group_source_req(r0, 0x0, 0x2f, &(0x7f00000005c0)={0xffffffffffff0001, {{0x2, 0x4e23, @loopback}}, {{0x2, 0x4e24, @multicast2}}}, 0x108) recvmsg(r0, &(0x7f0000000cc0)={&(0x7f0000000700)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff}}, 0x80, &(0x7f0000000b80)=[{&(0x7f0000000780)=""/32, 0x20}, {&(0x7f00000007c0)=""/115, 0x73}, {&(0x7f0000000840)=""/141, 0x8d}, {&(0x7f0000000900)=""/205, 0xcd}, {&(0x7f0000000a00)=""/100, 0x64}, {&(0x7f0000000a80)=""/199, 0xc7}], 0x6, &(0x7f0000000c00)=""/153, 0x99, 0x10001}, 0x100) ioctl$sock_FIOGETOWN(r2, 0x8903, &(0x7f0000000d00)) openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000d40)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) ioctl$VHOST_SET_VRING_CALL(r0, 0x4008af21, &(0x7f0000000d80)={0x3, r0}) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000dc0)=[@in6={0xa, 0x4e21, 0xfff, @ipv4={[], [], @multicast2}, 0x3f}], 0x1c) ioctl$KVM_PPC_ALLOCATE_HTAB(r3, 0xc004aea7, &(0x7f0000000e00)=0x3ff) setsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000000e40)=0x401, 0x4) getsockopt$inet_sctp6_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000e80)=@assoc_value={0x0}, &(0x7f0000000ec0)=0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000f40)={r4, 0x3c, &(0x7f0000000f00)=[@in={0x2, 0x4e21, @broadcast}, @in={0x2, 0x4e24, @multicast2}, @in6={0xa, 0x4e21, 0x80, @local, 0x5}]}, &(0x7f0000000f80)=0x10) openat$uinput(0xffffffffffffff9c, &(0x7f0000000fc0)='/dev/uinput\x00', 0x2, 0x0) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000001000)) getsockopt$IP_VS_SO_GET_DESTS(r3, 0x0, 0x484, &(0x7f0000001040)=""/224, &(0x7f0000001140)=0xe0) setsockopt$inet_tcp_int(r0, 0x6, 0x17, &(0x7f0000001180)=0x80, 0x4) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r3, 0x84, 0x75, &(0x7f00000011c0)={r5, 0x7}, &(0x7f0000001200)=0x8) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f0000001240)={r2}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x308) ioctl$PIO_FONTRESET(r0, 0x4b6d, 0x0) setns(r0, 0x40000000) openat(r0, &(0x7f0000001280)='./file0\x00', 0x2, 0x80) 03:16:42 executing program 1: 03:16:42 executing program 2: 03:16:42 executing program 3: 03:16:42 executing program 1: r0 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000040)='memory.high\x00', 0x2, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCADDRT(r3, 0x890b, &(0x7f00000000c0)={0x80000001, {0x2, 0x4e22, @multicast1}, {0x2, 0x4e24, @loopback}, {0x2, 0x4e24}, 0x384, 0x4, 0x5, 0x7, 0x1, 0x0, 0x1000, 0x1, 0x7fffffff}) fsetxattr$security_selinux(r2, &(0x7f0000000080)='security.selinux\x00', &(0x7f00000001c0)='system_u:object_r:newrole_exec_t:s0\x00', 0x24, 0x0) 03:16:42 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xbda}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, &(0x7f0000000580), &(0x7f00000012c0), &(0x7f0000003ffc), &(0x7f0000000480)) waitid(0x0, 0x0, &(0x7f0000002ff9), 0xc1000006, 0x0) 03:16:42 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) ioctl$EVIOCRMFF(0xffffffffffffffff, 0x40044581, &(0x7f00000003c0)) capget(&(0x7f00000001c0), &(0x7f0000000200)={0x0, 0x0, 0xffffffffffffff1c, 0x1f}) sendmmsg(r1, &(0x7f0000005fc0), 0x800000000000059, 0x0) 03:16:42 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002480)={0x26, 'hash\x00', 0x0, 0x0, 'sha512-ssse3\x00'}, 0x58) r1 = accept4(r0, 