[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 56.787426][ T26] audit: type=1800 audit(1570400809.914:25): pid=8436 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 56.809066][ T26] audit: type=1800 audit(1570400809.914:26): pid=8436 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 56.830090][ T26] audit: type=1800 audit(1570400809.914:27): pid=8436 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.1.26' (ECDSA) to the list of known hosts. 2019/10/06 22:27:01 fuzzer started 2019/10/06 22:27:03 dialing manager at 10.128.0.26:46035 2019/10/06 22:27:03 syscalls: 1018 2019/10/06 22:27:03 code coverage: enabled 2019/10/06 22:27:03 comparison tracing: enabled 2019/10/06 22:27:03 extra coverage: extra coverage is not supported by the kernel 2019/10/06 22:27:03 setuid sandbox: enabled 2019/10/06 22:27:03 namespace sandbox: enabled 2019/10/06 22:27:03 Android sandbox: /sys/fs/selinux/policy does not exist 2019/10/06 22:27:03 fault injection: enabled 2019/10/06 22:27:03 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/10/06 22:27:03 net packet injection: enabled 2019/10/06 22:27:03 net device setup: enabled 2019/10/06 22:27:03 concurrency sanitizer: /proc/kcsaninfo does not exist 22:27:58 executing program 0: r0 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$TIPC_CONN_TIMEOUT(0xffffffffffffffff, 0x10f, 0x82, 0x0, &(0x7f0000000180)) setsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f00000005c0)=0x1, 0x4) pipe(&(0x7f00000004c0)={0xffffffffffffffff}) getsockopt$inet_dccp_buf(r1, 0x21, 0x0, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='memory.stat\x00', 0x0, 0x0) openat$cgroup_int(r2, &(0x7f0000000480)='io.max\x00', 0x2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) r4 = openat$cgroup_ro(r3, &(0x7f0000000040)='/\x02roup.stap\x00', 0x2761, 0x0) r5 = openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000040), 0x2, 0x0) syz_emit_ethernet(0x0, 0x0, &(0x7f0000000100)={0x0, 0x3, [0x0, 0x606, 0x9b2]}) write$cgroup_int(r5, &(0x7f0000000140), 0x87) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r4, 0x10f, 0x84, &(0x7f0000000080), &(0x7f00000000c0)=0x4) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000780)={{{@in6=@remote, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in6=@loopback}}, &(0x7f0000000880)=0xe8) ioctl$ifreq_SIOCGIFINDEX_team(r4, 0x8933, &(0x7f00000002c0)={'team0\x00', r6}) ioctl$sock_inet6_SIOCSIFDSTADDR(r4, 0x8918, &(0x7f0000000300)={@mcast1, 0x0, r7}) sendfile(r5, r5, &(0x7f0000000240), 0x8000) ioctl$FIBMAP(r5, 0x1, &(0x7f0000000000)=0xfffffffffffffffc) 22:27:58 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$inet6_int(r1, 0x29, 0xcf, &(0x7f0000b67000), &(0x7f00007d0000)=0x3) syzkaller login: [ 125.265077][ T8601] IPVS: ftp: loaded support on port[0] = 21 [ 125.360504][ T8603] IPVS: ftp: loaded support on port[0] = 21 22:27:58 executing program 2: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x40000000000a132, 0xffffffffffffffff, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r1 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r1, 0x101, 0x19, &(0x7f0000003680), &(0x7f0000000280)=0x4) [ 125.446945][ T8601] chnl_net:caif_netlink_parms(): no params data found [ 125.536490][ T8601] bridge0: port 1(bridge_slave_0) entered blocking state [ 125.545529][ T8601] bridge0: port 1(bridge_slave_0) entered disabled state [ 125.556840][ T8601] device bridge_slave_0 entered promiscuous mode [ 125.602987][ T8601] bridge0: port 2(bridge_slave_1) entered blocking state [ 125.610111][ T8601] bridge0: port 2(bridge_slave_1) entered disabled state [ 125.620078][ T8601] device bridge_slave_1 entered promiscuous mode [ 125.666883][ T8601] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 125.669954][ T8607] IPVS: ftp: loaded support on port[0] = 21 [ 125.686331][ T8603] chnl_net:caif_netlink_parms(): no params data found [ 125.699275][ T8601] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 125.778625][ T8601] team0: Port device team_slave_0 added [ 125.787255][ T8601] team0: Port device team_slave_1 added [ 125.796669][ T8603] bridge0: port 1(bridge_slave_0) entered blocking state [ 125.805147][ T8603] bridge0: port 1(bridge_slave_0) entered disabled state [ 125.815084][ T8603] device bridge_slave_0 entered promiscuous mode 22:27:58 executing program 3: syz_emit_ethernet(0x3c, &(0x7f0000000140)={@local, @link_local, [], {@ipv6={0x86dd, {0x0, 0x6, "6c48a3", 0x14, 0x82f, 0x0, @dev, @dev, {[], @tcp={{0xa0008000, 0x6558, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000000c0)) [ 125.826539][ T8603] bridge0: port 2(bridge_slave_1) entered blocking state [ 125.834760][ T8603] bridge0: port 2(bridge_slave_1) entered disabled state [ 125.846154][ T8603] device bridge_slave_1 entered promiscuous mode [ 125.903403][ T8603] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 125.914924][ T8603] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 125.974215][ T8601] device