s=1 11:03:53 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x71c000, 0x0) 11:03:53 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xb8, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:03:53 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d81d000018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:03:53 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xcd0) 11:03:53 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:03:53 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x8, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:03:53 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d848000018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:03:53 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xd58) [ 734.647082][ T27] audit: type=1804 audit(1577271833.663:188): pid=22554 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/590/file0/bus" dev="loop4" ino=109 res=1 [ 734.733659][T22548] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:03:53 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xdc0) [ 734.804221][ T27] audit: type=1800 audit(1577271833.763:189): pid=22563 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="bus" dev="loop4" ino=109 res=0 11:03:53 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:03:53 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d84c000018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:03:53 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) [ 735.128372][T22579] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 735.186210][ T27] audit: type=1804 audit(1577271834.203:190): pid=22589 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/591/file0/bus" dev="loop4" ino=110 res=1 [ 735.233722][ T27] audit: type=1804 audit(1577271834.243:191): pid=22592 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/591/file0/bus" dev="loop4" ino=110 res=1 11:03:56 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xe00) 11:03:56 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x760000, 0x0) 11:03:56 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xb9, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:03:56 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d860000018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:03:56 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\a\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:03:56 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xa, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:03:56 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xe28) 11:03:56 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d865000018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 737.677229][ T27] kauditd_printk_skb: 1 callbacks suppressed [ 737.677279][ T27] audit: type=1804 audit(1577271836.693:193): pid=22606 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/592/file0/bus" dev="loop4" ino=111 res=1 11:03:56 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d868000018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:03:57 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xc, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) [ 737.930665][ T27] audit: type=1804 audit(1577271836.743:194): pid=22617 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/592/file0/bus" dev="loop4" ino=111 res=1 [ 737.993286][T22610] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:03:57 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xe90) 11:03:57 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:03:57 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d86c000018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 738.246151][ T27] audit: type=1804 audit(1577271837.263:195): pid=22641 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/593/file0/bus" dev="loop4" ino=112 res=1 [ 738.340999][T22644] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 738.362461][ T27] audit: type=1804 audit(1577271837.303:196): pid=22650 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/593/file0/bus" dev="loop4" ino=112 res=1 11:03:59 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x960000, 0x0) 11:03:59 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xba, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:03:59 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\xff\xff\xff8\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:03:59 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xeb0) 11:03:59 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d874000018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:03:59 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xd, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:03:59 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d87a000018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 740.852800][ T27] audit: type=1804 audit(1577271839.863:197): pid=22664 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/594/file0/bus" dev="loop4" ino=113 res=1 11:03:59 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xf18) [ 740.923986][ T27] audit: type=1804 audit(1577271839.933:198): pid=22676 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/594/file0/bus" dev="loop4" ino=113 res=1 [ 740.951640][ T27] audit: type=1804 audit(1577271839.933:199): pid=22679 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/594/file0/bus" dev="loop4" ino=113 res=1 [ 741.012597][T22670] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:04:00 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xf80) 11:04:00 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:04:00 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00?\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:04:00 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xbb, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 741.393094][T22697] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 741.464123][ T27] audit: type=1804 audit(1577271840.483:200): pid=22707 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/595/file0/bus" dev="sda1" ino=17310 res=1 [ 741.571973][ T27] audit: type=1804 audit(1577271840.523:201): pid=22702 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/595/file0/bus" dev="sda1" ino=17310 res=1 [ 741.597123][ T27] audit: type=1804 audit(1577271840.523:202): pid=22707 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/595/file0/bus" dev="sda1" ino=17310 res=1 11:04:02 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0xc07100, 0x0) 11:04:02 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d8f3000018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:04:02 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00@\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:04:02 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xfe8) 11:04:02 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x23, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:04:02 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xbc, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:04:03 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d8fc000018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 743.952427][ T27] audit: type=1804 audit(1577271842.963:203): pid=22725 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/596/file0/bus" dev="loop4" ino=114 res=1 11:04:03 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x100b) [ 744.031027][ T27] audit: type=1804 audit(1577271843.043:204): pid=22733 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/596/file0/bus" dev="loop4" ino=114 res=1 11:04:03 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x1100) 11:04:03 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d88a010018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:04:03 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xae, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) [ 744.203224][T22730] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:04:03 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x88\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) [ 744.540767][T22760] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 744.571148][ T27] audit: type=1804 audit(1577271843.583:205): pid=22762 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/597/file0/bus" dev="loop4" ino=115 res=1 [ 744.630264][ T27] audit: type=1804 audit(1577271843.593:206): pid=22765 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/597/file0/bus" dev="loop4" ino=115 res=1 11:04:05 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x1000000, 0x0) 11:04:05 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x180f) 11:04:05 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d84c020018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:04:05 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xbd, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:04:05 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\a\xff\xff\xfe\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:04:05 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xc0, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:04:06 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d8f6020018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:04:06 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x2000) [ 747.097866][ T27] audit: type=1804 audit(1577271846.113:207): pid=22781 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/598/file0/bus" dev="loop4" ino=116 res=1 11:04:06 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xf0, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) [ 747.233081][ T27] audit: type=1804 audit(1577271846.163:208): pid=22790 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/598/file0/bus" dev="loop4" ino=116 res=1 [ 747.303786][T22779] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:04:06 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xbe, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:04:06 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\xff\xff\xff\xff\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:04:06 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800030018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 747.481329][ T27] audit: type=1804 audit(1577271846.493:209): pid=22803 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/599/file0/bus" dev="loop4" ino=117 res=1 [ 747.526300][ T27] audit: type=1804 audit(1577271846.533:210): pid=22805 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/599/file0/bus" dev="loop4" ino=117 res=1 [ 747.753041][T22817] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:04:09 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x7e000000, 0x0) 11:04:09 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x2003) 11:04:09 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x300, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:04:09 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800050018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:04:09 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x02\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:04:09 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xbf, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 750.198938][ T27] audit: type=1804 audit(1577271849.213:211): pid=22830 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/600/file0/bus" dev="loop4" ino=118 res=1 11:04:09 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800060018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 750.244185][ T27] audit: type=1804 audit(1577271849.253:212): pid=22843 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/600/file0/bus" dev="loop4" ino=118 res=1 11:04:09 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x200a) [ 750.290571][T22831] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:04:09 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800070018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:04:09 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x500, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:04:09 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x03\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:04:09 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x280e) [ 750.704301][ T27] audit: type=1804 audit(1577271849.723:213): pid=22863 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/601/file0/bus" dev="loop4" ino=119 res=1 [ 750.811609][ T27] audit: type=1804 audit(1577271849.753:214): pid=22873 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/601/file0/bus" dev="loop4" ino=119 res=1 [ 750.888827][T22868] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:04:12 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0xfeffffff, 0x0) 11:04:12 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x3002) 11:04:12 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d8d9080018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:04:12 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xc0, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:04:12 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x510, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:04:12 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x04\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:04:12 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800090018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 753.292177][ T27] audit: type=1804 audit(1577271852.303:215): pid=22891 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/602/file0/bus" dev="loop4" ino=120 res=1 11:04:12 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x600, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:04:12 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d8000a0018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 753.493254][ T27] audit: type=1804 audit(1577271852.303:216): pid=22894 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/602/file0/bus" dev="loop4" ino=120 res=1 11:04:12 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x3806) [ 753.561143][T22886] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:04:12 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x05\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:04:12 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xc1, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 753.737085][ T27] audit: type=1804 audit(1577271852.753:217): pid=22912 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/603/file0/bus" dev="sda1" ino=17367 res=1 [ 753.780522][ T27] audit: type=1804 audit(1577271852.783:218): pid=22907 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/603/file0/bus" dev="sda1" ino=17367 res=1 [ 753.843304][ T27] audit: type=1804 audit(1577271852.783:219): pid=22912 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/603/file0/bus" dev="sda1" ino=17367 res=1 [ 753.976488][T22925] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:04:15 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0xff600000, 0x0) 11:04:15 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x3f00) 11:04:15 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d8000b0018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:04:15 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x700, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:04:15 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x06\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:04:15 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xc2, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 756.402752][ T27] audit: type=1804 audit(1577271855.413:220): pid=22945 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/604/file0/bus" dev="loop4" ino=121 res=1 11:04:15 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:04:15 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d8000c0018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 756.536956][ T27] audit: type=1804 audit(1577271855.413:221): pid=22958 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/604/file0/bus" dev="loop4" ino=121 res=1 11:04:15 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x4000) [ 756.591207][T22948] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:04:15 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\a\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:04:15 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x4001) 11:04:15 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d8000e0018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 756.962937][ T27] audit: type=1804 audit(1577271855.973:222): pid=22970 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/605/file0/bus" dev="sda1" ino=17378 res=1 [ 756.970646][T22975] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 757.068251][ T27] audit: type=1804 audit(1577271856.083:223): pid=22977 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/605/file0/bus" dev="sda1" ino=17378 res=1 11:04:18 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0xfffffffe, 0x0) 11:04:18 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xc3, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:04:18 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d8000f0018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:04:18 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x11\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:04:18 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x400a) 11:04:18 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xa00, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:04:18 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x4805) [ 759.525278][ T27] audit: type=1804 audit(1577271858.543:224): pid=22998 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/606/file0/bus" dev="loop4" ino=122 res=1 11:04:18 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800110018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 759.631194][T23000] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 759.669818][ T27] audit: type=1804 audit(1577271858.583:225): pid=23013 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/606/file0/bus" dev="loop4" ino=122 res=1 11:04:18 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800120018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:04:18 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xc00, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:04:18 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x5009) 11:04:18 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x88\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) [ 759.990979][ T27] audit: type=1804 audit(1577271859.003:226): pid=23029 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/607/file0/bus" dev="loop4" ino=123 res=1 [ 760.032760][ T27] audit: type=1804 audit(1577271859.003:227): pid=23037 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/607/file0/bus" dev="loop4" ino=123 res=1 [ 760.163757][T23036] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:04:21 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x400000000000, 0x0) 11:04:21 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800130018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:04:21 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xc4, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:04:21 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xd00, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:04:21 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x5804) 11:04:21 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x03\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:04:21 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800140018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 762.630227][ T27] audit: type=1804 audit(1577271861.643:228): pid=23054 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/608/file0/bus" dev="loop4" ino=124 res=1 11:04:21 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x580d) [ 762.681724][T23052] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 762.791634][ T27] audit: type=1804 audit(1577271861.673:229): pid=23067 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/608/file0/bus" dev="loop4" ino=124 res=1 11:04:21 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x1005, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:04:21 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x6000) 11:04:21 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xc5, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:04:21 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x05\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) [ 763.128465][ T27] audit: type=1804 audit(1577271862.143:230): pid=23090 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/609/file0/bus" dev="loop4" ino=125 res=1 [ 763.194717][T23088] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 763.215356][ T27] audit: type=1804 audit(1577271862.143:231): pid=23095 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/609/file0/bus" dev="loop4" ino=125 res=1 11:04:24 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x60ffffffffff, 0x0) 11:04:24 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d8001d0018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:04:24 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x6008) 11:04:24 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x2000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:04:24 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x06\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:04:24 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xc6, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 765.684845][ T27] audit: type=1804 audit(1577271864.703:232): pid=23109 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/610/file0/bus" dev="loop4" ino=126 res=1 11:04:24 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800200018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:04:24 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x680c) 11:04:24 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d8003f0018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 765.857221][ T27] audit: type=1804 audit(1577271864.753:233): pid=23119 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/610/file0/bus" dev="loop4" ino=126 res=1 11:04:25 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x7000) 11:04:25 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x2300, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) [ 765.960345][T23113] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:04:25 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800400018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 766.270960][ T27] audit: type=1804 audit(1577271865.283:234): pid=23147 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/611/file0/bus" dev="loop4" ino=127 res=1 [ 766.337091][ T27] audit: type=1804 audit(1577271865.343:235): pid=23150 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/611/file0/bus" dev="loop4" ino=127 res=1 [ 766.383098][ T27] audit: type=1804 audit(1577271865.353:236): pid=23151 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/611/file0/bus" dev="loop4" ino=127 res=1 11:04:27 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x760000000000, 0x0) 11:04:27 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\a\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:04:27 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x7804) 11:04:27 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800480018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:04:27 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x3f00, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:04:27 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xc7, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:04:27 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d8004c0018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 768.858447][ T27] audit: type=1804 audit(1577271867.873:237): pid=23170 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/612/file0/bus" dev="loop4" ino=128 res=1 11:04:27 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x780b) [ 768.901404][T23167] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:04:28 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x11\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:04:28 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d8024c0018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 769.059785][ T27] audit: type=1804 audit(1577271867.903:238): pid=23179 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/612/file0/bus" dev="loop4" ino=128 res=1 11:04:28 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x4000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) [ 769.212682][T23189] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:04:28 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x800f) [ 769.464131][ T27] audit: type=1804 audit(1577271868.483:239): pid=23201 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/613/file0/bus" dev="loop4" ino=129 res=1 [ 769.490971][ T27] audit: type=1804 audit(1577271868.483:240): pid=23207 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/613/file0/bus" dev="loop4" ino=129 res=1 11:04:30 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x7fffffffefff, 0x0) 11:04:30 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00 \x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:04:30 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d865580018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:04:30 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xc8, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:04:30 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x8803) 11:04:30 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x60ff, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) [ 771.912086][ T27] audit: type=1804 audit(1577271870.923:241): pid=23227 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/614/file0/bus" dev="loop4" ino=130 res=1 11:04:31 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x9007) 11:04:31 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800600018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 771.973930][ T27] audit: type=1804 audit(1577271870.963:242): pid=23232 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/614/file0/bus" dev="loop4" ino=130 res=1 11:04:31 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x900e) 11:04:31 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x7600, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) [ 772.150553][T23224] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:04:31 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800650018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:04:31 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00?\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) [ 772.401429][ T27] audit: type=1804 audit(1577271871.413:243): pid=23253 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/615/file0/bus" dev="loop4" ino=131 res=1 [ 772.434885][ T27] audit: type=1804 audit(1577271871.453:244): pid=23256 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/615/file0/bus" dev="loop4" ino=131 res=1 [ 772.626160][T23261] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:04:33 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x960000000000, 0x0) 11:04:33 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x9802) 11:04:33 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xc9, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:04:33 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9600, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:04:33 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d858650018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:04:33 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00@\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:04:33 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800680018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:04:34 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xa006) 11:04:34 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xa80a) [ 775.139018][ T27] audit: type=1804 audit(1577271874.153:245): pid=23282 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/616/file0/bus" dev="sda1" ino=17455 res=1 11:04:34 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d8006c0018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 775.240532][ T27] audit: type=1804 audit(1577271874.213:246): pid=23290 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/616/file0/bus" dev="sda1" ino=17455 res=1 [ 775.253805][T23279] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 775.318750][ T27] audit: type=1804 audit(1577271874.243:247): pid=23290 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/616/file0/bus" dev="sda1" ino=17455 res=1 11:04:34 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xca, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:04:34 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xae00, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) [ 775.658878][ T27] audit: type=1804 audit(1577271874.673:248): pid=23317 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/617/file0/bus" dev="loop4" ino=132 res=1 [ 775.704516][ T27] audit: type=1804 audit(1577271874.713:249): pid=23321 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/617/file0/bus" dev="loop4" ino=132 res=1 11:04:36 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x30710000000000, 0x0) 11:04:36 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x88\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:04:36 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800740018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:04:36 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xb005) 11:04:36 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xc000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:04:36 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xcb, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:04:37 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d8007a0018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:04:37 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xb00e) [ 778.126112][ T27] audit: type=1804 audit(1577271877.143:250): pid=23334 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/618/file0/bus" dev="loop4" ino=133 res=1 [ 778.130459][T23331] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 778.259909][ T27] audit: type=1804 audit(1577271877.213:251): pid=23343 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/618/file0/bus" dev="loop4" ino=133 res=1 11:04:37 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00 \x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) [ 778.300652][ T27] audit: type=1804 audit(1577271877.253:252): pid=23334 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/618/file0/bus" dev="loop4" ino=133 res=1 11:04:37 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d8fe800018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:04:37 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xb809) 11:04:37 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xeffd, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) [ 778.550354][T23361] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 778.666360][ T27] audit: type=1804 audit(1577271877.683:253): pid=23372 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/619/file0/bus" dev="loop4" ino=134 res=1 [ 778.717742][ T27] audit: type=1804 audit(1577271877.723:254): pid=23374 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/619/file0/bus" dev="loop4" ino=134 res=1 11:04:40 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x40510000000000, 0x0) 11:04:40 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800810018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:04:40 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xb80b) 11:04:40 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x01\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:04:40 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xcc, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:04:40 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xf0ff, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) [ 781.228805][ T27] audit: type=1804 audit(1577271880.243:255): pid=23391 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/620/file0/bus" dev="loop4" ino=135 res=1 11:04:40 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d8018a0018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:04:40 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xc00d) [ 781.322597][ T27] audit: type=1804 audit(1577271880.243:256): pid=23401 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/620/file0/bus" dev="loop4" ino=135 res=1 [ 781.377132][T23393] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:04:40 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xfdef, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:04:40 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x02\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:04:40 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d8fec00018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:04:40 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xc801) [ 781.761113][ T27] audit: type=1804 audit(1577271880.773:257): pid=23427 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/621/file0/bus" dev="sda1" ino=17488 res=1 [ 781.874539][ T27] audit: type=1804 audit(1577271880.843:258): pid=23427 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/621/file0/bus" dev="sda1" ino=17488 res=1 [ 781.937623][T23421] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:04:43 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0xc0710000000000, 0x0) 11:04:43 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d808d90018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:04:43 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xc808) 11:04:43 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xcd, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:04:43 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x03\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:04:43 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xfff0, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:04:43 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800f30018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 784.361211][ T27] audit: type=1804 audit(1577271883.353:259): pid=23449 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/622/file0/bus" dev="loop4" ino=136 res=1 11:04:43 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xd00c) [ 784.424044][T23445] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 784.444696][ T27] audit: type=1804 audit(1577271883.403:260): pid=23459 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/622/file0/bus" dev="loop4" ino=136 res=1 11:04:43 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d802f60018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:04:43 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x20000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:04:43 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x04\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:04:43 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xd800) [ 784.845420][T23473] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 784.919142][ T27] audit: type=1804 audit(1577271883.933:261): pid=23479 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/623/file0/bus" dev="loop4" ino=137 res=1 [ 784.984100][ T27] audit: type=1804 audit(1577271884.003:262): pid=23487 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/623/file0/bus" dev="loop4" ino=137 res=1 11:04:46 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x100000000000000, 0x0) 11:04:46 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800fc0018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:04:46 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xce, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:04:46 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xe004) 11:04:46 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x05\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:04:46 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x100000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:04:46 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xe803) [ 787.441176][ T27] audit: type=1804 audit(1577271886.453:263): pid=23508 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/624/file0/bus" dev="loop4" ino=138 res=1 [ 787.497985][ T27] audit: type=1804 audit(1577271886.453:264): pid=23513 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/624/file0/bus" dev="loop4" ino=138 res=1 11:04:46 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d880fe0018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 787.551545][T23499] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:04:46 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x06\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:04:46 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x2009ff, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:04:46 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d8c0fe0018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:04:46 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xe808) [ 787.942723][T23523] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 787.996206][ T27] audit: type=1804 audit(1577271887.013:265): pid=23534 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/625/file0/bus" dev="loop4" ino=139 res=1 [ 788.063646][ T27] audit: type=1804 audit(1577271887.053:266): pid=23539 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/625/file0/bus" dev="loop4" ino=139 res=1 11:04:49 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x7e00000000000000, 0x0) 11:04:49 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xe80f) 11:04:49 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800ff0018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:04:49 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\a\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:04:49 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xcf, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:04:49 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x307100, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) [ 790.486039][ T27] audit: type=1804 audit(1577271889.503:267): pid=23555 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/626/file0/bus" dev="loop4" ino=140 res=1 [ 790.527827][T23557] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:04:49 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\xfe\xff\xff\a\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:04:49 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d80000002f008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:04:49 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xf003) [ 790.582853][ T27] audit: type=1804 audit(1577271889.503:268): pid=23562 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/626/file0/bus" dev="loop4" ino=140 res=1 11:04:49 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x400000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:04:49 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000050008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 790.892273][ T27] audit: type=1804 audit(1577271889.903:269): pid=23580 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/627/file0/bus" dev="loop4" ino=141 res=1 [ 790.949898][ T27] audit: type=1804 audit(1577271889.943:270): pid=23586 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/627/file0/bus" dev="loop4" ino=141 res=1 11:04:50 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xf401) [ 790.991016][ T27] audit: type=1804 audit(1577271889.943:271): pid=23585 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/627/file0/bus" dev="loop4" ino=141 res=1 [ 791.045614][T23577] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:04:52 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x8000000000000000, 0x0) 11:04:52 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xd0, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:04:52 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d80000006f008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:04:52 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x11\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:04:52 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x405100, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:04:52 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xf807) [ 793.601243][ T27] audit: type=1804 audit(1577271892.613:272): pid=23605 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/628/file0/bus" dev="loop4" ino=142 res=1 11:04:52 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800020018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:04:52 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x30000) [ 793.638720][ T27] audit: type=1804 audit(1577271892.653:273): pid=23605 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/628/file0/bus" dev="loop4" ino=142 res=1 [ 793.685225][T23609] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:04:52 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800030018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:04:52 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x514000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:04:52 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x34000) 11:04:52 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\xff\xff\xff8\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) [ 794.149128][ T27] audit: type=1804 audit(1577271893.163:274): pid=23641 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/629/file0/bus" dev="loop4" ino=143 res=1 [ 794.210881][T23647] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 794.258739][ T27] audit: type=1804 audit(1577271893.273:275): pid=23650 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/629/file0/bus" dev="loop4" ino=143 res=1 11:04:55 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0xfeffffff00000000, 0x0) 11:04:55 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800040018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:04:55 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xc0000) 11:04:55 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00?