0x0, &(0x7f00000000c0), 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ipv6_route\x00') sendfile(r1, r2, &(0x7f00000002c0)=0x1, 0xfb9) 03:16:42 executing program 0: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x0, 0x32, 0xffffffffffffffff, 0x0) clone(0x0, &(0x7f0000000580), &(0x7f00000012c0), &(0x7f0000003ffc), &(0x7f0000000480)) waitid(0x0, 0x0, &(0x7f0000002ff9), 0xc1000006, 0x0) 03:16:42 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmmsg(r0, &(0x7f0000000480), 0x2e9, 0xffd8) request_key(&(0x7f0000000100)='rxrpc_s\x00', &(0x7f00000001c0)={'syz'}, &(0x7f0000000240)='\'*[!\x00', 0xffffffffffffffff) add_key(&(0x7f0000000080)='asymmetric\x00', &(0x7f00000000c0)={'syz'}, 0x0, 0x0, 0x0) execve(&(0x7f0000000040)='./file0\x00', &(0x7f0000000200), &(0x7f0000000240)) ioctl$sock_inet_SIOCSIFNETMASK(r0, 0x891c, &(0x7f0000000000)={'sit0\x00', {0x2, 0x4e20, @multicast1}}) 03:16:43 executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000001480)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000080)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) read$FUSE(r0, &(0x7f00000040c0), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0xfffffffffffffff5, 0x1}, 0x50) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000180)={0x30, 0x5, 0x0, {0x0, 0x1}}, 0x30) 03:16:43 executing program 4: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup\x00', 0x200002, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000080)='cpu.stat\x00', 0x0, 0x0) pread64(r1, &(0x7f0000000000)=""/17, 0x33, 0x0) [ 234.628527] IPVS: ftp: loaded support on port[0] = 21 [ 235.799922] bridge0: port 1(bridge_slave_0) entered blocking state [ 235.806367] bridge0: port 1(bridge_slave_0) entered disabled state [ 235.814163] device bridge_slave_0 entered promiscuous mode [ 235.879040] bridge0: port 2(bridge_slave_1) entered blocking state [ 235.885495] bridge0: port 2(bridge_slave_1) entered disabled state [ 235.893415] device bridge_slave_1 entered promiscuous mode [ 235.958407] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 236.024200] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 236.219009] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 236.287761] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 236.604355] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 236.612228] team0: Port device team_slave_0 added [ 236.688107] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 236.695571] team0: Port device team_slave_1 added [ 236.760124] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 236.767468] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 236.776466] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 236.839062] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 236.907677] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 236.915034] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 236.924090] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 236.988973] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 236.996231] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 237.005198] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 237.721343] bridge0: port 2(bridge_slave_1) entered blocking state [ 237.727759] bridge0: port 2(bridge_slave_1) entered forwarding state [ 237.734629] bridge0: port 