hsr_slave_0 entered promiscuous mode 22:27:59 executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000040)={@dev={0xfe, 0x80, [], 0x13}, 0x9, 0x2, 0x2, 0x4, 0x0, 0xf2a}, &(0x7f0000000180)=0x20) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x7a05, 0x1700) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)={[{0x0, 'memory'}]}, 0x200600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0x0, 0x5000000) write$cgroup_subtree(r0, &(0x7f0000001600)=ANY=[], 0x23fa00) [ 126.023428][ T8601] device hsr_slave_1 entered promiscuous mode [ 126.208709][ T8609] IPVS: ftp: loaded support on port[0] = 21 [ 126.214224][ T8601] bridge0: port 2(bridge_slave_1) entered blocking state [ 126.221896][ T8601] bridge0: port 2(bridge_slave_1) entered forwarding state [ 126.229712][ T8601] bridge0: port 1(bridge_slave_0) entered blocking state [ 126.236877][ T8601] bridge0: port 1(bridge_slave_0) entered forwarding state [ 126.281237][ T8603] team0: Port device team_slave_0 added [ 126.289877][ T8603] team0: Port device team_slave_1 added [ 126.310500][ T8612] IPVS: ftp: loaded support on port[0] = 21 [ 126.324587][ T8607] chnl_net:caif_netlink_parms(): no params data found 22:27:59 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)="d800000018008100e00f80ecdb4cb904021d65ef0b007c06e87c55a1bc000900b8000699030000000500154001008178a80016000c000100e558f03003ac110000d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe04000000730d16a4683e4f6d0200003f5aeb4edbb57a5025ccca9e00360db798262f3d40fad95667e04adcdf634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92307f27260e9703", 0xd8}], 0x1, 0x0, 0x0, 0x7504}, 0x0) [ 126.473913][ T8603] device hsr_slave_0 entered promiscuous mode [ 126.531436][ T8603] device hsr_slave_1 entered promiscuous mode [ 126.571169][ T8603] debugfs: Directory 'hsr0' with parent '/' already present! [ 126.606620][ T3278] bridge0: port 1(bridge_slave_0) entered disabled state [ 126.625782][ T3278] bridge0: port 2(bridge_slave_1) entered disabled state [ 126.654198][ T8601] 8021q: adding VLAN 0 to HW filter on device bond0 [ 126.667498][ T8607] bridge0: port 1(bridge_slave_0) entered blocking state [ 126.674692][ T8607] bridge0: port 1(bridge_slave_0) entered disabled state [ 126.684131][ T8607] device bridge_slave_0 entered promiscuous mode [ 126.692138][ T8607] bridge0: port 2(bridge_slave_1) entered blocking state [ 126.699189][ T8607] bridge0: port 2(bridge_slave_1) entered disabled state [ 126.709109][ T8607] device bridge_slave_1 entered promiscuous mode [ 126.733739][ T8607] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 126.742913][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 126.755698][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 126.775251][ T8615] IPVS: ftp: loaded support on port[0] = 21 [ 126.777933][ T8601] 8021q: adding VLAN 0 to HW filter on device team0 [ 126.792097][ T8607] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 126.836974][ T8607] team0: Port device team_slave_0 added [ 126.846024][ T8607] team0: Port device team_slave_1 added [ 126.877025][ T8616] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 126.886079][ T8616] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 126.894448][ T8616] bridge0: port 1(bridge_slave_0) entered blocking state [ 126.901559][ T8616] bridge0: port 1(bridge_slave_0) entered forwarding state [ 126.909512][ T8616] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 126.918969][ T8616] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 126.927514][ T8616] bridge0: port 2(bridge_slave_1) entered blocking state [ 126.934677][ T8616] bridge0: port 2(bridge_slave_1) entered forwarding state [ 127.034074][ T8607] device hsr_slave_0 entered promiscuous mode [ 127.101329][ T8607] device hsr_slave_1 entered promiscuous mode [ 127.191479][ T8607] debugfs: Directory 'hsr0' with parent '/' already present! [ 127.224018][ T8612] chnl_net:caif_netlink_parms(): no params data found [ 127.234094][ T8616] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 127.246925][ T8609] chnl_net:caif_netlink_parms(): no params data found [ 127.284249][ T8601] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 127.294835][ T8601] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 127.323469][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 127.333151][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 127.342136][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 127.350429][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 127.359593][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 127.368245][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 127.377539][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 127.386509][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 127.394937][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 127.403749][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 127.411733][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 