\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:04:55 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x713000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:04:55 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xd1, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:04:55 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800050018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:04:55 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x400300) [ 796.726666][ T27] audit: type=1804 audit(1577271895.743:276): pid=23672 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/630/file0/bus" dev="loop4" ino=144 res=1 [ 796.816472][ T27] audit: type=1804 audit(1577271895.783:277): pid=23679 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/630/file0/bus" dev="loop4" ino=144 res=1 11:04:55 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x71c000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) [ 796.885917][T23674] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:04:56 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800060018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:04:56 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xa2ffff) 11:04:56 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00@\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) [ 797.238327][ T27] audit: type=1804 audit(1577271896.253:278): pid=23698 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/631/file0/bus" dev="loop4" ino=145 res=1 [ 797.327073][T23702] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 797.331351][ T27] audit: type=1804 audit(1577271896.273:279): pid=23704 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/631/file0/bus" dev="loop4" ino=145 res=1 11:04:58 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x1000000) 11:04:58 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0xffefffffff7f0000, 0x0) 11:04:58 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800070018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:04:58 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xd2, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:04:58 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x760000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:04:58 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x88\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:04:58 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800080018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 799.739819][ T27] audit: type=1804 audit(1577271898.753:280): pid=23722 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/632/file0/bus" dev="loop4" ino=146 res=1 11:04:58 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:04:58 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800090018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 799.908443][ T27] audit: type=1804 audit(1577271898.783:281): pid=23728 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/632/file0/bus" dev="loop4" ino=146 res=1 11:04:59 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x2000000) [ 799.963020][T23715] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 800.078602][ T27] audit: type=1804 audit(1577271899.093:282): pid=23742 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/633/file0/bus" dev="loop4" ino=147 res=1 11:04:59 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x4000000) 11:04:59 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xd3, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:04:59 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\a\xff\xff\xfe\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) [ 800.215693][ T27] audit: type=1804 audit(1577271899.093:283): pid=23749 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/633/file0/bus" dev="loop4" ino=147 res=1 [ 800.388022][T23759] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:05:01 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0xffffffff00000000, 0x0) 11:05:01 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xc07100, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:05:01 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d8000a0018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:05:01 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x7000000) 11:05:01 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x008\xff\xff\xff\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:05:01 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xd4, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 802.945849][ T27] audit: type=1804 audit(1577271901.963:284): pid=23784 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/634/file0/bus" dev="loop4" ino=148 res=1 11:05:02 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x8070000) 11:05:02 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d8000b0018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 802.978713][ T27] audit: type=1804 audit(1577271901.993:285): pid=23784 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/634/file0/bus" dev="loop4" ino=148 res=1 [ 803.045687][T23780] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 803.057495][ T27] audit: type=1804 audit(1577271901.993:286): pid=23794 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/634/file0/bus" dev="loop4" ino=148 res=1 11:05:02 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x01\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:05:02 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x1000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:05:02 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d8000c0018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:05:02 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x9000000) [ 803.339997][T23807] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 803.369738][ T27] audit: type=1804 audit(1577271902.383:287): pid=23811 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/635/file0/bus" dev="loop4" ino=149 res=1 [ 803.405888][ T27] audit: type=1804 audit(1577271902.413:288): pid=23814 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/635/file0/bus" dev="loop4" ino=149 res=1 [ 803.439811][ T27] audit: type=1804 audit(1577271902.443:289): pid=23811 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/635/file0/bus" dev="loop4" ino=149 res=1 11:05:04 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0xffffffffff600000, 0x0) 11:05:04 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d8000e0018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:05:04 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00 \x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:05:04 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x2000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:05:04 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xa000000) 11:05:04 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xd5, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:05:05 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d8000f0018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:05:05 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xe000000) [ 806.148784][ T27] audit: type=1804 audit(1577271905.163:290): pid=23842 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/636/file0/bus" dev="loop4" ino=150 res=1 [ 806.180608][T23837] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:05:05 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x10000000) 11:05:05 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800100018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 806.258689][ T27] audit: type=1804 audit(1577271905.243:291): pid=23856 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/636/file0/bus" dev="loop4" ino=150 res=1 11:05:05 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:05:05 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x3000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) [ 806.642593][T23873] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 806.715170][ T27] audit: type=1804 audit(1577271905.733:292): pid=23879 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/637/file0/bus" dev="loop4" ino=151 res=1 [ 806.762658][ T27] audit: type=1804 audit(1577271905.773:293): pid=23883 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/637/file0/bus" dev="loop4" ino=151 res=1 11:05:08 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x7e) 11:05:08 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x100b0000) 11:05:08 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800110018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:05:08 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xd6, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:05:08 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:05:08 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x4000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) [ 809.131189][ T27] audit: type=1804 audit(1577271908.143:294): pid=23894 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/638/file0/bus" dev="loop4" ino=152 res=1 11:05:08 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800120018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:05:08 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:05:08 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x11000000) [ 809.290382][ T27] audit: type=1804 audit(1577271908.213:295): pid=23905 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/638/file0/bus" dev="loop4" ino=152 res=1 [ 809.315887][T23896] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:05:08 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x5000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:05:08 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xd7, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:05:08 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800130018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 809.547657][T23920] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 809.788414][ T27] audit: type=1804 audit(1577271908.803:296): pid=23929 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/639/file0/bus" dev="sda1" ino=17587 res=1 [ 809.830708][ T27] audit: type=1804 audit(1577271908.843:297): pid=23937 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/639/file0/bus" dev="sda1" ino=17587 res=1 [ 809.890684][ T27] audit: type=1804 audit(1577271908.843:298): pid=23940 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/639/file0/bus" dev="sda1" ino=17587 res=1 11:05:11 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x4000) 11:05:11 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:05:11 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x180f0000) 11:05:11 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800140018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:05:11 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x5100000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:05:11 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xd8, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:05:11 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d8001d0018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 812.328233][T23951] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:05:11 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x20000000) [ 812.441456][ T27] audit: type=1804 audit(1577271911.453:299): pid=23959 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/640/file0/bus" dev="sda1" ino=17613 res=1 11:05:11 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:05:11 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xd9, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:05:11 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x20030000) [ 812.627074][ T27] audit: type=1804 audit(1577271911.533:300): pid=23968 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/640/file0/bus" dev="sda1" ino=17613 res=1 11:05:11 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800480018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 812.670056][ T27] audit: type=1804 audit(1577271911.553:301): pid=23975 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/640/file0/bus" dev="sda1" ino=17613 res=1 [ 812.792448][T23979] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:05:14 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d8004c0018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:05:14 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x60ff) 11:05:14 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:05:14 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x6000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:05:14 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x200a0000) 11:05:14 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xda, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 815.411558][ T27] audit: type=1804 audit(1577271914.423:302): pid=24006 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/641/file0/bus" dev="loop4" ino=153 res=1 11:05:14 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800600018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:05:14 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x280e0000) [ 815.535131][ T27] audit: type=1804 audit(1577271914.523:303): pid=24025 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/641/file0/bus" dev="loop4" ino=153 res=1 [ 815.538503][T24010] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:05:14 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x7000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:05:14 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x30020000) 11:05:14 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:05:14 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800650018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:05:15 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800680018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 815.946479][ T27] audit: type=1804 audit(1577271914.963:304): pid=24046 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/642/file0/bus" dev="loop4" ino=154 res=1 [ 816.016435][ T27] audit: type=1804 audit(1577271915.003:305): pid=24050 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/642/file0/bus" dev="loop4" ino=154 res=1 [ 816.045391][T24043] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:05:17 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x7600) 11:05:17 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xdb, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:05:17 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x38060000) 11:05:17 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x8000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:05:17 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d8006c0018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:05:17 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) [ 818.438205][ T27] audit: type=1804 audit(1577271917.453:306): pid=24064 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/643/file0/bus" dev="loop4" ino=155 res=1 [ 818.609237][ T27] audit: type=1804 audit(1577271917.453:307): pid=24069 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/643/file0/bus" dev="loop4" ino=155 res=1 11:05:17 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:05:17 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800740018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:05:17 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x3f000000) [ 818.718159][T24072] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:05:17 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\xff\xff\xff8\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:05:17 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xdc, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:05:18 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x40000000) [ 818.994587][ T27] audit: type=1804 audit(1577271918.013:308): pid=24096 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/644/file0/bus" dev="loop4" ino=156 res=1 [ 819.030280][ T27] audit: type=1804 audit(1577271918.043:309): pid=24101 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/644/file0/bus" dev="loop4" ino=156 res=1 [ 819.117434][T24099] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:05:20 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x7e00) 11:05:20 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d8007a0018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:05:20 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:05:20 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xa000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:05:20 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x40010000) 11:05:20 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xdd, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 821.666697][T24119] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 821.677077][ T27] audit: type=1804 audit(1577271920.683:310): pid=24120 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/645/file0/bus" dev="loop4" ino=157 res=1 11:05:20 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800f30018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:05:20 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x400a0000) [ 821.736222][ T27] audit: type=1804 audit(1577271920.733:311): pid=24131 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/645/file0/bus" dev="loop4" ino=157 res=1 11:05:20 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:05:20 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xc000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:05:20 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x48050000) [ 821.899758][ T27] audit: type=1804 audit(1577271920.733:312): pid=24120 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/645/file0/bus" dev="loop4" ino=157 res=1 11:05:21 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800fc0018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 822.239146][ T27] audit: type=1804 audit(1577271921.253:313): pid=24160 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/646/file0/bus" dev="loop4" ino=158 res=1 [ 822.248737][T24155] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 822.328198][ T27] audit: type=1804 audit(1577271921.343:314): pid=24165 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/646/file0/bus" dev="loop4" ino=158 res=1 11:05:23 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x9600) 11:05:23 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xde, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:05:23 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x50090000) 11:05:23 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d8008a0118008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:05:23 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x88\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:05:23 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xd000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:05:23 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d8004c0218008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 824.877972][ T27] audit: type=1804 audit(1577271923.893:315): pid=24180 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/647/file0/bus" dev="loop4" ino=159 res=1 [ 824.926997][T24182] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:05:24 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\a\xff\xff\xfe\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) [ 824.965856][ T27] audit: type=1804 audit(1577271923.983:316): pid=24191 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/647/file0/bus" dev="loop4" ino=159 res=1 11:05:24 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x58040000) 11:05:24 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xfffffff, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:05:24 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800f60218008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:05:24 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xdf, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 825.239387][T24203] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 825.489432][ T27] audit: type=1804 audit(1577271924.503:317): pid=24214 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/648/file0/bus" dev="loop4" ino=160 res=1 [ 825.580724][ T27] audit: type=1804 audit(1577271924.543:318): pid=24223 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/648/file0/bus" dev="loop4" ino=160 res=1 11:05:26 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x307100) 11:05:26 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x580d0000) 11:05:26 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:05:26 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000318008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:05:26 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x10000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:05:26 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xe0, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 827.894894][ T27] audit: type=1804 audit(1577271926.913:319): pid=24234 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/649/file0/bus" dev="loop4" ino=161 res=1 11:05:27 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x60000000) [ 827.984949][ T27] audit: type=1804 audit(1577271926.973:320): pid=24252 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/649/file0/bus" dev="loop4" ino=161 res=1 11:05:27 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000518008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:05:27 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x60080000) [ 828.069938][T24242] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:05:27 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x20000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:05:27 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x680c0000) 11:05:27 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000618008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 828.342340][ T27] audit: type=1804 audit(1577271927.353:321): pid=24268 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/650/file0/bus" dev="loop4" ino=162 res=1 [ 828.381431][ T27] audit: type=1804 audit(1577271927.393:322): pid=24274 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/650/file0/bus" dev="loop4" ino=162 res=1 11:05:29 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x400000) 11:05:29 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x02\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:05:29 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x70000000) 11:05:29 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xe1, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:05:29 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x23000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:05:29 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000718008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 830.986758][ T27] audit: type=1804 audit(1577271930.003:323): pid=24295 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/651/file0/bus" dev="loop4" ino=163 res=1 11:05:30 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x78040000) 11:05:30 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800d90818008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 831.050603][ T27] audit: type=1804 audit(1577271930.043:324): pid=24308 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/651/file0/bus" dev="loop4" ino=163 res=1 [ 831.086203][T24299] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:05:30 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x3f000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:05:30 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000918008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:05:30 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x03\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:05:30 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x780b0000) [ 831.457771][T24325] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 831.520898][ T27] audit: type=1804 audit(1577271930.533:325): pid=24327 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/652/file0/bus" dev="loop4" ino=164 res=1 [ 831.570750][ T27] audit: type=1804 audit(1577271930.563:326): pid=24327 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/652/file0/bus" dev="loop4" ino=164 res=1 [ 831.607072][ T27] audit: type=1804 audit(1577271930.563:327): pid=24336 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/652/file0/bus" dev="loop4" ino=164 res=1 11:05:32 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x405100) 11:05:33 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000a18008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:05:33 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x800f0000) 11:05:33 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x04\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:05:33 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xe2, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:05:33 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x40000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:05:33 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x05\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:05:33 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x514000) [ 834.108170][T24347] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 834.118164][ T27] audit: type=1804 audit(1577271933.133:328): pid=24350 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/653/file0/bus" dev="loop4" ino=165 res=1 11:05:33 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x88030000) [ 834.201970][ T27] audit: type=1804 audit(1577271933.213:329): pid=24362 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/653/file0/bus" dev="loop4" ino=165 res=1 11:05:33 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000b18008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 834.230574][ T27] audit: type=1804 audit(1577271933.223:330): pid=24361 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/653/file0/bus" dev="loop4" ino=165 res=1 11:05:33 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xae000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:05:33 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x90070000) 11:05:33 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xe3, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:05:33 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000c18008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 834.618356][T24381] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:05:33 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x06\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:05:33 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x900e0000) [ 834.730365][ T27] audit: type=1804 audit(1577271933.743:331): pid=24397 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/654/file0/bus" dev="sda1" ino=17329 res=1 [ 834.783091][ T27] audit: type=1804 audit(1577271933.793:332): pid=24390 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/654/file0/bus" dev="sda1" ino=17329 res=1 11:05:33 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x98020000) 11:05:34 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xc0000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:05:34 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000e18008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 834.995873][T24405] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:05:36 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x713000) 11:05:36 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\a\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:05:36 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xa0060000) 11:05:36 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000f18008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:05:36 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xe4, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:05:36 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xeffdffff, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) [ 837.482736][ T27] kauditd_printk_skb: 2 callbacks suppressed [ 837.482776][ T27] audit: type=1804 audit(1577271936.493:335): pid=24436 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/656/file0/bus" dev="loop4" ino=167 res=1 11:05:36 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xa1ffffff) 11:05:36 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800001118008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 837.533497][ T27] audit: type=1804 audit(1577271936.543:336): pid=24451 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/656/file0/bus" dev="loop4" ino=167 res=1 [ 837.614972][T24439] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:05:36 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xf0ffffff, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:05:36 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x11\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:05:36 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800001218008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:05:36 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xa80a0000) [ 837.906518][ T27] audit: type=1804 audit(1577271936.923:337): pid=24469 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/657/file0/bus" dev="loop4" ino=168 res=1 [ 837.939916][ T27] audit: type=1804 audit(1577271936.953:338): pid=24472 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/657/file0/bus" dev="loop4" ino=168 res=1 [ 837.996399][T24467] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:05:39 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x71c000) 11:05:39 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800001318008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:05:39 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x88\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:05:39 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xf4ffffff, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:05:39 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xb0050000) 11:05:39 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xe5, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:05:39 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800001418008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:05:39 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xb00e0000) [ 840.613258][T24489] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:05:39 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x03\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) [ 840.762494][ T27] audit: type=1804 audit(1577271939.773:339): pid=24505 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/658/file0/bus" dev="sda1" ino=17650 res=1 11:05:40 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xf5ffffff, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:05:40 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800001d18008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:05:40 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xb8090000) [ 840.980605][T24510] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 841.227774][ T27] audit: type=1804 audit(1577271940.243:340): pid=24530 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/659/file0/bus" dev="loop4" ino=169 res=1 [ 841.318216][ T27] audit: type=1804 audit(1577271940.243:341): pid=24534 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/659/file0/bus" dev="loop4" ino=169 res=1 11:05:42 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x760000) 11:05:42 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x05\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:05:42 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xe6, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:05:42 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xb80b0000) 11:05:42 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800002018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:05:42 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xfbffffff, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:05:42 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xc00d0000) [ 843.698121][ T27] audit: type=1804 audit(1577271942.713:342): pid=24550 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/660/file0/bus" dev="loop4" ino=170 res=1 11:05:42 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800003f18008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:05:42 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xff092000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) [ 843.815141][T24548] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 843.835010][ T27] audit: type=1804 audit(1577271942.723:343): pid=24557 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/660/file0/bus" dev="loop4" ino=170 res=1 11:05:42 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xc8010000) 11:05:42 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x06\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:05:43 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800004018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 844.206287][ T27] audit: type=1804 audit(1577271943.223:344): pid=24579 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/661/file0/bus" dev="loop4" ino=171 res=1 [ 844.286291][ T27] audit: type=1804 audit(1577271943.273:345): pid=24587 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/661/file0/bus" dev="loop4" ino=171 res=1 [ 844.352558][T24581] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:05:45 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x960000) 11:05:45 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xc8080000) 11:05:45 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xe7, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:05:45 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800004818008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:05:45 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\a\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:05:45 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xff600000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:05:45 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xd00c0000) [ 846.866504][ T27] audit: type=1804 audit(1577271945.883:346): pid=24607 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/662/file0/bus" dev="loop4" ino=172 res=1 [ 846.963167][ T27] audit: type=1804 audit(1577271945.933:347): pid=24618 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/662/file0/bus" dev="loop4" ino=172 res=1 11:05:46 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800004c18008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 847.041256][T24611] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:05:46 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xfffdffff, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:05:46 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xd8000000) 11:05:46 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800024c18008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:05:46 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x11\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) [ 847.399185][ T27] audit: type=1804 audit(1577271946.413:348): pid=24628 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/663/file0/bus" dev="loop4" ino=173 res=1 [ 847.502124][ T27] audit: type=1804 audit(1577271946.453:349): pid=24638 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/663/file0/bus" dev="loop4" ino=173 res=1 [ 847.688415][T24642] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:05:48 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0xc07100) 11:05:48 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xe8, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:05:48 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800655818008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:05:48 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xfffffdef, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:05:48 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xe0040000) 11:05:48 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00 \x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:05:48 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800006018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 849.850078][ T27] audit: type=1804 audit(1577271948.863:350): pid=24656 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/664/file0/bus" dev="loop4" ino=174 res=1 [ 849.886917][T24659] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:05:48 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00?\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) [ 849.964275][ T27] audit: type=1804 audit(1577271948.973:351): pid=24672 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/664/file0/bus" dev="loop4" ino=174 res=1 11:05:49 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xe8030000) 11:05:49 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xfffffdff, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:05:49 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800006518008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 850.209845][T24679] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:05:49 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xe8080000) [ 850.455185][ T27] audit: type=1804 audit(1577271949.473:352): pid=24691 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/665/file0/bus" dev="loop4" ino=175 res=1 [ 850.538242][ T27] audit: type=1804 audit(1577271949.513:353): pid=24697 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/665/file0/bus" dev="loop4" ino=175 res=1 11:05:51 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800586518008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:05:51 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00@\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:05:51 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x1000000) 11:05:51 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xe80f0000) 11:05:51 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xffffff0f, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:05:51 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xe9, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:05:52 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800006818008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:05:52 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xf0030000) [ 853.166763][ T27] audit: type=1804 audit(1577271952.183:354): pid=24721 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/666/file0/bus" dev="loop4" ino=176 res=1 [ 853.197025][T24715] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 853.292741][ T27] audit: type=1804 audit(1577271952.273:355): pid=24735 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/666/file0/bus" dev="loop4" ino=176 res=1 11:05:52 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xf4010000) 11:05:52 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x88\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:05:52 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800006c18008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:05:52 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xfffffff0, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:05:52 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xea, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 853.670811][ T27] audit: type=1804 audit(1577271952.683:356): pid=24753 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/667/file0/bus" dev="loop4" ino=177 res=1 [ 853.670826][T24751] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:05:52 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00 \x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) [ 853.776798][ T27] audit: type=1804 audit(1577271952.793:357): pid=24759 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/667/file0/bus" dev="loop4" ino=177 res=1 [ 853.953202][T24766] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:05:55 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x7e000000) 11:05:55 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xf8070000) 11:05:55 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800007418008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:05:55 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xfffffff4, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:05:55 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x01\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:05:55 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xeb, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:05:55 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xffff0000) [ 856.205777][ T27] audit: type=1804 audit(1577271955.223:358): pid=24784 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/668/file0/bus" dev="loop4" ino=178 res=1 11:05:55 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800007a18008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 856.241586][ T27] audit: type=1804 audit(1577271955.253:359): pid=24793 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/668/file0/bus" dev="loop4" ino=178 res=1 [ 856.276313][ T27] audit: type=1804 audit(1577271955.253:360): pid=24784 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/668/file0/bus" dev="loop4" ino=178 res=1 [ 856.321884][T24779] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:05:55 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xfffffff5, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:05:55 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xffffa200) 11:05:55 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x02\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:05:55 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800fe8018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 856.707400][ T27] audit: type=1804 audit(1577271955.723:361): pid=24815 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/669/file0/bus" dev="loop4" ino=179 res=1 [ 856.754835][T24817] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 856.767607][ T27] audit: type=1804 audit(1577271955.753:362): pid=24823 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/669/file0/bus" dev="loop4" ino=179 res=1 [ 856.829787][ T27] audit: type=1804 audit(1577271955.763:363): pid=24815 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/669/file0/bus" dev="loop4" ino=179 res=1 11:05:58 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0xfeffffff) 11:05:58 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x03\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:05:58 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xffffffa1) 11:05:58 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800008118008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:05:58 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xec, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:05:58 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xfffffffb, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:05:58 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800018a18008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 859.256720][ T27] audit: type=1804 audit(1577271958.273:364): pid=24940 