1(bridge_slave_0) entered blocking state [ 237.741040] bridge0: port 1(bridge_slave_0) entered forwarding state [ 237.749218] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 238.581885] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 240.404008] 8021q: adding VLAN 0 to HW filter on device bond0 [ 240.647602] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 240.891230] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 240.897481] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 240.905559] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 241.217670] 8021q: adding VLAN 0 to HW filter on device team0 03:16:51 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x800000000000059, 0x0) 03:16:51 executing program 3: capset(&(0x7f0000000000)={0x19980330}, &(0x7f0000804000)) r0 = inotify_init1(0x0) fcntl$setown(r0, 0x8, 0xffffffffffffffff) fcntl$getownex(r0, 0x10, &(0x7f0000000300)={0x0, 0x0}) get_robust_list(r1, &(0x7f0000000040)=&(0x7f0000000240)={&(0x7f0000000280), 0x0, &(0x7f0000000140)={&(0x7f0000000100)}}, &(0x7f0000000180)=0xfffffffffffffee6) 03:16:51 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000005000)='/dev/sg#\x00', 0x0, 0x8002) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000040)={0x0, 0x300}) 03:16:51 executing program 0: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000300)) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = inotify_init1(0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000580)='/dev/null\x00', 0x900, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000000500)=ANY=[@ANYBLOB="b7b0febe89a0b27d99badf96115818954ae07d4fd2037a12"], &(0x7f00000004c0)=0x1) ioctl$int_in(r0, 0x5452, &(0x7f000001a000)=0x81) r2 = syz_open_dev$sndpcmp(&(0x7f0000000540)='/dev/snd/pcmC#D#p\x00', 0x4, 0x80) mq_open(&(0x7f0000000000)=' \x00', 0x802, 0x46, &(0x7f00000001c0)={0x2, 0x5}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040)={0xffffffffffffffff}, 0x106}}, 0x20) write$RDMA_USER_CM_CMD_GET_EVENT(r3, &(0x7f00000000c0)={0xc, 0x8, 0xfa00, {&(0x7f0000000340)}}, 0x10) ioctl$TUNSETSNDBUF(r1, 0x400454d4, &(0x7f0000002780)=0x5) ioctl$VT_ACTIVATE(r2, 0x5606, 0x7) accept4$vsock_stream(r1, &(0x7f00000002c0)={0x28, 0x0, 0xffffffff, @my=0x1}, 0x10, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(r3, &(0x7f0000000240)={0x3, 0x40, 0xfa00, {{}, {0xa, 0x0, 0x0, @mcast1}, r4}}, 0x48) 03:16:51 executing program 4: r0 = creat(&(0x7f0000000080)='./file0\x00', 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000080)={@ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x17}}}) r2 = syz_open_procfs(0x0, &(0x7f0000000000)="2f65786500000000000409004bddd9de91be10eeaf000ee9a90f798058439ed554fa07424ada75af1f02ac06edbcd7a071fb35331ce39c5a00000000") ioctl$PPPOEIOCSFWD(r0, 0x4008b100, &(0x7f00000014c0)={0x18, 0x0, {0x1, @local, 'tunl0\x00'}}) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000000100)={0x9, 0x0, 0x1, 0x3, 0x4}, 0x14) syz_open_dev$loop(&(0x7f0000000340)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x200, 0x1ff, 0x0, 0x2, 0xa, 0x1c, "2e27256dbdfdc9a7cca5f9ebcf98667cc31d9b115da4e77d5dbb1414de00d1e47075a970f7d9690eef9a7f47fe5621d06055178d2862abe4b31857bb4c9a2b14", "fd17aa843c9ce042cdaa5e3038bedab783a74818498517af1c8fc12d555d493c3082d86bb1c2c0dae127e0d1b89a7c13def2b5c5989e63cc36e7dd508429c2f5", "3ccabf9fdda89d04d28e4bd05120325d6d437906045e485042034905d713a1c7", [0x8, 