127.467629][ T8612] bridge0: port 1(bridge_slave_0) entered blocking state [ 127.475148][ T8612] bridge0: port 1(bridge_slave_0) entered disabled state [ 127.483697][ T8612] device bridge_slave_0 entered promiscuous mode [ 127.503388][ T8601] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 127.526961][ T8612] bridge0: port 2(bridge_slave_1) entered blocking state [ 127.539226][ T8612] bridge0: port 2(bridge_slave_1) entered disabled state [ 127.547834][ T8612] device bridge_slave_1 entered promiscuous mode [ 127.567738][ T8612] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 127.579343][ T8612] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 127.593864][ T8609] bridge0: port 1(bridge_slave_0) entered blocking state [ 127.602390][ T8609] bridge0: port 1(bridge_slave_0) entered disabled state [ 127.610047][ T8609] device bridge_slave_0 entered promiscuous mode [ 127.618178][ T8609] bridge0: port 2(bridge_slave_1) entered blocking state [ 127.625466][ T8609] bridge0: port 2(bridge_slave_1) entered disabled state [ 127.634142][ T8609] device bridge_slave_1 entered promiscuous mode [ 127.684764][ T8612] team0: Port device team_slave_0 added [ 127.695748][ T8607] 8021q: adding VLAN 0 to HW filter on device bond0 [ 127.717558][ T8609] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 127.738885][ T8612] team0: Port device team_slave_1 added [ 127.764238][ T8609] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 127.793719][ T8607] 8021q: adding VLAN 0 to HW filter on device team0 [ 127.830118][ T8603] 8021q: adding VLAN 0 to HW filter on device bond0 22:28:01 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0x1d, 0x0, &(0x7f0000000400)) [ 127.884085][ T8612] device hsr_slave_0 entered promiscuous mode [ 127.921409][ T8612] device hsr_slave_1 entered promiscuous mode 22:28:01 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0x1d, 0x0, &(0x7f0000000400)) 22:28:01 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0x1d, 0x0, &(0x7f0000000400)) [ 127.951317][ T8612] debugfs: Directory 'hsr0' with parent '/' already present! [ 127.966884][ T2871] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 127.990388][ T2871] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 22:28:01 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0x1d, 0x0, &(0x7f0000000400)) [ 128.015394][ T8609] team0: Port device team_slave_0 added [ 128.023911][ T8609] team0: Port device team_slave_1 added 22:28:01 executing program 0: r0 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_AUTH_DEACTIVATE_KEY(r0, 0x84, 0x23, &(0x7f0000000080), 0x8) [ 128.070299][ T8617] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 128.094156][ T8617] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 128.105017][ T8617] bridge0: port 1(bridge_slave_0) entered blocking state [ 128.112179][ T8617] bridge0: port 1(bridge_slave_0) entered forwarding state 22:28:01 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) r1 = socket$packet(0x11, 0x2, 0x300) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000140)={0x0, 0x0, 0x8de7d8f023d06bd7}, 0x4) sendmmsg(r2, &(0x7f00000092c0), 0x4f, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4f, 0x0) [ 128.131633][ T8617] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 128.140634][ T8617] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 128.154816][ T8617] bridge0: port 2(bridge_slave_1) entered blocking state [ 128.161982][ T8617] bridge0: port 2(bridge_slave_1) entered forwarding state [ 128.175252][ T8617] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 128.202323][ T8615] chnl_net:caif_netlink_parms(): no params data found 22:28:01 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) r1 = socket$packet(0x11, 0x2, 0x300) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000140)={0x0, 0x0, 0x8de7d8f023d06bd7}, 0x4) sendmmsg(r2, &(0x7f00000092c0), 0x4f, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4f, 0x0) [ 128.246359][ T8609] device hsr_slave_0 entered promiscuous mode [ 128.301360][ T8609] device hsr_slave_1 entered promiscuous mode [ 128.341186][ T8609] debugfs: Directory 'hsr0' with parent '/' already present! [ 128.349030][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 128.357811][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 128.367314][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 128.376250][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 128.385684][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 128.394054][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 128.404429][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 128.427850][ T8603] 8021q: adding VLAN 0 to HW filter on device team0 [ 128.482925][ T3278] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 128.492351][ T3278] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 128.500675][ T3278] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 128.509636][ T3278] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 128.538616][ T8607] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 128.550361][ T8607] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 128.574521][ T3278] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 128.584030][ T3278] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 128.592718][ T3278] bridge0: port 1(bridge_slave_0) entered blocking state [ 128.599880][ T3278] bridge0: port 1(bridge_slave_0) entered forwarding state [ 128.607575][ T3278] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 128.616675][ T3278] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 128.625171][ T3278] bridge0: port 2(bridge_slave_1) entered blocking state [ 128.632256][ T3278] bridge0: port 2(bridge_slave_1) entered forwarding state [ 128.640059][ T3278] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 128.648496][ T3278] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 128.656850][ T3278] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 128.665571][ T3278] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 128.676521][ T3278] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 128.685215][ T8615] bridge0: port 1(bridge_slave_0) entered blocking state [ 128.692919][ T8615] bridge0: port 1(bridge_slave_0) entered disabled state [ 128.700566][ T8615] device bridge_slave_0 entered promiscuous mode [ 128.710599][ T8615] bridge0: port 2(bridge_slave_1) entered blocking state [ 128.718768][ T8615] bridge0: port 2(bridge_slave_1) entered disabled state [ 128.726868][ T8615] device bridge_slave_1 entered promiscuous mode [ 128.751679][ T8607] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 128.792820][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 128.804283][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 128.813442][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 128.823311][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 128.835122][ T8615] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 128.846275][ T8615] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 128.865494][ T8609] 8021q: adding VLAN 0 to HW filter on device bond0 [ 128.873935][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 128.888384][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 128.899017][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 128.935579][ T8603] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 128.947307][ T8603] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 128.957280][ T8615] team0: Port device team_slave_0 added [ 128.968837][ T8615] team0: Port device team_slave_1 added [ 128.976874][ T3278] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 128.985901][ T3278] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 128.999198][ T8612] 8021q: adding VLAN 0 to HW filter on device bond0 [ 129.038786][ T8603] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 129.114002][ T8615] device hsr_slave_0 entered promiscuous mode [ 129.151562][ T8615] device hsr_slave_1 entered promiscuous mode [ 129.191799][ T8615] debugfs: Directory 'hsr0' with parent '/' already present! [ 129.207528][ T3278] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 129.216491][ T3278] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 129.232841][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 129.240690][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 129.277848][ T8609] 8021q: adding VLAN 0 to HW filter on device team0 [ 129.303619][ T3278] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 129.312371][ T3278] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 129.320722][ T3278] bridge0: port 1(bridge_slave_0) entered blocking state [ 129.327835][ T3278] bridge0: port 1(bridge_slave_0) entered forwarding state [ 129.336834][ T3278] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 129.347408][ T8612] 8021q: adding VLAN 0 to HW filter on device team0 [ 129.375389][ T3278] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 129.406965][ T3278] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 129.416089][ T3278] bridge0: port 2(bridge_slave_1) entered blocking state [ 129.423255][ T3278] bridge0: port 2(bridge_slave_1) entered forwarding state [ 129.436998][ T3278] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 129.445889][ T3278] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 129.454861][ T3278] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 129.463423][ T3278] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 129.473353][ T3278] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 129.481296][ T3278] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 129.489820][ T3278] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 129.510166][ T2871] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready 22:28:02 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$inet6_int(r1, 0x29, 