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/670/file0/bus" dev="loop4" ino=180 res=1 11:05:58 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x3000000000000) [ 859.448053][ T27] audit: type=1804 audit(1577271958.283:365): pid=24948 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/670/file0/bus" dev="loop4" ino=180 res=1 11:05:58 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x400000000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) [ 859.513640][T24939] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:05:58 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800fec018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:05:58 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xed, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:05:58 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x04\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) [ 859.889979][ T27] audit: type=1804 audit(1577271958.903:366): pid=24974 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/671/file0/bus" dev="loop4" ino=181 res=1 [ 859.930411][T24976] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 859.967650][ T27] audit: type=1804 audit(1577271958.933:367): pid=24981 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/671/file0/bus" dev="loop4" ino=181 res=1 11:06:01 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0xff600000) 11:06:01 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d80008d918008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:06:01 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xc000000000000) 11:06:01 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x05\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:06:01 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x60ffffffffff, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:06:01 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xee, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:06:01 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d80000f318008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 862.386282][ T27] audit: type=1804 audit(1577271961.403:368): pid=24999 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/672/file0/bus" dev="loop4" ino=182 res=1 11:06:01 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x40030000000000) [ 862.449680][T24996] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:06:01 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x760000000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:06:01 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d80002f618008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 862.551794][ T27] audit: type=1804 audit(1577271961.403:369): pid=25006 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/672/file0/bus" dev="loop4" ino=182 res=1 11:06:01 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x06\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:06:01 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xef, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 862.825549][ T27] audit: type=1804 audit(1577271961.843:370): pid=25026 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/673/file0/bus" dev="loop4" ino=183 res=1 [ 862.874282][ T27] audit: type=1804 audit(1577271961.843:371): pid=25031 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/673/file0/bus" dev="loop4" ino=183 res=1 [ 863.002572][T25030] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:06:04 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0xfffffffe) 11:06:04 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xa2ffff00000000) 11:06:04 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x7f4697e75000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:06:04 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d80000fc18008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:06:04 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\a\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:06:04 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xf0, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:06:04 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x100000000000000) 11:06:04 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d80080fe18008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 865.517778][ T27] audit: type=1804 audit(1577271964.533:372): pid=25052 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/674/file0/bus" dev="loop4" ino=184 res=1 [ 865.596227][ T27] audit: type=1804 audit(1577271964.563:373): pid=25067 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/674/file0/bus" dev="loop4" ino=184 res=1 [ 865.613962][T25051] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:06:04 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800c0fe18008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:06:04 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x7fffffffefff, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:06:04 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\xfe\xff\xff\a\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:06:04 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d80000ff18008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 866.015678][ T27] audit: type=1804 audit(1577271965.033:374): pid=25087 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/675/file0/bus" dev="loop4" ino=185 res=1 [ 866.072295][T25083] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 866.126727][ T27] audit: type=1804 audit(1577271965.063:375): pid=25092 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/675/file0/bus" dev="loop4" ino=185 res=1 11:06:07 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x400000000000) 11:06:07 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x200000000000000) 11:06:07 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d80000000f008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:06:07 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xf1, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:06:07 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960000000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:06:07 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x11\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:06:07 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x400000000000000) 11:06:07 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000218008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 868.606470][ T27] audit: type=1804 audit(1577271967.613:376): pid=25108 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/676/file0/bus" dev="loop4" ino=186 res=1 [ 868.641107][T25106] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 868.672287][ T27] audit: type=1804 audit(1577271967.663:377): pid=25121 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/676/file0/bus" dev="loop4" ino=186 res=1 11:06:07 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\xff\xff\xff8\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:06:07 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x1000000000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:06:07 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x700000000000000) 11:06:07 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000318008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 869.132446][T25134] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 869.183123][ T27] audit: type=1804 audit(1577271968.193:378): pid=25143 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/677/file0/bus" dev="loop4" ino=187 res=1 [ 869.280478][ T27] audit: type=1804 audit(1577271968.203:379): pid=25146 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/677/file0/bus" dev="loop4" ino=187 res=1 11:06:10 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x60ffffffffff) 11:06:10 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000418008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:06:10 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x807000000000000) 11:06:10 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00?\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:06:10 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xf2, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:06:10 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x2000000000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:06:10 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000518008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 871.696926][ T27] audit: type=1804 audit(1577271970.713:380): pid=25164 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/678/file0/bus" dev="loop4" ino=188 res=1 11:06:10 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x10000000000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) [ 871.772664][ T27] audit: type=1804 audit(1577271970.713:381): pid=25168 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/678/file0/bus" dev="loop4" ino=188 res=1 11:06:10 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x900000000000000) 11:06:10 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000618008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 871.875940][T25162] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:06:11 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00@\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) [ 872.083982][ T27] audit: type=1804 audit(1577271971.103:382): pid=25187 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/679/file0/bus" dev="loop4" ino=189 res=1 11:06:11 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000718008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 872.205521][ T27] audit: type=1804 audit(1577271971.143:383): pid=25191 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/679/file0/bus" dev="loop4" ino=189 res=1 [ 872.316625][T25195] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:06:13 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x760000000000) 11:06:13 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xa00000000000000) 11:06:13 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000818008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:06:13 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x30710000000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:06:13 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xf3, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:06:13 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x88\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:06:13 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xe00000000000000) 11:06:13 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000918008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 874.821749][ T27] audit: type=1804 audit(1577271973.833:384): pid=25218 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/680/file0/bus" dev="loop4" ino=190 res=1 [ 874.888308][ T27] audit: type=1804 audit(1577271973.873:385): pid=25228 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/680/file0/bus" dev="loop4" ino=190 res=1 [ 874.982007][T25216] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:06:14 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x40510000000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:06:14 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x1000000000000000) 11:06:14 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\a\xff\xff\xfe\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:06:14 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000a18008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 875.397444][ T27] audit: type=1804 audit(1577271974.413:386): pid=25252 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/681/file0/bus" dev="loop4" ino=191 res=1 [ 875.406259][T25250] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 875.442625][ T27] audit: type=1804 audit(1577271974.453:387): pid=25255 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/681/file0/bus" dev="loop4" ino=191 res=1 11:06:16 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x7fffffffefff) 11:06:16 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xf4, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:06:16 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000b18008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:06:16 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x100b000000000000) 11:06:16 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x008\xff\xff\xff\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:06:16 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x50e797467f0000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:06:16 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x1100000000000000) [ 877.904749][ T27] audit: type=1804 audit(1577271976.923:388): pid=25274 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/682/file0/bus" dev="loop4" ino=192 res=1 [ 877.921183][T25266] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:06:17 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000c18008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 877.997431][ T27] audit: type=1804 audit(1577271977.013:389): pid=25274 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/682/file0/bus" dev="loop4" ino=192 res=1 11:06:17 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:06:17 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xc0710000000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) [ 878.229927][T25290] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:06:17 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000e18008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:06:17 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x180f000000000000) [ 878.364313][ T27] audit: type=1804 audit(1577271977.383:390): pid=25298 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/683/file0/bus" dev="loop4" ino=193 res=1 [ 878.450724][ T27] audit: type=1804 audit(1577271977.383:391): pid=25301 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/683/file0/bus" dev="loop4" ino=193 res=1 11:06:19 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x960000000000) 11:06:19 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xf5, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:06:19 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:06:19 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x100000000000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:06:19 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000f18008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:06:19 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x2000000000000000) 11:06:20 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x2003000000000000) [ 880.988969][ T27] audit: type=1804 audit(1577271980.003:392): pid=25321 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/684/file0/bus" dev="loop4" ino=194 res=1 [ 881.036503][ T27] audit: type=1804 audit(1577271980.003:393): pid=25333 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/684/file0/bus" dev="loop4" ino=194 res=1 11:06:20 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800001018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:06:20 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x200000000000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) [ 881.168858][T25325] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:06:20 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:06:20 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x200a000000000000) [ 881.395577][ T27] audit: type=1804 audit(1577271980.413:394): pid=25347 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/685/file0/bus" dev="loop4" ino=195 res=1 [ 881.444043][ T27] audit: type=1804 audit(1577271980.453:395): pid=25347 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/685/file0/bus" dev="loop4" ino=195 res=1 11:06:20 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800001118008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 881.566669][T25351] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:06:22 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x300000000000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:06:22 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x30710000000000) 11:06:22 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xf6, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:06:22 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x280e000000000000) 11:06:22 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:06:22 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800001218008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:06:23 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x3002000000000000) [ 884.136548][T25378] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:06:23 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) [ 884.176471][ T27] audit: type=1804 audit(1577271983.193:396): pid=25389 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/686/file0/bus" dev="sda1" ino=17876 res=1 11:06:23 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800001318008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:06:23 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x3806000000000000) [ 884.350896][ T27] audit: type=1804 audit(1577271983.253:397): pid=25397 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/686/file0/bus" dev="sda1" ino=17876 res=1 11:06:23 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x400000000000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) [ 884.456876][T25401] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:06:23 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800001418008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 884.500804][ T27] audit: type=1804 audit(1577271983.273:398): pid=25389 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/686/file0/bus" dev="sda1" ino=17876 res=1 11:06:23 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x3f00000000000000) [ 884.796299][ T27] audit: type=1804 audit(1577271983.813:399): pid=25419 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/687/file0/bus" dev="loop4" ino=196 res=1 [ 884.841293][ T27] audit: type=1804 audit(1577271983.853:400): pid=25425 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/687/file0/bus" dev="loop4" ino=196 res=1 [ 884.884728][ T27] audit: type=1804 audit(1577271983.853:401): pid=25419 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/687/file0/bus" dev="loop4" ino=196 res=1 11:06:26 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800001d18008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:06:26 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xf7, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:06:26 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:06:26 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x40510000000000) 11:06:26 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x500000000000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:06:26 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x4000000000000000) 11:06:26 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x4001000000000000) [ 887.185269][ T27] audit: type=1804 audit(1577271986.203:402): pid=25444 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/688/file0/bus" dev="loop4" ino=197 res=1 11:06:26 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0xc0710000000000) 11:06:26 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800004818008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 887.272910][T25439] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:06:26 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) [ 887.415348][ T27] audit: type=1804 audit(1577271986.263:403): pid=25449 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/688/file0/bus" dev="loop4" ino=197 res=1 11:06:26 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x510000000000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:06:26 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xf8, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:06:26 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800004c18008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:06:26 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x400a000000000000) 11:06:26 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x100000000000000) [ 887.760530][T25470] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:06:27 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800006018008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:06:27 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) [ 887.963431][ T27] audit: type=1804 audit(1577271986.983:404): pid=25485 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/689/bus" dev="sda1" ino=17904 res=1 11:06:27 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xf9, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:06:27 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x600000000000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:06:27 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800006518008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:06:27 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x4805000000000000) [ 888.275233][T25504] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:06:27 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) [ 888.393817][ T27] audit: type=1804 audit(1577271987.413:405): pid=25516 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/690/file0/bus" dev="loop4" ino=198 res=1 [ 888.434251][ T27] audit: type=1804 audit(1577271987.443:406): pid=25519 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/690/file0/bus" dev="loop4" ino=198 res=1 11:06:27 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800006818008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 888.611267][T25523] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:06:27 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x700000000000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:06:27 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:06:27 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x5009000000000000) [ 889.001380][ T27] audit: type=1804 audit(1577271988.013:407): pid=25539 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/691/file0/bus" dev="loop4" ino=199 res=1 [ 889.006764][T25536] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 889.050726][ T27] audit: type=1804 audit(1577271988.063:408): pid=25547 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/691/file0/bus" dev="loop4" ino=199 res=1 11:06:29 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x7e00000000000000) 11:06:29 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800006c18008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:06:29 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xfa, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:06:29 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x5804000000000000) 11:06:29 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff8\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:06:29 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x800000000000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:06:30 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800007418008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 891.072274][ T27] audit: type=1804 audit(1577271990.083:409): pid=25560 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/692/file0/bus" dev="loop4" ino=200 res=1 [ 891.135073][T25564] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:06:30 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x580d000000000000) [ 891.201395][ T27] audit: type=1804 audit(1577271990.203:410): pid=25571 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/692/file0/bus" dev="loop4" ino=200 res=1 [ 891.266915][ T27] audit: type=1800 audit(1577271990.203:411): pid=25571 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="bus" dev="loop4" ino=200 res=0 11:06:30 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:06:30 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xfb, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:06:30 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x6000000000000000) 11:06:30 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) [ 891.657205][T25591] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:06:33 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x6008000000000000) 11:06:33 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xfc, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:06:33 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800007a18008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:06:33 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x8000000000000000) 11:06:33 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:06:33 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xa00000000000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) [ 894.110255][ T27] kauditd_printk_skb: 2 callbacks suppressed [ 894.110291][ T27] audit: type=1804 audit(1577271993.123:414): pid=25623 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/694/file0/bus" dev="loop4" ino=202 res=1 11:06:33 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x680c000000000000) 11:06:33 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d80000f318008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 894.148172][ T27] audit: type=1804 audit(1577271993.163:415): pid=25629 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/694/file0/bus" dev="loop4" ino=202 res=1 [ 894.231044][T25621] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:06:33 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d80000fc18008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:06:33 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xc00000000000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:06:33 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x88\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:06:33 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d80000002f008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:06:33 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x7000000000000000) [ 894.645128][ T27] audit: type=1804 audit(1577271993.663:416): pid=25653 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/695/file0/bus" dev="loop4" ino=203 res=1 [ 894.705846][ T27] audit: type=1804 audit(1577271993.723:417): pid=25662 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/695/file0/bus" dev="loop4" ino=203 res=1 [ 894.760796][T25649] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:06:36 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0xfeffffff00000000) 11:06:36 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xfd, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:06:36 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x7804000000000000) 11:06:36 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000050008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:06:36 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\a\xff\xff\xfe\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:06:36 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xd00000000000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) [ 897.210843][ T27] audit: type=1804 audit(1577271996.223:418): pid=25673 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/696/file0/bus" dev="loop4" ino=204 res=1 [ 897.257584][ T27] audit: type=1804 audit(1577271996.253:419): pid=25690 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/696/file0/bus" dev="loop4" ino=204 res=1 11:06:36 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x780b000000000000) 11:06:36 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d80000006f008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 897.368153][T25684] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:06:36 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x1000000000000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:06:36 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d80000000f008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:06:36 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x800f000000000000) 11:06:36 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) [ 897.729572][ T27] audit: type=1804 audit(1577271996.743:420): pid=25707 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/697/file0/bus" dev="loop4" ino=205 res=1 [ 897.798349][ T27] audit: type=1804 audit(1577271996.783:421): pid=25716 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/697/file0/bus" dev="loop4" ino=205 res=1 [ 897.918071][T25717] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:06:39 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0xffefffffff7f0000) 11:06:39 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d80000002f008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:06:39 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x8803000000000000) 11:06:39 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0xfe, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:06:39 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x02\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:06:39 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x2000000000000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:06:39 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000050008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 900.310271][ T27] audit: type=1804 audit(1577271999.323:422): pid=25732 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/698/file0/bus" dev="loop4" ino=206 res=1 [ 900.347763][T25731] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:06:39 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x9007000000000000) [ 900.361673][ T27] audit: type=1804 audit(1577271999.353:423): pid=25749 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/698/file0/bus" dev="loop4" ino=206 res=1 [ 900.388909][ T27] audit: type=1804 audit(1577271999.353:424): pid=25748 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/698/file0/bus" dev="loop4" ino=206 res=1 11:06:39 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d80000006f008100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:06:39 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x03\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:06:39 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x2300000000000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:06:39 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x900e000000000000) [ 900.718344][T25761] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 900.832052][ T27] audit: type=1804 audit(1577271999.843:425): pid=25766 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/699/file0/bus" dev="loop4" ino=207 res=1 [ 900.960411][ T27] audit: type=1804 audit(1577271999.873:426): pid=25773 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/699/file0/bus" dev="loop4" ino=207 res=1 11:06:42 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0xffffffff00000000) 11:06:42 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018028100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:06:42 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0x102, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:06:42 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x04\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:06:42 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x3f00000000000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:06:42 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x9802000000000000) 11:06:42 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018038100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 903.398884][T25788] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 903.427005][ T27] audit: type=1804 audit(1577272002.443:427): pid=25794 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/700/file0/bus" dev="loop4" ino=208 res=1 11:06:42 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xa006000000000000) 11:06:42 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x05\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) [ 903.478411][ T27] audit: type=1804 audit(1577272002.483:428): pid=25802 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/700/file0/bus" dev="loop4" ino=208 res=1 11:06:42 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x4000000000000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:06:42 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0x103, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:06:42 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018048100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 903.739631][T25806] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 903.946296][ T27] audit: type=1804 audit(1577272002.963:429): pid=25828 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/701/file0/bus" dev="sda1" ino=16534 res=1 [ 904.037084][ T27] audit: type=1804 audit(1577272003.053:430): pid=25828 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/701/file0/bus" dev="sda1" ino=16534 res=1 11:06:45 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0xffffffffff600000) 11:06:45 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xa1ffffff00000000) 11:06:45 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x06\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:06:45 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018058100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:06:45 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x8000000000000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:06:45 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0x104, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:06:45 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xa80a000000000000) 11:06:45 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018068100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 906.494639][ T27] audit: type=1804 audit(1577272005.513:431): pid=25847 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/702/file0/bus" dev="loop4" ino=209 res=1 [ 906.549183][ T27] audit: type=1804 audit(1577272005.543:432): pid=25855 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/702/file0/bus" dev="loop4" ino=209 res=1 [ 906.617956][T25842] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:06:45 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xae00000000000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:06:45 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018078100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:06:45 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\a\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:06:45 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xb005000000000000) [ 906.881435][ T27] audit: type=1804 audit(1577272005.893:433): pid=25871 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/703/file0/bus" dev="loop4" ino=210 res=1 [ 906.941051][ T27] audit: type=1804 audit(1577272005.943:434): pid=25879 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/703/file0/bus" dev="loop4" ino=210 res=1 [ 907.007652][T25876] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:06:48 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xc000000000000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:06:48 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0x105, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:06:48 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x11\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:06:48 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xb00e000000000000) 11:06:48 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018088100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:06:48 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018098100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 909.598633][ T27] audit: type=1804 audit(1577272008.613:435): pid=25898 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/704/file0/bus" dev="loop4" ino=211 res=1 [ 909.647960][ T27] audit: type=1804 audit(1577272008.643:436): pid=25898 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/704/file0/bus" dev="loop4" ino=211 res=1 11:06:48 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xb809000000000000) [ 909.697659][T25903] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:06:48 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x88\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:06:48 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xeffdffffffffffff, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) [ 909.866960][T25918] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:06:48 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d8000000180a8100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:06:48 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xb80b000000000000) 11:06:49 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x03\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:06:49 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d8000000180b8100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 910.084524][ T27] audit: type=1804 audit(1577272009.103:437): pid=25925 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/705/file0/bus" dev="loop4" ino=212 res=1 [ 910.141187][ T27] audit: type=1804 audit(1577272009.153:438): pid=25925 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/705/file0/bus" dev="loop4" ino=212 res=1 [ 910.225535][T25933] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:06:49 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0x106, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:06:49 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x1000, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x3ff, 0x14a}, &(0x7f0000000040)=0x18) r2 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vcsu\x00', 0x2000, 0x0) r3 = dup(0xffffffffffffffff) setsockopt$packet_int(r3, 0x107, 0x10000000000f, 0x0, 0x0) r4 = getpid() sched_setattr(r4, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r5 = dup(0xffffffffffffffff) setsockopt$packet_int(r5, 0x107, 0x10000000000f, 0x0, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r5, 0x0, 0x10, &(0x7f0000000580)={{{@in=@remote, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@empty}}, &(0x7f0000000680)=0xe8) stat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setresgid(0x0, 0x0, r7) getgroups(0x1, &(0x7f00000006c0)=[r7]) r9 = dup(0xffffffffffffffff) setsockopt$packet_int(r9, 0x107, 0x10000000000f, 0x0, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r9, 0xc0502100, &(0x7f0000000980)={0x0, 0x0}) r11 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r11, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, r12, 0x0) stat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setresgid(0x0, 0x0, r13) r14 = getpid() sched_setattr(r14, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r15 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r15, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, r16, 0x0) r17 = getgid() r18 = getpid() sched_setattr(r18, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r19 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r19, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, r20, 0x0) stat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setresgid(0x0, 0x0, r21) r22 = getpid() sched_setattr(r22, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r23 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, r23, 0x0) fstat(r23, &(0x7f0000002f80)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(0xffffffffffffffff, &(0x7f0000003000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r26 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r26, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, r27, 0x0) getresgid(&(0x7f0000003080), &(0x7f00000030c0), &(0x7f0000003100)=0x0) r29 = dup(0xffffffffffffffff) setsockopt$packet_int(r29, 0x107, 0x10000000000f, 0x0, 0x0) ioctl$sock_SIOCGPGRP(r29, 0x8904, &(0x7f0000004600)=0x0) statx(0xffffffffffffffff, &(0x7f0000004640)='./file0\x00', 0x400, 0x0, &(0x7f0000004680)={0x0, 0x0, 0x0, 0x0, 0x0}) r32 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, r32, 0x0) r33 = dup(0xffffffffffffffff) setsockopt$packet_int(r33, 0x107, 0x10000000000f, 0x0, 0x0) r34 = accept4$packet(0xffffffffffffffff, &(0x7f0000004780)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000047c0)=0x14, 0x800) r35 = syz_open_dev$dri(&(0x7f0000004800)='/dev/dri/card#\x00', 0x5, 0x6401) r36 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, r36, 0x0) r37 = dup(0xffffffffffffffff) setsockopt$packet_int(r37, 0x107, 0x10000000000f, 0x0, 0x0) r38 = getpid() sched_setattr(r38, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r39 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r39, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, r40, 0x0) lstat(&(0x7f0000006c00)='./file0\x00', &(0x7f0000006c40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000006cc0)='./file0\x00', &(0x7f0000006d00)={0x0, 0x0, 0x0, 0x0, 0x0}) r43 = openat$cgroup_int(0xffffffffffffffff, &(0x7f0000006d80)='memory.high\x00', 0x2, 0x0) statx(0xffffffffffffff9c, &(0x7f0000006dc0)='./file0\x00', 0x2100, 0x80, &(0x7f0000006e00)={0x0, 0x0, 0x0, 0x0, 0x0}) r45 = dup(0xffffffffffffffff) setsockopt$packet_int(r45, 0x107, 0x10000000000f, 0x0, 0x0) statx(r45, &(0x7f0000006f00)='./file0\x00', 0x1000, 0x7ff, &(0x7f0000006f40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r47 = dup(0xffffffffffffffff) setsockopt$packet_int(r47, 0x107, 0x10000000000f, 0x0, 0x0) r48 = syz_init_net_socket$rose(0xb, 0x5, 0x0) r49 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, r49, 0x0) r50 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, r50, 0x0) r51 = dup(r50) r52 = openat$vnet(0xffffffffffffff9c, &(0x7f0000007040)='/dev/vhost-net\x00', 0x2, 0x0) r53 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r54 = dup(0xffffffffffffffff) setsockopt$packet_int(r54, 0x107, 0x10000000000f, 0x0, 0x0) r55 = syz_init_net_socket$rose(0xb, 0x5, 0x0) r56 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r57 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, r57, 0x0) r58 = getpid() sched_setattr(r58, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r59 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r59, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, r60, 0x0) pipe2$9p(&(0x7f0000007080)={0xffffffffffffffff}, 0x4000) r62 = dup(0xffffffffffffffff) setsockopt$packet_int(r62, 0x107, 0x10000000000f, 0x0, 0x0) ioctl$VIDIOC_TRY_EXT_CTRLS(0xffffffffffffffff, 0xc0205649, &(0x7f0000007140)={0x9a0000, 0x2, 0x5, r62, 0x0, &(0x7f0000007100)={0x30045, 0x0, [], @p_u32=&(0x7f00000070c0)=0x8}}) r64 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, r64, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000007180)={0xffffffffffffffff}) r66 = accept4$vsock_stream(0xffffffffffffffff, &(0x7f00000071c0)={0x28, 0x0, 0x0, @hyper}, 0x10, 