0xbb9]}) ioctl$LOOP_SET_STATUS64(r2, 0x4c04, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12, 0x0, 0x0, "804e2486cff9d9266b6504d1017e922724e02697040000005249cf42d85e7f102204bb458c81a116e92835a7de67f1f800000000b74e77d3dd1a520200c1748d", "9b0fcdf54d8916989d30222a2d0b51e59e9dd68ff929a901016e96d8f4cc000043da0000d2000000000000b100", "73e37038ac9e1afce8d30c230037155d045737cfaa8dd98f8db0f64fe0594b51"}) fallocate(r2, 0x0, 0x1, 0x8200003) fsetxattr$security_ima(r1, &(0x7f0000000040)='security.ima\x00', &(0x7f00000000c0)=@sha1={0x1, "c39335d9e7a736eeafc9f0bf5cd0257c4365bf31"}, 0x15, 0x1) ioctl$EXT4_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000000)=0x4000) fallocate(r0, 0x20, 0x0, 0x10004) 03:16:51 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmmsg(r0, &(0x7f0000000480), 0x2e9, 0xffd8) request_key(&(0x7f0000000100)='rxrpc_s\x00', &(0x7f00000001c0)={'syz'}, &(0x7f0000000240)='\'*[!\x00', 0xffffffffffffffff) add_key(&(0x7f0000000080)='asymmetric\x00', &(0x7f00000000c0)={'syz'}, 0x0, 0x0, 0x0) execve(&(0x7f0000000040)='./file0\x00', &(0x7f0000000200), &(0x7f0000000240)) ioctl$sock_inet_SIOCSIFNETMASK(r0, 0x891c, &(0x7f0000000000)={'sit0\x00', {0x2, 0x4e20, @multicast1}}) [ 242.918145] capability: warning: `syz-executor3' uses 32-bit capabilities (legacy support in use) 03:16:52 executing program 2: r0 = socket$kcm(0x29, 0x2, 0x0) write$UHID_INPUT(r0, &(0x7f00000006c0)={0x8, "8a86178fa586f8d7213aa6f466b75fbd67c374b74de1e88fe8c72c7fba4798e26decc37ff822c391800352d9d7d7158d1b50980d28c7851cebb41adce735a45ffa614ff0399040d8132bf9d8f365b410d43b39d9afe87b7788320844586cf499cbfda2bc1f20243743a806e0ab4eb95aecf9eda5e4cc0862f25347e5393259c2349be172c9887a852a836de14d083cfbe9e1f18b2f85f317bfd0a5f09118a76b138f87334ed4cf8a6ab01aa191e987be4326b30b7705e16f2301f8351f2eac77eb423a640333b176ea1f57829b092d3e4a6db85313996ceab8323a5689345569cc675a4242395f0892b84deb3f4343d6ac0d86892a0805b28620f8fcc0a136a21cf0a97a74496eb7de14302566ae981d29152abb0a4a12b14d4ae46aa877c26c4391e9098c3ce73092730a11721cee318deec061a94603b04511eb85b5a67c4a49a38fc09d0955e760c6708f8e30967a6729c1b72f2cce270cf4c466e9d688e11e411f2405e036fb9b4e8c8c7b8c83dec3f60f7392715300a57287d59c0f0833a6fc56eb92282b10c9e206b4b0f981bc47a54877c8b16883b50c0662a599806d8ad4cde76d2b44e2050b6d0d96824b7f2359aa054e437b16e6120d62581ca77504474bb7168b1e801e163cb4b3b549496a5c2c4d47ee7ff461078d556deaf8c5b57c43607198d873d8af529642fc92432da63e22556276b880e72a3a5ee5325bdba25b1c59b7a8cf90565eadca736853c7b2ceb789517a119e0be9a6d199e7a56613d51df6642e3a4bfc49a99fe81b36442bea81da216a8f51086cf4dffb87ab33084b8da84eccc6950ea733358ac25c3456a19be352de31b4ed4776897a8321007fb9663e2804f061b3e82b1e4893efa492f96d05ee6f1ec2c8ce46d4146ff0ca867607965502d404f84b5eadb19c23843e0a7fb2184416c4e3bfeeea54597b1e96968108088a7caeaee4fac75aa955a9c4ae7cd0e9a3cc140d50c57a8a1c167dc516c926737abebeedf2b8b11177936ff1ed2f831eee10d465fb75e70d787de54ccff6d6c273aa77cee9da5daae5e1a6a70872e564b097447e9fe4aeea67a5d2b5d98cf725ece1699b88bc24e6a376818faed2213a26ccd1888c7edb77eb54960217d2ea3bc76430f58d85affed832131e67e9b7624ee76d8553d3def452e89d9f6d2cba3a2afc489ef3ac3823d133b9ba917696ae0053e68d0a68d56b2ddf4dddd016e5510abc46e413ae242198ac362b3ac4b151d9513b461d91a2e1b4d6818e9b85a9ed1f0292ccd94063c246fcde8be7