0x5c85954753a9ae36) r67 = syz_open_dev$swradio(&(0x7f0000007200)='/dev/swradio#\x00', 0x0, 0x2) r68 = dup(0xffffffffffffffff) setsockopt$packet_int(r68, 0x107, 0x10000000000f, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f00000073c0)=[{&(0x7f0000000280)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000300)="6ac82093bb333b86cea176e05dce8686fdf984cb65a399cc53d3a5248b9d3d43bc29d5b035c849652214b09362ddebdda295e9ee3f9ea9cd2158ff2fc3f714adc3ed6c65702aaa46eaa8e846880a7075aa79402f9d9f", 0x56}, {&(0x7f0000000380)="baaf3ba3b377fc13503fd73dcec987295bf63c79de9209a8fd8fc280015f81997e1524e8f4dd78ee39e0d0be79a8688b9c6984c9763be486b3e69934040ca9b13d45e6fe485eaa235f037ac49d2abc1a89f343ac6c8983abae35cce73893b29546c0d006b6ef70fcc8ad2c0c64d5ac851a2ddb3430195687ebd56a4d99f7ff43839ff4e670ced8cda42ea950f9b09d90", 0x90}, {&(0x7f0000000440)="60c6ba2ed1aec2eb574678984ce939213ee212e07ff39e02d212d3008a24b7c7658332379d3cbe2986820ed1d8ef45073e2bf440657e675a6890761f41f7a7f8e9daead32a3c4e2e3779ca49010c1ffbf6868a2d7f78a96d9ada4171987b7e555f35622bf5e6cb809c724d3aece6cdbc16c619a30cba59a090856382af3e0177d509393fc9ba2be8a1c2cddea28f89f1122818404fa25a2e6b6c78fe836366c7f2b50cd020e28500c13f6017cb755bfd4e42d4e023ad721aefab34883908431aee18ded7219c9328b03830", 0xcb}, {&(0x7f0000000180)}], 0x4, &(0x7f0000000700)=[@rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, r3]}}, @cred={{0x1c, 0x1, 0x2, {r4, r6, r8}}}], 0x38, 0x4000810}, {&(0x7f0000000740)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000000940)=[{&(0x7f00000007c0)="4a5df77666a60d2c5db048f873c2b6d1c3eb356e5239beaf2bb8e861d1614520d2104d858ffe4d6dad4c283b6931a7f32b3584f32611dae7b05d17525587a79ed90eaca96a871304aeae09fd97579544db174e9fc60d253c844614c565346eb6c22f2567cb0cbf291d1ea8e7b4c0c63e56071069758a5654123bbbf6489e8fe39a7e6ed2a5246de9778e64f536d3a94648367f38bbb0c359f6cc293f08d58b279e", 0xa1}, {&(0x7f0000000880)="0add8dd42da7706d49489888d70ccae7f4a6244eb2cea09ffcef676b02e2d4e4ede95d699cd7435f230f179d1e50b647456f53b3fe52bc7fd2b2695d09e8aa3ed1ab93007219fab2ae0c6afef6cec4155eac12ed41e33b49d966663b8e33faf38db5b6d69552321ecec3eca9275990dc36835ca70e9633421f39a446558611c67d32", 0x82}], 0x2, &(0x7f0000000a00)=[@cred={{0x1c, 0x1, 0x2, {r10, r12, r13}}}, @cred={{0x1c, 0x1, 0x2, {r14, r16, r17}}}, @cred={{0x1c, 0x1, 0x2, {r18, r20, r21}}}], 0x60, 0x48104}, {&(0x7f0000000a80)=@abs={0x1, 0x0, 0x4e23}, 0x6e, &(0x7f0000002f00)=[{&(0x7f0000000b00)="c6d5bdb535b3f1b0ffb5a170c9b4a7a2fab46752a939ca21a38c7637bd07cdfe8ea5872164552a74426854ad4e3b542c44251e519559494f2bac644361bf4e1295a162fb5f7b2b64a035a8908f168370f4b9f8e683a7c7eb85af11512987d90ed462258a70960e95dd5e63d30634ce9606889e2b17d25915b883f39ada1f1e725ac0f1606cdd4f817e6a4b6f07dbc25cded2c2b9044b6761de3e20d23cbac1ae1ff02de64c11effee7516a507aa0abea08823102443de6a6e726d98b48dbf82d947b99210915ef15b8f5b0ec9ff3f6a41f9bfc9a8e13e14694b2319193253feb12e64ba6541bdc204f8bc638bd10e9135357ab2333ab78f3f3ab918cdece", 0xfe}, {&(0x7f0000000c00)="c996bb1730a50b37d4fd1385f6a7ce1c28d416ff34d41756864552863ae4904a55b956d048717a3181d9f620239916d19ee3753d21af567f7a3fdcaae77252593dff85fb99cac8775c38b23a9c38082a0a721f58c89606ee63fc8fea99ca79ae8620ae7946c4a2c1d92bb7199e64590c0975b8010d1be554b5c5a9930d8fa45b3b128635303d11ba257c74a4ee1b2aa475c99f391dfd6a38914be058504a5fa9f9df1944e6617d56a7e9d13379382b90f72c736e9d06abd79d525d0103f155d69134bed49ccc3cabdd542c6d822a91c6d132463f51df7718d7d7e46acf6cb6e21e5355431e857552e83acb2f2d2ce57d1dd888bd97e93607e6364b95704971a2f01db7e95987b547070c7cd6bb87a73d7f67922e4be44c5d289d3e5eb57a5bd820d190b34204805ac45fd07a3b18de62c850256c46898f92b18d6366070206dda1d76ae8bdc58c0e988b4b4e10505241b61fe1bbfb945c4ff0b237a1289bffdee7bfa7d34a7996bb90d3c644923bc42e15d9c9e74368682e3810e9bfe69df3fe942bd90d2c825d4ea96313e4e739d3ca7a8ca7df7f8068bd1e69dd34f200b0cb0770281a65819d9fe121dbf6dcc03f19a2df62c00cd2e72c67f912580d870d8db5829c0a7c33e3093b715992d099f7de74bc4b902db284c09e772f4b8bf58552b8319f248ed25ee26446dfc02d2c4a88a4d757a1ab8064b373ba7685f0db4cd6aa042599ad95d1877136b0ec405b52f4d4f361f5cf006fdc20935458cee91b23d7a071a71e619c420d143d31545a99f6d4ba60a3948898328c55f3f6b9262bc4ae6fa5404866d91a59ea4a73501a555e88c40a1560b0b937a0246a19343d631cd87136126007cb314d04372e49f6b727b3febfdca761cf1c01e25a012822851ae76ba91259be9aea072e300c59fd6f91e20a69fbbd8202d88d850dfb573a9210caff8741a947f8c5f5d0a37a6cfb2abb3e26c9f1b16b6f009c710c74c1556ec6395059a985ae94c0571f13b1bc669416026d83aa25628898cee404672174f533f1faf27ccd3e6caa3d121c1d67b59afa1b576bbc21f80bef2d459f2f0b8cd64368bd1c3e0228d60b9d44edf0be1b6b44021e72c29f596d6edacf38b3dd9631e32893c8fec20cab4c304d00d78260afed561ddfc286967a741af27f0c9d0b3db74a2afe7f2909db816d578420239fa3489d372c3c2a7e6dbf50a57fbbbdc2bd467b40ae649d16f7c0441dfb26a1db7ae2846aa082f7ad64f3ce8b62eda8a4cfd7f943b102e128bc937cd25d951a07854e6a0dd7ef9ce8514c776b95380f5fdb11684cf226c149919a63d9d41d4ba97c4830acba83d60697e9772d72cc156cd9127ae5f9136a4726ffd462b59eb08584849f03389d12eeddccd041def94eaf652942dc7baf2c83b031fbe2c8eba0f43f6fc098d971fc36fb8a131a470f1d1881a16b4372d13dbf98ed11083c7cf04aa57823ca7e2811ea543e05af9dfa77cba921c69f28eff68362a8df3461094cd574a6a07423f5b047cd4ac45f988bcc07b2681ff5426d95e578debbf9b2ac39e894e18fa1cba9ff8dbd4f3be3dd74fc6f764e4dc2d0dad2fb06dff60192c01610b69239dd367e640cf218539875c90fbcfe5183f512bee494f072080bbdb747419aa3925ae7458a7a5b49e96fc816bc45cc34bd0f4e20557503ab36c2dee55264bd63d6736252d77a8132bfcef2085bafc654ba66be1b8ba237e4edaf5bbbc3cd948c103ac2a175396328e22f64dec1369f6bef4815925bacd8e5fb014e38f7be414733abd838322e5b3eb709dd1f263305096f47da83b9f4fbf15bb795b40a48d3bfc83435233cadc0355e1d7dfdd15e11dfc97c7403d6a5aaac5d18605a610ce2ab8e4a494e517e1b318ce39b827e420965a192f1f1341cf10a5ce17dff416602cdbf8bb16366a1d4a5235b29bd380f2bfc9fabe0ced2d6995a9429d49b9068b4786cbf8570333f6ae1ae2fb4705648f3df2502dcf88a10592365546ff829beaa546f62b798545e090a6487185bc384f9e4ce91d9104f66fbc8a16e90ecb6608e696be94c789ec3355451b67d9ca710aa39a484d7ff69cf3ac54fbaf493e3d6914abf5be9b6c9ef960670509c045f92a58ed0c23ca4ca32cddffa3fc47ee646840a79c738b27badf84f5090395d98d2cfa99425d29982c3c9bf178b2729c9a27c35b529cbb08950de731ecd83aa20e45a4da5c2489f6a63ad959814bb2e8256e2b0e2021986f2b4717aed3c12af0ac73524880af976d101b0171455cf3c77bdb1c9fe7b04ee2830a60525a4f09a17c2086d11315cef23ff8ee5ae5fd71908de884fc71ed4f1b826149e0a31244b6739897a1895af7bf396e849160f380146cbee945449f78c3f585a1e83fedf3c00dc26c94ab1d04c7ecc3dc40416345143576689869a3ad89e0db537ac7fe38c5c2cafdb2c3bc41f74a5a32b55e37694ad5ea2e417da033c0c5be88e5ec5830350e228143fd119cd4bb9629e122d08e345fa3638e8b708c61e257cb64fc25681c3b27b411ac7e78e277e582f112f768cc15536a61df778aa1303f6888d099483d890f7379c74455652c134cb227a894778b5706b886763bed9ce8b8fc4fcf37c6522c2d2f9f8947533ca996d7c3c740a6d4b0e68d061422ca52c406721f174f5707dc62011d9febde3242102bdba58fbe3ea81d0a24755989ce434ed022c5da97719be51cb3b22ab9663d371b76a8c865849e518c462e300fa0fc7752db192b7444f319027453a2ba83162b7ff00fd21a202aae654fc1537ee5272611f2dd46c616f53063567680cae37684960801b73f410a51b9bb1abf75fdf86515b0a53cddda13ec8e6f3d38e4d657f4de2cdbdadc2fa379777f76a6e2c54c4c6262a88cb683fdf04c9c1c8582d1aee1d24dfaf0de2521ce62b674086515cd3a9e58fcb1e9c6c8fdb2af4f7e1794ec94642819d78596adab692852a0f46e8c7a41bbe7ee9d91d43412ec40b2ef0a6ad85ce897ad9c3e92c3b9932aa10222c19e9fdb5990cdc3df5a38ea2fac5f06eec57f3481b3e98ecb37c4adc89870dc19740d0416579df3e382692ebe7c0fb4979cc01be5be0ff5acaa054e5c2145f08ddc1aeca1a974d8d6d6d22bed9b402aa26dbcafcee0974f618300b2b33635b4f37885bef9b15e3aa70bc18b0eb39377c3821c1f646dc4be9be1a2409582133c2d6727b85cc82ac7e8abeb04a2d9e8d47289c61940c9a99cb359211de7f12e6a783024cc209be8ae9c381494744e83b6918c8dd5a7ccc22cec9659e04996665e3519b9c076b0b39912d4822ef86b52bf588298d5b24787c3f50a7b52d31033d61dc270bc685ed5a817e1a88ac5376c9a987d9d224a2c4e30f552bf8378b2a546d5dfd48250b3e8c3e2b460381c0d28f7b5b2b1873425b6213e3139a064d0ec9e6f6796187cbf3ce8f234ff09033dc48428cbaba5988dd2e50a9c08ef6a9c08e87d93dc9f53bc002c12cc499e95af5def8755afd23d488e35cf63ece65ea7ee1421248cd3ff25e863b16290909e916877d51f442b4ea7e00657b13036e49881d6b693b4d1e9fbdf6093b8a5647b5ef8406348ddd080b24cb91974f20944b27ad55bc554ef44b50e9ca5b5dd84c092844485f82034ae3acc134cf177d5f7f323aaeca38f5b2c7de3c76d4fecc0711489dcd2cb21bb87a601bdfadc8facde7e594b247e333e0290119bb07379b88bb7e69bcafbef5c97447e79119f512f31a7fca8d70ae045bef0a04c2141fecc08fb844428a81dcf732ed90a82457ad4407122e622540bbe492dfc7f2ee0e0792e7c65c922c39fbfeff255ea946b5d51b9f7ac510e7a879394361fb7191d8859a249a673b0ca8c644cffeaa2efcc6f643f97d21f8e273109630b1c5d9ff85e1c92bdbeccd9a0590e87d8a4a3ab761069391f7d81fbd2136a72dcabc398b0dfeea2e45d296386bf9a9fe9f18c0aa8f70185b14f762c7e357f79f58b239ffba0ef9484dd1d43187523dfdc04601fb66880caf65777bd1ba729e5fc65731f1e8c86998b6af73cf8b2e3b8e13c7fb91f9082529440b7340a837e73a27dfa59d5e13276c752dbd4fa977407ac2cd4f4d18151b9ba226ecbffb80ff87ff30ab13633d57db56e9e2564e08802712d8cd28b2238627f59b95dd278948026c7fbef1464734fa3307b78bb29cdf5d0e1e189aa43c3995252839ba380080eb5aa7dcc4cf61299168234ce9bacc1bfd2671509d890f10c47907c43955cdd1825b3cd6750047b61688f97d24fae752f193c4a9ec9a8b2ed8f4c1e347fb8d5cdc4c1a6e89a7f23a6fd93964da787bbe855b1a66fa1a04a8abbcccabd302613469006045854478cb0e3a0d6dbcc4062b7f82b4a977ce20f9772a90e31cfec7449c84fb5d2b0570712337e2c970136e5d1c602bd244f45611f1b52218ae1da9cef9841d0386e740be14ae4b40011db0420c06b976f5bdf25e4e1acbea139e9dc291648d29ac25641f43e0eb856fc24563ab483400c390c2bd891604b31a4b00d05e6488adccf5ba34cfc4c3c847f9df04a91e4b2c87ec142e1a8fe64e9abf93c5e076c9264f352df7b7fee1d7f7af0174c8d3ecc0d2d6c27ca85bf593faed15bc2602e9856f8a4a9ec908bb9246154d00bf1304612d23444fc845eb1ebddfdf7931b886b3b7f42c73f43587ee1c43f98d823af561235fc391b534e9210d53b2be2080cdab3e7fb4294212f8d9539a463033132f5d0b7b8872493032efe1cc5b37dc455bb42e58974bd464f82ae9ade744cee6beb3bf31980168fb57a0eba6bb9c27d999b7e043df8456c34b5b84a7c6a86d1245c792f6ff9cd20c1013235815509abf3fb83003b73aab20effc7165db9b82d865889035321485bb5bbc40e260a52a027a25e98bf95a733889d43f49878ee3265f19a7d51ae378db3803717fe11a2b88c3e88b9a1381a4474c35f711000d87aec6173e6550c99adeeba1d378ae8973f97fff240f2e9ed3923e4ce1036e3dceffcf113893117194649e99bad05d4f6c3fd2f6a874573f83d0fc77d059bf3c8850d12058f32dc2981c6e41261cc4e5e72917ba30858854f9d881d3dbd96fb0e592d16a354e8f78a24ad7312e216cc98b70e9a55e53329efa42ad56eac91f4ccaa1ee484fba87703f95474026770ac491e855485bb16c08dba25f3119676440f7423f93d2e5eb8a40226f1f5de5dc30a8ce57cb0b0bc20dd6e07acdd82a8495d34f68b78650fc2f653c040cfb38a9771f7e35918e00a7554c6785cccfae3f7d0556d5bf193f9dea0f965137f1e91881130029e501e7932f92c41b392122c1ed20e5feb9a67df8629c6f3160d495d4917214d7723da38594a985635b6419dc5ad2a8f9428fe6ccb7b4d7455998e2d3cda157ad9c06f3c7e036572de6939ad4066eb76c59e2bda371ce6a1e9636631e9fb35276215585ebe5c17af466f028918cb9d3e9e991f20231afef6c7bc1f19595b2ce1741f47fec58815edd1e467b212bdd90d117c8a2a3fbe3e5606a36ca4350055055a63c7c2d7ba6c68464831f048cff864978a81e43213cc5c46d84cb2685c0c5ed7e13860e2e9d39fcc3baa4150f43d82b6346937d0b3e08d05c9a336161da2f0497101e9bd0945d67eeb9e27d785ede31f5c226011050a30870728a4b67569f0eb602f8c4f3ae5bf1d6dfb891859359c8bcdc0183663ba2d73f9236725cad5f9d2fbc5eb8a4838c6ba3c5af305769d89d67a86fb80a4f0541a33dc4be065d4ccde3ce894140f03eac85a21f71b7f30170547221d640bb6f5a9f6574b4008f329ff7f3f6", 0x1000}, {&(0x7f0000001c00)="1a9f16a83771a64d7969b586a64e85c3ac1cc7df9fb1058538d20df9bf90d5c3ed3b4e7f2f2e649582e050d405f181bd1ff897eea4cb8d6baf867a8b20e227cbdf5d30c4f506cba0d670ad9a693ec6981408aa804705ebb516417afe30723cfabd98a046f37b0b17912f22cca2feb079746a2be4266da17f2d7d89b77932784deb5fbb25b9802b02c9775351978edb66db9d8d65c4a70f60b3278da72f2eddb2b0d422d8d7cb42a99632e09bee8305161e7b4fbbbbe83953eb24d4c89e0f5a46b570af6916cb46ab15172480b88d1de0889866dc6f2750d69f692c674fc40472d4d110527d42c45d320be7226b7451d742769e6ebaa184b71de7723c05506804d6a87bc12662d4e58eeb4674ec58dcb7ea7b74ab7dc9e3bb24eca7590c3af80b270780e0bbf983ad7f7a62f4c67645ac0947d43052fdd0bb421ee7439be628d8eb068b31c3ab3944d70869372f91b091ea759393e295b91e16f7c632854fff408c7bf9d211d4bebf9f00d26d0062222c66395991dc892eda2fd224a2b9fb7f0e5693b1a606524a315144452c5a74155ead559585680a857c576fb3cf7f1234a2ea3f21ad6950a695aa2ccfabea506ba2771d58edfe5d8b0797144566a91d203e12e135f3d1cb2c117f4e6b6845a94d6317120ae3cb77a575b0ad27421c89217b477652495ae7862f07952c52695f14a77a45449b9de599636be90ee0e75e22acc8185556ff4035de80dac373c06c8b0bdb163ab234820f3483bda7a42c90dc68238e4023dcd432bb598c941611168afd4cca45459fc256d07a6248eb35076783598eeaf4a10af1d12c96910819dca197338a6b00e5c43b6be4cefc5f77774bcb31011ecb0489e23388cb7e6d810b13ac5c535b9884165af691adf991fed5250f68b5b989c0401eb0ba7fa72a933ab99f06ed82567293bdfab8ccd0650e823ff4bbdd1a8a8b34aa5cec05091d0e45ab49aa95c069b25506bdd6252b001e264a293a17644c690a741d37b9e0e8655a9795a93dc55b61724b598f0905e49abef738c2d237c463f7796fec03ffbed1f7effd19d5db16f069483956953c5b814612c47b9c1e1b66e08f2f964c84fd63ec75402718d3113f3894200354a262821ab3417c8b80507d7a2e254ca73e603149716400896baf4b2caad22485f3e3db16885fcf5d1cc287632089dc6185b35f86dea9f9f7fca59526c10eb99ed2975882e0783faf4c9262baaac9572a42e8b8532e3646a5ad9b94e84407202f248aa77a163ab4dd34179208c4da71f4a1c00843822f573ce60c8690fc60cfa1c24310bb12a5a5921f4501acd894022104fff7be132a6a4f71fc1f4552c154b3378f6d0d8637c5a467d13e7114a5bda8922b624053b16394a841d598e4a3f05b5b99e4e469ed285ae4ccaeaca49d9ed4356059af1ca48e5857a0cee973d1dfa0d37ed1069ad93d3a82456797fff366264026abede889e2d48a1d78f2e82643dcb22e1b832a87225d0ca4dd6b4a136e6ebce80ccf7dca54876e4bc823f0dfd273e95aea53c4b9da53d3c596d15bb26851d85c43efbd03a513f9baa820c78b72eb426c128233a7c14f4dfbe5ca0541e87c119203e48ebc8e7a61801572ef2d87ffce6e7994bb51c486c98970c7a39d94b44536a032776304f922d3d9e8d83e3cbadfd7c76fc7dcbe41308816776228f760a9dc1fb252462f119205093c18bd62ff817b76428a442b891a75860279da8dd220b99b80bae38b203cece89868a652b73a90018850bb661c1d6982f4489f229786efd49d8470dbaab057606ba65d696e3a44e299a4d782a8e3e3d4794660d6e8bee1c47c50456ffda4359a6d54d61891265e4df61623a04621f427ed101fe024c41789b218d4c5e8b86d1728c5da1c745356a60307409c8b4bd1434292dde2d132bb52d951dd8eb66ac32fdf0bb148a4ac59a355b4399fc32f5f9a374f5dd7f6e9a55887c25abf95608d347aeb08968bde94adb7260a470fcbdffb44983bd4c56000b8eaf8bcdb2f3614b51b99c8238798204c299147c021bca937f971b4a0c26d3e5da519c1d3bae6c6afd7861bc7caf7025fff2a92f57ca4f5bfb3066fe8a5e839cea478d0e9d824ae5dcb0a9909b25dc833b2ba6ec0bf37cef4ac72d99af47742d484b8a7f84d28a4f97e551841e5da96abe7432a02fbf0b2033800a97e6d6d3203f6c30f26f3a50329273a9a130e782cef4ab415e9d6cfe2a7af12127fabbd889fa0a77ab74987f78c0c91007b3cbea9fcf2a0412eaab4671abbc663ae52d4ad06c2a79598f42b19bbb613717eb65004c1ecb38e1811fbd15b2ed271d888cb58478bde960e2ae0a852825d93398a250428830fe4b8cb3a3ef87f8d59775273ea632a817a91b65a9302eb236baebe1f4a547da4d30faef5cde510cd0219fbe4db100a2c375ab9dc64c9fe85e4a0e22f80c0904cda1021b6cc90b4196f98d85cfbe7edbcb90c57fdb967aee18d6eb61361cd8af63d57b261947501689e4e4fe8fefaab15bf68e29311b7cdebaf9379cb3eb19b6076e829d53e1c5ca64c78ebc1fa48fd2d723b9500faef1bf662a9ffe9e3758d3aef9841692b05a201c76d34c814acaa2e3f3626c3b77a0f5565c9b93bbf11ef5c0d96d5b209ebd5acb498012b924781627cebdf0114d2c0192fd1e996b746ab9a2a3d7bd700930117ea5a3c9814801131228bbc47963eaf05ea03fee7184e5daf7fdd2f1e089562a23eb8fea2aeb74157d5cc71395167be59aacecba919ee6a6b1e06dd889dd595c9063ce1797123a55a3289797224acf1c215a6c6558830c544cbfa8a19769b195b5ddb8987880783eb0c6f71aeeb467cbdb0fa776c0ab20df803c8d736f8fe00e9b652ceb7cc4cc647d16d8dc717b00fca8c26e77035278cf3d5e1248cca0b29828b7201b829e4ca5c3330cfef8416a2786d1670ed20f9738f23efdf8abfaef58bde089139b888ee5d24c7bcefc7f6103c0b79cbfcfcc66718efff6ef5b864ede8f05a41fb0f43c996555bbf79ac8740eded997398d6798aab6577dc92044dd26a989d3f1b99ad09bac11de27f0027cd9c2af9d368885f35261bf95a9eee4651c28496c08787b9f5d866c86426ab1426621d7a76a79ea15782867f81d8530d2d2208fca278b0dc9600031331f74354e90747bd8de53a5ed7347344854bce537f629a9e711f9c140f5b52f6db326bf9f9ad95e7008db00b1668a3d8a9afa76bd3d534036e62d03434888ab9236a38e4216b987472190c49f0995780625bad287d11e3870ac2813f53c34d8fbd8956c8900d226ea18179b931a56d55e79b803830121146736bd50eb52d9c7aec99f26e8f83fa951cf306427e2bb5d7295165c85faf8b5b62c9f7a8dc2781d29280ad854f9d7c692580adaba43f7f7e30fd95082e8d65d85a6de1d4a7fde7fa77d681204335139886229026e8f85302870d84a32995095fc1e815328d755d41bd1219fd9bb68c3ed17f987616036e3c7a6d1280c1dafa1fa609ee2003d36e658095ab14265cf4f1935abe5b76c03e7fea328a446bd3618455a1654b8ffabf2f8b1c897d596a6599868a6dfac38e388214e4c8ce9b37659389af44f163ec351411fb1665c57ea300ac87503b9f528e6742c140ceae28a779eee33db2a42323d1f387089eeb93b8aadd92f346831fbed8a834246f24eee8abf62989fca53d15de03d3e1fcf6e00d88b37d1ee207b9f573b0e597f25845d5c94de83fcc8a5098429e40017492ebd572cc97f0839bb209a65e5d8bd607db0f7e224e647808d8704e6db51438819ca4d6c67b665464caecc685378477ac213ea4d13eab7e840cc010f14e0495e0350fd45cbeae7d4b7c74cb37757607e68b10cd3ae1c3620d6b5e2db626f5526dae746db87d8378cb694b4af885e27e7ebef9330d2c07c81637de20feeb5958e196cd35ecde009b72abf41ace7a62db40dd0026200d4363d22a569da9c0f8ee30b8b2db3a28509c74ea6bb6ed65084387cd7b46785d63e63ba365c05f851629d5f5e5355e284114e61767a81cc1db8700863229c979a603a2d615990a142d1e1cbad5e939a635a0654916bf8daa3eb5d22ae37beb83b2526b917319dee9cab95df0ba47e259312f66e1d0fb9e4b687f867673e0354dd64446e941c62fb4251ce42949b0ff9b08961d752d58eaeeee444b92e318429c891c810045d86077a514faa7b65a98d78129aa39e3e961571763446b91719d53668ba4cc4e074be4fac6a463f5364ee78d68a18ce98f2b4b2f24e0d387cedb99512a75b264c22079a626b3925680569d53efc16939652e838f83edeaf58e1d02108e10d0edb12ce877fe92cc1bd1a5b98459674066d10bbb40bac92bd858e529485470e24fec4c98792fa07cbf0ea037b9daa6792350f2e9ca81fd37793ad6c474d10fa646f3c5a63f34f1661fb9b337736a91da582a7dd2e2c856824d5f987e98988c9b5e27baa4100333752b90023bbf52a5f9f9b5da1fb778e1056aa82b1f0cd55389b2c483a6ea53133e21507329945a6405c1eafb54244a0acdd540d98898aed43353312bcbeae425581b9695607e91d67774f5bef76afd59d0710342d7a40b79437c822a63ccaa4f19dd5d098ed6013dad72ad64d7bb01a1b3e11785b35f954112db57443f84b1c084aa4e4a42edb6f56179e9faa5f15347f13727be011cd8fb81792bb432186fb8fcbf514dcc7f5b0b849c2426a2ef5e8aa39955b3691c91c4c66e1cf8000eae683d9990d668a114bdbb2c47712e16f8ee9aafcc3aa8ffcf11859a223c4c41ab17ca6c6618d75fe77d03c0156d27817f12f18c40c7f79b4694e87802eb76c11381085e8888e81a0d82f7514b8dc3e898d1aebca3ed6622faf60bb9593bf0498c6ec63ac9d16d34f3ecbb32ce855f2dead94668ebca1a2c3630799eccfe28724104e0b60ee70e29fdf8eaf2e1db6981bc0f09d3061a48b2ea234a9053df89b1c7ee1318535d73070bec4a3f1ace92e35221c2fa13abe0d31dea7f74a1628af39f2beb64e1b38e497d0a6f6ac5463284d043a49cecead35e6fb73a3ad9609fb9ecfafe4bcfff3f2bc611df6bdb82cb965ddb496e5da5b35724285a8be709206993c17fd9e73d40d1be1eae5599682825ee82f00c7429289317c6217e4dc11854ca8a441a056a8e97c0384beac8a5cccf2f960d598a69296670b76ab4ecfde525134b2ec332f94b500287faba83bd2c308b3e596143b2d03c8befd2e39de407f3881490bd5cdaa740c974195bac42057246c4e701118d453f449933aef775c5941f51f9001c233e84be1189a41c9ee0f0c8c3523f4e8d7fa7b5985612ad85ec6db5323a9ad642d99b57e31cff6b73960192cd58bb447369495a959e0ec2c0b8e6f79142136d3c403a3722ac696ff586d4fd6c012c3d6a4b3c1db15da095913017aa285f3b324c696435e72c30f9d1ca9d12bc6b018ea6a44aa40a8d62953f4f76e577b8a777ec7cb595d19a07f0bfc4220b47a3975e9a9dd512d0f9069ad9edd9e6732d3e56b617de88783f0b79f2b36b9cbcc16cd80787669341b2779ffbbe3b872b555fa657e88571f4538fdb8fec44b0b6e584779b16dc15c9f517b384ccda99c9d8ea37ab53e4f9471c1a55ccfaffe122c35df704da76524e0e3c98f884b18a11314e1ae9ed2dbc475a481c1ff644a611de39c713be8418a7898b8f9360f472d121dbc737a88d29aceaa29f716d843e64efdd883d64d491639d763b5cbc23705907218cb1a85d3515c76d9422eea3c03ef92edd8769766bb1c178689768c7d9dd2310134c93483407a33f", 0x1000}, {&(0x7f0000002c00)="ed26b3fc65557bff53877f77800f8282928b26", 0x13}, {&(0x7f0000002c40)="01aeaf36ef49a8302822a197a871cc5358bf9aa015463c697ab2644ef6ab844aede41be0813abf4ccd5ebd1d8a1019292a158795c3b3196c18ac9f669a08916c18324e7773ac8dfa6a911c16d19ab30459af0cadcb803b98fbf980052f90cd", 0x5f}, {&(0x7f0000002cc0)="d4fac41e8f7fdba9bb5d89d54d145f3e6aab1bc66adc6d21c48a253dc9c7869c9aaf9e39d7e264c7b347976abbb7434f5de427fc474601450a90d5d410331264c10b13610c48bbc4ec32cb32658d9873337dfc908886a764f699ce214cb82f7e2e49abbe49b841ce03e8585a19", 0x6d}, {&(0x7f0000002d40)="ecf669c4bfe259b70df5b93e15511c0c2788f455de174988318b2b1d719d93f348e18b1a51c4686cc920604dd3a72f165737a47fe3f3a683155fe4e21933c94a0944d5fd0c68e90e1a32dabbdf089392f6bd4c7eb532f04eb0d05022e9ee952901cc3e22d0517de408e57cc54266928f4b6ec2f4aceb37b6be5bd29c96371062d75805d542cc49e17793cf79129f810f44de47d370fa5d1e04c8a9c7ef685f8d80a4f4cbb9696cb58f2e8ac82c042b3ec7e3eb263f5d8fd9be804c9216d14fec2fdc6115d8d3a1a04fdf9df71112a0c8c05238b6d7d73345f5c075594cac49ef7a8a012a149115965db50bb66a10e07d", 0xf0}, {&(0x7f0000002e40)="17e55580a645185d2b195192a5d07d58e757413cf2591419a675029dffad3451b2e0ded99d5e1ed3f205290fa025ce117fe571783dfa02ad06e5a845201df4cb2dbac232edaa2d0f3ed5100c04a7bad41aba40afcaf36e67066fcbdc26801e0c43912e578ccf582c0899677109fda77ec4e74d9ab8288ef460363681de5e096f7d9ecf656b0abce2e21bbd65e617cae642042e6dc942e53092fb", 0x9a}], 0x8, &(0x7f0000003140)=[@cred={{0x1c, 0x1, 0x2, {r22, r24, r25}}}, @cred={{0x1c, 0x1, 0x2, {r0, r27, r28}}}], 0x40, 0x40000000}, {&(0x7f0000003180)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000003240)=[{&(0x7f0000003200)="16758fc0568fa14d6dc5fc33d2c76995c30bed5f61d0ecc38914905696f971", 0x1f}], 0x1, 0x0, 0x0, 0x448c4}, {&(0x7f0000003280)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000004580)=[{&(0x7f0000003300)="e38e5c83180d69a1884ec92373c58bcbbbe64e0951cb4184b7ad11959439f9aaee0ecd59d3fad487e665adcacfda6103b813a852fa4fe95a31ae4c29aa715169622eec5077260a4c", 0x48}, {&(0x7f0000003380)="7eda73574216ba61ffc822cb3b998b2b", 0x10}, {&(0x7f00000033c0)="a15d7a77b63f4cca1018538b930b8276dcd4471897df145fdd69d67935342899c11a3d8a1323cad3d7272bd6b8856fd9b3d13a3fa5399c603aec0383399da5a0cd5f974bbe8cc1d9d8cfde086dbe86bfc7a3495b96a7bd34537c4290b337dd692e7c87f6933554135900b45811d98ebc91d550c76f40da0a92ef17d270753de1c0b58f540554c6e1c743669302c2b86dfa05dbed39ca8af5440f3004162e3a1f6583a04d07dc0ceec697c585ba490661fb084eb5a10db52795d72c1450", 0xbd}, {&(0x7f0000003480)="ccdba33d1d13a681a7149a1bb31da6184abf590cd57e507f914cf6887ea8b4d57d0eb1740cdfb5fb280f3dfacffa79de22638ae4270d1ac8bcb586acd957b3780bbae9e41d553d3c6db5778bbbb47727869b58e6da41a67d64da6077de93b343b5f5d06ae27337fcd16c6678a878c144279e1b1e18a2fa6d1d86966d57329999724af0bb58b4dfc583b2b808d95c0af0abf3da7950cddc9b507d5f8ecb2073bd4ef04b67b472e4873fd0e3c3650aadc2f9b6729f6e46bb4a7349411fd5e13adbcd84038fbeec3e8cec8a1e1850696dd2d3b0d18cee306c44d68f084085c416bbb619c2ee46355eaa0bb99ff15ba6cf888c2a7fd41fcf45a2b1d28424e68b36caeb0f98a54c9a7fbb1b3cdba561c5c7e371beabed4581f3f23ae62f730ce061ee0d0bc3532c46dee4b7b3557212c4bc17ac77e93ba52950619b1c2fec7e84c1f42706f1e7683f1a836a44044fd04d1d3e43c6a037ed6e207fc12463882150ee71d175aa2540ad3c7a054a3f0d42ad6e14476e0879bdddc32157031ab3a153ea13ad8acd086f90c905bac38da6ec31a5f1dc890551ba20d6aa001c3ee4c8ae19ab4e256b91b89d98edb4a409f2994e974f919609e247c8d2c1f1164a18f88ea46fdc374185c3381992729f1ffaa445bbeead07c4a8c95a4d7878ef0d58b6f50a3a326afb8f18af094413b49775fe0c83de5f007559950369b1274d495328380ffd041421130a74e39fa2662a95fd7547c89f3bd608e626a511ab320f4b1b9ea787990113b1420b62bb35a0793135c44d5cf4e8f8fd1eb63b22f4e7b86ca04de3229b4dc4f118b21716f960a2ea3585e5bcfc76bc93f41d67af5b975854313e94ea1ae703be4a94f0c8945b4016a6c86938302b8280a3902dcec6fcd2beb6f683eb23f8e2155872d9ec3095fee9ad1b320d76386ff415895885ba407067fe9faab1abc66d22a7f85d436078a8f9993fd5a047a70c45d25f1bfcc8141ce7864d914d456201eb567ec5a42d588ef391bad2cc0ef8555a28bea63619090c772c3ede2d399dc21c5da91fd02b31f7e6b5c0e6b52e0de44b5cf54b5ac27242629672c9d2cfaa682acc7a8ba9820a11af5ed6fa09b476b38f59c5be56e8e48500773851144da2cb95f524b2919bca4b5fb588717a376a8d01e1ae50394a3de0fef54c7f0476b6d73e327c6147dc93d913126fd5704d1b21e3c05e54c9e97d8488756c4fd0cc951b082d73d982ec363cba1af82206a9c5d549403e862aaec3ce4df708b77643f47faec68275e4821b6ee582730e2f620c34883ea8d474095f817c6e6f0f5914681fd834300dc3c9be9040b41bdeed774cfd5b91c8771e68c401ca4987b0a715f2cc4cf20fd9214607225e95f462d8bb4ddbbec91a9f1da7470b30477ccd8057dc01c4eaf1c360faa6aff8a9d230bbb73eef7d3d33541fec6a16c095cf6c35db999e9de9f4e3ffffcb65dcb12dc25b68d88daff39e3b7dc0cd230a3d0246d740f5fc77c8735831f508df2a453226fe1c114b95ef429d2b80a8230255bfc3a3e532faa6b0ebf363ede1b3df0a792ade04eb106d429c2e889526e7024b226dd9846e2e2c57a3fdf730131382febd34ee0ca39e012ed28485b5fb825858c180bc07bc761754a3fabccb28f404114564ab5e3cf19d6502a569cc3a870e326695a97d27fd4c3b56bfcdd5ab49b701532b0ccfd0fb14f59be0695a2213c17f4806f8d57b0b48ef82900b7aa9daa792b3c0e0d2987270dc20de9f1d19c6d95418e085d19e623431a207d0b2a631b94b798a44b9c6d1174e43777ea16a0dae985383dc81246197759a77b5979464afff6b6fb4dce7de71fc04f1ab141bb2ec29437b07bd6ac3e32eb84269d64ec1b4c410cf54cf954f25356ea9713a027f0c6924605f9cdf2da83e0f12c95c788fd8c23c75f1b1c97e569cfc45b5d630444952d44bf9896d16dce7ce46b093a7d545d8462b215038fe87f116fae6dcb5148bbb4fd18290d7389326e163204f005b37e1ca3cb72694be57c6a4dc45faab26ea51914ada61357b2419c64a81fda54d9a7e07d6e2c49f0abeab8f1fa84b5934bf235124f7a1ebd82888cf1ecd9f97dc2dbaa24eafbeabc44b8775ac3ece49f7d2af492904d4514639f3520460bb8bfe494c624842910526a1dd0617102f33229f295ad39eacd89f05475c06403c31abc1c97641fb287f7ff25fecb9e079985eae36af1285a6a934d181d52537b3377947e08c1c365599288cfeced6eab0e17e083092912630d05a3917f9cfa417eafb28de9ae0179e8c5c6adc932eff34723825a72f71518b4f66674b7ffb45803c0cf577142fb4d1161c097b224b067db6b113471e1d6b164cafc6fa4947efeebbe05abde24eee93dc6c28d5c30ce4c87203b0f6a46e22ea203b6e43b908ca26ad8b31637b704fc672a3bdc0474fdfa7e4a798bdebe05b51f2cb6261a88750bc5fdc327c583f309a40ed07fb0c54d3c822ef35ef3a5e566b34c319ee81327866c34e081814f48740c6efab3b98bcd09a439a30afe20bc5698f5261f89dd3ecbc79ea24f35466a36fa8ed94a028c5606350f32b0ad06f167634c76f74eff834895440f161f690e51d191a10f15f7543517910ce5fc011edd4b8ce5a2f059e8890e29bca82bbd64aed01e8a97c8e77700f2598937c6276613cff23d1055348c6949821389017e44d396ac0636c3c2a0f6033283639f21ced1e95fa4bc2bd8c21553f6a75231773ed016671e434a4ba81f16ec84a7e1e42ebcdc084ab37e88d685d584bc5ed6c961fec6977d76b896fdffa6bf6dd06ae75f9bcdc4e8a8c06f8e2867d297fdee80d31934f7abc785b8f6306d0ea97824edad008d3d313e85e2da3d42459d0ff2cf285ea298c89becbc62c248dad9f9a62ee56bdbcea0972851ab975e8de183786c5d064744dfdf118461f45f0380e75174c088e47d07564bff565f7407daece597f2dc13b7f4ee5212ec67e8026f03b8afb653764520d63f6bf30ce50c35d30a803a3f2fb5aab604616cebcb382c424565982238c072f0582cfb3a2bbe7620abd5d9fe0bcf283bebe34c15ff34758e8a39c8af76d3c42389274de46da7b09c3552871874722f81998a83d03d4479b07b53da3be5ca088dd0448d26bec97a7e45e36e078292b613e66e7c1db967df2f55ebd216e53d0c35766ceef1b07616ef236634710d8e6caadd80c76993790719efc54247d43157406c04b7e1fe62aa87ad13c6dac74fba9d7f443f516d7d550756d4edda62698cf43c795edd9afbf101b0bb1b4c8607aab51c265c29e1c809b0318e116c230d7aea57968037f2123b466b548e7487b4fcb82b892be87e7756de92dafea6284546ecf17999589cc893f042f123c2b26108da61fc65a736980723f3c6d6d32445d52493432d247a6d775198bf9c82b1021a858cbe3320496e6f23279d4d4d3a82b6673b6f2be15a0e4a94f7889baa3117e2da1add5c65857a8dbcad442fd2a55a152feb821381f9f9eca56deff2aa5a6051c17557457f8038013095bc072df9cfa30b5862d7c5afcce0d0adaacf68c2fb63d0082762e23433e9a600e2382dd0a24a88839fa62b504adb48911e9568aef274a19c1413dece831a9c7bcbd092e311f3292655da04e629dc2bc0b8c3a461efe0358b2a68f59d08dc6bf91056d9117eb06b249a4eb3fc89c5f83114975663ced4f0a35dd6ed36ab9a502418550ba1c8f372aaf5c67e2e1b87599dbb29a13ef0e13399643be23376c24a1f386d0f8152f8313c1d83c425181b8f8050cd2e17f414f6a8f5478c280b54d8d66938810fb8685674d30db728244b54bb1a7950f52f61088a17d703f3c901f344adec01ff61fe12360dda4161bb4d983cd7835f9840102981486ddeca164c220b06023b7add60b9fe6091712df668ad167faa02ed21fb9eee9488c6fa255b7b1a764a364c871eed07460bd089e4c01f0897fabc9ff033d413076fd36fca0b569c6b5a8b22a78054e6193ad29848f1608fd9d353259925e997a263837cb5593207a2dfb8d17e1556a26a2c197ba3e7ffc23d9154677e298debfbf3e23cf3a3b5cd835c7b87cb1f31056b3fd55fe1233773faf31c5b6c6672c6da5733fb7312ee2e7b859c0acbf52dace831d6de348883053a84f3072c1804578837759c2ec85d1da1ccf02b82ee7c9d392d39ae5351c02d54ddc045fc7083dfa0cb8c2e8ef2de2fa9b0a1a63c0c6282237073dc97c954f468609e72f84c600eaba510d968df415f03aaa7a57d64b36cae6ce84c3177e4d19798c34d8552ed683180dadf9d19804a53bce485a39926fe1a75e2d534ba4303a6108b5e2f5139ca63ab814b07916d63386aa016b5101f66269969dd4c7f69369f15b4eb8478f5ac3b98cb1aa979972c86f7cd22d8948e4c6f6813506d95f6dcd70b92b4354e1d7e055c505d5559f8d20a5b6206a206ad2d8217442d083c34d462ebfb7e0c6cbb45293a0e586a8d9f03448dd63e4e958cc890ef3d5dd79ee3a6f22ff77beaf1704805edceefba9071a35c139671b7873caea64c33ff52270961b4f820cef08391ca641663d538b385d882508f89397f2b79a62ee997b5d89099495aff92876fa5d6ce05b3eaaed1d88d5167e1f17b29787d926fca38f4f86fa22c21c29bca641db8a42a94e3911a4e4e1a28a88ba5dbd7c075e8b8ff1ae1d49ab3a4a213f6bc134ed52e69abe737fee0efb80ffd4c31973794b50d3c989fce44e68802e036dea157c3f55370297e7a7f48ca80925c4e77563dacc6c173468006d699e4ff1e778312d5365238abd8a06d271d4829d312556389d5d6451d645280dcb6eb623a8619a48d65771e285ed8902eee0ea30e6152d48ffbd24759db0d78d6a7b37f54382d2f3c245bf2a709a68676baf165814193ea742f5972d7ba52bf34b07b149b456328928879379317e48cbe208febee3198fd0a39665508702770cb9ebbebefbc3605c0da1a5cba94071c1ed565cb87b51c8e08a4e3e86331d71302547f0e097f7100b507fbf9014216116f2c5d558a470146d5edd8e8355147932bda6ea4fc29bb788c021737e1f9018e5b555aee20693e46cf490af1653c3c67417e2b0839ac3042ecb58e761be9fec1ff8e3d7054ea4b5fc4bc4194e81e4012080c1805e539b6a8e7187c63eaf390e3b3bb2f98884575ad98b80b96f2fedc567db26b778b0cecb90f0b20edd68ac78afb7cdda08249ec303de742b39d919567b5e3d9932c041d8e6d5b167bc0e0f79460a3ca9c13e2748c874f84c9889de68d92197f36b39ebfa946d47caedcc08c6d0aa6b72d1b3862f53fe6a58173c7ec5768b9ae8c589976b2370891d0d2a7737c0ea1ccfa817c74d6e50e27e1fb9e3b093c164150bd080d126bd784ae88e4e53326a8c63695362e175ce8f75e200aa3cb098feb5de91c11656d49b301abbb39c9f3bb63981427a351a775a9cd0082825ad95af7e25dc6300c4c7333b9d34db99dcf337f9621b219c2a2b6fe837e8b8c2af3c229f7e47292ff8a599fd2af366c5a3ab087bde1cd0a2c8190079745bf9e449855cf26449b944acc0253e2dee1dfbc0e8dafa7a91244816e1c47c98d94dfbe12fe6d048f23a1b03591676c220800de22367625d1936a5b3b341c89c250e7ce3e5592e90396f549b2e988209238fb0d9aea4352590902398f1d199a133f516913f608f1b324ecf05ab704dde04c681b35776cacedab6e06be094febbbe0105a13b2112132aeaba10b40f0cefba224b1c42d7bd29250f27131b55a5c58eb9419e3a1bd517c086ec0afd6109a66149761fb997", 0x1000}, {&(0x7f0000004480)="2191baec3aebb81c33c0568afa753545a2d643bb1d26461179ea1303f167f976a4438a1305ba6fbba60cbe24e417915a2c2dedaaeafffc5849cfb475127a43ee5b978dd5331d533f6d98834995583e79d45963e98d7f980573df9a9e333ef8f82d25393d703c92f0b49213a3985d953e9652136fc9263b37c66cf3c407eb1eeca73666c77265f8a722a18da3a4c6b6f883c4163b797f78d5334ab896dee1b2e79449e01ce807b1f7e9f78bff651ce5f35b21144b00ae014eaca4ce5f1968b3b9f652ae79d6a926f75a41e0f1f1a88a0fb39db51c48500dca38470fdee4e2503b72b32f0800a896cd22fb6db33642f71520a3955ae64272", 0xf7}], 0x5, &(0x7f0000004840)=[@cred={{0x1c, 0x1, 0x2, {r30, r31, 0xffffffffffffffff}}}, @rights={{0x2c, 0x1, 0x1, [r32, r33, r34, r35, r36, r37, 0xffffffffffffffff]}}], 0x50, 0x20000000}, {&(0x7f00000048c0)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000006b80)=[{&(0x7f0000004940)="4e454a506939004cb49e91caa97b685b49861b6ac6a7d3d09da05893f2d61026b65822990115d5809dcc9fb25370576381c3db62251763b5ac349118f87cb24fb5c82133450e23b30107d19a6bdbdec8ff48998ce3f49de6512d9564cec0716157b51b7d273b80be4c5e9da35f1d7090675e914fbe0c72c7c9aa707157cf11e8e398c0ccee3d256ff117a24304f93175880bf04e50fe94087b171a74a28e3cb73e0424a865c859a849d24cd7db82a2aeef4db18be44d43778822da02ab1460928c4b0c85175ff36eb582e3ab687052417a7e22ec030e6668a2bd73981c836d0670928f71236257353b1f344ed45c4d404808f18242adfa06326d84c8ac7541b2e35e536e7385cdce7d931040a6c6e50b2590e3c9ade73aad9a3fa6c917855212ff2c0e4eb029aacd3936960d9f96334e69ceb5aebfb2ab142d4b5e7231861252cef260d9aa00feb0e1087c3a7f4b37ae6a0c1e8c2cb4b7c0edde2232aa2223be920bab536327731d9bd24dbe253431b689428ebcb1927887f6b3ae2816ac4b82e707d18ba4e0ca46ceffd192f597ed64152cfad590d4069ec57ee26d25edb9126b89823f8d200bd77183e91e37e9afc92aaca685d17c22c2e1f2992c9bdcd5b2dfcf1463947000cdfbdd5bcf3cd504e88a1d4c7abc5b08ea647023dbcd5a9bc9da0ecdef4ee19205b46fc5b0f64591fb810fa056e9b2dd14d485e4d076d53d9e6c96603e1f2c8cd830a5dd2de69ffa58e4fd6da0ee430f99d20bc4423e12f21146e8757f35568e3762e1e2b30ab48e4d322e70416c213381941bd9a7a21acf3f67bde93476eb5ccdc2cd5a10d13626460b975c672f81187c31271668be0dd485f4b55c87c62d006b5e7fa9cbad137d6c44ae7671fb36f810bef3654095365ae80facdc90d186121553956501996e10cc46c36af6a20796767a5f18c90fa7e6a32c376040e3b38707a696184e4904b6b95b041565342a065d0407e8b8dea94a067f462acec0523a6e217f95f8490c6c3c11701ed26f0737c9776c4fb39e4ebee7814aea3ab8e2caf90207b327d4fecf23d5cb5c1dede3e90d1ccfe4673f33fdcfffa6b8061f435a27e7205cbf5218832dec1e21448c63a314fa0aa88941463286a3f18385ffe1b2c41bb6b62db391536d8f68d5798e9cbf31f4d67aff3678bbfedfc2a093a4c3576fa0c969ad04ef5b174758402ce271f28f3b4795068513e809a45e05cfecfc50950f4168bd2ea319f916d77f0a6f01da9aab0549c151ff257d9953fd279aa6043146550005d6c985c4b6c45a9c427c9a4061b1079787abc0debea79c14f7a1b8777ff79a9715475651af4ac48cf49a7475e6c9c9c3706dc348c40658788da748a12f52c60dec105fd4490e02db6039d93021cfa7aca5948f5444e3fbc2b3394e05c849ff444b8cb2d3147b207a0ebe809077e574d9148e113aad570bea3ef9ba5b9106ed1c51eefd287ca62b8a8341063c19814cf89c28ca63fc0182b6b48c319ff256d9e45e452fbda4f06c3fe007cc17353e9184874e5a2e7b5d58245a20a173a1ba867145c7733d0e8019894581d82cf48599e082418ec8aea79660586e49223518747ca67f6bcd0712fef413fc9623a0d484a7d021b55fe28c56b461fe383d7c8eb85376df4d57ac0a946948ce27994d20fca320a508ec829ff8d1889f4a5c0dbcc2d9cdaef2cb761a0ecb960f1de99f965f58a5e9cc4a070cd28ab9f506d3f48f9477d6eeda08f73a7854af85b8079595925b4347f86e81269ed461734f2dc687d1401ab560d617aed99eca49b0c865e0130eeb312fde0b74bb042e96c627279033bedeca476c3fc2bd3f154456bf6279beccc59cf57c6ea674ecdcbdb027bbaf7996050865dcd31ad3f1beeb55a90b410a78321d2db1088e2a2421ab01cf1ee8666683577230f9d87b4607442ebd438522c6a4429773e3c78638cca0a9bf4d5145ecf8066e7ae7cfec22c3fc82442ddda1b5c2d8060fbe8a97fed6c6c1b1d957013738248e45c8b805e550202f2c13f78defcb31de2c1a4c9d392ca03ec862b6cd00937cbd5044c3ccda427a2f85a4a3c247ecb6b796297ce9fbc8e7a42d2b07538efcbee3e3218617418b948fb2d83d51e676fb6b745bf46112fbb4b7fe5d969b6924c80caf32dbc2e151fbb3b0dfcd1e59ecdb941e7db3c3d03f82c12fc0007828554183df29cf01b09fa30bacf0f053a42ca1130c73973b4ae65de685112886aadd24703f8a7181d525b6eed2f7635c1e2a955caabfcfdd872b0cf11ef20a855504e5f1412c280939e3a23c79b593c27af494921f8705c2b93fc2a0c0c330a273b5a16a14190f520979d3dcc3419a4ae114c3696a7b6986a0aff59c749b06c200fbf295aaff2bca7706a2ddf6f06bdc898593520aa220dc6006f293d1e79a68d2b73f6eedad33d6e3ba04cc334dfb96504121456bf8db2324488c9d649e181f69c75784bfa82870fdf85e0a4501afaf23afb11dc66f783b7840c3d10c409190c7c5c452187ef05daae1224d041e5939bb0e2db58e4e2bad4a819b58c16ca1a6ec07dea60a398b7f59e05d6b61c61f581d11228c8becfb59bba5a576003c8567299306a90b46ebebeacf9e657b1aa484caf1d693f1652946e24974e3b559c8a476d48b6b7359996ea7d1dbd557fe0619718733c4fcb6e82c37d0a9ca630ae852a1453c01d1e14444d7fe9682033982fd670faa1ed9ba8efb2ec72afa9872bb3050ea7a9f3c854f5b448c049ea7b6a57ff51d28a39e392a4feb230872fcdf56d15fe0f7c34ce31e67e4a434b0d75709600d144eb352b5336ca38464c4198492e78f56b09c2c3be4fee721cbd1ca4140cee242cd66424a3f2746c3b910e49d03e6e7483ef6e67e745d8c9870f0e403ce805cf8a4f06d641c298a4a1febb0bbec59cc38cc7df9511a05f0c5b021fc642fe893a2bf75d08622874841858a976919ae55dcf506ad11033de54f35584f3d8d6cde24fe7a04ffa7fee79f869dc211b50da993fd85c6cd270b97defc25c2837721905268aae8271c6aae2a930b9558772e6fb30b13eecbb799cbdadb55ba535d8d7e42594875691d8f2b35e41b932bc02cda8c80e9a84a3b6421e4b6fcf2fccfd95be547255f0c62d786507e2390b23cfb83da0e6ad0c64264328e5f82278fa2d1c5f372174a51a6d8a7a645f47407f97d15af7f63cc61073de676612705b3cf74fc52bf1a1896c184addcbd406cd10441c9d5d878666d14b72ee9a1af004f798c6c7a9a4999075ad4637e2c41d77f6ca0379b67919da13a00e48e165238ab523d9bee7d3776d5753f4e7c6215c0158498b0ea267e1df9f7207fa74bca8c46183d5d06fabb75264c7c7ea8204299e1ce5432a27717f8f45d52e009ed8bbc1c4b711cd6498cd3f17b728c3337be92642a63296ff973e374a7764a0b96f4d1b5b09540923f96ffe925723f7151db9140bb862084ec648e6154075eca9b603638b08b1db01f724ed2901ead95c86b56bba045aee650ba7ef87a0aa86225d62196ccae83b79f0b20b9f27a34dc58c28c10e1431702f544f98f967ed63d28482ef605608cc0cd581d5b5c35051071f99ac0e31f5e77f2fca067f10511b17a65f71250f95ff27876b290bd00da375c9d8f5721d86d643de72cb86e3e79982e0398e1df79b5864eb946d10ddd8448532fd7cb93e1934b8aaa735ad35c611a4e2d5600e466da7e5169c85d213ee438b730678f2dff859cfde039e984d914ee99054567612a4cd692e47b151ee79cfff49d46a97517aae85442deeef76b383d543422c14cbd06e8e5c9fa05fcf0b8cf962d5eeb6306713598eda702270ac275caa1191eac99ab1ffef164365f3ba7e5675e72ec46591f1b36e53f76dd28fca9bb8beecddd3198169039e29b6229343c6dbb2e99c53b618eca8dd7d853be5410311316ea9d5f85704a6aad161ec1b3bb59bc73ee22e0ec0ca976a358bf7d1abb0d63f5699a3e04a59c5108033f77568fd40b18330ed3d46e5c493cf5f5f08e3ab9832d3128e7cce07b8839d29015e5be8da30b925ef52835e91b1b4e0ff453e57058e2a63f90345366a24035df80381f5bbafe5b42ad3cb3f6b8d7dd154f2785e8b87fe01b997a20e596e793bee85741307084b10899c6b4683085b5150276b3522d4998e611052820ca17532e46e89b521549a75afda82d6603c3f1267b97039a23737629c10c6cf00d13f47ea5b3e3b76382e773de3b2236f7e6c18840459470247abd5e623068a809d6bae96a5b34684eef183106a1918a73ae8a12ad35ca303f70df2e05cea124c977fc4b9230a6ecc353d170bee472d5d9cb021e7c8b4f1c90f5247940910b7ef84834776c13e327631f96af482555601a49830de7d97b65f6a2e4e1918a73797d032f6f29cce6fd46940e743fe9c1247417cf5067520e07bc9911f2eab5f58e077778831405c4df0a19c6c59e07264f060a313af032b38452cd4e54a19fb529a94994ddef868323780fa0b989feb707114f56d238808645c851642bbe1f156eaf029393994ac9e229f9dc79795d90d29325ebb08f6136c8a9162d0e357bf9972f60e42f0ab44f3301b2a176ae5d094c29f798cd93944ce8fdcae312c0b5ce06b10c04a8253f3a31b7cdf0d5084a85ab86f8cd2621a8b0688b0f3cd638ee865b8479aa7aca7cccf88f2ad3e5a03b678fcccc9f070d07fa4705e2006a1cdde263390f2b3ec562f3ae8e7d3b7d985cc7f1be6f265c7416cf6e1631fcc7475fb58e43b6acad4224473793906720431f5500505556eec439fdf91330326efab0332cd18a35910423acca7baabbf1dff75f6c316036f69ed01228d574b305c944a378580949a9918006be9d86db21280ffcfe669e3e846b2a400750a937878569794041e4df6bb7f70e29515aaf5953f3093189fd1188e67fba22c5cf396dadccc33213c8046be8afbcf0c60458db4ae872b26e0c753457909d07b3e2ce3bf1cf42a034bdb68025d5c4bd6dafd37cd9741dff8c6721061fd892687a4fb301db316a4fc3da27140ebcfac5b1326a397e6554891e759f2612ce17ef6c065395f10c2b74a3c04b44bbf0be5dc9ed55dfa63e14da49fb986b8359d318284cdb9dae0104d0c7795891b8a87e1d5d2f630268d9ea283ccdc859e20d5486a772be6defe5441e774da0e91e6b25c14de4a0f0526c860cf8d3a9b21d54403cc09f24fc82eb7658b566d7a30a81f875486b24fc2a1fa4bec1dc1731830de6fd6082676dac9b887902950e67515227869b5f1d7771478dee57103447bec6fecac3624d9a0e498110a80281268dab5fc53b8c95d774d41bca3d4503f59d9c330fbe1458f97bff121bfb03e965bbdbb41516549b5739a9d754ef8a90ef01ac1a8d0fd1da919cefe2cc0120fabb51e8bbbb6157c92d5e6b03fe74ae8ab7754484a4dbdf40a0b478fc84ea03a5aada610218a10d7d02f2fb59556c3b8eded908d9bb28ad0015947545c6e64ea3beabbe8b8ae51922e4e733ac8bc9959f7a396810092d99059bf1ef346ea1e74893d6ae05e4b17b585fa8567510eb1655aef019b22ba44d4fbcce35d0bf1c24126e141102ceb9fb1dbd5849dc35c7dcc34bb9d9f00ea744336c5cdfade8756e895955ca447a8dc8a2ab8c029cd9cf5883d3a14e4b3ab6cdce1828a4745f798ca2396a6a9079757f532c926eb5b370dff81ff69fd4343aef915f1c174c74d487ef9475a45ad1959a36810877fe78ba3988558ffbe205be4edc21c0b3e91838cff647e70fd66be8be2b2e85a6206cc912a8e13b0c0a818b9ac477f9229e17c779", 0x1000}, {&(0x7f0000005940)="31354ba833bb8a89272a6b906038fc3a7769b5fb6f496ed2359c8e1323bbb3b39ec5476afb2ad98ab174d12d0854c2973d2706da981afd1552836f65f0aaad36332dc23b98d28301467853e3410d5a61ed9d71ea0510496cd4cb18d1365b109faf767c18fa2c", 0x66}, {&(0x7f00000059c0)="101abab58f96c7e8292a1b9498cbbe5d1aa4ae206d7bf337f74d3e0a479b454608eab53dc86b66aa51ebed4c369291d12114267041a23ec710981f57be2184aeb16c33223ebf8daaa75119997bd51708c66b19478202a1ee151ca05eebbb7ec1d60e50ecb972a15ca2bb53fd07e31d91f1000dc9a1d9a7b7817e64dcc54d694ea240296c16b50de5da99ce36593a7706b6c96e4a38358d9ad1450d2072394b15eddb5cca6fb60f9a41f360012d36899b42256e79c6f3d7ee8d7f0a97c78217a9898c19a312bc60ce2bd419458dc7c96c7e76f228c3a6ab52f9885ea3c679681951f8", 0xe2}, {&(0x7f0000005ac0)="1ff1bbd708a17c3887fcfeca635788ebe7bc63063e7f67070345c52938545f143518796a9f2a1810c16b40a8f6685e733b5453730e433d7980fe6be8e33a4e9aa6e3034124e744a6388b79b4aad2fed19e196b8f026745acdee806e10c2a7c1e32bbf1f2b4e66f148c57546ecd90459053d08f79604c3657d41ff43d8d47dd933bdc91fdbc61d3ca489b2ca94b7cd9450f3de6d63083f5a994e5b96ac059919c4228f2f1384b33", 0xa7}, {&(0x7f0000005b80)="ddae1ccccba681209e5f4f182162eba82dba27a9666a2fd462cf0c359f808e519889c2624c5fe55b6a6bd78d968335ae8713fd5ef7ce56efb9f44bcee6b8873600c1c25b10ebf9cc363a14934473126dead847899a0affb2b5d38423231abf9c0630187137630d512607803c5d06c1ae266a5ac38f85265f251902aec8d5d939e2543d5b1013c8d3dec0d59b55f29a72e012d5febd210a787b594da75e3b8ed381da4ed4e4fbd0da11c57dbdb9c8a87e04cd98ebdf59328cb7dd7907788f18b3b31fb342868cbee1326d0baf13660f6e676e298220db583bfaba95f5e50116313998ecadb4588673d3df3cc7a86f0f8ea3175f894544acb98ed2c37cba883a6506cd91309b34db0a388b118f0954799ba349e13e0a8a332cc7ef78e993f77af46e99d46f2b690c1eea7e706a205bfe4f27a6d9ae1cbe0141fd25bed4947aa0c7a08721c7ffd0750d70385828933421d6d941eb2f72c5f9dfa7cf084aed7eeb1924b34692c2d0979983fbe1a5955c65d589e28de2e0ed73a7921a67826993905df14bd9d48a835c15eca52399754bed83c36e6ee06ecd7397feb2da1a281cbb07f15604fec263cd5d7104b7f06dd8a3a82479f83e7c04ed8cb21a67f9f541c4a749672421d7c7159592f65de00f7bd4deddeb741357bba5374cd19824bfd4d250165dd787f65b30acae08fed36f650081191dd33a475b3c8ab5f8c6806de0fa89434ee95d5ae35e1748913908289870404713f80d4fcdefccfded7181a396acce0a70da27cf5e5bc2a6283caf4167166e31fbe0b10267459e1ca7e0433568f62bf87323b3f32bfce7172da9b47d295f593260e1b36442f968ffa9838c1d8126ff84f50db6d5f4e5983ff6e72aacd82618d34c5cadfdf1a5f9698f30802523adfd5e4c45d942c549dd1369a7fd059f421771efaad0a3e072160938740a52fd82ee4585ca7ecb6899aad112461e8d3b8aa6df38e09f08c1158330f627da0b2d75aad83ceb2fa2895514933356c4ffb7f0ea12a32bb3a6fe273baf95a425b6e9b5b7321a478427208e83f8216ded175947b262ec5c94a901d4ac05fcb05c0efd39825b67f1b73618364d5032b58048165ffe57db3ac9b68c7015f5c299b297404c2460fa567e9a0daf223a089c84e7b304133d33f3fa022899557c3b1d21b1579950071da9950989da197e586e88b345f79a4258fc68f89fe48bb9dbaa633cb88e6627c3917ce73f4c32f310388de1971dc948663318410820ad88b8e07b2127cc95b2a7bb88160a108f78d9fa51db2473d4a438fa619843074602d13e3c77a567e29f92b6aaa119eee34e6260083e74d45b2f30b43c43c4484179da5c339d7854af5a26cba26f9f5a997e129bbc367102ff8d661fcc1d1531e82efab5c0589015e136eb78b536021313e1d32e1a71a46d7825a0fab6529bb88d36d23b9609d360380967eb1ef8775e45b0bced1e35b2a55dfc54a66ebb23a5e967b72cabc10cbea8667bfd1190cc22020b52a3a92d6c1f290fd40ead3a3f44fbf4d22d5c59b9031b7114bbea5533d4485e7a0f8c87b1d8b26dda57f1f04614901244d8dc69aece3ae82cb5564c56b72d1df3e4d3fcacf9d6791fd1e149d70b49206591dc238d65273a228e03779dcbc7d5c46721e33896fe909258beef5ca92c36581d2fbad14f6b47c8eced8c942b1f74ab85bc65d7ff994280461bed9a81ed8cd2ee7e89647359503de78931295c87376104090bc49128fbb7d4c9941499c429af92c0e0e46f614bd240629266f24451d6f8ba609aa886d1e1bc1b96a9191c4b55dd8117f492b2fdf01fc51eec458aa07cf1c9d194794071e906f3df0dfa8f3bd797f84baa5d7e9ae88348f81137381cbe7c2c63b1f6d04c912fa30fb708d298b0785a92e3235143575935cec9c33c1c61bf44b5a06c6608cda964eb29dfd9440fd71d8ac034341a5f928e09279364c2c7c520f2c9ad261623f56ce3bc6cadf0b6a57b1448d059d1d09e6beef8fa4652bdea798f28a0a35a2e1d912b10f24803f2e518797c899e1c3a276248ca752784a4e1d074b26c92c34430e48d711fe5fa1e0fc274f43e265cd4fd2e5a39cd75fec460cf15a72ebcc08456289252d6e44018dd2631d85943cfb73fead4a4a3129d24016de553b9139a4534d8a599acf41690127060c77c4719888b5e34848c677fac5e1cf5ec4fc2e3b12c638a672dbf64fdaf8e422643d3673d8c75933aa779a1d794ce694ea9eae4bab4a05d29f96633d27ed4bc78932dbbc44766a623cbeaa5c6caeafe005b49f23d0dabd08657fa0f58f7c91816d875cdf3eca1dc496f8f96322d0cd0301e3088c1cd4eb1ae10fb1cee73862cb07113a11335863906bf77009360d3e83371e02edf7dd8ab33f4ee1880194332934312b8151873c4005951c2127f6cca522ff779742b18a85c5a876c5d814a7f43ec55be799b7d3a459f3dd8def10b6f6dcab8462eb547066683edda90a1845d7bcf68df4e88cdc55d19aba8a83ac05fc7d7ead628752f467dd1da6bbb53bc3f34bf01db8633c06dd1b821a09c4c78475f60bfc85fa378f8b671183a6e2be8806845a0ffca3b5e8ce7ef64206906bb53d34e3e8a3b0620892dfed029339875b2d8b0f4bd241c47064f6e4a3c2b8cde6f64fe650e78e0de0fbf4017408247e2de91b2583911032c971610f7760022c95e9156495fd3e7cbafd6d8ab672e2a79b72dafb8180b09c55fe9e72cb9981ad6382381bea5d1b7453e42d9572878eef3b60c85b53887154ca26f70104fd8c4cfe39ef94cdf617a039da3d99e609a300a2dfe874a560b02353f3cc01d4f317e73142c690378b4e67f39a6f28ff37d5a055340c69b88e499a44000acd6aac50931acfe1e2a97fcdfb3deb8a51c9e8ec0b43de865f325fd8bbef9bba4567e4c8bc86eacc783450c6ac0328db6b33fb05ec06c8586bd93c68dfdb2c62b70dd9a3e418faf24052556f3cdb063cb2f7dfd903794ad171ef6ca25dac52d3f9cf52aa17dc86bec4a3af1fdc2e0b34485da4f9beda5ebac17ed9ad615629b27bfc49e9e3dce2e53950a66748e93c4d575f4268f64f0a165be86eb497a06574f7983fcfc94c761189472cdac66ef58501afe376dd74ecc513c83ed375d68092c7e1ef363ecf3115577f34532e5d3f9697f6947a2dde5bc14c640cb03564c0d3370d08ea7003b4b2f0f0b2459b3e45037dc0cc2b8ab2486400b17ad3b1f86f81ef22353514339c521f47a06bd45d834eec556c3083cc4f010d73faf6fa4b4370a682f1efb8b066ddfde675016341a544310b3ff970b0c5b0185fce089a505d1ca8e9231bbce2d363dcceb490d946436b306007e1e9bbc5e180353ad23b82bc90e74d7b8beefff6b97ed466cf96c589607aa5748e6e1b2876cc8d16db26a9399d4e52127c7e24d06aa74779012cecbd4b4622def861fa514cf536046c401758229f6dffbe2e2383fe0eff98d0cd2a7042878ad1b71ae6c7755d5b88f14b2b65ea38c458b16dc3b4c325fb463cb471da8216d0065d5427da56a8e89f772c9fce4f0e0808b11006e3c05749a2797b32d25b89b9efa075f2eea03471b14eab99dcb7cf0752798f1cea544e6dccef279625f50476b1246074fbe7a597c8f525fb449443d9d1b92ecdabd3cf039bab30c488ed56b025f2928898db736ea69865670db7292413173ab37765e7a3ae360c24cf761be0cec370f0ef4d1c5b085ee4d94100c5ecb09afcb99db88af0033610271d0e6ad03986cfbd8645ebcebd22af228fded86f6e311548d790bb2d43c2de4f8494d149580e73368d4c33e3a058ec595f74491fc6b3116ceca19f4a95313746441b2a6f46f33778f4f5dd6ba1f68d200e6a11da24f993a1a59c28fc7b651f566fbe37edce179bcc7e7641ff98a782ee34568e50b9fa3a470d13b75f4fe85058dd159e5070fef01a2d4fa8c60e3a19d0a7c9f3c979b8ecfc0467e7615c87bd911ede67b28e2fee6bd1fe2c7d3142b5a838fdd6e3acefe3919a4366d9fae7525581ec8ae8540f878a8ef847cbb3c1100197bfea6f9aa606473b89dc35a441c6aa6a8b87f54fadd9831788175277503e6bb6bea85115d3070d42fe94bcb6dcac68182d56222d44574bca9b2c85f6fd715397c3815cbff237269b843c50d020644476b0da0868eee1daf8fff07935de133b5c2d8df46514f1569a5a0af884899f2fb48fe45101b07ed75e7cd6da2cd0c3e3e73b6895fb25f32e3273da442b38cc0680891f96589304bc2872193fc7921e48e3ae105a5a3c4c6c2725cdbb00c59440397a795d592bf48b940249bbbb900fb88b7c839e0e9f1274083c3f4196cb649a232f44c57094afb46151c3706297a3237b57a2c073ebf3a33ef7f972b9f5b4903a4fcded40f117cdf8433bf641178710a49fe4839964067b4ae631ea453f03f25d2179da000098e4e7700b9d844fdba3623982da6edebab3e765e5e431aef65450bb2559758657f2f4f8965db1ecc7f0fc6c0737eb5c02031f899eb83127c20a30fe73b74f427ad0020ef2d2e94587720b9fe4fd2fa3926930e0939ebf3202e2b1780e4cc7d605d0a3b6b513476952d0308a7c94fc0e7a0c9fd96cea103cf7d0f2420ba22cbae389741e428766da6b4bd558e88dc77debec4cd39f5cf2a5d192ddb4f77868cd72c9a85b097e03ed1ee3c4729a40106a88e12d334ceeecf2e643c3a5ebca8136181779d5a7e13823eb6304450979bf043645409a5e4ee571ee12d1b33560d80fa8721970f7821a4cd3e8e6b89087e77b4814e1af928beea160643642e05572897e33baf3ac30145f1fabbc40eaf382fd0c9d5cdee1581541e0fa81d9ec110a5d4a9cb203d32736f7572f4237aec2496927f2465bc28145044259dd87446b3762d690fb67555289512969ca2b5e0e5d5599b669de44a714bfeff1fd839534ab0926b9e158331afeedadb99159c9242fcee358df48737bfff3d17b0d96bc99e9534a34a7cc6f53d791909f9473aecb9463d17f0da07f12b7db2ed20cbf61516cb948d4ec4d5cd53b15d13dc05bb95c8d5a241d23b3439df7931cd373a8d39bf08f31d75e041d69bfa0d6cd7f3c4bd6e084644a8b4429d319f42a7bec13db621cc3b05ec769ca25d0f3bad1c0f21d9fad146bcf97e72bf857be8d0d635015e9a3dbf6dc172b6b4e1bee59ebd0b9d0fef4950d866fea3542fb78f932db01166b8822b17dff204f43ffc8656c42249a5ffcfe007994bb769d1cfb87816f0014efc35137203572521398cc24e6e9c21aedcf4dde21772d519a918d43769b33f56e1ef63a7136656bc8e6f063522b705df41355bd0e1fd74c74b9f531fe74b6b33eba87c1d84165962558c7e4ddd714ce97e5eb5659ce4684a08ba99bc18e083afe1e0f33d38e008368583f4d2a71f1bc90f4ff1289c58fdc0c073e0892a5dea87122933ac7c3e8c69af75a734d6df04dcf9a7a9bd1b0baee2da6b781d91f8ade6881d40dd858cddb90ad75400fd4d49192dff8b00d2266b6ccdbb2969896b86a765d1fee142aa1553fe566a241800da036443cbd241f640a5830f2222d91bc7462250cac776c07db7d66e6ebfd77d48ad57fbe7802084d6f24c5eddb472f8795626fa56019fa8c3d90d9f0e47e4a0f980c5b1b7618dfd7fe30b509206b29ca179d674d718925236d65f9a1390fc78627785b1b83975017cd710ad7eae52c178168515de27f11f2fe836c011474361388fc97e27a082413e6eb39ab11c2652b70060acc7c51c113a91df1a50355ecec168843a7c59db1c2a7a82848313aae0726579a2ba903d1f89ad", 0x1000}], 0x5, &(0x7f0000007240)=[@cred={{0x1c, 0x1, 0x2, {r38, r40, r41}}}, @cred={{0x1c, 0x1, 0x2, {r0, r42, 0xee01}}}, @rights={{0x14, 0x1, 0x1, [r43]}}, @cred={{0x1c, 0x1, 0x2, {r0, r44, r46}}}, @rights={{0x38, 0x1, 0x1, [r47, r48, r49, r51, r52, r53, r54, r55, r56, r57]}}, @cred={{0x1c, 0x1, 0x2, {r58, r60}}}, @rights={{0x18, 0x1, 0x1, [r61, r63]}}, @rights={{0x14, 0x1, 0x1, [r64]}}, @rights={{0x24, 0x1, 0x1, [r65, r66, r67, r68, 0xffffffffffffffff]}}, @cred={{0x1c, 0x1, 0x2, {r0, 0xffffffffffffffff, 0xffffffffffffffff}}}], 0x148, 0x80}], 0x6, 0x22008050) getsockopt$inet_sctp6_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, &(0x7f0000000080)={r1, 0x9}, &(0x7f0000000100)=0x8) 11:06:49 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x05\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:06:49 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d8000000180c8100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:06:49 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xf0ffffffffffffff, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:06:49 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xc00d000000000000) [ 910.555376][ T27] audit: type=1804 audit(1577272009.573:439): pid=25953 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/706/file0/bus" dev="loop4" ino=213 res=1 [ 910.626372][ T27] audit: type=1804 audit(1577272009.623:440): pid=25962 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/706/file0/bus" dev="loop4" ino=213 res=1 [ 910.629218][T25955] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:06:49 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d8000000180e8100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:06:49 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xf4ffffff00000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:06:49 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xc801000000000000) 11:06:49 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x06\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:06:50 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) r1 = dup(0xffffffffffffffff) setsockopt$packet_int(r1, 0x107, 0x10000000000f, 0x0, 0x0) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/loop-control\x00', 0x400, 0x0) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000080)='/dev/adsp1\x00', 0x10402, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, r4, 0x0) r5 = dup(r4) setsockopt$packet_int(r5, 0x107, 0x10000000000f, 0x0, 0x0) ioctl$USBDEVFS_REAPURBNDELAY(r5, 0x4008550d, &(0x7f0000000000)) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:06:50 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0x107, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:06:50 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d8000000180f8100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:06:50 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\a\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) [ 911.189584][T25982] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:06:50 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xf5ffffff00000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:06:50 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xc808000000000000) 11:06:50 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018108100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 911.486290][T26004] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 911.512777][ T27] kauditd_printk_skb: 2 callbacks suppressed [ 911.512802][ T27] audit: type=1804 audit(1577272010.523:443): pid=26009 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/708/file0/bus" dev="loop4" ino=215 res=1 11:06:50 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0x108, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 911.708754][ T27] audit: type=1804 audit(1577272010.593:444): pid=26015 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/708/file0/bus" dev="loop4" ino=215 res=1 11:06:50 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x11\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:06:50 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xd00c000000000000) [ 911.753960][ T27] audit: type=1804 audit(1577272010.593:445): pid=26009 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/708/file0/bus" dev="loop4" ino=215 res=1 11:06:50 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018118100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:06:50 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xfbffffff00000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) [ 912.103211][ T27] audit: type=1804 audit(1577272011.113:446): pid=26039 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/709/file0/bus" dev="loop4" ino=216 res=1 [ 912.107247][T26033] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 912.194464][ T27] audit: type=1804 audit(1577272011.193:447): pid=26043 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/709/file0/bus" dev="loop4" ino=216 res=1 11:06:53 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018128100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:06:53 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xd800000000000000) 11:06:53 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00 \x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:06:53 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xff09200000000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:06:53 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) r1 = dup(0xffffffffffffffff) ioctl$RTC_PLL_GET(0xffffffffffffffff, 0x80207011, &(0x7f0000000080)) setsockopt$packet_int(r1, 0x107, 0x10000000000f, 0x0, 0x0) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r1, 0xc1105511, &(0x7f0000000280)={{0x7, 0x1, 0x8, 0x2, 'syz0\x00', 0x8080}, 0x4, 0x10000000, 0x8, r2, 0x3, 0x400, 'syz0\x00', &(0x7f0000000000)=['wlan1-\x00', '\x00', '\x00'], 0x9, [], [0x7, 0x4, 0x9, 0x1]}) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:06:53 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0x109, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 914.292197][T26055] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:06:53 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018138100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 914.319814][ T27] audit: type=1804 audit(1577272013.333:448): pid=26060 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/710/file0/bus" dev="loop4" ino=217 res=1 [ 914.347828][ T27] audit: type=1804 audit(1577272013.343:449): pid=26074 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/710/file0/bus" dev="loop4" ino=217 res=1 11:06:53 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xe004000000000000) 11:06:53 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00?\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:06:53 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xffefffffff7f0000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:06:53 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018148100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:06:53 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xe803000000000000) [ 914.685079][ T27] audit: type=1804 audit(1577272013.703:450): pid=26089 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/711/file0/bus" dev="loop4" ino=218 res=1 11:06:53 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xfffdffff00000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:06:53 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xe808000000000000) 11:06:53 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d8000000181d8100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:06:53 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0x10a, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 914.832440][ T27] audit: type=1804 audit(1577272013.713:451): pid=26093 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/711/file0/bus" dev="loop4" ino=218 res=1 [ 914.871610][T26084] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 915.158768][ T27] audit: type=1804 audit(1577272014.173:452): pid=26112 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/712/file0/bus" dev="loop4" ino=219 res=1 11:06:56 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xe80f000000000000) 11:06:56 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00@\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:06:56 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018488100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:06:56 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xffffff0f00000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:06:56 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0x10b, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:06:56 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) r1 = getpid() sched_setattr(r1, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff}) perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0x3, 0x5, 0xff, 0x0, 0x0, 0x8c3, 0xc2e82, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1ff, 0xd, @perf_bp={&(0x7f0000000080), 0x4}, 0x8404, 0x5, 0xffff, 0x2, 0x7ff, 0x6, 0x4}, r1, 0x8, r2, 0xe) tkill(r0, 0x3c) r3 = getpid() sched_setattr(r3, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r4 = getpid() sched_setattr(r4, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r5 = dup(0xffffffffffffffff) setsockopt$packet_int(r5, 0x107, 0x10000000000f, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={r4, r5, 0x0, 0x8, &(0x7f0000000000)='lo-ppp0\x00'}, 0x30) ptrace$cont(0x7, r0, 0xce, 0x4) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:06:56 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xf003000000000000) [ 917.344615][ T27] kauditd_printk_skb: 1 callbacks suppressed [ 917.344638][ T27] audit: type=1804 audit(1577272016.363:454): pid=26130 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/713/file0/bus" dev="loop4" ino=220 res=1 11:06:56 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xf401000000000000) 11:06:56 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xffffffff00000000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:06:56 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d8000000184c8100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 917.540757][T26132] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:06:56 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x9, 0x10000) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x0) ptrace$cont(0x20, r0, 0x0, 0x0) 11:06:56 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xf807000000000000) [ 917.589804][ T27] audit: type=1804 audit(1577272016.383:455): pid=26140 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/713/file0/bus" dev="loop4" ino=220 res=1 11:06:56 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x88\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:06:56 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018608100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 917.958914][ T27] audit: type=1804 audit(1577272016.973:456): pid=26168 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/714/file0/bus" dev="loop4" ino=221 res=1 11:06:57 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0x10c, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:06:57 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xffff000000000000) [ 918.029802][ T27] audit: type=1804 audit(1577272017.043:457): pid=26178 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/714/file0/bus" dev="loop4" ino=221 res=1 [ 918.058420][ T27] audit: type=1804 audit(1577272017.043:458): pid=26177 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/714/file0/bus" dev="loop4" ino=221 res=1 11:06:57 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018658100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:06:57 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00 \x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) [ 918.177817][T26175] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:06:57 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xffffffffff600000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:06:57 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018688100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:06:57 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xffffffff00000000) 11:06:57 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d8000000186c8100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 918.502546][T26195] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 918.532289][ T27] audit: type=1804 audit(1577272017.543:459): pid=26204 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/715/file0/bus" dev="loop4" ino=222 res=1 [ 918.666369][ T27] audit: type=1804 audit(1577272017.633:460): pid=26208 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/715/file0/bus" dev="loop4" ino=222 res=1 11:06:59 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x1200, 0x100) getsockopt$inet6_mtu(r1, 0x29, 0x17, &(0x7f0000000040), &(0x7f0000000080)=0x4) 11:06:59 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0xffffffffffffffff) 11:06:59 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018748100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:06:59 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x01\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:06:59 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xfffffffffffffdef, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:06:59 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0x10d, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:06:59 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d8000000187a8100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 920.819278][ T27] audit: type=1804 audit(1577272019.833:461): pid=26227 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/716/file0/bus" dev="loop4" ino=223 res=1 [ 920.896143][ T27] audit: type=1804 audit(1577272019.843:462): pid=26236 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/716/file0/bus" dev="loop4" ino=223 res=1 11:07:00 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0xfffffffffffffff0, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:07:00 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018f38100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:07:00 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) ioctl$sock_FIOGETOWN(r2, 0x8903, &(0x7f0000000000)=0x0) syz_open_procfs(r3, &(0x7f0000000080)='net/tcp\x00') [ 921.012129][T26230] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:07:00 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x02\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:07:00 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018fc8100e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 921.363898][ T27] audit: type=1804 audit(1577272020.383:463): pid=26261 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/717/file0/bus" dev="loop4" ino=224 res=1 [ 921.399562][T26259] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:07:02 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x03\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:07:02 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) r3 = dup(0xffffffffffffffff) setsockopt$packet_int(r3, 0x107, 0x10000000000f, 0x0, 0x0) ioctl$EXT4_IOC_GROUP_ADD(r3, 0x40286608, &(0x7f0000000000)={0x80000000, 0x8, 0x6, 0x446e5628, 0x4, 0x9}) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) ioctl$PPPIOCSACTIVE(r3, 0x40107446, &(0x7f0000000200)={0x3, &(0x7f00000001c0)=[{0x72, 0x9b, 0xff, 0x1f}, {0x891, 0x0, 0x3, 0x3}, {0xc914, 0x2, 0x8, 0x5bd5f3b0}]}) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(r1, 0xc0205647, &(0x7f00000000c0)={0xa20000, 0x3, 0x200, 0xffffffffffffffff, 0x0, &(0x7f0000000080)={0x9909ca, 0x7fff, [], @ptr=0x4}}) r5 = dup(0xffffffffffffffff) setsockopt$packet_int(r5, 0x107, 0x10000000000f, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000140)={0xffffffffffffffff}, 0x111, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(r4, &(0x7f0000000300)={0x8, 0x120, 0xfa00, {0x2, {0x7f, 0xa7d7, "596c8ca2b32c356c83f1a18468fc9723e560e8c589fecc8e2029f1d281e8ae4f899856ca9b507c07b3d4bac48108456a450e45fe73d8a91858cc02ed0400f5e4685131f7512107ca769e5958f8e8785a098cca200cf80156b61a5caaa5c20730a6991bbed094c24038ec7a22a05faa3ca2f4f992428af453886e6d8cdc3ab0ff600f4c3d5547159a5a7df32003bff39e9a1c1b2a4f28cb177b057a706811a07af4d7802028691b1339192a0fa0ba741102775756472b83501bf697056feeb221ec110ab353798a7a663aae2e889868bf51720763ce4810e05c4c841bef696da7a3526d55bfa60b32bfe6e0439f87c92ca79ef7c2da2050ac6e72b92e84e8b85d", 0x7, 0x6, 0x91, 0x9, 0x7}, r6}}, 0x128) 11:07:02 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008102e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:07:02 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:07:02 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) r1 = dup(0xffffffffffffffff) setsockopt$packet_int(r1, 0x107, 0x10000000000f, 0x0, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0xc0502100, &(0x7f0000000140)={0x0, 0x0}) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r0, 0x3c) r3 = dup(0xffffffffffffffff) setsockopt$packet_int(r3, 0x107, 0x10000000000f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000000)={0x0, 0x5, 0xfff, 0x101, 0x400, 0x0, 0x5, 0x1, {0x0, @in={{0x2, 0x4e21, @multicast1}}, 0x3, 0xe113, 0xfffffffc, 0x8, 0x2}}, &(0x7f0000000100)=0xb0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000280)={r4, @in6={{0xa, 0x4e23, 0x2, @local, 0xffffff00}}, 0x0, 0x3}, 0xfffffdd9) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:07:02 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0x10e, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:07:03 executing program 2: r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = getpid() sched_setattr(r1, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) prctl$PR_SET_PTRACER(0x59616d61, r1) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x3c) ptrace$cont(0x18, r2, 0x0, 0x0) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r2, 0x0, 0x0) [ 923.960141][T26286] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 924.026040][ T27] kauditd_printk_skb: 1 callbacks suppressed [ 924.026064][ T27] audit: type=1804 audit(1577272023.043:465): pid=26291 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/718/file0/bus" dev="loop4" ino=225 res=1 [ 924.045647][T26281] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:07:03 executing program 1: pipe(&(0x7f0000001340)={0xffffffffffffffff, 0xffffffffffffffff}) fsync(r1) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000000300)={0x0, 0x1000, "4fec14cb24d25b68f17810b0c3ead96c54bdbfb59d5b1b3644a9ebe75f438e71fb51998920e3e1f2a481e53354a3455c81dad20249636987f08535e003f5d440d1680e418be480dc39d04e8856d03f25a5abd15445f0f388f05fce2e790c81e3c61c25591c3f4fcd8d451eb7a27816728740abd046110a22458249467648748bc487f20a6ee9273487c97eaa15e0d0de41c31a63d737aee373cfaff3a9770f8a3875b1546b9bcb39db50ee6c3f7c3fe6985b4ae432b30c25ed83f94bd3a6b96d51a62db8d2c06585d61613bbdc8fcb94f1a0a7ae1c7d231057f606adfd52c0430f4f4d33825063d8eb98e63602b9f5f946b312bf3629f4ff3cf658083efd7cfab1b372089dee5f5a3eb30d681fd0bdf856c4ca2eea1328754c5c94a8201fd58e7aa48e1d7a38d941558c6c43d6bff87950459825e75060da887500d261f0f83af1cf4499448c9a69cd5505730574355e3c9a3bd412f86846abb32366d2ca0c6f9d8d3621664563192a0a26b1ee9865edd0bc3ce8b2ade604ea9cbbf653690fc4717299a7284d882acfa654e595e4cd4965e0703143ecfcd50bc85d24e37f860060a7948048ea4130adadefc1df9c3db2cc2ac51f388a6429e881b82bf27a95061e31d3266c4c582c9cc471c2611189b167cc6a60069010e3f48870dffa5e0b4bf89a207abadc3122a585763d0321d2066ea4440edeac8cc3ccd9f462e700813afa27440953d587779ff035777bafd95f18fa16f5168d72356a9e981a3479d6c49107f04f5ddd60cc932a8b284ce901a08bdaef9f78d89354edcfd1076ac171829d006ca382463080620645ad1c7f9442f5b22f228abfb97e9ce6fe211efb7f844a506660a76d615abfbb64e651ac37612d5c42d47c817ca7c315f286f47c0a603f69455ccc93a08b86cfd0109a98c6919e4475e30b92d579af048757db69259fb17421fc16c4c835a65951b3f423a52cac32fbda713c73318f7bdc68cd607f04cff183e25e8857f26f06385ba408ec1c47ca011938776e9dafe60be80ad59c4e385ad6d84a2dc498ad723286bfcb3d4d0e12fef8b169bfa5f2557920b512ab0a7c20f9afaaa9e66713ba4634de27e71a96440b76bd5ffa75fb983c081d341d2a0545b3e9b57b12494b7d5975a9000dc86539b60dcd80eeb7c399d7897a0c2d11f0d80e71efdcb17eedd406d4c15fbbb836afc0a3cc76456d76ba0e83aa987945f568bbcc11ea1af831aa4f1df2dcf4d648157f5073cfe2adb754638406263ab205bb7abd0c55c2d1332f58c845edf65ba6d88e2dac2c6e280186a2310092d3b860e3ddb970a5fba3ceb4788ccc10c86139ed4833f57f0a73e9c9bf247e019343b9e3536120d4569d3cb62dca01324e50c00bda3590458d428f2bfd8cc5b4cc5e8fe1712a66c0a13e4404cba0cdd81e022ea98b1ac54603d0600b97160646cb9df4a39346e3f2996d52e11658bcf3c57735413f31390fd3cee8cce638ae742d054c696b77c2158c97396d5a9d1aa7e585f770a5ba79c55f07d1bc5c54d3b54b056286b371e9fea2933c39d7dbaa4d139cb534e7ec1e7b9f7d58e236edd4439ab5df7ab8137854eee55eac328a3383f891400c5dd159831f8496cac48497c9a186dd3964dc2dd39c75d7427cb06e07c7c68cf55af396a0aab0a00537c38ab770935b137b1173ddacd12f4634bfb195d4c86a9005687929239889ccd696884c9413b29f4df0a156d9ca2e4db010d0b662c0a0fbb7cfe29c7b19b22e3c22470c938dba0667a7c930d013125f3b97248b466aa204c47cbc3b395042cb5ca60af277d07650a5a2df8d7ba929b2bf8b39ab7278d0f07d0483562329e82e4ae4b93cf79469b8249eb9910143d520288b409b9075d04d82a3ee31b33c7d45566572b7f61edfce48f0e73e5e0c7a04421c1f10025a18607f64daa9a494e8b6598ded555790bcaee4919605e3b3389e161514bc5e30faeaf0767273c9ea7d9ab550bf51aefed7f4f5124d6ccc6b02f03f6e84a49107bf9346315d1c8a5f0fafcbf7bd9c19b89f9a674acf471e9784a6d9f823456fa6421bb64788b94a238c3ecadf572adaca30255c165293215542d8eac9737c22dd2831efc0bf8303901e92d2b6370b68677c1bb9c425a56eaf490af7810f3d673965493314d33859d29ab5913c29f744a74e7fbe3422b8df0804bb5728b7d254b1bdbf849a22e9016573e8d63e8ccdef2b5b23519dd9d9f45fdf15f94b17078db8a044eeb4e347d4916ed3aded3f0cf91f574277e9648f6ff74048e5233e91b924c86be80e36eb0fbe17111b4862ebaef7fdaba762577416f675ff0e1681b3cd8cd2fbe01da069d4cb801fd6c58942c2aa9a6562b38bff0a0257d837cff8a5d7a56e7dae6fd8ac739e275f451223cfaaf48d7204303000afc798e78a7544d038ceec868785c66fc5767abb94ae3bbdfb4e21fb2e2e9b779ea8d0bec8fe6350bc1bd68df6b69a7118b81f075c81921402ff178d0e1d935bf9dbd39a4340befed1f55cd70e4f64cf560eb580cd81397fd1c24de15aa7f1800a8818cf7442d1fec0ae3753e7375e465168d4da51df754ce506500aaf25f0fbb430b223f9a7f4ef8d8f2712f3343a54f2a68e1c374057aa9547be07ebb8e4b45ae6f1aa6ad17986779b241cbf33259ee0b2c29ceff016b56130756d0ec79bb2953871d79c55f4d4637ee77bb02ab97b9efe25bfe3c75378473645f6999aafa2acaaeca8aa176019b892f71c0951e43f3b8748ad3eaa86eec3b673b76d95ae36b8eda3697b65232629c2550dd7dfd9d494987df27478cb9c60f47dd0181d8ba923fd1590d1a86a99eef5391171a1a265611c42850e8850124e930fcca0432267dd1aa95f76e126241bc1935ebf6b391ebb098b9f9100dcd7b67090c321dd968267dbb58f79f0c7a82614de0328e3603ca396c7e3aecc6dacc8f0d3936a3acb809b9441bfa3c55c97290e3740cb6fa9f48cd2c385da30b25d5609aae0d718d9a8043cb1859d477ebee4fb90f21cbef13e86f59c83e694c9bd2dc61be250e1ec04a6e46d1ac5a6c26a671feff90830b19d17082147152922e300bfa139198904addb7e141e0bfbcfe031e87a34aa7de183331a7d9996ea2459390fd46e066ee054377cd02ed17c3b40138b225cc5a381bdf5d0febeb2de50d11e276efc6f2e53efcb0a978c09f52b982832ef5deeb9865f75a31ceb555aeb2c44885b9bc5fda1ac68b9f57a55062d27b8bc10bd3b79ef95050479ee7299b0d118a934978ef06be9e654f01615d6d015a6a3f71749e84d5bf9e196493db5aec2f647100d32c45bffe5735490e2121c29c79f7eca4904ace339bb9b9e4136d95e97419c465e5fcba3d0606d06c6992f8453b3e1b9303ce82fb7b9bd7f07d7c74f8132dceb990e3efbc79fc510c5b8928a6b641a021aaf273d6d7bbebff93af2a870b82a9f1ff82c66ceca2c1bef0918af7327d2946d54def654699a4c5f63a66427eff066ec8f323c6a25c5e76b0f709cf55e2b93a22b0cc007fa19bf1ee7319d7088f93024615616f667a79b14a6b3b44f06a21f2728a9f2eef0ca7b545c6e73cf6e2989f79e5b3309624bc603b674a3bf3ba564ecaa3ddc33b0663324dbf4f0de2b737d52eab0a883a96ef55395c0da946db60b7667c400816346648fe072310924740f34d49270590e7267f2a84f9db8305982afd42abc1c28f9631832246bbdd66b1f0d6c6c89fde21a117f685af4202a9f5bb1977d86ac5b00fe07a371e6f5e3770297c6be4f0b6d483670ce7fee64603505cffa4ae2918e8374dd33655b7b3ff8843ce52fc2d1ae3b628455d21cb6a8f8f50ec8edb9389150074ba1676fb91e08a9ad47fce23305ef3894dd228b5fb8e10c25ddcdb83107a8ab7b35cd9d6210407c748f30b3a57414df66e05199bc60820161d6fe6e1e17afbdc4368ab373f13fbca92bd68470020fd676233c9f5c49a2d306d8228f4e86fce1b0270faeb393aaabd2cdfe745903de37af601b087c00883921d4a7a679816820d4a466df01026a2539ca568f0b18f0505abb799a64f98262c9ba34081376fac7c2ded5932513cb1e7f5080927512a24e6a4559dc27cd94a798fd01728d77d18dab3039739e54c22d4b1d8063da9c7115d5d7b81889ecfac1ebe422b831a1b686ec1f917635746d67c92afa3056e61f6586f95c2dfbf90a4189e9c9687e6d4d7c985eb4695d53ee5654da6cbd1aa59816a07b25ba229ad738e59577b49cf085f60f5b2da4bd3ca47b1b63d99458f7186e640ebf39027c135b2c9ccc9d2f64340e195989c151e7ffa1fa8e3ccc394b329ec6dde6fddb4686ad1087222aed0a4f6f3a1c88648f4cb08e6238148db4136d68f121c4050cdf274cd7df8e056f72c3fc1fe1fd8c907631ad9a78ea9d0d211c7cc68758b6e5a322924ee2bc4580d69444acc82f48098d82790124ee3d6a5f3cfd7e378294cfcb78b8c8bd2db442dc45c62a5f3638089b4be69249a6841bfc6d24226c0acde154603894101e02c7210100f64709c13cfefc2f957d547cc7a309a92f3cbc49a68ff61d3cf3e616584f4a3798ab651904671917aef572c74b997ecde4f353d594fcae9feed26018181aa49fb911611a9e9a9d6effa4e58221e527f5c48e4a9104f241737566466b23db6bf5a1c96a3b78fa0150415b5f9e4c6ac6b964ec76406949dc0e6ae747755e89527e3f2e4c9f1ce4ef34f40c6a5530dc42e34c5ca7e81d7159d56c30f146945dbee99ebebf26154d5c9cdc0793337a83512add707abaec1278938499e609b5bcdee1b2503bcca82460cbbd25672c4790ad0a67e9688b92ab60895223b43cc46741ed258de5352879774a85c73186b82114f5264667b33991d56dba39ef2006831c41c8894b0bd04c7a9903eba0291bb7725bbb70e26ebabe60c5eaca8568f2c16bcc8704cfe25c72ad766dbc865c28fa9eb47df2878de7980eb215b067003e1c262afd1d66f12a562afabd6f363bb48a3079777129eb07985b8853225d1624d86b131456057f06725a0b9d6f969d514241f1effef76535823c8a390ac4dd0b99e75f171856d39357a031e8d6a5611af69ff3f965e86f39f31cd5c96cc10745b5d3513f7a016524c1ec743946c44a3daccb23f75ef7c1a329a88838a9a5c298af916b836632cba1ecb47221c0651f54e75aa5be984e16122ed27053e04f553797ffe727ef4ef7d7423ac3c267b0694f32d0330fe993f21550c64e2a14cca0f87b1e33d624d2f7296a3e6fe5a5d7fd412200e3c8213f30aff2dec97cc0312000affb1e24eab8ebfb3d3862ead807f0c82fbfe90309999eadd42a76339a70c8386ec1c813b32a9028337fa0fbbc3583fcac40489707eb47458a8fbf0bdb71fe5db68b26c0813366e904c8f106a89e24b92e819b4fd19fab0ffd9096ff8486eeec9b79da9c5418fbcc4e9aea80abd110778a66cb526aeeead042f78f0449eebd7cbf9658045b808609d7621c7aaeefe2ec6cab98e0890c0657653461da7fb1e825a9a16ced629970bca479eae49847f12c5e68f657f9a69b157dfb1e5a6835c4a8a6669ad30b386afa0263c77dbe357f32797a4c44cfd86b683017a7f3b4ae45c60d1b6ef1ce10a93f71eca255bd47472449a5fca351debf0aa1fdc208cbae8db91f03b23404eee8550fbd9ceee3ec78b0adba63088c764a965cc78b859e14cc58091ce477e83fc217241fb03d652028ea4d63e70e7a666321fea03adaebdc3b0618ed09d1e212bb93c02392abab058db6cf114796a3efed244ac9b2bb8b1190e524fa099f1fb3fc1dbc"}, &(0x7f00000000c0)=0x1008) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000140)={r3, 0x1, 0x30}, &(0x7f0000000180)=0xc) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 924.087034][ T27] audit: type=1804 audit(1577272023.083:466): pid=26296 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/718/file0/bus" dev="loop4" ino=225 res=1 11:07:03 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008103e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:07:03 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x2, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:07:03 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008104e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 924.402238][ T27] audit: type=1804 audit(1577272023.413:467): pid=26313 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/719/file0/bus" dev="loop4" ino=226 res=1 11:07:03 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(0xffffffffffffffff) setsockopt$packet_int(r3, 0x107, 0x10000000000f, 0x0, 0x0) r4 = dup(0xffffffffffffffff) setsockopt$packet_int(r4, 0x107, 0x10000000000f, 0x0, 0x0) write$binfmt_misc(r1, &(0x7f0000000300)=ANY=[@ANYRES64, @ANYPTR=&(0x7f0000000140)=ANY=[@ANYRES16, @ANYPTR64, @ANYRESHEX=r3, @ANYRES64=r1, @ANYBLOB="29bbbc8d985223ef52d9fe463bf75f2ff3b3ba33e9ced8aa16c42134066b654bd04be511d71c512154d258a77f64b8d3f7e5230f075aa37d81044b9c04f95e867acd180a0f897768633d1d89181634f84fa9870abd9a0d7d664e9d8a98e23d0acf81302d1a8799e49fd1fb0ed2ea06e06036e5c939b516e35813add9edf18de5457b6c0c3967f0c86c7a7f4c7112a5a4d75a4ed1f395a23e02e0f6adc0bd909179f90cadcf5cc18984e30b519001f9540acd9854c03c0021706750eebdade4ee69286c1823e84cbda261476c88a06b80f1"], @ANYRESDEC=0x0, @ANYBLOB="fcfa2a90a4bc055a095154a94dece2c7654fa1124ded24e047c5ae449257f2cecd80507d7f0183e606d5d4f7703b019b5ebd0a9ad8d0704c2def7d4c1a42a4d04c919bf64e71c9fb66dda022e0871fcb4306adf0f09b4640b7f2791935d757e093f119adfeb3b2dd766658e4c7b131bf55a1495004666bcfd066650894ee15608db62fcd597c2dcc345feeb8a24d732366fd5bbe1d3c518dce762f9f41cc8467dd453f6c27cbb37fa27b973c9b79f8671e612c1be230f546dbb4e97a442e4bd07ee6746ee04814fa8049c691d56a11eacc7a4f89f9f27f0ad96569bb08acd2014523713782717c0072bf", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYRES16=r4, @ANYBLOB="18ae3c8b6f1171e61fbe9d7cb363c5cb2b95a9033ced36ed07da40824feacffeb8bb6c1d851196e40435e6b6c5a5d5", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYPTR, @ANYRESHEX=0x0, @ANYPTR64, @ANYRES64], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYPTR64], @ANYRES32=r2, @ANYRESHEX=r2], @ANYRESHEX], 0x128) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x47, 0x47, 0x8, [@ptr={0x0, 0x0, 0x0, 0x2, 0x2}, @enum={0x10, 0x1, 0x0, 0x6, 0x4, [{0xf, 0x8001}]}, @datasec={0x1, 0x1, 0x0, 0xf, 0x3, [{0x5, 0x96, 0x4}], 'F98'}, @restrict={0xe, 0x0, 0x0, 0xb, 0x5}]}, {0x0, [0x30, 0x2e, 0x61, 0x30, 0xc2, 0x61]}}, &(0x7f00000004c0)=""/245, 0x68, 0xf5}, 0x20) ioctl$EXT4_IOC_MOVE_EXT(r5, 0xc028660f, &(0x7f00000005c0)={0x0, r2, 0x7f, 0x80, 0x0, 0xff}) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 11:07:03 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x04\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) [ 924.442417][ T27] audit: type=1804 audit(1577272023.453:468): pid=26318 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/719/file0/bus" dev="loop4" ino=226 res=1 11:07:03 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008105e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:07:03 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000080)={0x7, &(0x7f0000000000)=[{0x8000, 0x1b, 0x73, 0xfffffffd}, {0xcc, 0x0, 0x3, 0xffffff81}, {0xec7, 0x2, 0x1f, 0x7}, {0x9, 0x5, 0x3, 0x6}, {0x8001, 0x92, 0x8d}, {0x31, 0x5, 0xf7, 0x3}, {0x8, 0x9, 0x0, 0xea}]}) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x0) bind$inet(r1, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r1, 0x0, 0x10005, 0x0) 11:07:03 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x3, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:07:03 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0x10f, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 924.705335][T26324] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:07:03 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x05\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) [ 924.881061][ T27] audit: type=1804 audit(1577272023.893:469): pid=26342 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/720/file0/bus" dev="loop4" ino=227 res=1 [ 925.002064][ T27] audit: type=1804 audit(1577272023.923:470): pid=26344 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/720/file0/bus" dev="loop4" ino=227 res=1 [ 925.068107][T26349] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:07:06 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0, 0xfffffffffffffff0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) r1 = getpid() sched_setattr(r1, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) prlimit64(r1, 0x7, &(0x7f0000000000)={0x1, 0x7}, &(0x7f0000000040)) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0xe8c0, &(0x7f0000000100)="2e519e5b1aa5d6fa663df7b8468f5a8b91000000000000f0105011981532f27919a7b88592819ac88cc152785345415ab276d60695ee87b069b9dfdbc0bb4eb1918309c2d57d6399b0394d338e2bad0452b5c53cc4b76473188e087255cd0e8d6239d171151214d380974918eb3a0990e1d505d493fd50c9bddd98") ptrace$cont(0x20, r0, 0x0, 0x0) 11:07:06 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008106e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:07:06 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x4, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:07:06 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:07:06 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0x110, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:07:06 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) r3 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x40001, 0x0) socket$kcm(0x2, 0x2, 0x0) r4 = socket$kcm(0x2, 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r4, 0x1, 0x3e, &(0x7f00000002c0)=r5, 0x69) sendmsg$inet(r4, &(0x7f0000000240)={&(0x7f0000000100)={0x2, 0x4e22, @rand_addr=0x1}, 0x10, 0x0, 0x0, &(0x7f0000000040)=[@ip_retopts={{0x28, 0x0, 0x7, {[@timestamp={0x44, 0x18, 0x5, 0x3, 0x0, [{[@local]}, {}, {[@remote]}]}]}}}], 0x28, 0x5}, 0x0) setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r3, 0x84, 0x13, &(0x7f0000000080)=0x6, 0x4) 11:07:06 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008107e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 927.264942][ T27] audit: type=1804 audit(1577272026.283:471): pid=26367 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/721/file0/bus" dev="loop4" ino=228 res=1 11:07:06 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x5, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) [ 927.372667][T26363] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:07:06 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008108e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 927.429974][ T27] audit: type=1804 audit(1577272026.293:472): pid=26372 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/721/file0/bus" dev="loop4" ino=228 res=1 11:07:06 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000280)='/dev/full\x00', 0x200, 0x0) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_bt_cmtp_CMTPCONNADD(r3, 0x400443c8, &(0x7f0000000500)={r4, 0x9}) 11:07:06 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\a\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) [ 927.592859][T26389] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 927.680757][ T27] audit: type=1804 audit(1577272026.693:473): pid=26390 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/722/file0/bus" dev="loop4" ino=229 res=1 11:07:06 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008109e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 927.764275][ T27] audit: type=1804 audit(1577272026.753:474): pid=26396 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/722/file0/bus" dev="loop4" ino=229 res=1 [ 927.976493][T26398] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:07:09 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x6, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:07:09 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d80000001800810ae00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:07:09 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) r3 = dup(0xffffffffffffffff) setsockopt$packet_int(r3, 0x107, 0x10000000000f, 0x0, 0x0) vmsplice(r3, &(0x7f00000006c0)=[{&(0x7f0000000140)="b6d375dd8e225a7a72f7eacbf9d5e81275a1339e520906b5c7fec4497462432372c5d3a4cb71c3832b7bda6303b6a3bea9647cf88f5de42c541db42963ec6c1c622eab96d421e9fa9a05304079118b5daefec68b3cb33cafe2f6", 0x5a}, {&(0x7f00000000c0)="4e30f9239758183d256864b6ba1bf72e885edbc1377d345f9736df80ebd566e83104dd7f2025e60d59dc", 0x2a}, {&(0x7f00000001c0)="4fd2aa46cc198ebf6df9f36013aa113577f02c52aa4efe3a9b36909b4fcbb9739894d96199d56a0db3774672e3b5d3abc050b3f8a5b8ebafb39aff441b61b3ed223ceda5719f8e4cf39755fe95a531bccc18ea8d07f2a90860d5a706186274f1a697da572ee30137c6e9822c6e3895cc3b937b5535e24a76e4f1ba52ceab06d88fda0cb6682a212dee7f4769ac1d1b9724f97b71a2f1ce009f1b53ba811357adc88effa24ac013ab9aea3e8617a00c2167730ad81316b6a438f62a9e8059a8df0ba568981ccd2f908056bea9f1bf69d8319d981bddbab94b72501cde05984e4af74b5c367bf46e9f9541e8", 0xeb}, {&(0x7f0000000300)="837fe264a28a2490d102de435f013758516795f89bce2307757db93423e04f03fd5366056ba784b790a61b201b489ef5e18bf265771d9e1a3f157e53ada3d0f443948e08b9eafb90afce956d899c477f8c475e9aa6efd6a0193e20ff32a98d309e6a7bbe21c87698e2333532ff79a98f846a0a2e23f47a06b62f3d14d5d0ccc6f44e70623e1e157e41c261d28d50c40b38df9a3e562c529d9f85d3039efa671efe8f1a263851132be469", 0xaa}, {&(0x7f00000003c0)="47f7b1d0826d84eeb467f4532e78e828d395868078e0f51c305c6d2ddfb6f3d4b9b0d6ace5b4f6dd84c4a6b270a5565b28d5628f4ab0ccc70bf2d3a0a46e0e78182464b754a32a73812d535bede9c4592293cc9712946caea059edb9424360b3ab4379265ee3e61a4548cef54dfb6ea0432d8c760591f9e407eb853621138e560cdaea082d93e016f70433b6573257d458f781eb0fdd1db4a817c1b1982dbb79160786ae5f8bbc9017c6bdc82c02f405bf7bc76b", 0xb4}, {&(0x7f0000000480)="cbaacc56c03e252d590f6ab41bed3c2504eee204584f2d28931224bac5fc5a3781cd4278405266ceaf259b863a8de34ac3d8f4808bf53aa844710698b7f9304d36fbe43e4d5320", 0x47}, {&(0x7f0000000500)="5b1a0c21cc07ccaaf0a277d80157364aec286e9d9b5812f5a711fdb40320ee40360977270fbb4c4a145ea4f3c8382043f246a2e879304c13660e1c966160a82ad3dc3b1f24bc82303514008f24b57724363ffcdc4d1f9b1672fb53fa083d7fda36ea795fa1930ff9606d99542c81e7ca4b4f9a8dd1edbe2e5bff732e44260c219dd56b81aaf99100d41a16b677d23847cc43c33acb2cfbf4b1be7e28a74e36d9f145cce35b39532f9c866046da167cc7c18b0691c32d47b4a8", 0xb9}, {&(0x7f00000005c0)="6f62f53c18cd2f015a4a16eeb242d37a72480da812670882f3a8cc89a573ab7370497032080546b762d1551fe8828ebea614718019df1bc8959d34bf68a34e2062c3458cf192e01693d63c0c9cfd7d6d53527cd6e9fa8587e0edd04242d3d5ac0a00d0dfda719278cbbe4d8cfc5e403bc8d9f0bb072b58e88a4ed961c8562006c55689e44e2a253c26cf5d9fb00694ef9aff5b1049d26c55455c0d965b1a7d03c7d9fc6ed607c2", 0xa7}, {&(0x7f0000000680)="d4030bc529cce330101460b7625a54bdc46c668e4c4f48013b98a1f8354f83af7282d40d6f18859f4ee2842d1f1b4d720484d375bf85c4efeb5cac", 0x3b}], 0x9, 0x3) r4 = dup(0xffffffffffffffff) setsockopt$packet_int(r4, 0x107, 0x10000000000f, 0x0, 0x0) ioctl$PPPIOCSACTIVE(r4, 0x40107446, &(0x7f0000000080)={0x3, &(0x7f0000000000)=[{0x400, 0x3, 0x9c, 0xfffffffc}, {0x75, 0xff, 0x80, 0x7}, {0x3, 0xa1, 0xfa, 0x7}]}) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 11:07:09 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0x111, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:07:09 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\xfe\xff\xff\a\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:07:09 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000140)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000013c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d01005ae6080000000000000079aed75d492b41fd983f79e65199615607672c59e6020000bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edbe92175aaa1c4ecc7aeeb72e0d050000", 0xfffffffffffffea8}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = dup(0xffffffffffffffff) setsockopt$packet_int(r1, 0x107, 0x10000000000f, 0x0, 0x0) r2 = dup(0xffffffffffffffff) setsockopt$packet_int(r2, 0x107, 0x10000000000f, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f0000000180)=ANY=[@ANYBLOB="05e33759222701a22bf3527a2a2d1d00f061", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0], &(0x7f0000000100)=0x18) setsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f0000000280)={r3, @in={{0x2, 0x4e21, @multicast2}}, 0xff01, 0x120}, 0x90) r4 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x14000, 0x0) getsockopt$TIPC_NODE_RECVQ_DEPTH(r4, 0x10f, 0x83, &(0x7f0000000040), &(0x7f0000000080)=0x4) ptrace$cont(0x9, r0, 0x9, 0x3) prctl$PR_SET_THP_DISABLE(0x29, 0x0) [ 930.430599][T26431] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 930.483749][T26425] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 930.494042][ T27] audit: type=1804 audit(1577272029.503:475): pid=26420 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/723/file0/bus" dev="loop4" ino=230 res=1 [ 930.539804][ T27] audit: type=1804 audit(1577272029.553:476): pid=26438 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/723/file0/bus" dev="loop4" ino=230 res=1 11:07:09 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) socket(0x0, 0x4, 0x6e) r3 = dup(0xffffffffffffffff) setsockopt$packet_int(r3, 0x107, 0x13, 0x0, 0x0) connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e21, @local}, 0x10) 11:07:09 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x11\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) [ 930.570973][ T27] audit: type=1804 audit(1577272029.553:477): pid=26420 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/723/file0/bus" dev="loop4" ino=230 res=1 11:07:09 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d80000001800810be00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:07:09 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x7, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) [ 930.791306][T26446] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:07:09 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r1, &(0x7f00000002c0)={0x2, 0x2, @rand_addr=0xc6fd}, 0x10) connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) r2 = dup(0xffffffffffffffff) setsockopt$packet_int(r2, 0x107, 0x10000000000f, 0x0, 0x0) r3 = dup(0xffffffffffffffff) r4 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/bsg\x00', 0xe1f024525ac3f837, 0x0) preadv(r4, &(0x7f0000000280)=[{&(0x7f0000000080)=""/46, 0x2e}, {&(0x7f00000000c0)=""/8, 0x8}, {&(0x7f0000000140)=""/118, 0x76}, {&(0x7f00000001c0)=""/149, 0x95}], 0x4, 0x8) setsockopt$packet_int(r3, 0x107, 0x10000000000f, 0x0, 0x0) r5 = socket$caif_seqpacket(0x25, 0x5, 0x5) splice(r5, 0x0, r3, 0x0, 0x10005, 0xa) 11:07:09 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\xff\xff\xff8\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) [ 930.938838][ T27] audit: type=1804 audit(1577272029.953:478): pid=26456 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/724/file0/bus" dev="loop4" ino=231 res=1 11:07:10 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d80000001800810ce00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 930.992184][ T27] audit: type=1804 audit(1577272029.953:479): pid=26459 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/724/file0/bus" dev="loop4" ino=231 res=1 11:07:10 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x8, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:07:10 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d80000001800810ee00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:07:10 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0x112, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:07:10 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(0xffffffffffffffff) setsockopt$packet_int(r2, 0x107, 0x10000000000f, 0x0, 0x0) readv(r2, &(0x7f0000000000)=[{&(0x7f0000000140)=""/208, 0xd0}], 0x1) r3 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r3, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r3, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r3, 0x0, 0x10005, 0x0) [ 931.188292][T26465] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 931.419009][ T27] audit: type=1804 audit(1577272030.433:480): pid=26485 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/725/file0/bus" dev="loop4" ino=232 res=1 [ 931.527766][ T27] audit: type=1804 audit(1577272030.433:481): pid=26489 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/725/file0/bus" dev="loop4" ino=232 res=1 11:07:12 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = dup(0xffffffffffffffff) setsockopt$packet_int(r0, 0x107, 0x10000000000f, 0x0, 0x0) ioctl$sock_x25_SIOCDELRT(r0, 0x890c, &(0x7f0000000280)={@remote={[], 0x0}, 0x5, 'veth1_to_team\x00'}) r1 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x3c) ptrace$cont(0x18, r1, 0x0, 0x0) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r1, 0x0, 0x0) 11:07:12 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0x113, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:07:12 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d80000001800810fe00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:07:12 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) ioctl$sock_netdev_private(0xffffffffffffffff, 0x89fa, &(0x7f0000000300)="c6db2995063ba22eb65f1d782205b9dc7f7e09688e1ef53ee4c00730053fb3d786e6239a2172f6e297f62edf5d4c5b658984966ae0a6b30339393b8fbe67acbe006520058da43959e538148333384b6585dd17c3215fe27575ab4641ed20fff2a41213c38cfea03883e072e9ec71f04ecd1ac2b09e077882408e1ea5a4339912e1ef2c92cab1cd0a7bd5413b16b261e21d481865361090075fcc64dcabe9b2a12998893dffcb00e511d97a52b1379863509f95c8a553de2f3115ee3720ff58a4d4a0b3adbcd7661208d8d29fcea1a93189e08159300c1b9d31f57b6ef0163c39d4d580d2dad16037ab1ba71aa74d8b6fd0cf64ff0886662b29f763659e4c3bfb42235eb3573b8c1e669b7d285e05b5e725bdeaf53be6958adc97d4aee4ada1bcc5dd075d09276d656e3d4a70b8699cec90ead72c9c73dfe0ad37d9ea1d785e758c5578cbec62269f40438540045a1898e4bc246929b7fa740bdf4cff7d27684885ae1b534de362a3c6c954bbbe370265fc73a61fd6f4a08011f04116a52721a19d7227384dfeecfc017151ae5d1cb8322bda0570d9618eb9faff067c0caaf5b4bd96fb7be252df640c06fe871340e7c4d3a52e6838ece40e6036a6bda0c7660fe13029e4537c39c426ce483b8aeb5f58c034b9cd6f2d07bf50880c461c588dd285dfbe0c1b2e3f72f0a0505a63e37445513d6f9d1d2fb8cffd15985a952f8e60959292f168d81687173d94a066110f028d9c35b7e0ec6d33b9cfc136c593227d6617804f31a360561d4b89892a50d166891d47a50d4d33e81bb809adcd5c7e5c806f8c305ab40c338e1e08b1de23126d82a6f45daaaf5b9f7cbe9dfd50078adf740d512ba5cbe6b1d428586f043704e8c78e16a97142214764cdf959fb720f884b1f0dc791ccd6377740d09f62008dab2534dc07de000225353c000f1509dab8974cdf931412ba74f20e8339b458107b92d5591ddac5c855105248eca812328bd6e668ba67d82567eed21f922f90153429a4e1c8eccbff7a534473ec6e24fd4047edc6847f3c37829591c423f97e3bab1a9d44f41cac359e3f557cfc4416849ddddb7a6f681e14caa978674a912e93dfff2a5a37454607479c0574b49fbeb6e3a3404af28e47fe750b8b6f8fd76fc5ac5de871b05c4c41924b99b97aa06689a53c09ef21776d84de04c2d2b1fa59cc4e2be56f95b7c1df362bf183a7fe1a1f5490e15a4c9837cec23af9e6fc0205efb09c5f038c113a56c349a8d73c1da5f4c9c6ceeb20d1dfa89085af3eb2c3975e9f73224ca93a71ad846f512bee17c17619019d00c969059f4268ba7d046a2ea2be74bcb6094a0f87c6533f0d01611da19529ae28a7003d698e1e640e0724aa772efe7c053eae0759375830e9c4ba5132b3a650dd2ec7d8c800eba4f2d1082756291b4d5d9fe60ef632819b0ed1cdef33f84116182746fc1042a53edd8f3c2bda57430b44b35b4d2c75004f360711f83e740f290faeb47f0a2e15e540ffa0ff1677185d0eb91f95074ffe17d28ce865414a8b1cf48cdf9cbf32339cf41d5d14abdbe2aca70d512f3c82f39d1d68e189b961e1bed6d76dcd49f673bf92e9b80d1dacf1c6983b38056a8791fc30ab8f258355c81dae34307291740ed232018cee0c7ee70d74f96d04c7c3498f5d0c0e41f4de0fff53a65e47a43ca2780309122a2ef8c0f5fbaa79c5a41c0106b8cd0cf50d17ccc6e75bd531c15cefabae1239650568233f579ae92284cd5c18bd09793333c34d0b44970b853fd17729cf4bc547fc57e78258bb2fc9fdfd3decb408dbe3dfee75fae072b2a182e94105d4c32ade6ac6cd9b33f3ec0e512095ee2a85a26fb7b03eacc6ab8b80b41a471fe26698272c6819f1f1fb79b3f95d7289d1af239e3f5e64dfe18df657179ce1c23bcb0b23105ce8d0101138143bff88af983933e2b289b75d1b102b66f9e5fa5be7af977468b98c3bf61c1d7514e5fce87431a76ff1c0ed3bb82682377b7613018c071b54d1e13e39cd0a807205dd0dc84cd26716934887d62eeb66f2e2cc861c405765db901fc37e940a683d7dd02d251f0123317ebfda1b4293e24787df15e702bad3fba5a976d053f9962bf40a04c6e8cbb72d2ecb360f5f297991b20a7d9aca81a1d7d3a6e69ab57e08b90aaf22a217e70d3b61fdf5e74cc2c1cf0c66b8baf11e367ea254aa2b032a813a68d6284f0735e0cb739374f6423430569d6f84a3f54f30199db62d44eb75b3e5b80d4b30e49cb7cadad3b8f61fb8d442b4e502645bdad67ac75aabc17fc89bec8a9937ef9408bb3e1c527301f7570d4956e03d653fd5650d3af595fb10775d57dbfa353063f9a7d5e978e29ceaaa9b28a32acb3de71431bee6091dfbf5d8bc8a86798ee68e746d5d9f5dfd33c6ada640a4387902e5aae713f276f42fe4801ba374d669a48422e11f3c71dd9a5602d7b134f190bf0fd80e41de6f8572567a994dcf19dc459392e056516ec72405836c279f02dd37c875b9c4ab15d9ab08cd2d4155fb99daa6d9c295b5e2a6394113c6adf5ad2825ac29113b3422f3f192c58865eb0d6d7087fd1343956f1b9286d95c42965782d661409ae63397d3cc902b56b524fa8742ac6e8263ddebc271dbf6fbf3b62f361a7ca9e4b322c15511b24f81d23ff1d1b66d36bdb6683c558b3432691dd6cb9f0cb2bee62504eaeda7f4e4665f69eccf68eae1441cbe78a15ba79cf8127223191796fb20d43d0369d398645e958615b39cec0bb3701d4be8ff88eb2fd326683cc9b299987eb9872d0d44fec1e13f2ce7123b198c999da9d4103f0fe614896f3151531c964ad8c9add3b67477ec9730d904f1b747ff01ccab3d99d9b115c3e31a684daee7b13790a7952f86f67104adca2a09308b4d0d33ec07966fbf100ddc17da320cb453b479613a43a951447e23d24727d05b90fb0e3d3584740d0f4501f5702b5af9b9ed0b3f6e8c1d04504d9b1e6aa1196ec9b26aa733f509bd09bfa19452c34d46550ac38577f0e4af05a2d8d24d0289e446b118a8a1d4741e8d39f8abc2d4a3b4600b136859b6b56cd1f4fe1aa641938a5ab978e02fdb253b03cfee8fc4b71afbe2d3ecbc8cd15a81b01fbe53fdb44ec6faa7f6f9898c6ca6127a897a0e77c3857acbc90c67c724d8ba6c5e57d1d26dd7b5d02d882564524718c27d9127e8a027c68f32a5e4879c67c10ebf9f944afaf280c3ba66977e529c1a16626dc11922762e091fc7a1165563388f52caa9ddbb0c860e34c36d42d6c69aa97eafb0d4f0437dc40263d088b21333e776809cfd142bf1c49213b73d1b5a85350ee3e22035113a00818194b01ec1dc29214789020bb14b27b43044f2f844a4522bd2e6df5bdd1ade8b15b000234a1304597c3b2c86e3fb37b0fcc68bb692a5b2cafe7f7713c51869a5093b675cda099ba66933c0e8e649cf26a5ef3212f8032976d47ce6dc79bdf28c45705b32da5ffd57313b333a7ed8cd955e9883cc4d37df56d9d0a79902e9bcfd08acd80d3fe5034b3fe745357aeeb7215540993142af850b6a0a8fb993dc9fbed47d0acab1b10491e57c092cbde63f308e4c817fafdae428d636906acf30832c8efefbdce72330caff5acccc939379f11e508d45298aa0cc1c7d427639c50d3b41076c04b805c69191ebc9608ae0279812a2e06ec69ca219c7d3b8935e04bb7166c92bb407f2b60e13d49967351206acbf1b6e623385c0448a9438eabde8dbce495fcbe86949521d55dc166ba8eb4ecb93ac1fbf3358ef1c34ae48e1d9987598eb4070ddfa10c88512264fd2a3c127a6da8eaf746c1f0b9017958eb9a1d3550f95310c3763469f47e0769555a52c2899c03a7a193b9a0092a9f489798f899c530d4f7d33d1f010b2a3db5a8bdfb301659fdc20f69b78deaf0e148bfa958501207a0cf6060236ada0b2ac9e19134c557fedb0a245ce80a094569d97050e90d2fbbd5fa6022fce9938268b85576576267cb61a6ba1ef61acabd9761e52475f5c8659e674660095e9f89deeea1a2b0af39661a65ab41d7a8258b9798cf1271913cc7d993f4830d55c42ae12ceab1321be2108e41cc8cf1e5423d02cf70f963e31ce4dd570d29ac2d78bed67504470cc1d9e3c8c36918313c702cd2acd5ae96cedb19c1b5e32f31ace70b831c274d39e2a8850295bcb62301eab67325b610da442a83b8bad70519541521a19a13f04c8888554872a50dcb571712ec0d1736f84b73e49c05dc42c40f37dced67b6d75c73a981998060fd883bb0f311bef1fa448590ba00639fa00371e47e2cefc714464aca70fad1fef0a2cac811c988817d706d99af049e27da4ccd8d1cf8ad715dedc253194412bf43a0f257209cd24874021732f298e28aa87f3adec931fab9840ff80b1c7f317b61585a154032da77ef6cbc8c7146b710b66220c68d4c2a649d7664aa119fe19ee2315fe32793e7d9ddb974e4d1f03c103eb00e8547e9cf98ba31030501eda1b995d3b8ef4082fdd890a7e085fa5a890ee9749a459ed968b573b1005ff537c8a25cf9633964471c521788e0f90527bdd62bd183f3180019a9173135002c3a9ede0f612d9cbe752035e27df97d2e51f70939a2fd2c74e452b7a5ebd504aeb6980901c1c5c282b16b85505ea6026d88a76001fa109cd3581ee93e0cbef339a4f7aa51a0bc835dd70889d45997341d91be58236a9738df7b2ee2e43009f99d46a621e17a55e82c65904669f7a2f33801174fce44ac2c94d6359033b4287120c4a85c42265a2bb011e19411e421ffbbdbefa1aecc2265300a146bbcb4c4bb677b7b03f8c06b663066cc7b4daaa620800c00048bdbc4e24bdfe95e214021404678aa5b06498abc1cb9cef41eaff968a3693411b2f46342ce2f3490994fd156905ff5cad681aa25ed27987b2714edd829993c5bbfb2bd8e1a8121cd94237b018756e43ad80123c0f5e781030d0a5e29dd7347c88a3ce9dc7333796742b447ed35e1bb0f3a76231a0f11b9f15e74b6eec664a9c73abeb8c1559ee8b8bf33073b04f3455d8313e4c70ff91e2fb3723732bbf47c0cc3b5b5ee24f7eb08d66ce1fc7c9036cc237a81ba24dc9255db3fb3ee95a322f8e5e0b222d5841c6792ed91249cc86214d80a05af4e43d83fd4c944d2719454586fb41ad858afd905da5cbe92ea8dcad0546994443ec89b91ec1a4e63bff5a34540b64d886eddd82a59100dbf6492bb43a58e22e58f2e285d50487313d9390342ca312853fe1773530406bb15e7e4d4956a1d19a38598a7140d45cc429d4760bc2cf7582772078c35f19bceff680b281e8d1f95e522025b0f7709184d01c36712fad6967bbac5804b34000f60178f2ced9c432c2a5f611c1a0f233a3237bee0a473d4bbb1e377c73da25ec4bc269f16f6b0adf82d0861f10031a03c1c52b2d9712f17070cd719a22560f872537d5ac28b6de1427453453ddd76dfda005e63a9707f10a6f69e77943831b03462952dac24cabba334e441097cc648e00ebd3428740ee896d8f75d2d064c93bc8e77794eb6092c4768af6129bd6f7190cc34a8e5fe4aeb9263cf5dab8fd1e613ebba661784cfa6ae69ee0f144211fc0335c08be2899851aab7cbb4be5c0178c9a3d881854579146cd865efab854725f666f1c78673618c7249bdaa0463c8d1f123ce185b698c986d888e3e82d9d097bc4efb681fb3fa51f1d1c51b608c4f98495ec5bc1e6d6c8592b32589b99eeb3d78b2c94b90efd1ff95ea598401a559d089ca923d89c7362dfaa8d98bf2fe529036ee5552eac6b97e3c12ae3a2f8533aca1b36") 11:07:12 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00?\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:07:12 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x9, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:07:12 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) ioctl$VIDIOC_DV_TIMINGS_CAP(r1, 0xc0905664, &(0x7f0000000140)={0x0, 0x0, [], @raw_data=[0x3f, 0x4, 0x3, 0xf41, 0x5, 0xad31d756, 0x2, 0x9, 0x8, 0x7, 0x20, 0xfffffeff, 0x2, 0x7, 0x7, 0x0, 0x80, 0x8, 0xffffffff, 0x1, 0xffff, 0xffffffe0, 0x4, 0x9, 0xd4c, 0x0, 0x9, 0x7, 0x2, 0xffff0001, 0x2, 0xc5f9]}) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 933.566285][ T27] audit: type=1804 audit(1577272032.583:482): pid=26504 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/726/file0/bus" dev="loop4" ino=233 res=1 [ 933.617719][T26505] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:07:12 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008110e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:07:12 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$TCSETAF(r1, 0x5404, 0x0) ioctl$TCSETS(r1, 0x5403, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:07:12 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0xa, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) [ 933.718584][ T27] audit: type=1804 audit(1577272032.583:483): pid=26513 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/726/file0/bus" dev="loop4" ino=233 res=1 11:07:12 executing program 1: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) setxattr$trusted_overlay_nlink(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='trusted.overlay.nlink\x00', &(0x7f0000000100)={'U+', 0x1}, 0x16, 0x2) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) r3 = dup(0xffffffffffffffff) r4 = dup(0xffffffffffffffff) setsockopt$packet_int(r4, 0x107, 0x10000000000f, 0x0, 0x0) setsockopt$packet_int(r4, 0x107, 0x13, 0x0, 0x0) bind$inet(r3, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) syz_open_dev$media(&(0x7f0000000140)='/dev/media#\x00', 0x401, 0x0) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) ioctl$SOUND_MIXER_READ_CAPS(0xffffffffffffffff, 0x80044dfc, &(0x7f0000000000)) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000180)={0x0, 0xcd, 0x30, 0x100000001, 0x1000}, &(0x7f00000001c0)=0x18) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, &(0x7f0000000240)={r5}, &(0x7f0000000280)=0x8) 11:07:12 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00@\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) [ 933.803722][T26522] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 11:07:13 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008111e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 934.053472][ T27] audit: type=1804 audit(1577272033.073:484): pid=26537 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/727/file0/bus" dev="loop4" ino=234 res=1 [ 934.235522][T26536] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:07:13 executing program 1: pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) ioctl$KVM_GET_VCPU_MMAP_SIZE(0xffffffffffffffff, 0xae04) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r3, 0x800c6613, &(0x7f0000000000)=@v2={0x2, @adiantum, 0x4, [], "4ddbda458777a711f7496fd9fefb4cd0"}) pipe(&(0x7f0000000080)) setsockopt$inet6_mtu(r1, 0x29, 0x17, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 11:07:13 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:07:13 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0x114, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:07:13 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008112e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:07:13 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x88\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) [ 934.393222][T26555] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 11:07:13 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(0xffffffffffffffff) setsockopt$packet_int(r3, 0x107, 0x10000000000f, 0x0, 0x0) ioctl$SNDCTL_DSP_CHANNELS(r3, 0xc0045006, &(0x7f0000000000)) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 11:07:13 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008113e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 934.590654][T26565] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:07:15 executing program 1: pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) r3 = socket$inet(0x2, 0x0, 0x0) bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x6, 0x0}}, 0x2) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) syz_open_dev$dmmidi(&(0x7f0000000180)='/dev/dmmidi#\x00', 0xff, 0x100) setxattr$trusted_overlay_opaque(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='trusted.overlay.opaque\x00', &(0x7f0000000100)='y\x00', 0x2, 0x2) 11:07:15 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0xd, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:07:15 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\a\xff\xff\xfe\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:07:15 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008114e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:07:15 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0x115, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:07:16 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d80000001800811de00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 937.008436][ T27] kauditd_printk_skb: 3 callbacks suppressed [ 937.008461][ T27] audit: type=1804 audit(1577272036.023:488): pid=26594 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/729/file0/bus" dev="loop4" ino=236 res=1 11:07:16 executing program 2: clone(0x3000000a0160101, 0x0, 0x0, 0x0, 0x0) io_setup(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f0000000dc0)=ANY=[@ANYBLOB="726177000000000000000000000000000000000000000000000000000000000002000000030000004003000000000000b800000000000000b800000000000000a8020000a8020000a8020000a8020000a8020000030000000000000000000000ac141400ac1e00010000000000000000626f6e645f736c6176655f31000000b9ebf3f421e248ee477de1857a08500076657468310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000b8000000000000000206000000000000000000000000480049444c4554494d45520000000000000000000000000000000000000000003f00000073797a30000000000000000000000000000000000000000000ac1414aae0000001000000000000000076657468315f746f5f687372000000006e72300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c801f00100000000000000000000000000000000000000005801686173686c696d69740000000000000000000000000000000000000000036272696467655f736c6176655f31000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c700000000000000000000000000000000000000000000002172fd6d5400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000005bf6000001000000ff7f000008000000000000000000000000000000000000000000000028004e46515545554500000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000320278bea67df2451b95bc9447000000000000000000000000000000000000000000007000980000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000feffffff00000000469e92dde9bd3cea48edf0a64d8be3f1d9bdfe015af442cf5ed48318e6635a95bd394e28a0bc09995268448c430b0bc26cdddc3333d34bedff8387aee2e72f31f29e5d81064a344c44426a257469ad2c5b4de7408fb064adb633de8f66fa5a827730d1cb2b50c208c944f7bd364e2118c4317f788f7075b97041e62b712f990167b3a4afc3fc2775808ef1449c05723ed5c87f86c850ffffffff43a4c834e5bd9ed60ea7218fc26a4119cfb12185c1ca877344c1679a3c29d829eb9e85d8f41ce9703ad13b657109fd4a85d1c3b7ba1158c3de796647d25cc29ac216c79877e842f1c909852f90970fd6971a39fe708b7702135934e6ecb95bcc37462e18f70a14b56b77bf4252530d0052bd9dbfa91e6956a4036c2736a29e7063ce7050a3ed2e9f6830c41e44f229c86114c93b1472a6d04764762a7f9fc7ff7f5b00fb100399f4e87fb9f235a8ac1226ee697faaed53427f87cb0a9e8d7b6a0be6d1bf558813595a8bc7a6b01ad2ed196e12966e596fe095b9f9640b6e54202e3861ad8e8d125d2d854a992e4523edd855802ae0f39d0d7ec66aca7dd47d1d529208f2664aa81e84aa4b1cc19dfbe100ac9455670c548d"], 0x2f) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x8, 0x0, &(0x7f0000000040)=ANY=[], &(0x7f0000003ff6)='G\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, 0x0}, 0x78) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$netrom_NETROM_T1(r1, 0x103, 0x1, &(0x7f0000000080), &(0x7f0000000100)=0x4) r2 = gettid() ptrace$cont(0x2e, r2, 0x35, 0x6) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x3c) ptrace$cont(0x18, r2, 0x0, 0x0) r3 = creat(&(0x7f0000000280)='./file0\x00', 0x92) ioctl$VIDIOC_G_FMT(r3, 0xc0d05604, &(0x7f0000000480)={0x5, @raw_data="0394177c4ceba57545df00a9ca6c8b4632d7373f7324a122f812b15880d4e0ccfce9370f5290376c33878832e841cdf4b787f4268e2d55fbde0ec2fb56937bc9c6b4aa09b53d72f109e424b8a0c2b185c2f7173c8058febc513657005856efc6fe094ec3ce269a60de5e0b1709ac2e375f1b814a079bff7763d20196934b2ce96bd4a7d95c98873dbc8a7706ecaa7b1152402e0506a6aca708f118e0e78334185855e5b08dcb9a4566d1704b107865176c802c3f435bff1b84bea67f424f66609eeb5e285976013b"}) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r2, 0x0, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000002c0)={0xffffffffffffffff, 0xfffffffffffffc5b, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140), 0x0, 0x0, 0x0, &(0x7f0000000180)={0x0, 0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=0xaea}}, 0x10) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000300)={r4}, 0xc) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000001c0)={r4}, 0xc) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000040)={r4}, 0xc) 11:07:16 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(0xffffffffffffffff) setsockopt$packet_int(r3, 0x107, 0x10000000000f, 0x0, 0x0) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r3, 0x110, 0x3) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) r4 = dup(0xffffffffffffffff) setsockopt$packet_int(r4, 0x107, 0x10000000000f, 0x0, 0x0) ioctl$TIOCL_SETVESABLANK(r4, 0x541c, &(0x7f0000000000)) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0xfffffffffffffd18) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 937.100290][T26593] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 937.192256][T26616] ptrace attach of "/root/syz-executor.2"[26615] was attempted by "/root/syz-executor.2"[26616] 11:07:16 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008148e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:07:16 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) r1 = dup(0xffffffffffffffff) setsockopt$packet_int(r1, 0x107, 0x10000000000f, 0x0, 0x0) r2 = dup(0xffffffffffffffff) setsockopt$packet_int(r2, 0x107, 0x10000000000f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r2, 0x84, 0x13, &(0x7f0000000080)={0x0, 0x6}, &(0x7f0000000100)=0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000140)={r3, 0xb41, 0x2}, 0x8) r4 = dup(0xffffffffffffffff) setsockopt$packet_int(r4, 0x107, 0x10000000000f, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r4, 0x80045530, &(0x7f0000000000)=""/75) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 937.242086][ T27] audit: type=1804 audit(1577272036.173:489): pid=26612 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/729/file0/bus" dev="loop4" ino=236 res=1 11:07:16 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x10, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:07:16 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x008\xff\xff\xff\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:07:16 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$VIDIOC_G_FREQUENCY(0xffffffffffffffff, 0xc02c5638, &(0x7f0000000000)={0x59, 0x4, 0xfffffffb}) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r1, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, r4, 0x0) splice(r3, 0x0, r0, 0x0, 0x10005, 0x1) [ 937.390957][T26626] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 11:07:16 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d80000001800814ce00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 937.585740][ T27] audit: type=1804 audit(1577272036.603:490): pid=26639 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/730/file0/bus" dev="loop4" ino=237 res=1 [ 937.621484][ T27] audit: type=1804 audit(1577272036.633:491): pid=26643 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/730/file0/bus" dev="loop4" ino=237 res=1 [ 937.641581][T26636] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 937.650240][ T27] audit: type=1804 audit(1577272036.633:492): pid=26639 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/730/file0/bus" dev="loop4" ino=237 res=1 11:07:16 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0x116, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:07:16 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x23, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:07:16 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:07:16 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008160e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 937.914485][T26657] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 11:07:17 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008165e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 938.035845][ T27] audit: type=1804 audit(1577272037.053:493): pid=26662 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/731/file0/bus" dev="loop4" ino=238 res=1 [ 938.116557][ T27] audit: type=1804 audit(1577272037.103:494): pid=26665 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/731/file0/bus" dev="loop4" ino=238 res=1 [ 938.117637][T26659] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:07:17 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008168e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:07:17 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) [ 938.211476][ T27] audit: type=1804 audit(1577272037.103:495): pid=26662 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/731/file0/bus" dev="loop4" ino=238 res=1 [ 938.300934][T26673] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 938.499281][T26676] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:07:19 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4200, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = dup(0xffffffffffffffff) setsockopt$packet_int(r1, 0x107, 0x10000000000f, 0x0, 0x0) getsockname$unix(r1, &(0x7f0000000000)=@abs, &(0x7f0000000080)=0x6e) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:07:19 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0xae, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:07:19 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) r3 = dup(0xffffffffffffffff) r4 = dup(0xffffffffffffffff) setsockopt$packet_int(r4, 0x107, 0x10000000000f, 0x0, 0x0) r5 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) ioctl$VIDIOC_PREPARE_BUF(r4, 0xc058565d, &(0x7f0000000080)={0x6, 0x5, 0x4, 0x410b8000, 0x3, {}, {0x1, 0x8, 0x7, 0x2, 0x8, 0xfd, "01df3584"}, 0x0, 0x4, @planes=&(0x7f0000000000)={0x2d58, 0x1000, @userptr=0x1, 0x7b0}, 0x2, 0x0, r5}) setsockopt$packet_int(r3, 0x107, 0x10000000000f, 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f0000000140)={0xcf, 0x9, 0x0, "707900cd209ef5205ca48cf0d021fefbbe11cea44640f5b1e7b56b5c99804e7982113a6e43043e314ecb2444936836c50655a8ca1307bb895131dc7c5a8e7cc7c5b6144cd44d2b94480e64d6ebaf6e39f8ebccd1a4ff3a71aa0b03e8d7894480f16a8c633f95183dfb98d68f38b726dea529c509e2a6546426fa7222c86cc8543182252600860b871010aa66ff9c68e32d17981439927f3469807a3b031a20dfc828901aa32d3e30fbfd31deae9fd3498ca894be83e3b2c6cfc1b7bcaa49de380a68b905668bf1c888725606a54ee6"}) connect$inet(r3, &(0x7f0000000040)={0x2, 0x0, @multicast2}, 0xfffffffffffffe79) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) setsockopt$IP_VS_SO_SET_FLUSH(r1, 0x0, 0x485, 0x0, 0x0) 11:07:19 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d80000001800816ce00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:07:19 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0x117, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:07:19 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:07:19 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008174e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:07:19 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = dup(0xffffffffffffffff) setsockopt$packet_int(r1, 0x107, 0x10000000000f, 0x0, 0x0) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r1, 0x29, 0x41, &(0x7f0000000000)={'mangle\x00', 0x4, [{}, {}, {}, {}]}, 0x68) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:07:19 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x1, 0x0) r3 = dup(0xffffffffffffffff) setsockopt$packet_int(r3, 0x107, 0x10000000000f, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x1}) [ 940.531733][ T27] audit: type=1804 audit(1577272039.543:496): pid=26694 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/732/file0/bus" dev="loop4" ino=239 res=1 [ 940.596717][ T27] audit: type=1804 audit(1577272039.603:497): pid=26709 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/732/file0/bus" dev="loop4" ino=239 res=1 [ 940.650713][T26692] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:07:19 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:07:19 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d80000001800817ae00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:07:19 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0xc0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) [ 940.898379][T26729] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 940.937000][T26723] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:07:20 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) r3 = dup(0xffffffffffffffff) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r1, 0xc0506617, &(0x7f0000000200)={{0xef35d635c56b0872, 0x0, @descriptor="89d53e086dbc2f41"}, 0x4d, [], "1feaf6ef2588e76a62f039d1e5f96914d7cf2c378ae18514dc46e25783d5d8f63d37dc46bc7a94a3fde1520211649cf12e81749bb7511cf03cfc66c32d76649a72b78823f7cc8d59c9d44df048"}) setsockopt$packet_int(r3, 0x107, 0x10000000000f, 0x0, 0x0) sendmsg$nl_route(r3, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000030}, 0xc, &(0x7f0000000080)={&(0x7f0000000140)=@ipv6_delrule={0x90, 0x21, 0x1, 0x70bd28, 0x25dfdbfc, {0xa, 0x80, 0x0, 0x6, 0x81, 0x0, 0x0, 0x1e, 0x4ac60d66442e9983}, [@FRA_DST={0x14, 0x1, @rand_addr="dde696557b41ef167c43e67a29b242c6"}, @FIB_RULE_POLICY=@FRA_IP_PROTO={0x8, 0x16, 0x11}, @FRA_DST={0x14, 0x1, @rand_addr="161e434997c7449cd4bbfeff915161ae"}, @FIB_RULE_POLICY=@FRA_SPORT_RANGE={0x8, 0x17, {0x4e24, 0x4e22}}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @FRA_DST={0x14, 0x1, @loopback}, @FIB_RULE_POLICY=@FRA_IIFNAME={0x14, 0x3, 'gretap0\x00'}]}, 0x90}, 0x1, 0x0, 0x0, 0x40040}, 0x88815) 11:07:20 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d8000000180081f3e00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:07:20 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:07:20 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d8000000180081fce00f80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 941.336943][T26748] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:07:20 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0x118, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:07:20 executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet_dccp(0x2, 0x6, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/nat_icmp_send\x00', 0x2, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000000000006000000000000000600000000000000", @ANYRES32, @ANYBLOB="000000000500"/28, @ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\f\x00'/28, @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00R\x00'/28, @ANYRES32, @ANYBLOB="0000000008000000000000000000000000000000000000e5ff0000d3", @ANYRES32=r3, @ANYBLOB="0000000001000100"/28, @ANYRES32=r4, @ANYBLOB='\x00\x00\x00\x00\a\x00'/28]) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r7, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r7, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r5, 0x0, r7, 0x0, 0x10005, 0x0) 11:07:20 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0xf0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:07:22 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) r1 = dup(0xffffffffffffffff) setsockopt$packet_int(r1, 0x107, 0x10000000000f, 0x0, 0x0) r2 = dup(0xffffffffffffffff) setsockopt$packet_int(r2, 0x107, 0x10000000000f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000040)=@assoc_value={0x0}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f0000000100)={r3, 0x1}, &(0x7f0000000140)=0x8) ptrace$setopts(0x4206, r0, 0x0, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x400, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r4, 0x40042409, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:07:22 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008100e00280ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:07:22 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:07:22 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) r3 = dup(0xffffffffffffffff) setsockopt$packet_int(r3, 0x107, 0x10000000000f, 0x0, 0x0) ioctl$SIOCX25GCAUSEDIAG(r3, 0x89e6, &(0x7f0000000000)={0x2, 0x5c}) fcntl$dupfd(r2, 0x406, r1) 11:07:22 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x300, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:07:22 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0x119, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 943.796445][T26781] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 943.867683][ T27] kauditd_printk_skb: 4 callbacks suppressed [ 943.867746][ T27] audit: type=1804 audit(1577272042.883:502): pid=26779 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/735/file0/bus" dev="loop4" ino=242 res=1 [ 943.915148][ T27] audit: type=1804 audit(1577272042.923:503): pid=26797 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/735/file0/bus" dev="loop4" ino=242 res=1 11:07:23 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) r3 = dup(0xffffffffffffffff) setsockopt$packet_int(r3, 0x107, 0x10000000000f, 0x0, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000000)={@loopback, 0x683, 0x3, 0x0, 0x1, 0xffff, 0x5}, 0x20) 11:07:23 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008100e00380ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 944.027468][T26784] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:07:23 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x500, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:07:23 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) r3 = dup(0xffffffffffffffff) r4 = openat$autofs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/autofs\x00', 0x40, 0x0) setsockopt$packet_int(r4, 0x107, 0x7, 0x0, 0x1a1) ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f0000000080)={0x2, {0x2, 0x3, 0x8, 0x4, 0x6, 0xf}}) syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x80, 0x380) [ 944.117204][T26808] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 11:07:23 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008100e00480ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:07:23 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) [ 944.361824][ T27] audit: type=1804 audit(1577272043.373:504): pid=26815 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/736/file0/bus" dev="loop4" ino=243 res=1 [ 944.402879][T26827] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 944.407865][ T27] audit: type=1804 audit(1577272043.413:505): pid=26815 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/736/file0/bus" dev="loop4" ino=243 res=1 [ 944.449898][T26821] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:07:25 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0x11a, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:07:25 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:07:25 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000000)={0x2, 0x20, @empty}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) dup3(r2, r1, 0x40000) 11:07:25 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008100e00580ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:07:25 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x510, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:07:25 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x1d4}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x0, 0x8) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x80240, 0x0) ioctl$BLKPBSZGET(r1, 0x127b, &(0x7f0000000040)) ptrace$cont(0x20, r0, 0x0, 0x0) r2 = dup(0xffffffffffffffff) setsockopt$packet_int(r2, 0x107, 0x10000000000f, 0x0, 0x0) accept4$packet(r2, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000100)=0x14, 0x800) [ 946.892185][T26847] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 11:07:26 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) lsetxattr$trusted_overlay_nlink(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='trusted.overlay.nlink\x00', &(0x7f00000000c0)={'L-', 0x5}, 0x16, 0x0) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 946.956225][ T27] audit: type=1804 audit(1577272045.973:506): pid=26851 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/737/file0/bus" dev="loop4" ino=244 res=1 [ 946.989175][T26843] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:07:26 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008100e00680ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 947.066288][ T27] audit: type=1804 audit(1577272046.023:507): pid=26857 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/737/file0/bus" dev="loop4" ino=244 res=1 11:07:26 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x600, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:07:26 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) [ 947.161518][T26866] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 11:07:26 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r1, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) r2 = dup(0xffffffffffffffff) setsockopt$packet_int(r2, 0x107, 0x10000000000f, 0x0, 0x0) splice(r2, 0x0, r1, 0x0, 0x10005, 0x3) 11:07:26 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008100e00780ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 947.384952][T26879] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 947.444035][ T27] audit: type=1804 audit(1577272046.463:508): pid=26875 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/738/file0/bus" dev="loop4" ino=245 res=1 11:07:26 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0x11b, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:07:26 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008100e00880ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 947.500137][T26870] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:07:26 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008100e00980ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 947.553139][ T27] audit: type=1804 audit(1577272046.513:509): pid=26884 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/738/file0/bus" dev="loop4" ino=245 res=1 [ 947.573503][T26888] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 11:07:26 executing program 1: r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000400)='/dev/dlm-control\x00', 0x40000, 0x0) getsockopt$inet6_tcp_int(r0, 0x6, 0x1b, &(0x7f0000000440), &(0x7f0000000480)=0x4) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r3, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) r4 = getpid() ioctl$FS_IOC_GET_ENCRYPTION_KEY_STATUS(r3, 0xc080661a, &(0x7f0000000140)={{0x3, 0x0, @identifier="fca34da057ba779dfcae68cd765091a1"}}) sched_setattr(r4, &(0x7f0000000040)={0xffffffffffffff33, 0x2, 0x0, 0x8, 0x5, 0x0, 0x8001}, 0x0) r5 = dup(0xffffffffffffffff) setsockopt$packet_int(r5, 0x107, 0x10000000000f, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={r4, r5, 0x0, 0x11, &(0x7f0000000000)='self+mime_type&*\x00', 0xffffffffffffffff}, 0x30) openat$cgroup_ro(r1, &(0x7f00000001c0)='cgroup.controllers\x00', 0x0, 0x0) r7 = getpid() sched_setattr(r7, &(0x7f00000004c0)={0x38, 0x1, 0x2, 0x9, 0x5, 0x0, 0x1}, 0x0) r8 = openat$nvram(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/nvram\x00', 0x1, 0x0) kcmp(r6, r7, 0x4, r3, r8) connect$inet(r3, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) r9 = dup(0xffffffffffffffff) setsockopt$packet_int(r9, 0x107, 0x10000000000f, 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000200)={0x0, 0x0}) r12 = dup(0xffffffffffffffff) setsockopt$packet_int(r12, 0x107, 0x10000000000f, 0x0, 0x0) ioctl$VIDIOC_DQBUF(r9, 0xc0585611, &(0x7f0000000240)={0x0, 0xa, 0x4, 0x20000000, 0x0, {r10, r11/1000+10000}, {0x2, 0x8, 0x6, 0xff, 0x6, 0x0, "ab06448c"}, 0x2, 0x1, @userptr, 0x8001, 0x0, r12}) r14 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r14, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, r15, 