204d990648e5ef7d010429fbe6c613ffa7880700a5dc35724e1e80cfc1a5df4ec6aed73096707215cdd04f3bc797c9e8b45d06e43e1ba19acb52fd69df0d8c39a83a7973203146c28fc8b9451d90c6dd7f57af2eb7f3db1aac6f68c9bf232dc497a83e4529b67e308f73de176fb6738e769d2946b5a3b18b3566f9698bff7cba27d0723bd3f376fee0d8cb5ca8bdcc46c45e40bb44e20d3d403324c056b1c24f5fc16a2f286cbe4afa6fa8c38eae567ed8828fd62796c01c95cf7038808edcc1c38f31f2aae372d951916b7eadd615d6ea2d3e7d90aa453bd5db3ebff5911b945a676063a9c8308be4470cc7fec00c493128e08c254e85f0bc7abe17f9016b0f75a7137c700afec1b93bea6d79042a19906e1a609c568d23b38bc785303c68afe2fa6739b49224abfcc8a1a1d0405f468deeb3c79249599d3416633fe05a9136eea2cd25a707e9e76edfc1ee34668493cffe3c4d78197ca4704065ddc95c9b458f989cc5f39ab3c90500c9e4e756baafcca032bbf3d79b78f7ea1c33c13465f05f5f41f65bc3f37705c08210e6501646e09a4a31fac0e62faff24f5fcb9aaafccae34c5090aade82244daca2a5a280b926213414a7f65698a8a4558a6a35b6c9643c32271ba535a4cb7f37160a356769b9e87c125c466b2efe3735e2ff3c85e8f725540a4e1937c3164dc69256f7a9ee7e952ec5939f55b63be3203eda1d27f6009477c7f9aba258ceb1cca6b5986f98cab0d110c40ffeabfadc0d1e273395a1af3f6f6d472961f5f81fb9a6d20d0d7e953405248099a6d2d01d604ed8fc7b23f7dfc80403d866ea4015cb3ac06ff516e0dcc1cfb873e02a4a3025bdcdc04ea4e06905843267967ea9993c4ba4dd5b43ce979841a2280d01e885cf8a8ac7a5805da4d0c82c66ed69494725e4cb8a1c194d65437f11fc5dbfc90329621e7289bf805a0e6b63408375f769386cf091772a54791204446bc58af28d176cc6d366186164665dcb2627e50b86bcc540ddc32c678d83e7cacc306b0ac5e9c21687f08f392c244f05d3444c06c993dda0cc83494637e099ec5b5677f73b0d1c43194708afe8c5573152ea5025e3a7aeec319cff78906a9e5dbac737283fe94c34915a3327fba27cf337e8503c665abaf53c0a7fcfedbc00188c6537d136deae38eea167e5f598aeedb0258b1adce55f0ee545ac4cd86bed5388c92364fe2dc43c2c7f6bbef35832dab7359a66359e9fc2f8d9de13fac9a1dbbf8a4a09711f6c880c8d3e3e36d14dd4c7d309c98a27a0cbea0e336f106c63128504227fad86063e5cc10bbb1a8bea86fbe4cc9e8bf15ec8a30559bdbda78684e0e5f3b65d4601c98cd706c3f13f059ff735ca8abb72ffc3808233b993205a35669f1fcf28ba7df9a5cd228ca883deaabd43362b8dd5cf122ccdd12a845e1f0feb03f43f55295f774bc94d2d93887044cbde7bc5a4deb3bfc4d26d29e4fd6d4e88ea92f47b6d11e3a3fa003baab78544935e92b76055f4829cfa131ca30dffc25f65e68872485af67a2401a423f80b1950507c8498c835a5e1dd1ffd14ba2b4d4266606f3a1abf7c35db4640c39f6598f5e197d531a5e25dacc4491b8f041d41d86230767354c6d35899881d826810cb3cb58269c318f279958a2273435a51e77b99a4272ad9009c460d061237156f3b797044374ae847753473a1e77dea435e67262ffdc449be1e1647e6c2c242daee1b5e8f8df2a8ebdf24cfa59e5c32e22dadf91e505a46fcc76801dfd78a5b4cc023cfe866f50d850716be1b88cf2795db087c0d3a55eff4429ceb4e2b39efc15f9360fa5e77c21af1ef751dc73f97cddc0955d008dd10a58626dc33d29042c893756ef618b140aeefa7d0618ebf92815275fe6957a0226c7c732c343f40f213d307ab6bb01c50e82779c46b3985bce56770c747b791b40c4eede98d08c36cec7e37938c4316e907f0193553d6ab62fc1f602d0ad6bf7eda74b7e0eb45be0bf75529299f96d12d4902ddd76876da82819c307386b8487150e11bfd70170bf247010c06b4800d8ae8e5e1f35ade7e2569f8059cd443650f2474f4a0319540afc4fa94018c659b640bb7f7f55ae18b641d9a79656701ac5f31f76c630ddb6faa07a901b7c2a878fa11e6d59c71f043ed6ed1c5454f96edfc4be2c8227a3514baae90c0d41b982cb3b79748f5a90cd3c074a145861658a5798ba6c9f5390e074437c411d4e08c7addd326085996c6f2ea772f33943d1ed32e3a54bcca5c09119d3c3f96ab2af62d7035984a4457b99d5f02ffd6fbebc1da7cc733f0c7f1fec2f601b046eb8dec964474d0205a13710630ba7468ca