0x0) getresgid(&(0x7f0000000300), &(0x7f0000000340), &(0x7f0000000380)=0x0) setsockopt$sock_cred(r13, 0x1, 0x11, &(0x7f00000003c0)={r4, r15, r16}, 0xc) splice(r1, 0x0, r3, 0x0, 0x10005, 0x0) 11:07:26 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x700, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) [ 947.710625][T26896] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 947.921705][ T27] audit: type=1804 audit(1577272046.933:510): pid=26905 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/739/file0/bus" dev="loop4" ino=246 res=1 [ 947.957855][ T27] audit: type=1804 audit(1577272046.973:511): pid=26909 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/739/file0/bus" dev="loop4" ino=246 res=1 11:07:28 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008100e00a80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:07:28 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:07:28 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(0xffffffffffffffff) setsockopt$packet_int(r3, 0x107, 0x10000000000f, 0x0, 0x0) getsockopt$inet_dccp_buf(r3, 0x21, 0xf, &(0x7f0000000000)=""/4, &(0x7f0000000080)=0x4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 11:07:28 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x900, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:07:28 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0x11c, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:07:28 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/dlm-cont\x87@\xa7\x89', 0x80000, 0x0) ioctl$IMGETVERSION(r1, 0x80044942, &(0x7f0000000040)) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) r3 = fcntl$getown(r2, 0x9) ptrace$cont(0x18, r3, 0x0, 0x1) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) mount(&(0x7f0000000000)=@md0='/dev/md0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='f2fs\x00', 0x80000, &(0x7f0000000180)='/dev/dlm-cont\x87@\xa7\x89') timer_create(0x0, &(0x7f0000000440)={0x0, 0x41d, 0x6, @thr={&(0x7f0000000640)="ae8ff0dd2f09cc8bcf82b019c4ece2ce10e504c757632b25cae5b3c9495b48f293e96058aa566102f16a07348c654c2b2b953618c1d540d5202b99a45ac6f348a367685f1b15d19a8716c2773548069163ee79693b5e31c1338c600826679de930e2a2cbc44c420bbf7448af87a59745fd1af6950f834a9c91e562579bac22b48d59067340a7fbfd76e9f72f0212afb5f748acb6b4ac8d348e01d143b55d5dbb1a35761a0e43fef22acda0115808fe5564e5858b184c2444c729674c135080d63fbfd0ddaabb8d39fab226b23f76", &(0x7f0000000740)="92452134b2c8435be9d1bcb81e193268d365b065144f6cbfe2f93d23f495ac57bcbabfb74bb81f66f057560017df590a2fbdef8407c15d94f4f2127a277815569458c2c90f6edf6f83a62cbc60c835ba273dc729f98925f6cc5d2d70b34c57b2d774fefe6609bcd2b0b92abbda05d77875ba8bda5a6239d66d9f212c5b372875a629bcff4a3c93ebbb3af8f18cf5197b4f764f4bb9e9843d408bab493f8a9e56d1e7b3bef648b56f3528bc3f981e5baab05c45dd9e8c89d4e770463eede44b98562f8ab2de2efa19c1a52c28fc8bd0f838db21e1f846e14b8c1d03932e5f7c2c5a86f5fd492de29d6cf1cb813f984cb3a4d61dcffb7de4ba5be71b757d8e62824570caa995fba1247081004ba1f53383ebe708713dac90269969c6d76294913ac0f4c89a2e235b61612c80df01a6c4e67fc6df04a5289ef4cdbe9b599eb938e10890e96d6b11a38788084440a9cfdadec373aed0aa72f614d68fa3285160223604363723ec6a9c0eb01c8f7c1690f73a3ccbe102e896b021ad066bd212985bfaa1452956bed3f746b6a570cfbc4c14587f72b48c82fb5657d79e0908d691bc71de7a9c19316cb3ce99887d3f329fe349ac33eaa428fd7d42d58254e8d5ce361c80f03265083730e49adbb8e9a5564367ae27c912c8a0a62f62c7378f1775f40c57699d546d584f07b229073375d12a40799d92b47292dd6a420436c89b352e5b37ee73afb55dd480667e9ca8cf8401a22a406d40938d2ba3361f36f7944eace72f791b96720eef4683f624e10cd8aea07ebfe7f267ce35b4695f81e4c48631dc33a30aa62d0c74b1444d95db196e96e39c96cae32091c3e3fdd87befb6a3d56d24e5a86098edcee0e59348c24184c8f59bb59b4c7258297e07ee408411c3e7b3f5fc822dbb08fca178030683b16ca28ab891c930181c68eb39c8209847d1a3a9b0423bc4fb616adafe035b69d10c4be4aea5a396a35663802bc6f9308b8a51babeab3151aee4d02efcff3e2fedad47acd70bca8cc7420e9e83bb071321cecce9916b27144f5c8c62695ab8c38531f04483a6b4563ef1968f925e7346bd1427fc282c5b88fd27021392ff44cee6f6e0deb87dcc113b3e32bcf0acbc8a8d1a1d58d1b5f34b6f8da7ec49624832836546e4c2515a14dc545a7c63878953408805092673bc30204a6ba1a534e0c07c113ad6b35173062312c6d09960c213697bf1dc53664060dfc2b53364fd241de5e926c1552c56e50d28146749ac6aaa56d3bf89ea644fca6fceba8aab88cd412ad5aa667ad40027565afcca60145ca53ce94dab1ba1fe3441bba3f1f37e09c96722af661d5f12e636f1764169a12cadc9f442501ae6c88f003f65149dbb4210c082c58e859fae1ae75f067d3467d151c849a7e8f100618960bf88c444f48ac36035264b5c45f7a90fa6b4640172638f5542a2cfbf20bfe5c3f2bf2f18109da5e6a05dd42f13d183867a6ad796e7e7199c1d1360cfeae2d5496c23cd98a89661e0d082cb809bc7bbec15bc09b480f25fa877719d4d60a6c86d2b5b0ca66bbaff246bc97ea7b8282ec2feb4aea6dbfd7cf6ab6d72c527002863f8922c4e350891976a1d1b1dc0a7d3ed0a65ec529bf5b96b91d1553a71c2c9f4fc6f975d6e8d768305733e48d256b798a48224ea2c6c92c85cb2dd0a847a2e33cb0b4117f5ef7514d3cdea41e5841fc5059fa1c96e6dbf6c3d90d44bc5c0aad404d25bd4b2646d3191eade05b6333be829be6c03dd3f54d4a836ba8a07cd6922e4007e803beb82bd6ad46079bb3179a6c8abc28d648cd29503ded78d980af20b7a80b2685cdc349ba027517562b6623c2673ebf61140282f385a1c7f60647f6856a866d6d417d5c6e4caeb6c9a77aa17570ba6889fbcb72facba1336a7af1718787826646d44789199bcf54302b6e5ba03bbee6b19b278144c67f1ab02412556c41247aeeaaae472d68a26f091383c6796b582d90abf96acb4c3efd0100c166095f7af4f9ace781eb17594a795859f1d4e78d31ee7c2ceff880f9ab20403770104462859caede9a40333652e7d8b9e41fa9ba4a1da0858f105af2051814564e17b39049eee8c52a992ffe500a2abcdd3e86c1c083f5dbb40f11ad4425581a20aa2b469f4d11f6a2a7e0eb08e8a2e23c31fae6093dde0286c0a16ef0178ef733549b99e40962df4f44569fb36a07e41e481bcea549409a528def042373ef2b6a2a13a10a7392201abf4c6e0bc2d7a4bde6ed4ddcea725df1f6eccbcecce23d76a9f1c4f9a13631ced56f817592e51bfbdccdd7999c7fc99ba33687b1503e879d77a33d4fe08be9819712096047c85c8a0c09ca82e9603470286375910d36682a98a634d2b706ca0672f80438b98ccf92c1c9fac2f42fa76f0904fc2f44d5df2ca795b1e3ed9e7e639c806b653da33c576b6b2ec045647e3941176f88d2fa5ee97d326e9daaa6ca0c30f21cde1f854336f47688b9f94a7f7e37be83956c26c9fca4280c98a95b5e0c1b42f62a6980c19478dc79e966163e7c7dc5c193509b962eecf61c5568253f4fb3af557d48697b578d5eb830dae5699318419b5c1f74a5246b6dd919cb8023b3712bcf6f96a79dbe0610e3dede78ef6a9e1ae50e789979d30dfed5418b92ae349f3cf46771d48c9a01561a9b427e6f81fcc2d86af63205c3a3d7e45d575fc9839e284dedecb6624a04a662ae63f31eed0748ea0f769fbee1f4927727d456bca2bcc72a3f4887d7ddab530ebede8289b4c2142b7eb3aafe472a443031974ba8b0fac8593c5ab3218f68668c637f152fb32a1bab1b994008a8a88fd61d6ae3ababa1f376689c66b0c854d5600f49a40195487fef2ddee0fb5c867f6b7266e0cc5a9590f8fcfdb6189ee42169fb14c63b568d04ee267aa100e1e8eb52069844a07ebfa428b96c0a8fa5c8a7402a05edb44faab5a46d91aeb7831b1d98a719901002c306a19576cc41e3bb2d2e5d0fa74432c51e7fe4b7a0d847e95cb030e0d51b875b8913ddb16ad5bbcde408032f8e297ed5fe2d1bf67917e135ab4a240e21bda3e89c864262ea405def628d3d9de1a24762a24bc1cd18209c6da5a0d640840dce397544acd72b5da5df326f61aa3248a39f7895e721760e81df605cbff500415f245399be53df96db04f1ddccb160d75bf78289b96ad250992295b67cef6896b6d5337bf2e3f5da04b27312cf7daf53c40f1794839f0481597e89b8270603aa848d5cb898aaae73bd2671326f921e4fd56f81b04dd2dce2c034961547898339d7e6f87a1bd9b6f86c4d17ab976b068df1961f2cfba3caf40ce83734ead0cff9f531b783c3f2e4d5abf993d791e1991e47b156ac1dbc30c8e61bb7c5d7a86da35f75cb48e97589455114534626472f41895d1d1c64695789b2a1da4960385edddd1e3b7b657561d0a53feddc151967c4c5f573e895b7080eabcbb87c48cdb19523732201d2796ac636ad41848f4f2feeabd91e73bd4650fe5b94a483eaf45866e7e083e007cbae100fd7fa0b9f2e54924e220cbe8ff069a34aa2f94f351c8ae475744570666fdd2c554f85341a600e45adffbf32f28292d7ce97299ae7263a42009b2956dd0b76d22cac8d4886a98fb87ca8a8cb6c43a8f59df156b2c9ab3adf4a9dc8ce1af0f45c4b26b0f9945ca93653e38214036bd26fa0fc2325167b16a22fe50c87b952649348e248467e9ee255426520d562a4ee315c1b65164e72adf3a3e8ba43a9d3d4dfad1775a2daade3b4306453f1c38a766b2e3c6659de7af7ae012d85c6886ef8fd5269e2044f5dfc9e7892c2991d042cf4fbb2d884f5b5297a87dca7096f6208fbc9d8fa058be001f46a31e316b98341a2af836d8265546ab74a34ecfc35281c0cbc4facb7a3791dd74ce60dafd680d38f45ab121e09b0ec087adaa85f116a30b782ad2036ed26cec24717b0073d7e906999faf06b849e7dcc7f13346c1a1de048b6f1068b45197eede1892110784309f8a19cf93d3d96eaeeecc032671f4bea73fa8fdf13742a7296c6dd277238fd419d8ee0dd3de8fcf3600b976f74f7f935e712140ee292b5deeab147799016cde3be01c29a7f4c823966d29f2db97011289b57dd4dc4a85cc2835335a8f81676b69514333ccd3c5dd7cb9b28de7fcb8a82e2b835d80dc4e4f8e934205a717a4352f5e5999edcd51f47f1c02026869bf1e9d8fe9f9a6a768ec3712bde88b4c5a02aff07719ec1bde993516a358acc8c42c892b702d983c984a5f404575151658cb1deae96890cfff256fae578617325486178cf338737277175a20dfec34e062978ec734b2978f4aecbe23579299270a844d716eb7f8fbaa48d29959d96f1a26b0c3bed6b84f18f9d7056ce756938dc266319c0aba8886b92392910e98eb25788ef2526f3df043fff1ef80b0c4d8dd2062996ed0414f79de742915fcaca52079ad0f47e4bbee608cd07df75eaae469b9d90105a8f0b2118dc4aa60f8b6a9a0d2906b69cbe80176fe33c1d111bf3b3f91ac2f1cbd53cc129e5943baf2d4ce1db9dea33eedb5aee78db9728de30a813d3ded69bd83dd01d6bc7648a66e0f5993b7a3335e453a5d8ed24727759e62222889a8fc8068d24697fa1adc3b5ce275e4702ade6cf2d6ca7fec122b7118a2dd9b05e8a1438909ac85afc90cf9db8117e87523d5d3b97c88cec50ec0d8ea50822a01f1532b56d50a56906932624288fe315c24af46a746de4e4155bd75e8299cc19be77c87b8a13286aad64bd4ccc153fc9bfb5b8c4e2c9b24947aab403b938902c983071d2573abc3b0ec1560fcb138b0c727fb391dd7fa9960bb3c1b49426e47fe7e387f584d6f40f87aaf958a6fb2699a58641bd53cc48c803cb276631e289d5e7ad01467bd1f441e279f2ea388e2ca13ab841d2a90325ce1d45afc31e9244db1174fc47edbdfda447b6487057c0ced1b79cd86e72ad2c9fa52e471984aa75aa54159b0322285e35afa7d5acf2ee48a94f2f940b334a50c7576d38fc944de2d8c9f5562ca72b219cf7aa66d76c0b982d13546fadd77d7fe7a2ee50ffc44ead70612b3bfcd6023f1bbfc217ec1769cdd2cb0e2cb4543f0e9efc680d5baee50c25ee54f1f7340837799a09602eafd3ff48db8d265f0497131ab1a85a35ae4f3a782b3874ec5c19f133cef9a8a2c6f74ec99584b3bcfbd03f5af6e106cf396d84234149869f115d2a4e2335596f4b95c94f7c23c0e37a7656917fde696ec1dfd74cfccf56ed55ec27eaf13cdc10e4f44a02b50cc3f5258011f350da850f37c66022cad19555f790911d10bea56a9d6099dfbc15f33806d3c6baac273c331e9e6c5c61d7f7676993b608da4b2dc2841ea7aea11ab2499339883161bcc8e190a6d7537c30fb79480464466b831c5649761980b2fdd4318785a40d241088977f7fdf66f3bf3c9d8df4e9374c2d5541f55d7a27a3a70f9f92beef639e271bfe0e49e268528314a9d8bdaeb03cc01ddb730d3c1ed3d5242f63dc06f89c412aea4c89944dc2efc5c6f9dcf20fbb814602471cc68cb588740cb4d8f6421fdc885daaf9976deed84a110da13935fe1d152f5f1c83467e35a40b0cf6413f99fa83dbf907bf87c7449f5b06a2d104063d2b3574019996f2a58439a718257f85b53095598510e23336df2b3fe1bb10b4a6ea4012c2c2e2928e7362d59126acc0d263499171e081b3340b781f0ad34e65958fd33e353811e2b3854b23a26bb9c401b16fb50de48f4ba2613e2b978b6abb64a6f17fbd58120bbe13947c6dd2818c0b562af88e512b05bf45b1ef8539fbc37c90d0684e519"}}, &(0x7f0000000480)=0x0) timer_settime(r4, 0x2, &(0x7f0000000040)={{0x0, 0x1c9c380}, {0x0, 0x989680}}, &(0x7f0000000140)) timer_gettime(r4, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(0xffffffffffffffff, 0xc0884113, &(0x7f0000000300)={0x0, 0xfffffffd, 0x9, 0x1, 0x3f, 0x5, 0x1, 0x5, 0x10000, 0x3, 0x80, 0x2}) [ 949.981437][T26929] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 11:07:29 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) r3 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcsu\x00', 0x200000, 0x0) setsockopt$SO_RDS_TRANSPORT(r3, 0x114, 0x8, &(0x7f0000000080)=0x2, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 950.026554][ T27] audit: type=1804 audit(1577272049.043:512): pid=26922 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/740/file0/bus" dev="loop4" ino=247 res=1 11:07:29 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008100e00b80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 950.171880][ T27] audit: type=1804 audit(1577272049.113:513): pid=26938 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/740/file0/bus" dev="loop4" ino=247 res=1 [ 950.199488][T26919] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:07:29 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff8\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:07:29 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_sctp_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f0000000000), &(0x7f0000000080)=0x4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000000c0)={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0xffffffffffffff58) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 11:07:29 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0xa00, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:07:29 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0x11d, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 950.371138][T26949] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 11:07:29 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008100e00c80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 950.560362][T26950] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:07:29 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) r3 = dup(0xffffffffffffffff) setsockopt$packet_int(r3, 0x107, 0x10000000000f, 0x0, 0x0) ioctl$TIOCGSID(r3, 0x5429, &(0x7f0000000000)=0x0) ptrace$setregs(0xd, r4, 0x3, &(0x7f0000000080)="f26a44783d8d9083e2deba9505f2fee0c26b7204f4ff0ad601e504571e54e3c31def9043de2d2b7a54a1963ab5ef51760fa5ab13dc9f4d63cab47373") bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) r5 = openat$dlm_control(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-control\x00', 0x54340, 0x0) ioctl$NBD_SET_FLAGS(r5, 0xab0a, 0x80000000) [ 950.591446][ T27] audit: type=1804 audit(1577272049.603:514): pid=26961 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/741/file0/bus" dev="loop4" ino=248 res=1 [ 950.672178][T26969] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 950.693591][ T27] audit: type=1804 audit(1577272049.653:515): pid=26967 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/741/file0/bus" dev="loop4" ino=248 res=1 11:07:29 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0xc00, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:07:29 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:07:29 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0x11e, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 951.000621][ T27] audit: type=1804 audit(1577272050.013:516): pid=26977 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/742/file0/bus" dev="loop4" ino=249 res=1 [ 951.121433][ T27] audit: type=1804 audit(1577272050.113:517): pid=26989 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/742/file0/bus" dev="loop4" ino=249 res=1 [ 951.162741][T26982] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:07:31 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000000)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:07:31 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008100e00d80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:07:31 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0xfec8) connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x3, 0x0) r3 = dup(0xffffffffffffffff) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS_OLD(0xffffffffffffffff, 0xc1004111, &(0x7f0000000400)={0x7ff, [0x1, 0x40000001, 0x7f], [{0x10000, 0x100, 0x1, 0x1}, {0xda2, 0x9}, {0xcbdb, 0xffffff7f, 0x0, 0x0, 0x1, 0x1}, {0x81, 0x1, 0x0, 0x1, 0x1, 0x1}, {0x5, 0x3, 0x0, 0x1, 0x1}, {0x100, 0x103, 0x0, 0x0, 0x0, 0x1}, {0x9, 0x2, 0x1, 0x0, 0x0, 0x1}, {0x7fff, 0x0, 0x0, 0x1}, {0x9, 0x8000, 0x0, 0x0, 0x0, 0x1}, {0xfff, 0x39f4, 0x1, 0x1, 0x1, 0x1}, {0x5, 0xfffd, 0x0, 0x0, 0x1, 0x1}, {0x3c, 0x8, 0x0, 0x1}], 0x4}) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0xfffffece) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000003c0)=@newlink={0x38, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_LINKINFO={0x18, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_LINK={0x8, 0x3, r6}]]}}}]}, 0x38}}, 0x0) r7 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/autofs\x00', 0x10000, 0x0) write$P9_RLINK(r7, &(0x7f0000000280)={0x7, 0x47, 0x1}, 0x7) connect$packet(r3, &(0x7f0000000000)={0x11, 0x7, r6, 0x1, 0x2, 0x6, @remote}, 0x14) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={&(0x7f0000000080)='./file0\x00', 0x0, 0x10}, 0x10) 11:07:31 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0xd00, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:07:31 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:07:31 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0x11f, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 953.028578][T27009] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 953.126539][ T27] audit: type=1804 audit(1577272052.143:518): pid=27006 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/743/file0/bus" dev="loop4" ino=250 res=1 11:07:32 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0xc}}, 0xd) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 11:07:32 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008100e00e80ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:07:32 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0x120, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 953.240685][ T27] audit: type=1804 audit(1577272052.223:519): pid=27018 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/743/file0/bus" dev="loop4" ino=250 res=1 [ 953.270221][T27003] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:07:32 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x1005, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) [ 953.375100][T27030] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 953.399440][ T27] audit: type=1804 audit(1577272052.223:520): pid=27017 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/743/file0/bus" dev="loop4" ino=250 res=1 11:07:32 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @broadcast}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) ioctl$KVM_SET_CPUID2(r1, 0x4008ae90, &(0x7f0000000140)={0x5, 0x0, [{0x80000000, 0x4, 0x4, 0x9, 0x4, 0x8001, 0x5}, {0x10000001c, 0x6, 0x2, 0x80, 0x1ffe00, 0x2, 0x75a}, {0x4, 0x1, 0x7, 0x0, 0x101, 0x7, 0x2}, {0x72842936587f48b4, 0x2, 0x3, 0x1, 0x1ff, 0xfff, 0x2}, {0x7, 0x1, 0x4, 0xa6, 0x9, 0x7fffffff, 0x3}]}) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 11:07:32 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x88\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) [ 953.624383][ T27] audit: type=1804 audit(1577272052.643:521): pid=27040 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/744/file0/bus" dev="loop4" ino=251 res=1 [ 953.723699][T27045] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:07:35 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) r1 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x400, 0x200000) ioctl$KVM_KVMCLOCK_CTRL(r1, 0xaead) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:07:35 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008100e01080ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:07:35 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) write$P9_RLOPEN(r0, &(0x7f0000000000)={0x18, 0xd, 0x1, {{0x0, 0x0, 0x4}, 0x94}}, 0x18) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 11:07:35 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x2000, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:07:35 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\a\xff\xff\xfe\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:07:35 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0x121, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 956.158958][T27065] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 956.269967][ T27] kauditd_printk_skb: 2 callbacks suppressed [ 956.269990][ T27] audit: type=1804 audit(1577272055.283:524): pid=27070 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/745/file0/bus" dev="loop4" ino=252 res=1 [ 956.279138][T27062] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 956.312026][ T27] audit: type=1804 audit(1577272055.323:525): pid=27078 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/745/file0/bus" dev="loop4" ino=252 res=1 11:07:35 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008100e01180ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:07:35 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) r3 = dup(0xffffffffffffffff) setsockopt$packet_int(r3, 0x107, 0x9, 0x0, 0xfffffffffffffd0e) ioctl$CAPI_GET_FLAGS(r3, 0x80044323, &(0x7f0000000000)) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) r4 = socket$inet_sctp(0x2, 0x1, 0x84) r5 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r4, 0x84, 0x76, &(0x7f0000000000)={r6}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, &(0x7f0000000300)={r6, 0x1000, "0e8c0bc35d0dba8c8426dec9b9e4b81e0c63c29dd106a6218330b1e9a55f32d793d6f2522891b82dd1c2b1a151ad432f945b27ff385a679acf7799e04584da53b4e35085c82b7d7617657408917be77d149a47c8094169e9a38bd7c4e76f991910d7daf9ac42486e7617cdc5f9010cd0a0b1b6e44ae9052d31aa5b60d31588e6b39de0e470efab8587395fce7de467e0af3e5dba0c2bc087d13126b7f7b2caeb071727cb1f44a51254fc8c7b24de68fe6598c4cfc4a300dc6eb40f22f1367141e1cfeabdb1024199802167fafbd928faaa254c897dbc33c62d108aaaa39338fd66bd08b985dfcc82dc45b7b985878a066d065a79f7c2f41f4601528ffeb6256b74f407ef4c2ebbfbe2eacf3a5137fdb43855e7d0bda4e0fc87360c08d6423e08b8f5d57837a05c82f7d2e83b118be91e92c258a5ad4d8b5f5da9639c3cb4b6d726835cc22c97509ba3b1c8a0ddbaea40f19236c87876099ab537885c775085734cedf87e8006e8dce4cfa9ee83ab60e5a198619e78b07acdb5b74ee577e819df166a6312f54749ca4b684f563283cb73c2409eeddc0f96b16f70d3d15da7beed18b037ea193bf2b41b0596d6da9d95534417bc0c011b35c9ed0405761920feb0115276bd5270cb72be3ace4edf29523c50a773a3c36c2e5ba7df36b00c42e8b3d1371dffc7f99abca799d999afd156245095c0c513b8c52b5ea21730ece0ee8394d5f53cf6838738b9f5d8e30ad806f2b4effcabd302e50c529454832fcbee9224f1813f246ad9376c1bd0c91ed085eecb087fdf068ac29ae61553cce012a20a84fde013a951157d6c3925fcd87b304bb9a3a5c973e048344963abe02e4cfef9cdfd5593d533038dc094014141306f92d60e8ac98526286c0c95b84f4eb683f4bb94eb892f31de4b8f67589f92bb17ae3a3d6a9c6d5de11842e44994db0cd7805612c667195986ae17e379644c4425d2875f78402c8225953ff3c97d4573b7a52b1f10694f4989ace0bbcafe7725f19f61c737c1a7579efc1d199aa263680f05d9308be4926ff1b69506aeb395742398f12ef1292b88816ceece50d04c79bd5e3c7760df09b9cb1a28eb1d3c0f54df541b58a5b9dff75ff5ecc818ca197c19e7c29eacadad159b662dba8f4f5d57c599b8707afefb57300747f7c6745d57cdebacd4c205bed30c9fe09eced9536b180f10de77d7d59d715b7fbec824b3fde7a440c193f1f82fdb2a1e189dfd172b00364fb4cd1238b52f8ac4cd9cd7847f382888ac86c269e2a81f3ef4d1c9da37d416b6143999d6bb903bf4f303955349933e3297009634bdf985ca0a85274ec64dc8128ddb3edd23f33be69f3ff1b4d2b771bf80def847145e0964e8e14d29a658593e8dbe891ac9173f632fa042e691050709c5da2c08f022e9656c70cd252edbd146781e67f32921602768d80c5b53613b4828180a651d3c9d7184a42a6ee1cd0275f98361fa3f82b81e2e61375c0e04f0a79215f729ab6a1e30bb17f8f36bb9698e36417019dc714346636a9c92450a97d0d57042f89614d8a020907545b37b1e806c9ad5be84ff6b41f8cfbab942eeace5051b6d5a5dd62a5057a1d3fdb9f09c943c6c66f3de3b2ebf739cccc806be2527d0f3f17c12ed9ca59496bba7096e0430078c8d4c2b7c8e3491c1b1db7c4159139727e2eaec38fd741aefdb1184954de1d76173767df142e875eab4734cbf1bc56721b071e0b1b4cfe7e1812124648e7f4949631e70806b9f1d373004ac9a14ed2916eebaf814a7a6bcce33fdfe403f457361478aea0964ceae014bdafdae32e40cdf37c179d73844a1cd25518025e99ac069458c8ab37b903b01ea9e2587f8228562d3ab84eb6373e92dd95c4ead66b8de54bd4ec7a78737cb5d7a600371939a1a1ad4df0b93074af417ff10b5ddfcc5c1ff9bca790202a6f0f1ddef0311b796e04ca48f8a9f28565f34de0f989709058abffb64ba52c2f36922bb4f16a1b23a40e91a7c8f4469e94fc2f9248e9f7696a2cfef49ad1934936b08f31275f41ad9f30d4b6158cb5d2d036a141cf48b52388a6ffd805b47b8bb3c3fa3d9f828d50e74c959a352a8105b857302df74830ecf93795966a16a75816cbf65005a4ced3b060cb345c78fbf6070e61267d8c3512827c2eda94b33099aaa51227d913d72d7450a96048370d46e53d5501128c5c1bfbf4bbc5bb4b4bdd7849282f808f1e56978b9b15aeb93176471882a90f77ec586e00e7d9cc2c34e92142b136b6155b72c930b5dae70b00cf4a89883a93bd5b70bb8810efe006bbb702200725372f02525decb64b8071674864a1b5fbebd0587b11a4246e31243be56b79691ed14883e9c1b81e8a6cfd9837e0a61152709802fe87cb003f7eed38acc53eb553e2f256f4c06e5c7855d85ba5523e14ea78e94758773c8cccf61c30c55fcbe24570aa1715853f8ca5a568698105d0f3c5cc994bc127bdbbd37de806784f7523b089d9aaadfc385f66c533d10091827666f6e5f7df5c79458dfc156c4502221c28ea931d7e9500aadd9e248a824898662a613de1f4a38b98013f6c658495907499dd1438b28e070bd9c0c6984a5b905b4a65d97712fb3dbd821da5732349ca28cd72b0b6bef9dcfc875b0696a0b61482912aba19b2b8eda9647b8d57ebbf6f37380586ebac4eaf04387d538b05c3d4851f3785c8be68f2358ef6c83a6af8835b98546b6270c13edeecbce75b7a78391f3df9a7a411df0d8d0b04d57104edb85c119989c1a4a03518f0e8bf51d7fe453fc0a1c2beb304ba2b04088602baa4600d151b9462b56d31758566f89196c89dacdbcee14a6fb174e5d84ad19790132185f53fe7ccffdfb96584d7b4769b747f177caa814304daeb2cea48687d07c120c3adc638938710212f6b0aa1f83c8bb363eb71afb6a62584e8a09219a03e5632d5f5bcfe9ed9314915cd2bb0721debc5be7bd20e0121ea23ad65e0781ebf0641e050ff34ad2783b66209fb19ab8a31bae09659a7d3492b18a7813a9ba03145c83c5ba501d78e03524df1ab78c43d29146059b46192d790fa64cf83c931034efbf405ae55dc603a0407d448283e71838b2c6b0040c3c081b918ab18f1c08cbd297fc543552a7d4284e8741615a4bb9e75f2efdee4fa7d3cc114f907a4665408056a66efb4150c9fcb05bb757fde676c6a6bf8e5740f746991afa6a992ddfd1031ac7e1452db1c17d00f42c5d31978362484068d32d654caeff8d46200614bda29c2fa6f01760373275382c2a40ddf45e60b3c971d910ac39cee25774b7757f86df8e48598b53bd5a22a8e18fb9aa61f5a08929f08bfb686fd1c93a53228b1931f8648557cbbfd6a499a6299b178b0318cb8e746e713f9a0c9345e2f576eadac5de3db3977166859c5f645b5c51de8d9abf29d9986f68b19ab637d5e010d69cdadae3d7ded1420ee9cd435861c138c939a4669df2568d79df7861589cb5b884bac58af1bc6ffbd9d7e4063a1bf9286914fba9a8f6d07d35aebf953f16e01641ac5ae0876ba91391c40f9925c82aa3a288d2491fca8628e0ed559fc73afead6fab7f2c06447e4c0b3387e5c8e050d46363f6fa625c864aa19a4db042836e7f73082461d805ee78699d3e0e183c3d85f8119ea74bd1db48abd9e3b6c08d56eb24f52fb26d0f9d2fe4c4922551e18e23ff5a549b7c5d00876b0cb8a756fa08badd7a54f387a6c089f7fec81f4582bdd9d20aa8c30c9988186d88723d2cb16b939d1052a8f1fda7e241ac0344f002793ea611039657ae01d3bed3276886f55f3642bafa1bf8c285037c43f689f2dd02ef93f8c19703b7f1f0e448c02b4ad94cb19ce83fb35ae7c5cfc8e0001813f25558d433c42a256ef102ad6450f7aff51f0e84ecdab6fac66fb1b3598ed94dcc5ab2a788b2f526a0992223381007d6b9d85f9362c82d2e7d908ac8206b9a224b2216e622713030138087689cbd3974e5e81ca7fa604b2fb5035a73f0218f129dcf2766d337215027acc1447aedce885fa17e054fb80ca28d22a5455c359a0dbe74ccb1cbb5be09ad07e3c8febefcbe7ec16027192236e0aa0ec2046b00e50487928c1d25babdc6b50c0c37f68c0e3f4b977b7c6e3a4eb323f9bf4be3c09f676d8f60f1fec31b19cb0e531c108f5bb8a777f8c4859f4cefe302be2ee17c08f73fa0c12be244240c84bdee724e0c31dd15681b208c5c47efcf77c7957defeac7626450c96776b322cc2760dc5b26e20e89dd2f1db37077c297d5769f0cc8ab5401d4ada94416b34e692e204b699063ba5ea2f78c816b8ad4f8e2a70cf07b686997f1a19837c9661f850a0a694182c437d804a6d1abac63eda00f5a5e4ca3f8546e0d5230a3a40942ff323909328561a5f2b311d4c0b3be8df93b3e8653141397b3024406d899d7d729b502939afcfcd40b6be37831f7bb0388fa13164fe487dc0f5324c31e14859267f4b05c511c436873070695418692c3b42d75aa7604a54b7dd18f8d1b1686208f6ca5992e99812cbe58b35521b0302bb6faf217ae35e03c47cb765219211ca9ef6a6dcbe788d20300fa7d3b80d5cccacc0db4ec3b6d52b49aef3b26c94f69e077e8e54f08ba1c9c33f602601c0f68b1c9ae680cdf9f16e587c783412149c826c36b9449c7754ea0b3371667a3600e75d46cab6441f28240bc4d36ef4e196f41c5e9c7f0cc1cc642b6488e8ad7ea234ee554d2ea695a95b68c31d8d996d6d2d2dea3bcbeae4453ee737c923f0a599ecfb1b0e692970cd32d00a55b9987b6d95f261c5e77975beacc6f1295a7cf05c85568b37e23fe351e48f6225105ea6127ce830f62b0d488596dc52bfa1f2469433a96c268a07ee02ee1389b6dd9cc62d7ba707672ef97448d04edfbd7df4528b8134334b101cfc9a73fa08a0a7e0adfb9de339ac2f0d6abf45ffea7f290754f02c6b8b16ed9cccc8d5a958c17a2f63e9c82d6d845ab794aac9d4b166baa6018038dda3733c810a722892b93e80024382933bf1dcb799c3a58bd5c808c09e16d38ab28829975c5cf6c8e417563f8acc86c9232c2dff97173cf97a9d86ec24c95093eb88c7e44dfb7e328a70612f6008b0def7545302e114c691f94bc4f8b4a0d9869a75542c986599854c22026d755bea808fed2fb4f22fbc631d0f732dc05118ad242ce284ff200c481be11abcd7035244d60731dbfa5c26cf74c9df3fdb14e4fc8dddd6eae53cdddc77b185c9dc42dac426ccfcc9a26df862194496f2e8c8bf0d1f6aefdc503aadb41073102af781dffe1c945c84cfecb9eb3ab83033b75c5e242d846b112d55e8803b2226b10a4fae269bb680ebff50f3400619c225929890151b04c82bbb01e952a6edaa386c0e73892f97fd1626292d4e0e1dee809b05563e02db2357aaf7c779f89d3d3a52afe172815964d80fd98d36c88bfb1e3ce799338a0e7af1a66c3276a87e4ff3711b57680269ddc86fffb53171ea9672f06683cd69ede5210cd2731f1e618fd70d512335bd43b9f0a3ed5fa4c8cd888c93763337d74a9363d42a53c837f06e681f6745350bb09bef56bb9427aca4c9b83b894830aa2325e86193b79f928247689d383202e6b9a9c1cf2a6bb50440d5767f762fd5df2536264a6f90d86c7f0e3f7e566eb16ed55259420ee764b539dd9d1b4407268954769c6811d1494d5fc89ee9c9d9466513bf6859b2ecb4e2ead42907ae734782b23098ca024f06d9ccf75efbc014371c7223b1a003d22822646bae8ae78fb7bc7aa81a02c0ad2756beb5cf2e96a33967af0a30b26a3dc75477b6348f52cc5cfda8470"}, &(0x7f0000000080)=0x1008) 11:07:35 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x2300, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:07:35 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) [ 956.545729][T27085] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 11:07:35 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008100e01280ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:07:35 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = accept4$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, &(0x7f00000000c0)=0x1c, 0x0) ioctl$sock_SIOCSIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r2, 0x8983, &(0x7f0000000140)) r3 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) fcntl$getflags(r1, 0x408) r4 = dup(0xffffffffffffffff) setsockopt$packet_int(r4, 0x107, 0x10000000000f, 0x0, 0x0) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, r5, 0x0) r6 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, r6, 0x0) r7 = dup(r6) setsockopt$packet_int(r7, 0x107, 0x10000000000f, 0x0, 0x0) ioctl$DRM_IOCTL_GET_CAP(r7, 0xc010640c, &(0x7f0000000000)={0x20, 0x7}) bind$inet(r3, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r3, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r3, 0x0, 0x10005, 0x0) r8 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vsock\x00', 0x200000, 0x0) ioctl$DRM_IOCTL_INFO_BUFS(r8, 0xc0106418, &(0x7f00000001c0)={0xfffffffb, 0x0, 0x6, 0x401, 0x1, 0x8001}) r9 = open(&(0x7f0000000200)='./file0\x00', 0x400, 0x22) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_PEER_REMOVE(r10, &(0x7f0000000980)={0x0, 0x0, &(0x7f0000000940)={&(0x7f0000000580)={0x1a0, r11, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_SOCK={0x14, 0x2, [@TIPC_NLA_SOCK_REF={0x8}, @TIPC_NLA_SOCK_REF={0x8}]}, @TIPC_NLA_MEDIA={0x70, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, [@TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_MTU={0x8}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_WIN={0x8}]}]}, @TIPC_NLA_NET={0x108, 0x7, [@TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_SOCK={0x10, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8}]}, @TIPC_NLA_LINK={0x4}, @TIPC_NLA_LINK={0x38, 0x4, [@TIPC_NLA_LINK_PROP={0x34, 0x7, [@TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}]}, @TIPC_NLA_NET={0x64, 0x7, [@TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}]}, @TIPC_NLA_SOCK={0x18, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8}, @TIPC_NLA_SOCK_ADDR={0x8}]}]}, 0x1a0}}, 0x0) sendmsg$TIPC_NL_NET_SET(r9, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x38, r11, 0x10, 0x70bd2c, 0x25dfdbfb, {}, [@TIPC_NLA_SOCK={0x24, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x2141e29a}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x5}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x48000}, 0x4c000) [ 956.719247][T27096] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 956.837308][ T27] audit: type=1804 audit(1577272055.853:526): pid=27103 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/746/file0/bus" dev="sda1" ino=16862 res=1 [ 956.857267][T27102] netlink: 'syz-executor.1': attribute type 2 has an invalid length. [ 956.882428][T27091] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 956.903206][ T27] audit: type=1804 audit(1577272055.913:527): pid=27097 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/746/file0/bus" dev="sda1" ino=16862 res=1 [ 956.919271][T27102] netlink: 'syz-executor.1': attribute type 4 has an invalid length. 11:07:38 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008100e05080ecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:07:38 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0x122, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:07:38 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x02\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:07:38 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x3f00, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:07:38 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) r1 = dup(0xffffffffffffffff) setsockopt$packet_int(r1, 0x107, 0x10000000000f, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000000)) ptrace$getregset(0x4204, r0, 0x200, &(0x7f0000000040)={&(0x7f0000000100)=""/168, 0xa8}) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:07:38 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) ioctl$KVM_SET_DEVICE_ATTR(r1, 0x4018aee1, &(0x7f00000000c0)={0x0, 0x0, 0x2, &(0x7f0000000080)=0x80000001}) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) getsockopt$IP_VS_SO_GET_SERVICES(r1, 0x0, 0x482, &(0x7f0000000140)=""/254, &(0x7f0000000000)=0xfe) [ 959.343872][T27129] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 959.372541][T27122] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 959.382844][ T27] audit: type=1804 audit(1577272058.393:528): pid=27124 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/747/file0/bus" dev="loop4" ino=253 res=1 11:07:38 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x03\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) [ 959.426542][ T27] audit: type=1804 audit(1577272058.443:529): pid=27135 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/747/file0/bus" dev="loop4" ino=253 res=1 11:07:38 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) r3 = dup(0xffffffffffffffff) setsockopt$packet_int(r3, 0x107, 0x10000000000f, 0x0, 0x0) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000080)=""/114) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 11:07:38 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008100e00f4decdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:07:38 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x4000, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) [ 959.684728][T27140] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 959.705413][T27147] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 11:07:38 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008100e00f4eecdb4cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:07:38 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0x123, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:07:38 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x04\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) [ 959.877367][T27157] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 959.896175][ T27] audit: type=1804 audit(1577272058.913:530): pid=27152 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/748/file0/bus" dev="loop4" ino=254 res=1 11:07:39 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008100e00f80ec634cb9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:07:39 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) r3 = dup(0xffffffffffffffff) setsockopt$packet_int(r3, 0x107, 0x10000000000f, 0x0, 0x0) ioctl$SIOCAX25ADDFWD(r3, 0x89ea, &(0x7f0000000000)={@default, @bcast}) [ 960.001125][ T27] audit: type=1804 audit(1577272058.943:531): pid=27152 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/748/file0/bus" dev="loop4" ino=254 res=1 [ 960.060205][T27169] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 11:07:39 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x60ff, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) [ 960.188130][T27166] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 960.199814][ T27] audit: type=1804 audit(1577272058.953:532): pid=27160 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/748/file0/bus" dev="loop4" ino=254 res=1 [ 960.487688][ T27] audit: type=1804 audit(1577272059.503:533): pid=27179 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/749/file0/bus" dev="loop4" ino=255 res=1 11:07:41 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x05\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:07:41 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008100e00f80ecdb0ab9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:07:41 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) r3 = add_key$user(0x0, &(0x7f0000000000)={'syz'}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$dh_compute(0x17, &(0x7f0000000300)={r3}, 0x0, 0x0, &(0x7f0000000200)={0x0}) keyctl$set_timeout(0xf, r3, 0x3) r4 = dup(0xffffffffffffffff) setsockopt$packet_int(r4, 0x107, 0x10000000000f, 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000140)={{{@in=@multicast1, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in=@broadcast}}, &(0x7f00000000c0)=0xe8) r6 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, r7, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000300)={{{@in=@rand_addr=0x7, @in=@multicast2, 0x4e20, 0x340, 0x4e20, 0x800, 0x2, 0x80, 0xf5c48510247cf24e, 0x3a, r5, r7}, {0xfffffffffffffff7, 0x4, 0x3, 0x9, 0x1, 0x614, 0x17bd, 0x96}, {0x7e, 0x80c0000000000000, 0x7ff, 0xdc}, 0x2, 0x6e6bb2}, {{@in6=@remote, 0x4d4}, 0x2, @in=@empty, 0x3505, 0xe, 0x1, 0x8, 0x20, 0x4, 0xc0000000}}, 0xe8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) r8 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, r8, 0x0) ioctl$VIDIOC_QUERYBUF(r0, 0xc0585609, &(0x7f0000000000)={0xf6e, 0x3, 0x4, 0x10000, 0x4, {0x77359400}, {0x2, 0xc, 0x6, 0x7f, 0x3, 0x5, "ffd5020d"}, 0x100, 0x3, @fd, 0x314, 0x0, r8}) ioctl$SIOCRSSCAUSE(r9, 0x89e1, &(0x7f0000000080)=0x60) r10 = dup(0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) setsockopt$packet_int(r10, 0x107, 0x10000000000f, 0x0, 0x0) setns(r10, 0x8000000) 11:07:41 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0x124, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:07:41 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x7600, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:07:41 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = getpid() r1 = getpid() r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sched_setattr(r2, &(0x7f0000000040)={0x38, 0x2, 0x8, 0x0, 0x5, 0x0, 0x0, 0x400}, 0x0) sched_setattr(r1, &(0x7f0000000040)={0xfe70, 0x2, 0x2, 0x0, 0x4, 0x800, 0x0, 0x3, 0x8001, 0x7fffffff}, 0x0) wait4(r0, &(0x7f00000002c0), 0x2, 0x0) mount(&(0x7f0000000340)=ANY=[@ANYBLOB="2e2f8dd36eda20128e9a04d46cc27091c5eb07b9a4ea5a7769b4"], &(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='cgroup\x00', 0x800001, &(0x7f0000000180)='em0\x00') clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) r4 = dup(0xffffffffffffffff) setsockopt$packet_int(r4, 0x107, 0x10000000000f, 0x0, 0x0) ioctl$PIO_UNISCRNMAP(r4, 0x4b6a, &(0x7f0000000000)="d756d86a587dda87828c2e61285fd4860625654abd45f8b47097d57f") vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) r5 = dup(0xffffffffffffffff) setsockopt$TIPC_GROUP_LEAVE(r5, 0x10f, 0x88) setsockopt$packet_int(r5, 0x107, 0x10000000000f, 0x0, 0x0) connect$vsock_stream(r5, &(0x7f0000000040), 0x10) ioctl$SOUND_MIXER_READ_VOLUME(r5, 0x80044d17, &(0x7f0000000080)) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x3c) ptrace$cont(0x18, r3, 0x0, 0x0) ptrace$setregs(0xd, r3, 0x0, &(0x7f0000000080)) ioctl$RNDGETENTCNT(r5, 0x80045200, &(0x7f0000000300)) ptrace$cont(0x20, r3, 0x0, 0x0) [ 962.378506][T27202] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 11:07:41 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008100e00f80ecdb25b9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 962.433762][ T27] kauditd_printk_skb: 1 callbacks suppressed [ 962.433801][ T27] audit: type=1804 audit(1577272061.453:535): pid=27201 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/750/file0/bus" dev="loop4" ino=256 res=1 11:07:41 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(0xffffffffffffffff) r4 = dup(0xffffffffffffffff) setsockopt$packet_int(r4, 0x107, 0x10000000000f, 0x0, 0x0) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcsa\x00', 0x4400, 0x0) r5 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280)='/dev/sequencer2\x00', 0x10402, 0x0) setsockopt$packet_int(r5, 0x107, 0x14, 0x0, 0x3b3) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x218}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="0201000210000000000006000000000008001300e4feff400000d2a82be90000e592c300fcffff390000ff0f00000000e00073000000000000000000000035000000000000000000000e02ff00000000030006000000000002000004000000bb0000e0000000000003000500000000000200423b0000000000e70040000000e0c01b8446bdeba4580f49140d94ecda0ca68eedd5ea506eaf7e31ab65b8c11d6d27d1dc583ebd6bc7dfcac2b3fd02810b229920db3f5eddbb00bd6454c6288a42599dcc440b8f088607cecd801df8aed31f0100f0c8cac0b1b826846650e4553196908d1176f54f734f3b8f0c5d86587031ce112345af849456a7b28c4d69d0ab5302c12b5a149322a02ccf02ce0c04c460ac0755f3d5994c0fdc2976a29cf366e5f500000000000000040cc42fd4ae15d4661b53eb6a2935277de5d89429c213181e14b807e64550574d1c97507829d441dbdbb7f5d5dc562aaa3f8bf10f7086f821d99d734581294c2089e267813215ef24049a0469dcef0000a92f000000000000000000000000000000000000edbd2270781d9cef37a467d3885e167a2697bee7901b0a3ffb58b7d331aa14dc5bfcffb5ed614d5e7ce1b41a5daf093d87e1210fbfab89d26497f7dd162867339568179f3f3619877d9d30a7ed491f8eb628843fbb038acdf65ba0d8f2fce4f9c71b7f37827a35dfd5b8c4bbfc86146448218e18439fe9217db38de50e841c5d09b50cbf922329127ea58a"], 0x80}}, 0x0) r6 = socket$key(0xf, 0x3, 0x2) sendmmsg(r6, &(0x7f0000000180), 0x400000000000117, 0x0) write$FUSE_NOTIFY_POLL(r3, &(0x7f0000000000)={0x18, 0x1, 0x0, {0x1}}, 0x18) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 962.526853][T27194] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:07:41 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x9600, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) [ 962.582522][T27215] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 11:07:41 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008100e00f80ecdb4db9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:07:41 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x06\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) [ 962.632388][ T27] audit: type=1804 audit(1577272061.453:536): pid=27206 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/750/file0/bus" dev="loop4" ino=256 res=1 [ 962.701316][T27220] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 11:07:41 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008100e00f80ecdb50b9040a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 962.911792][ T27] audit: type=1804 audit(1577272061.923:537): pid=27226 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/751/file0/bus" dev="loop4" ino=257 res=1 [ 962.939211][T27229] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 963.000949][T27237] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 11:07:42 