8807b028cdaaeb1970fd8d31a68f7ef3e56a2cb300766fcbfc8f53bece56ba10b211df2c24c427df7c8b6ee69cd1edacf71e817d1732be3bfb85d1373f8a686c76ef9bcc071ec028341e7de4be5fd99c7206e9476cd1383ebbc1995ef09d5cc478ffb9623763507f12dd4a9b2f5a4ffbcf2a199fd9c7828ed65136c0918343a5dfed82789658f4dcaea806b229e7420a7d9a7e357280556a09f720571916b7efd1e0e2ebd1cedf2fb86c4eadae8fffd51309009058b0756e939541e972e4be30253bd277a43c27e83020223eab9bff1cfb332c59365113d8532c31a77945bba3e680e522b2d284997090a95ebf955fd05a6284f46db6a90d8f30968fd30a0517f46bfc3bcb9aad542da3b3cec430e25ee339485f17747b4ca72f900f831b8de74a858c982f73a3a30b3d816691d50226c1ce61c7549e8892180248544d0d99346489d38dcb041c4c43bef1beb5771df4af8cd8a3bd205314ffe08079041e8ce4733184c3bc24b124837acd90b31ac6fc5a4a2d0364143bb8f6ed60cb3860cdd5b4179c6a80f4c5f3a6e1437ec29d89f726ec776a5e784c4eba2dce6fab2e83174ee2a9a2a9672087ff4aa7e452ad1843546d44eda2c8c33a1043d06b4727f567d6c0693287c514834a033f4893739b80d99d35e45e7ad899d8740d901071e04eb2e930783bfe738d0e67e6df383919d73c12339dbafbc72da544511d00051c7629ffdc109b37ace21c9675cd54e5dfe6a36e48cf62d3f3431a1f8e2bfdf8c4207db66783b3d33fd755b9cdcc4e19c7b8dd78f6c2317ab8fa5da99c846567d1eee89b4a29fb44667991daf9490494f82721fbce475dec5f2fbd4aefac331d41a6fc60b4a54ea939c4128c1127098211714ea0e4843a2befadb4d6389be76e2a790d397752c78bf3b84465d3fc9c250cc5f43695b49c3f2fc078781983092b0a00e6c2b87e881fa1806c38118cce85cbf61d372a1574e2a5dc4898a99781ae7191430ecf7b51f248d5175adf00c69723c592ef6042f90954ead480c4d1cbd6197a6e5b16cc3c52578642df273677527b5ee8301ea2f891687d852ebefff6ef29eab71efd056b992a809af4f100adffda3080298f35c010a540785d80e7b21215052175e6ed0c8abb24633d5e39c7fd14c054a90f9ed4c6ac9203866047110abdad38c39ba994b613298b06085c1ac5382b506c90b8e0a452f5aa2769cc540aabed921d3699e10b408cd37118b3dc157c24df45c0cb1ac9f5e1f4a29c9542976a5cf7db3914f8ddcffbea353dca70ea94ec476f01cbf04f1d0cbb8db92109355a714ec7c361b9b88b737f6a36cefa2620b98cbe65769fdc33a061edb215ab5b693f27a1fae63a2507295615295cb148abccdb711133908dab3ec377251760936cd8dc2e59e037befcfacc17ff876e55cd3f66e6c6744589a112b3104ed265fb6ac94092d3c709181868c82c1211ad0e327e57fb0c9fce2ed43ac36a603928a366b0f1e95b16fad594ef43b8a6135b4e93eea2565a4468e423949871cd6faaa74bc6a984214b9c4854bafaea6698802be1fac06c6055a45ce4b86ddc230862363c612a2c7c2bf08c876f8c20f5beb134f04e5cdbed996dd54e5bac619d16aba136f9db47c8739f5aa04b9bc16feaaf0a4f47d5ee9e6a8eb1d72ca487baa33141d87d879298fc1057c9aee7b4d6beb5025c7b6c1d0e214d18e749bd6e1669ec3ccc1c1a4164b31fd9a0452d7214bb97bccdb8df0b2634122ad3bb008fb011cbdcc1b80653c3d8bf8346efa39674c23d6d59610e72e2f520667e7572e59a08b27855b4011f644f94e70a0e4ac59d1d5730f187016aa847aaaff4610071c494c01f9f768c27765e911704eb95a26b26d04b68f8a0512c55204ebf6870088972ea74c9014ab9239696bf6b6573c0a845c2260634f7c8261adc05c5d9e8b9ea5c87a9169919bd72cceecedc7eac5fdcd0073c67bd8bb9613d3c95cd00cc0d07a8d0c73911c442c8f92329f9b2980a9b6413c0618aa3ebe59d3a4beca3d2fb0881f56db7880b70973220a1da6232ace4d468696c29e9184b79a1634d74d651812bc861f0ef99a3b6f02c8ea4babad622f37f6861ac62da0d7f7c15ba94e7c90757520119c59419201f12e125bef13d5921fc60c80928081fb428dd", 0x1000}, 0x1006) sendmmsg(r0, &(0x7f0000009600)=[{{&(0x7f0000003d80)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x4e24, 0x0, @remote}}}, 0x80, &(0x7f0000004040), 0x0, &(0x7f00000040c0)}}], 0x1, 0x800) 03:16:52 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000005000)='/dev/sg#\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x2284, &(0x7f0000000040)) 03:16:52 executing program 4: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000000)={0x200000, 0xc04e27d3b503e3e1, 0x0, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f00000000c0)=0x3) 03:16:52 executing program 0: openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000240)='net/softnet_stat\x00') openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r0 = inotify_init() inotify_add_watch(r0, &(0x7f0000000080)='.\x00', 0xfe) r1 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r1, &(0x7f0000000480)=ANY=[@ANYBLOB="7f454c4673000200faff3c46dc000000006e010000000000004000000086000000f401000000000000ffff0000030038000100ffff0000d9ba050000700100000000000000000000000500000000000000018000000000000001000000000000000600000000000000010000800000000005402fc8e76d86f7afad21f1dfde89256d81fe0fe797a94935e51d088d2d6cb7bc58ef9893054dff5129e827281a313a688007a3ea53e2c8b190c043c04c206c9657712327654e700dac1c8bc9905e26f80000003d47c9ad1d000000000000000000004d86a89b"], 0xd8) sendfile(r1, r1, &(0x7f0000000080), 0x10001) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f00000001c0), 0xa198) 03:16:52 executing program 2: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000080)='cpuacct.usage\x00', 0x2, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r2, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) sendfile(r2, r1, &(0x7f0000000200), 0x4) 03:16:52 executing program 3: [ 243.717614] ion_buffer_destroy: buffer still mapped in the kernel [ 243.746588] Not allocated shadow for addr ffff88017933e5c0 (page ffffea0008d73740) [ 243.754315] Attempted to access 8 bytes [ 243.758359] ------------[ cut here ]------------ [ 243.763133] kernel BUG at mm/kmsan/kmsan.c:1075! [ 243.767910] invalid opcode: 0000 [#1] SMP [ 243.772126] CPU: 0 PID: 6354 Comm: syz-executor3 Not tainted 4.19.0-rc4+ #63 [ 243.779331] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 243.788710] RIP: 0010:kmsan_get_shadow_address+0x2d6/0x3d0 [ 243.794346] Code: e9 89 00 00 00 c7 04 25 20 73 28 8c 01 00 00 00 65 48 8b 04 25 00 fd 02 00 c6 80 7b 09 00 00 01 80 3c 25 38 73 28 8c 00 74 0c <0f> 0b 0f 1f 84 00 00 00 00 00 eb fe 48 c7 c7 11 bc 57 8b 31 c0 4c [ 243.813253] RSP: 0018:ffff88015659f780 EFLAGS: 00010046 [ 243.818634] RAX: 000000000000001b RBX: 0000000000000000 RCX: f8a35d7caf0c7b00 [ 243.825913] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000000 [ 243.833194] RBP: ffff88015659f7b0 R08: 0000000000000000 R09: ffff88021fc38f50 [ 243.840498] R10: 0000000000000000 R11: ffffffff86258280 R12: 0000000000000001 [ 243.847779] R13: ffff88017933e5c0 R14: 0000000000000001 R15: 0000000000000008 [ 243.855060] FS: 0000000000cc0940(0000) GS:ffff88021fc00000(0000) knlGS:0000000000000000 [ 243.863288] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 243.869193] CR2: 0000000000706158 CR3: 000000015656f000 CR4: 00000000001406f0 [ 243.876481] Call Trace: [ 243.879090] kmsan_internal_unpoison_shadow+0x5c/0xe0 [ 243.884313] kmsan_unpoison_shadow+0x72/0xd0 [ 243.888746] vunmap_page_range+0x828/0xc20 [ 243.893037] remove_vm_area+0x39b/0x450 [ 243.897048] __vunmap+0x34c/0x5d0 [ 243.900553] vfree+0x79/0x170 [ 243.903684] do_arpt_get_ctl+0xddb/0xe80 [ 