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0x125, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:07:42 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\a\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:07:42 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x101000, 0x0) r3 = socket$inet_sctp(0x2, 0x1, 0x84) r4 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r3, 0x84, 0x76, &(0x7f0000000000)={r5}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r2, 0x84, 0x23, &(0x7f0000000080)={r5, 0xfc37}, 0x8) r6 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r6, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r6, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r6, 0x0, 0x10005, 0x0) [ 963.073398][ T27] audit: type=1804 audit(1577272061.993:538): pid=27233 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/751/file0/bus" dev="loop4" ino=257 res=1 11:07:42 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0xae00, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:07:42 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008100e00f80ecdb4cb9020a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 963.362302][T27254] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 963.393551][T27246] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 963.560222][ T27] audit: type=1804 audit(1577272062.573:539): pid=27256 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/752/file0/bus" dev="loop4" ino=258 res=1 [ 963.610714][ T27] audit: type=1804 audit(1577272062.623:540): pid=27261 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/752/file0/bus" dev="loop4" ino=258 res=1 11:07:44 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008100e00f80ecdb4cb9030a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:07:44 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0xc000, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:07:44 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x11\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:07:44 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0x126, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:07:44 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() r1 = getpid() sched_setattr(r1, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) tkill(r1, 0xf) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vga_arbiter\x00', 0x10082, 0x0) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) sched_setattr(r1, &(0x7f0000000000)={0x38, 0x2, 0x12, 0x5ef, 0x1, 0x2, 0x4bf4, 0x8, 0x7f42, 0x6}, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 965.475354][T27269] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 965.579445][ T27] audit: type=1804 audit(1577272064.593:541): pid=27270 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/753/file0/bus" dev="loop4" ino=259 res=1 11:07:44 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008100e00f80ecdb4cb9050a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 965.766480][T27276] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:07:44 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0xeffd, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) [ 965.812789][ T27] audit: type=1804 audit(1577272064.623:542): pid=27270 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/753/file0/bus" dev="loop4" ino=259 res=1 11:07:44 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0x127, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:07:44 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000040)={0x7ff}, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="20000000160001070000000000000000000c00002208bdb8ea27108e000400e0000801000000a5ca62b931d823be04470f8f0d14e4d9bb1ac1a918e527b0a6ffaaab9b98caf829455a54208e1c7678e7a1a40ffc50ae0f814308262f02d4e743b92af3620f59e0540cdea8490de061384bde0363a248d595e0129d8438d8d8cc237da47760fe1611488718252ecff40e907e9d99234390d85c6994186f84f9f25cf1bf49776a8a641e89300fb5c8d04c2c8f42ea592669474319e6b446cac2c426a2f168bbae114d7c6653458adb6caa243ec0da7e782a0b4fefa9f28f1497f76288ae7ae50eb8b2f6912b16b8f48b"], 0x20}}, 0x0) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x38, 0x3, 0x0, 0x0, 0x5, 0x0, 0x40}, 0x0) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r2, 0x10, &(0x7f0000000080)={0xba9}) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) r3 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000380)='/dev/vsock\x00', 0x121000, 0x0) ioctl$SIOCGSTAMP(r3, 0x8906, &(0x7f00000003c0)) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) r4 = dup(0xffffffffffffffff) setsockopt$packet_int(r4, 0x107, 0x10000000000f, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000100)={0x4e9, 0x2, 0x8, 0x20, 0xffff, 0x7fffffff, 0x1, 0xfffffbff, 0x0}, &(0x7f0000000140)=0x20) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f00000002c0)={r5, @in={{0x2, 0x4e23, @local}}, 0x7, 0x1000, 0x2, 0x3ff, 0x5}, &(0x7f0000000180)=0x98) r6 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r6, 0x6, 0x1d, &(0x7f0000000000), &(0x7f0000000040)=0x14) [ 965.918415][T27291] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 11:07:45 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x88\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) [ 966.042315][T27298] Unknown ioctl 35078 11:07:45 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008100e00f80ecdb4cb9060a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 966.202653][ T27] audit: type=1804 audit(1577272065.213:543): pid=27303 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/754/file0/bus" dev="loop4" ino=260 res=1 [ 966.301738][ T27] audit: type=1804 audit(1577272065.263:544): pid=27311 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/754/file0/bus" dev="loop4" ino=260 res=1 [ 966.378972][T27315] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 966.461201][T27313] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:07:45 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0xf0ff, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:07:45 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0x128, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:07:45 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008100e00f80ecdb4cb9070a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 966.650179][T27322] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 11:07:45 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x03\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:07:45 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008100e00f80ecdb4cb9080a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 966.817379][T27329] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:07:46 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x05\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) [ 966.969700][T27338] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 11:07:46 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0xfdef, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:07:46 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcsa\x00', 0x1, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) r3 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000000)={r4}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000040)={r4, 0x3e1, 0x0, 0x6d7f, 0x9}, &(0x7f0000000080)=0x18) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000000100)={r5, 0x4, 0x6, [0x3, 0x7, 0xfff9, 0x80, 0x6, 0xffff]}, 0x14) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:07:46 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008100e00f80ecdb4cb9120a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 967.210026][T27341] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:07:46 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x06\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) [ 967.362184][T27358] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 11:07:46 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0x129, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:07:46 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0xfff0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:07:46 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008100e00f80ecdb4cb9140a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 967.504627][T27362] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:07:46 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\a\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) [ 967.604159][T27370] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 967.730355][ T27] kauditd_printk_skb: 4 callbacks suppressed [ 967.730378][ T27] audit: type=1804 audit(1577272066.743:549): pid=27372 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/757/file0/bus" dev="loop4" ino=262 res=1 11:07:46 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008100e00f80ecdb4cb9500a1d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 967.771200][ T27] audit: type=1804 audit(1577272066.783:550): pid=27378 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/757/file0/bus" dev="loop4" ino=262 res=1 [ 967.872256][T27385] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 11:07:46 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x20000, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) [ 967.910920][ T27] audit: type=1804 audit(1577272066.783:551): pid=27379 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/757/file0/bus" dev="loop4" ino=262 res=1 11:07:47 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008100e00f80ecdb4cb904141d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 967.975922][T27381] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:07:47 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x11\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:07:47 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008100e00f80ecdb4cb904251d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 968.256472][ T27] audit: type=1804 audit(1577272067.273:552): pid=27392 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/758/file0/bus" dev="loop4" ino=263 res=1 [ 968.305661][T27397] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 968.370373][ T27] audit: type=1804 audit(1577272067.303:553): pid=27403 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/758/file0/bus" dev="loop4" ino=263 res=1 11:07:49 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0xfffffffffffffdab}, {0x0, 0x2d8}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x74}], 0x4, 0x4) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) r1 = syz_open_dev$sndtimer(&(0x7f0000000100)='/dev/snd/timer\x00', 0x0, 0x14100) vmsplice(r1, &(0x7f0000000480)=[{&(0x7f0000000280)="b9015e7b38f0a7d58ddfb72926535d8ceb4dd2fb56f6317ca297ba1c4e56ec57e9fdcbf03b7e3121fa855d4d80d5deffe13968e60a096efe9c90e9578cf2b85d8dfe562fc4cb2994ce92a081cbc7ae1f6a23819569febde83cf5ad605b3757938c0130819fbee2e10cd1aa9e662b747d0e9ef77bd9fb11684b01d9a0fe5700569685d63c31bed2296798da7477a4c05e99ae7a4558a7166df6", 0x99}, {&(0x7f0000000140)="cc32f3c25d29ad10df8f88b4461fe710da669598ba81436162b0be3e838c74c09f67dda6b4ed3808fa0d8caf5929e869be047ad436a8b2fd84dfbf070ffe6a5661dab7b351c1510f91d3710dd9e775bbf9721d2bb5", 0x55}, {&(0x7f0000000340)="0d33033d72bb492c177f253ca6d79ee6cb401583ce0da453fa86cb2e0b693487bc7cb87415c70770de3e5e142619d92481de4662ebae8e43d2b357746780c089a1d79b7c031bac4491e96b1ecd277dc762e80fb355f291556f098981c37147cc7f8f259cc844fb56fcae7f42813ecc73b87bb009bdbffdeb1f84d5ee9e389b1dfd88cdab607c0748", 0x88}, {&(0x7f0000000400)="38f6ad5f609121ca89ffe50e4080bc43a59adf822cf185099a33a0cb76c2713afe05d9a0c798ae3f18206bd07debeee6fcba12342599f843542783b44cf0ea833348a12f4e6e34840b76dbd87ce91ee213cfb2d69d55d60566d24d22a844a47218f5f380223928bec1246946004dea983eeb4d2c02c37b794d37f6", 0x7b}], 0x4, 0x0) r2 = socket(0x10, 0x2, 0x0) newfstatat(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', &(0x7f00000005c0), 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, r3, 0x0) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/ttyS3\x00', 0x180, 0x0) ioctl$PIO_UNIMAP(r4, 0x4b67, &(0x7f0000000540)={0x1, &(0x7f0000000500)=[{0x3, 0x5}]}) setfsuid(r3) ptrace$cont(0x18, r0, 0x0, 0x0) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, r5, 0x0) write$binfmt_script(r5, &(0x7f0000000740)=ANY=[@ANYBLOB="2321202e2f66696c6530202f6465762f736e642f74696d657200202f6465762f736e642f74696d657200204073797374656d2a6d643573756d73797374656d20766d6e6574317472757374656470707030757365722620236b657972696e6773656c662a0a87b43fe47bd8ef068446c4b2de42e07a81a8ebfd7772e447e665fcabfa2fe06c726212df9ff4756df9859cabc9446a0e1686e1ae5ae6ed635b11c0cbdd493a6ced210fe2740896a8d0788d678aafa0fcf5c32c28ea90f1b7f9ecf2d1251a5eeae92fd40a86e24edf6632f6693bc8638e65162000ca920ffefc5ee1443df06715815e1a4b914d56981567ffffeb09ed177db61957c35810655d39ffb11a799ab509c415196f0040c71a1d38f18f2dc1f1e08eb9f11b8bba5abeb96923fd12577a71b4240d653fda0cdb3518c4708c477b22bb91fa4505cc7153f98da5fd3f079c1cf0dfa952652a59a5fcce6971db75cfcdf6278671063eb56c19b4470033e637150fd1d71cb17bd222d23ce559344a6685b82ed3c4909dec1e570e035c66186240d5540122a80857b0b454b3e21e0efd696af9db26e248a21a9f573734404708421e4a3bd2eb585130232ee718"], 0x163) ptrace$setsig(0x4203, 0xffffffffffffffff, 0x1, &(0x7f0000000000)={0x8, 0x1, 0x6d75}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) sched_getaffinity(r0, 0x8, &(0x7f0000000080)) 11:07:49 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0x12a, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:07:49 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00 \x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:07:49 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008100e00f80ecdb4cb904501d65ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:07:49 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x100000, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:07:49 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PPPIOCGL2TPSTATS(0xffffffffffffffff, 0x80487436, &(0x7f0000000000)="9ccb56ef96d920e99aac3ebd6e977ed6644c6d") write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) r3 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x80, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r1, 0xc0206434, &(0x7f0000000140)={0x7fff, 0x0, 0x1, 0x617}) ioctl$DRM_IOCTL_AGP_BIND(r3, 0x40106436, &(0x7f0000000180)={r4, 0xffffffffffff5535}) bind$inet(r2, &(0x7f00000000c0)={0x2, 0x4e24, @broadcast}, 0x6cc9ab47a7604518) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 11:07:49 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008100e00f80ecdb4cb9040a5065ef0b007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:07:49 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) r1 = getpid() sched_setattr(r1, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) ptrace$cont(0x18, r1, 0xfffffffffffffffc, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:07:49 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00?\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) [ 970.269744][T27413] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:07:49 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200, 0x10) statx(r3, &(0x7f0000000080)='./file0\x00', 0x2000, 0xa94, &(0x7f0000000140)) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x26}}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 970.322984][ T27] audit: type=1804 audit(1577272069.333:554): pid=27428 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/759/file0/bus" dev="sda1" ino=16889 res=1 11:07:49 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) ioctl(r0, 0x7ff, &(0x7f0000000080)="52205e07f8dcee604229d866255d9709b3c6321ade8c324207810c673694f365478ac6d4cd2e95ec3f2523e691726296e63f649aaf056ff4932692da08117f3dc34646d2bfb19d6373947259e6794be15cef39067cca3eb20e8db35ca4db") r3 = dup(0xffffffffffffffff) setsockopt$packet_int(r3, 0x107, 0x10000000000f, 0x0, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r3, 0x89e2, &(0x7f0000000140)) r4 = socket$inet(0x2, 0x80000, 0x8) bind$inet(r4, &(0x7f00000002c0)={0x2, 0x0, @local}, 0x3cf) sigaltstack(&(0x7f0000fff000/0x1000)=nil, &(0x7f0000000180)) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) ioctl$EVIOCGKEYCODE_V2(r0, 0x80284504, &(0x7f0000000000)=""/54) r5 = dup(0xffffffffffffffff) setsockopt$packet_int(r5, 0x107, 0x10000000000f, 0x0, 0x0) name_to_handle_at(r5, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)={0x96, 0x80000000, "283b4c352e0043e79be5874e411df1e4a697c77b39dc8a20b83dbfca37a54084dc0289aacfcd2162c1c2f4c2fe196eb6992afae6d5d7cf469c5f3999241981d2acf30ccf7c0091c97a2c749258a99325e99a955d0fe922766f78e81c9b896a6a0c52214f8db572094d35141a023422f7341f3239a1af09f5f07b2c61ca1b7e6984bc6b31602a2a05d9ad903a7e68"}, &(0x7f0000001300), 0x200) ioctl$EVIOCGPROP(r1, 0x80404509, &(0x7f0000000300)=""/4096) [ 970.419519][T27438] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 970.426796][T27438] IPv6: NLM_F_CREATE should be set when creating new route [ 970.434090][T27438] IPv6: NLM_F_CREATE should be set when creating new route [ 970.441328][T27438] IPv6: NLM_F_CREATE should be set when creating new route [ 970.507900][ T27] audit: type=1804 audit(1577272069.413:555): pid=27420 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/759/file0/bus" dev="sda1" ino=16889 res=1 [ 970.589128][ T27] audit: type=1804 audit(1577272069.413:556): pid=27428 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/759/file0/bus" dev="sda1" ino=16889 res=1 11:07:49 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x2009ff, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:07:49 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008100e00f80ecdb4cb9040a1d65ef02007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 970.629286][T27442] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 970.757681][T27459] IPv6: NLM_F_CREATE should be specified when creating new route [ 970.796451][T27459] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 970.803717][T27459] IPv6: NLM_F_CREATE should be set when creating new route [ 970.810922][T27459] IPv6: NLM_F_CREATE should be set when creating new route [ 970.818139][T27459] IPv6: NLM_F_CREATE should be set when creating new route 11:07:49 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0x12b, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:07:49 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00@\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:07:49 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$VIDIOC_CREATE_BUFS(r0, 0xc100565c, &(0x7f0000000140)={0x559, 0x6, 0x4, {0x4, @sdr={0x33424752, 0xff}}, 0x8000}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x5e23, @multicast1}, 0xfffffffffffffe69) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f0000000300)="253acb1a916e40a3426fb5356778ba91a3b63da4b269662d40ceecda58efe4ab76fd35e0b1c7b8bb9ba556a1b939819338fa496aa6b1207acf4aa31d8d6a5b3864bc650bf5bf3995e5e2eca449deb82f98e5e2056fd7eba7b4b2522bebb51c0748259b3cd1174ce8ba8523d7cfdfc948611bdb2a3376a3f7677a507f46122af91f33adf590bebe9efd61bfcb987970ab3611d2e019e881020d31bdddaa96d099ca0b814238a9a43efc5a9b4eb3e8faf147246fe1bf1622f4bd38f01e6f65d6c9ede183326e70be037f984c11f2387fa5497a1728ce3cb84bcc23ad93307864abe492d408b7018430adf07a5c1e04625022d60b32fbbc43ba80997e51b27846300ca4b6ab174b13a3d78923c8fe3ddd4df288b33c02da4fc6a1870466eeb5e1bb88520cfaacab98930903ea76118c1e2a41a064e0c62f73669a8c9aa9d7ec60fd3ac0f2c1a2d3892a1716c351fbfe8448ddb0d6cf96446bfd65f8fd7b90a3367729f0ed5a0267bb1c0343da8d7721e41d4b2fc080c31f5869da9f2bbb9e4b18a5d382d318eafead4838ec575208f0e2f81b81f570ea53bcd80cb3fbeac57e4f477a7dae3219b20c9b83dfdeb1ea7912d02b9485aeb7ca014dd1224335e411f8e313be94e7c9dcb2ab5e28444340bff38c3cf62eb9478872f32577cd6b432cda2eae3f6a93553006d4c936a869fe61d88fd5e96b8298f280ed03790645010660098598d733c21e3dffd6506c8f3d79ca1f4a6538205057458a0a9bc27737e2472bcdf121490133e75518c2b1b3ab56de2ae915030bddd79dc0c75ca8e55f6fbeefb46ed57f0c9f0f5de8bc31af7a3393393d9d7c16b073ba2468353d41886eccaa82a8ca673dd7e8ad6c1b2d64f34a35d92d66959fc36894fcebf01d327d5ccd5a1b800f72487cdbf40f3040e5f420df51a01cec7aca0a787d92db0ae5bd632846b4808cea3023e9a2bbf85844c87eaee72d5d821d0a0559c14dd50bca6607815af5c6d056c503b3bcd3f5f91315ae5a59ffeee9c85e6cd41a26afa88a566bb812c0eaebbf7705266f55e54265e5b3d711408120837bd632130587145200cffba39a572ca42b3c307c479fc8ba2efcf8a82ef4799749e412fb37c76fdcf41442b700ce98a6900f5ac52257adb5afb68791a6e419f085b97eb478c556e12b1001c3bcbe1dba0d62084ab141b8c6eac2c0e1c6bfa0d03c4f5a90f7660ee428c0649fdef3489462c41791ae8bfd3b7e66bbbf3236e5cd428c9e893571811b1ad406bd2b3a61424b5cfc9e00d5662fbf9c860efb7f61d5a1bbe37680a9d917d2551d191193de8f4d53358f93552d06e342ab05f68a50232f9b214e9ab873e9e8fef5d7d81ab88585c5225c04276382eb4a25cc8ab64794761d6d8d5bffb0985e2e542edbd307d3c60bb40c077e02b07a3863d493b55ad61234dd322350cf08e434fb528eeeb33a358772b5f3e438fecc129f26382005e46f2c8a029f8bd5accc26e00b66c2dc4373fc9071247c0aaf9be8a07fad2e87df2e0202803df0c3f0e18ae536d010776e208b8e48ea202f5543039fd6ad2840b5ac8d500cc3b887bacd4bcb45799ef263ee794f30e064f54b5df2e0ae05161399eca84e212d7103351dc69289b0547fe6002ae2b64be6242d71f8fff0d32f453f1ae81dc3faa8bac69f7d8b3b7cd0ff6d75b119cb32b259534b658e5ab78eaa8e0207789ec4d097b674b0ec2eaec1f28efa17498d69c71c66331dd8233d6eba7ced1ac20d4d225ae0dfb8a5404c9a298f1052127dbe9ce4a5b83d7ff44bc84dd1de3e8847e81163bf14a37e1754209f8bf9fbd7992b7b959886921b28b0110cbd3f8f48bf8bfeae9f064d6d95ed0876cae822e95ef8989eea5a267fdffa4f8a3aaf4816b621cc07601a54fb606999eeffe5557157658055a8a4b99b26b7f094f345539f93cffe732f243ea7392dd9cc6bf2dd0a97ab8c72b5b6c5f3f939f2353c47017587f84f40ea5fa0a9e07c9dbca3a8466d7179da26b3eba557386ec94505a07fde5a7ca2c74f3d72bcbcaef0e952a12232ce05b36ea5885f5e52fa1da13bbdd041103241978214b0056d4e00230c521999272ac10b161d306f1f64948e341b98a07effebe3373b3adb045d9fb005d8eab8c2e2b352197d66c7a0c0ad6fca4bf4c8932797b4b6fad65791882a579b2513cd1b9d16174602c0a875a1a543ce271a4a72519e647d967c6af4436896928361ec4de7ee8199ea2b19f84c359dede755b0455ea831fc19ae555bb20223514664551e34237c82997d288e15c46f0034c38895a8348939dda00c29146b2aca7ab708927708fd3f42c365df5933bd3b987de0a92380383fdb96d15abc1635a938d773990302ffdbd30020570f047deba6aac6ab613ccb073dd1dc2849e53865902ec8c87babf70a53dc4969e4eea696dff22ef6868c6d3cf053a4d7f0ed8090b50d002274288cf574f45f0b8361990fb4a13bc7982df729dcafb92074e37b8f5efd4eec642318542f3b2bae33a2decbedf5aeb36a9d7af19709a14371bf1be57c65bffb4580ebff1c89310e1f32b95aa39eb192ec35cd8cf7efee573693333de570a8b4396e05989b6f9fa862fde484ac456f396f42cf60528f6c659275c5ad3ffad26ee1424dea3998a3a02400d4028fcfab3d2f97e3912517957dafb55069fc0b5cb3113dcd10ccf9c8bc3b21296a5ac377949126a7038cb05953e8d0fda65e81dcd842c16b92655b76ccaa4750e5f14f8e94660a631a30ce6189f0fd04624118022c2bb7e56fc1d8f79318ddd87db830c298c6efdb1b49fb167743b0599974ea8ad982f9422301e44ddeca262ac8912a94f872b513ec961dd5dca8400541562212b4a1bfe0e2ce34e727eab9e91b0e3d58cb8e2c7355c7ecf7d99f1df580ed20c4b466d9420251f65b9c6112fbd8b5bd75f23cdc02ffaf22f67f0f433e0c743cc6db54f84beabc670e52ebc4c84ed586efa79f1da541d37773fd471203bd6f650851edc15b4cc619302c13024010a2088df90595f948c091292bca7c9bf9165ceb495447dee551cd8c3722f2837784467dad5275bb638c36ed0c25d2b3accc46115e8212c0922fa5a8a68885bee5fb0ec63a8073be8440bbb628cecd989749466dc2b7e38cfc98585d774e5ffe3826c9adaa61b5f1c210cd020cff43a85335c1c33aa0c32e1edfafda70aa01ecf1165493ad5aba381dbad23e09f400cf63a005c498fb7190e6edb674e4e0252cabec1dcd74f16dc71eb4aa5c300d221f794ad705d4778537c7321055dbc845b4d5721c164b41d4153256f5ce4c89e2a3b0e6b6dfea1ac9d177f40e2d79e1a852f2adaf035f094b21289a758783366653274b247353cbb872d57cfe25a7a025ddf1b31d1972ee67b3f355675da2eb2ee8bc756103d27af19516d1f2a0495d83d63e98c7efd77e21d3d6d44025c3ca562f69e82dfbb71c570e56d32cde4f0a0a5660f23b8080a0527312229b0b3a1b4d33fedfce7da87dce5df81de45bdb29a2cf2766f5849d5a9a74b2142dd60c2c9ec9fa43827dbee82ec5bdbbd88a3e2d28ad0217ac55546048c7bace3802c341a7a74a73f22cd66fc54d9e78309ee85044e5c0b32e992aa35e8cc1b54e4065e2e4886ec3ee49f92bd6dd88f7ab3e750ee6a0d8aa0d6fccc352a181c24888998c22df28bffcf6984583f71616a3d39872b4ab35db7aaf51a02eb56794c9ead6bae7eaa814bf64a51eea2df05d819c713c1f826264a3f002803f0e39c173d7c4c595a5cb1178d1804b316a04e9b103bfb4e7079d7aeb5440af7df04539c771af8c9b904a7b5ea343cfc90c8f3de392108793a405f0d7d59ad4c199e1cd462925610dc8c5c6fa8c6d42fc9e3a2c52c81f3d5c5ed5066cc8833d76161e89470f2657c49ce584513ed8e53980c580a164f8feb0164d41c130cf34a39251f4a9e5b010e1d47a49280bd86720daf66077de8b49008da2593a2dad492d4a8e592f596db6e8db2f0721f1510d305b241912c58ec5e01dae377199aaae1c99ed56f9b73eb9b63ad59a6d480f90f17180309db9329a7813f57d53a951537ea0b2e955acc79841174b3aa012abc33014a31e09adcbfbe692d6c5e1335512e508e29bb9b2aa945c99cc396a776788b707404a174fa00a796a17e828c312546164c0fab7fd8da25898ed5459d66e0981f4e55366415358df8d3dfa7fbdad8ef0f2a605c567c976dbbaf02a632ba052479615e0f3eec94b3ffe7be3df6d7bd5f5f0f4a289f4b44d2518d4370a3f4274d38de71029906caa2d0334ad7328bcfab90f5506a5642f4f2e19fe7a3c794c2742fa657dd2f8efbb6641c7b5c9a9ab2adb33fc926cb2fad97cfe6c71d7e2aa7ca7256772b50a820f861041248bbf4bec81e26f52ef1ef22d8edb6131b52f81d873da55c6e038e56666b95281efc2a95857ac3fb83361fada41c387e8aa291816a01c19e2883efd0c7e02cb79d4cab5094ff2caf15e6e90b0845456c50fdb5f2cef6e008dda2fc190343444daa8363bba2938ca89d2b0dbc2e9a22914dfc009964c777b63cd506f424d8d736804ab769dbfe989ae3e3dfb3a4288a2fd5f25dc97bce14f28a237a3e9f83d1e941a66abe061805789b8b8b35ef00b10f4b560b9ad3ffad9a5a649a99b55c392c08b4aefbf6518c6af82d91d083a787f9251b6f88607494d3998b5ebc3f3330ad64fd74d0ec024c8aca7f85afc832c08c14237eca8c9155f4f5a8bef56385205d9395a202193c6afae81db6147ab6b94936364a4856d476211b7e81da243dc1c22628464256ac5cefeab9148c63be1027b8cc829ca334e0db797bfaafa67e41cc115587246612e76483cf5f4e5e8ad09ec6a25d8e665740bdcb7ed3470cd328cc75fb9897bc5ddc4fa4518e877ca0aceb122b8c62c2ba9686742044a54d5df207cbd30148736fe61d01095e9b15998c7137baf6fa7b16207925c0a39e2cd194e8331b438c1a09e7c09db4ccbff83c576890b81ee63e7a1cb6ed858c22dc808f438b7c8b41a1100f491a333eb02334317ec96fa5370b44a6c2df0d631fc967873fe50ff45e879ae4e12a0622cc67de45e6e01f02a95a4d604bb9a70439afbff0fe82ebd0de298beb7e9440ed9146f0c8a0f197bcff3ae7ad7d93fee868f4adf1908bb1f5f5d95c24d0775e7384bbc4157599bafaba61fd043a0f79a4cae080296cc2438f305fd30e07a69929827f9d355f3a4bfd51a6cc8a02b53be047af62ad195abb6115ac8d5c6fbfba91ac24b2f6441f7e192fd551ba3a5322a7e4f311c8bbe74cb101ed96a629cc93dde8c175dc8cba5d647b4a350e0e90e0da267b325129bde31b9be997b546501ecbabd3624df5d5f90e12830a12b56389cdd0034c7a01fbf463b189bb12b9d1eb41aacd0f21dd3f8c05e00928c63c2e11276388fa7ab1c980d9713593df9aa6aeb1074853875d2232c9701c9c8d7f049444c25049c7878d4add08b15fb5fbc744ecf34a50bf3c548e76a4cdc72645d33eeaa2fd702cc165a083b340c742959b25cf7c108c9726bbfb3a666a7e2fce6bd61aa2b7fc618a630e9bd6ccbe87cea995197d0db10c3d80311e1bd1a5d7f3b0558e9d07afead8f4ec4e068e01b762207b505b0e68abd34f9503c7ea22ae67de4184c5d9f6752c6c65b06fdc324194e367af0ba30349818879e95446ce622fa5b74384670341edd23181da8e21a991cdf03f38a14bc117dc1b7171e32a5580b52355c88f0c3ec3e17e80ca705f49b716e2114a70a0279c3d8867367c204196ea26908f08bf06eda030d4895fef35d7357cac3", 0x1000, 0x10, &(0x7f0000000000)={0x2, 0x4e21, @empty}, 0x10) openat$mixer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/mixer\x00', 0x10000, 0x0) [ 970.909282][ T27] audit: type=1804 audit(1577272069.923:557): pid=27463 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/760/file0/bus" dev="loop4" ino=264 res=1 11:07:50 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008100e00f80ecdb4cb9040a1d65ef12007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:07:50 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x307100, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) [ 971.083314][ T27] audit: type=1804 audit(1577272069.923:558): pid=27465 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/760/file0/bus" dev="loop4" ino=264 res=1 [ 971.188114][T27479] IPv6: NLM_F_CREATE should be specified when creating new route [ 971.196431][T27474] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:07:50 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) r3 = dup(0xffffffffffffffff) setsockopt$packet_int(r3, 0x107, 0x10000000000f, 0x0, 0x0) r4 = socket$inet_sctp(0x2, 0x1, 0x84) r5 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r4, 0x84, 0x76, &(0x7f0000000000)={r6}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_MAXSEG(r3, 0x84, 0xd, &(0x7f0000000000)=@assoc_id=r6, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) r7 = syz_init_net_socket$ax25(0x3, 0x3, 0xcb) ioctl$FICLONERANGE(r5, 0x4020940d, &(0x7f0000000080)={{r7}, 0x8, 0x58, 0x3f}) [ 971.229099][T27479] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 971.236375][T27479] IPv6: NLM_F_CREATE should be set when creating new route [ 971.243674][T27479] IPv6: NLM_F_CREATE should be set when creating new route [ 971.250978][T27479] IPv6: NLM_F_CREATE should be set when creating new route 11:07:52 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x88\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:07:52 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008100e00f80ecdb4cb9040a1d65ef14007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:07:52 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0x0) bind$inet(r1, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) stat(&(0x7f00000001c0)='./file1\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setresgid(0x0, 0x0, r2) r3 = dup(0xffffffffffffffff) setsockopt$packet_int(r3, 0x107, 0x10000000000f, 0x0, 0x0) ioctl$NS_GET_OWNER_UID(r3, 0xb704, &(0x7f0000001540)) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f00000009c0)='./file1\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r4 = getpid() sched_setattr(r4, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r5, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r7, 0x407, 0x0) write(r7, &(0x7f0000000340), 0x41395527) ioctl$TCSETXW(0xffffffffffffffff, 0x5435, &(0x7f00000000c0)={0x0, 0x0, [0x101]}) write$tun(0xffffffffffffffff, 0x0, 0x0) vmsplice(r6, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r9 = dup(r8) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r9, 0xc1105511, &(0x7f0000000700)={{0xa, 0x0, 0x8, 0x2, 'syz1\x00', 0x401}, 0x2, 0x500, 0x2, 0x0, 0x2, 0x6, 'syz1\x00', &(0x7f00000002c0)=['\x00', 'security[nodevsecurity\x00'], 0x18, [], [0x0, 0x7eaa, 0x1]}) socket$packet(0x11, 0x3, 0x300) socket$inet6(0xa, 0x3, 0x7) r10 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dlm_plock\x00', 0x80100, 0x0) connect$inet6(r10, &(0x7f00000000c0)={0xa, 0x0, 0x3, @initdev={0xfe, 0x88, [], 0x0, 0x0}}, 0x1c) 11:07:52 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:07:52 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = dup(0xffffffffffffffff) setsockopt$packet_int(r0, 0x107, 0x10000000000f, 0x0, 0x0) ioctl$TIOCGISO7816(r0, 0x80285442, &(0x7f0000000040)) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ioctl$TUNSETVNETBE(0xffffffffffffffff, 0x400454de, &(0x7f0000000000)) r2 = dup(0xffffffffffffffff) setsockopt$packet_int(r2, 0x107, 0x10000000000f, 0x0, 0x0) r3 = dup(0xffffffffffffffff) setsockopt$packet_int(r3, 0x107, 0x10000000000f, 0x0, 0x0) setsockopt$bt_BT_VOICE(r3, 0x112, 0xb, &(0x7f00000000c0)=0x3, 0x2) r4 = dup(0xffffffffffffffff) setsockopt$packet_int(r4, 0x107, 0x10000000000f, 0x0, 0x0) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000080)=r4, 0x4) r5 = dup(0xffffffffffffffff) setsockopt$packet_int(r5, 0x107, 0x10000000000f, 0x0, 0x0) ioctl$VIDIOC_PREPARE_BUF(r5, 0xc058565d, &(0x7f0000000200)={0x3, 0x5, 0x4, 0x2000510, 0x1f, {0x0, 0x7530}, {0xf, 0x2, 0x8, 0x7, 0x9, 0x3f, "ac7d60cb"}, 0x7fff, 0x2, @planes=&(0x7f00000001c0)={0x1, 0x7, @userptr=0x101, 0x2}, 0x7fffffff, 0x0, 0xffffffffffffffff}) ioctl$SNDRV_PCM_IOCTL_RESET(r6, 0x4141, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x3c) ptrace$cont(0x18, r1, 0x0, 0x0) ptrace$setregs(0xd, r1, 0x6, &(0x7f0000000100)="f2d0bd000036d5e1b072a2ace252febbba708bf965ed62add8856c8011b73bcb9e20406848312c6f99ba501c79a938343608568302a1b9200206172d8ff9d90170bd4a6463b23521186a77acb0a91675c15abca1a04048d12264d9771e067f10973e904e8fc1c5f9554067755ac6238a79f46be6fea0fb0bd9d159baef407fb5c47f4f93e78a7420fdff32f25d89411fbdd80894beb8ffc53a43b1a0acaf82c55d36bdd7abf04259944fa3") ptrace$cont(0x20, r1, 0x0, 0x0) prctl$PR_MCE_KILL_GET(0x22) 11:07:52 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0x12c, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 973.427103][T27509] IPv6: NLM_F_CREATE should be specified when creating new route [ 973.443760][T27509] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 973.446244][T27510] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 973.451003][T27509] IPv6: NLM_F_CREATE should be set when creating new route [ 973.468379][T27509] IPv6: NLM_F_CREATE should be set when creating new route 11:07:52 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00 \x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) [ 973.475593][T27509] IPv6: NLM_F_CREATE should be set when creating new route [ 973.527164][ T27] kauditd_printk_skb: 2 callbacks suppressed [ 973.527184][ T27] audit: type=1804 audit(1577272072.543:561): pid=27507 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/762/file0/bus" dev="loop4" ino=265 res=1 [ 973.615869][ T27] audit: type=1804 audit(1577272072.583:562): pid=27522 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/762/file0/bus" dev="loop4" ino=265 res=1 [ 973.615912][T27525] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:07:52 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:07:52 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008100e00f80ecdb4cb9040a1d65ef15007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:07:52 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x405100, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) [ 973.654141][ T27] audit: type=1804 audit(1577272072.583:563): pid=27507 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/762/file0/bus" dev="loop4" ino=265 res=1 [ 973.693086][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 973.698862][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 973.805497][T27531] IPv6: NLM_F_CREATE should be specified when creating new route [ 973.856039][T27531] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 973.863336][T27531] IPv6: NLM_F_CREATE should be set when creating new route [ 973.870535][T27531] IPv6: NLM_F_CREATE should be set when creating new route [ 973.877752][T27531] IPv6: NLM_F_CREATE should be set when creating new route [ 973.885193][T27533] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:07:52 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0x12d, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 11:07:52 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:07:53 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008100e00f80ecdb4cb9040a1d65ef16007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) [ 973.962037][ T27] audit: type=1804 audit(1577272072.963:564): pid=27537 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/763/file0/bus" dev="loop4" ino=266 res=1 [ 974.065061][T27544] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING 11:07:53 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x514000, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) [ 974.146705][ T27] audit: type=1804 audit(1577272073.033:565): pid=27540 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/763/file0/bus" dev="loop4" ino=266 res=1 11:07:53 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfec8) pselect6(0x40, &(0x7f0000000000)={0x972, 0x0, 0x4f68, 0x0, 0x44, 0x5, 0x1}, &(0x7f0000000080)={0x4, 0x9, 0x10000, 0xf1, 0x2, 0x6, 0x4, 0x1}, &(0x7f00000000c0)={0xb886, 0x81, 0x2, 0x8, 0xfff, 0x4, 0x0, 0x2ca3}, &(0x7f0000000140)={0x0, 0x989680}, &(0x7f00000001c0)={&(0x7f0000000180)={0x1}, 0x8}) bind$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) r2 = dup(0xffffffffffffffff) setsockopt$packet_int(r2, 0x107, 0x10000000000f, 0x0, 0x0) ioctl$RNDADDTOENTCNT(r2, 0x40045201, &(0x7f0000000200)=0x2) connect$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x10005, 0x0) 11:07:53 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) [ 974.279880][T27553] IPv6: NLM_F_CREATE should be specified when creating new route [ 974.313219][T27553] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 974.320490][T27553] IPv6: NLM_F_CREATE should be set when creating new route [ 974.327719][T27553] IPv6: NLM_F_CREATE should be set when creating new route [ 974.335008][T27553] IPv6: NLM_F_CREATE should be set when creating new route [ 974.429929][T27561] x_tables: eb_tables: snat target: used from hooks OUTPUT, but only usable from POSTROUTING [ 974.440222][ T27] audit: type=1804 audit(1577272073.453:566): pid=27563 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/764/file0/bus" dev="loop4" ino=267 res=1 [ 974.474383][ T27] audit: type=1804 audit(1577272073.483:567): pid=27566 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir581378611/syzkaller.k5LB5z/764/file0/bus" dev="loop4" ino=267 res=1 11:07:55 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d05", 0x88}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = getpid() sched_setattr(r1, &(0x7f0000000040)={0xffcb, 0x2, 0x0, 0x0, 0x5, 0x17fec45a, 0x1, 0x0, 0x0, 0x80000001}, 0x0) ptrace$setregs(0xd, r1, 0x100000001, &(0x7f0000000000)="bf5fb381766ea8fe8f3a365b0d82bb19c1b4d46df6e168c9dd3a5192641cadb007cfc24c7bd43e04739681dfd9d48eb404f90333187c45dcf253962243df443fa57a584441f7c45dd80a75a0bc820598091af39a149eeb88bdce28412037d153659eff9fc1712cdb89aad528b72a92ddb668a85f524c0ba8a6814a75afdfa2e6") ptrace$cont(0x20, r0, 0x0, 0x0) 11:07:55 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x117, &(0x7f00000000c0)=[{&(0x7f0000000100)="d800000018008100e00f80ecdb4cb9040a1d65ef50007c0be87c55a1bc000900b800069904000000050005001400812fa8000b000300000000000000035c3b6189d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775422f16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40cb0c7b73efdef777634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703", 0xd8}], 0x1}, 0x0) 11:07:55 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000800000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c0000000002000000000000000000000000000000f9ff0000000000000065727370616e300000000000000000007465616d5f736c617600000000000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000001badf12700000000000000000000000000001800000000000000000000000000000000e2ffffffffffff0200000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000200000000000000000006172707265706c790000000000400000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) 11:07:55 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(0xffffffffffffffff) setsockopt$packet_int(r3, 0x107, 0x10000000000f, 0x0, 0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, r4, 0x0) r5 = dup(0xffffffffffffffff) r6 = dup(0xffffffffffffffff) setsockopt$packet_int(r6, 0x107, 0x10000000000f, 0x0, 0x0) accept(r6, 0x0, &(0x7f00000001c0)) setsockopt$packet_int(r5, 0x107, 0x10000000000f, 0x0, 0x0) write$binfmt_misc(r1, &(0x7f00000000c0)=ANY=[@ANYPTR=&(0x7f0000000140)=ANY=[@ANYRESHEX=r3, @ANYRESOCT=r4, @ANYPTR64=&(0x7f0000000080)=ANY=[@ANYPTR, @ANYRESHEX=r5, @ANYRES32=0x0, @ANYPTR64, @ANYPTR], @ANYRESHEX=r2]], 0x8) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) r7 = dup(0xffffffffffffffff) setsockopt$packet_int(r7, 0x107, 0x10000000000f, 0x0, 0x0) sendfile(r7, 0xffffffffffffffff, &(0x7f0000000000)=0x4, 0x8) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 11:07:55 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000b00)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000ac0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) write$UHID_DESTROY(r1, &(0x7f00000001c0), 0x4) dup3(r2, r1, 0x0) fcntl$setstatus(r1, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x713000, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}]) 11:07:55 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f00000004c0), 0x12e, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000180)=0x6, 0x1f8) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 976.400258][T27517] ================================================================== [ 976.408406][T27517] BUG: KCSAN: data-race in get_signal / prepare_signal [ 976.415242][T27517] [ 976.417577][T27517] read to 0xffff88812115b064 of 4 bytes by task 27515 on cpu 0: [ 976.425217][T27517] prepare_signal+0x1f5/0x7a0 [ 976.429894][T27517] __send_signal+0x96/0x870 [ 976.434391][T27517] send_signal+0x224/0x2b0 [ 976.438788][T27517] do_notify_parent_cldstop+0x363/0x370 [ 976.444324][T27517] ptrace_stop+0x1ba/0x520 [ 976.448740][T27517] ptrace_do_notify+0xed/0x120 [ 976.453501][T27517] ptrace_notify+0x93/0xd0 [ 976.457923][T27517] syscall_slow_exit_work+0x144/0x320 [ 976.463295][T27517] do_syscall_64+0x359/0x3a0 [ 976.467885][T27517] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 976.473763][T27517] [ 976.476098][T27517] write to 0xffff88812115b064 of 4 bytes by task 27517 on cpu 1: [ 976.483825][T27517] get_signal+0x7c7/0x1320 [ 976.488273][T27517] do_signal+0x2f/0x6c0 [ 976.492463][T27517] exit_to_usermode_loop+0x250/0x2c0 [ 976.497731][T27517] do_syscall_64+0x384/0x3a0 [ 976.502305][T27517] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 976.508170][T27517] [ 976.510473][T27517] Reported by Kernel Concurrency Sanitizer on: [ 976.516606][T27517] CPU: 1 PID: 27517 Comm: syz-executor.2 Not tainted 5.5.0-rc1-syzkaller #0 [ 976.525256][T27517] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 976.535295][T27517] ================================================================== [ 976.543346][T27517] Kernel panic - not syncing: panic_on_warn set ... [ 976.549928][T27517] CPU: 1 PID: 27517 Comm: syz-executor.2 Not tainted 5.5.0-rc1-syzkaller #0 [ 976.558598][T27517] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 976.568629][T27517] Call Trace: [ 976.571903][T27517] dump_stack+0x11d/0x181 [ 976.576217][T27517] panic+0x210/0x640 [ 976.580104][T27517] ? vprintk_func+0x8d/0x140 [ 976.584699][T27517] kcsan_report.cold+0xc/0xd [ 976.589296][T27517] kcsan_setup_watchpoint+0x3fe/0x460 [ 976.594775][T27517] __tsan_unaligned_write4+0xc7/0x110 [ 976.600143][T27517] get_signal+0x7c7/0x1320 [ 976.604579][T27517] ? __read_once_size.constprop.0+0x12/0x20 [ 976.610467][T27517] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 976.616695][T27517] do_signal+0x2f/0x6c0 [ 976.620843][T27517] ? __read_once_size+0x5a/0xe0 [ 976.625704][T27517] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 976.631464][T27517] exit_to_usermode_loop+0x250/0x2c0 [ 976.636743][T27517] do_syscall_64+0x384/0x3a0 [ 976.641330][T27517] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 976.647213][T27517] RIP: 0033:0x45a919 [ 976.651226][T27517] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 976.670847][T27517] RSP: 002b:00007fb6a17bacf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 976.679273][T27517] RAX: fffffffffffffe00 RBX: 000000000075bfd0 RCX: 000000000045a919 [ 976.687234][T27517] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000075bfd0 [ 976.695189][T27517] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 976.703153][T27517] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000075bfd4 [ 976.711123][T27517] R13: 00007ffec3dae50f R14: 00007fb6a17bb9c0 R15: 000000000075bfd4 [ 976.720414][T27517] Kernel Offset: disabled [ 976.724736][T27517] Rebooting in 86400 seconds..