243.907784] ? compat_do_arpt_set_ctl+0x2e90/0x2e90 [ 243.912844] nf_getsockopt+0x481/0x4e0 [ 243.916773] ip_getsockopt+0x2b1/0x470 [ 243.920685] ? compat_ip_setsockopt+0x380/0x380 [ 243.925381] tcp_getsockopt+0x1c6/0x1f0 [ 243.929385] ? tcp_get_timestamping_opt_stats+0x1810/0x1810 [ 243.935116] sock_common_getsockopt+0x13f/0x180 [ 243.939810] ? sock_recv_errqueue+0x990/0x990 [ 243.944329] __sys_getsockopt+0x48c/0x550 [ 243.948521] __se_sys_getsockopt+0xe1/0x100 [ 243.952868] __x64_sys_getsockopt+0x62/0x80 [ 243.957209] do_syscall_64+0xbe/0x100 [ 243.961025] entry_SYSCALL_64_after_hwframe+0x63/0xe7 03:16:52 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) sendmmsg(r1, &(0x7f0000005fc0), 0x800000000000059, 0x0) 03:16:52 executing program 4: clone(0x0, &(0x7f0000000580), &(0x7f00000012c0), &(0x7f0000003ffc), &(0x7f0000000480)) waitid(0x0, 0x0, &(0x7f0000002ff9), 0xc100000a, 0x0) [ 243.966219] RIP: 0033:0x45a0aa [ 243.969429] Code: b8 34 01 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 dd 88 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 37 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 ba 88 fb ff c3 66 0f 1f 84 00 00 00 00 00 [ 243.988363] RSP: 002b:0000000000a3f648 EFLAGS: 00000212 ORIG_RAX: 0000000000000037 [ 243.996124] RAX: ffffffffffffffda RBX: 0000000000a3f750 RCX: 000000000045a0aa [ 244.003401] RDX: 0000000000000061 RSI: 0000000000000000 RDI: 0000000000000003 [ 244.010694] RBP: 0000000000000003 R08: 0000000000a3f65c R09: 000000000000000a 03:16:53 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmmsg(r0, &(0x7f0000000480), 0x2e9, 0xffd8) request_key(&(0x7f0000000100)='rxrpc_s\x00', &(0x7f00000001c0)={'syz'}, &(0x7f0000000240)='\'*[!\x00', 0xffffffffffffffff) add_key(&(0x7f0000000080)='asymmetric\x00', &(0x7f00000000c0)={'syz'}, 0x0, 0x0, 0x0) execve(&(0x7f0000000040)='./file0\x00', &(0x7f0000000200), &(0x7f0000000240)) ioctl$sock_inet_SIOCSIFNETMASK(r0, 0x891c, &(0x7f0000000000)={'sit0\x00', {0x2, 0x4e20, @multicast1}}) [ 244.017976] R10: 0000000000a3f750 R11: 0000000000000212 R12: 0000000000000000 [ 244.025253] R13: 000000000003b687 R14: 0000000000000006 R15: 0000000000000003 [ 244.032545] Modules linked in: [ 244.035782] ---[ end trace c8fcc6cd69659333 ]--- [ 244.040563] RIP: 0010:kmsan_get_shadow_address+0x2d6/0x3d0 [ 244.046212] Code: e9 89 00 00 00 c7 04 25 20 73 28 8c 01 00 00 00 65 48 8b 04 25 00 fd 02 00 c6 80 7b 09 00 00 01 80 3c 25 38 73 28 8c 00 74 0c <0f> 0b 0f 1f 84 00 00 00 00 00 eb fe 48 c7 c7 11 bc 57 8b 31 c0 4c [ 244.065122] RSP: 0018:ffff88015659f780 EFLAGS: 00010046 [ 244.070497] RAX: 000000000000001b RBX: 0000000000000000 RCX: f8a35d7caf0c7b00 [ 244.077771] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000000 [ 244.085045] RBP: ffff88015659f7b0 R08: 0000000000000000 R09: ffff88021fc38f50 [ 244.092320] R10: 0000000000000000 R11: ffffffff86258280 R12: 0000000000000001 [ 244.099590] R13: ffff88017933e5c0 R14: 0000000000000001 R15: 0000000000000008 [ 244.106869] FS: 0000000000cc0940(0000) GS:ffff88021fc00000(0000) knlGS:0000000000000000 [ 244.115104] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 244.121058] CR2: 0000000000706158 CR3: 000000015656f000 CR4: 00000000001406f0 [ 244.128360] Kernel panic - not syncing: Fatal exception [ 244.134643] Kernel Offset: disabled [ 244.138276] Rebooting in 86400 seconds..