0xcf, &(0x7f0000b67000), &(0x7f00007d0000)=0x3) 22:28:02 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) r1 = socket$packet(0x11, 0x2, 0x300) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000140)={0x0, 0x0, 0x8de7d8f023d06bd7}, 0x4) sendmmsg(r2, &(0x7f00000092c0), 0x4f, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4f, 0x0) [ 129.531992][ T2871] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 129.541253][ T2871] bridge0: port 1(bridge_slave_0) entered blocking state [ 129.548338][ T2871] bridge0: port 1(bridge_slave_0) entered forwarding state [ 129.628336][ T8609] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 129.642200][ T8609] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 129.656513][ T2871] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 129.670663][ T2871] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 129.693752][ T2871] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 129.702770][ T2871] bridge0: port 2(bridge_slave_1) entered blocking state [ 129.709955][ T2871] bridge0: port 2(bridge_slave_1) entered forwarding state [ 129.718170][ T2871] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 129.727677][ T2871] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 129.736794][ T2871] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 129.745634][ T2871] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 129.754783][ T2871] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 129.766935][ T2871] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 129.778057][ T2871] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 129.787639][ T2871] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 129.808405][ T2871] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 129.816370][ T2871] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 129.844413][ T8613] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 129.855210][ T8613] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 129.875715][ T8609] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 129.884258][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 129.898543][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 129.907476][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 129.916443][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 129.925767][ T8612] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 129.969025][ T8612] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 129.988362][ T8615] 8021q: adding VLAN 0 to HW filter on device bond0 [ 130.008726][ T8615] 8021q: adding VLAN 0 to HW filter on device team0 [ 130.017242][ T2871] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 130.025785][ T2871] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 130.052059][ T2871] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 130.060793][ T2871] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 130.070084][ T2871] bridge0: port 1(bridge_slave_0) entered blocking state [ 130.077207][ T2871] bridge0: port 1(bridge_slave_0) entered forwarding state [ 130.078136][ T2871] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 130.094264][ T2871] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 130.103659][ T2871] bridge0: port 2(bridge_slave_1) entered blocking state [ 130.110737][ T2871] bridge0: port 2(bridge_slave_1) entered forwarding state [ 130.123379][ T2871] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 130.142105][ T2871] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready 22:28:03 executing program 3: syz_emit_ethernet(0x3c, &(0x7f0000000140)={@local, @link_local, [], {@ipv6={0x86dd, {0x0, 0x6, "6c48a3", 0x14, 0x82f, 0x0, @dev, @dev, {[], @tcp={{0xa0008000, 0x6558, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000000c0)) [ 130.182861][ T8615] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 130.194469][ T8615] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 130.210310][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 130.219862][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 130.230168][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 130.239747][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 130.251195][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 130.271645][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 130.280308][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 130.289390][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 130.298304][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 130.319137][ T8615] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 130.326792][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 130.335188][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 130.481458][ T26] kauditd_printk_skb: 3 callbacks suppressed [ 130.481472][ T26] audit: type=1804 audit(1570400883.604:31): pid=8695 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir959603970/syzkaller.Mln8FE/0/memory.events" dev="sda1" ino=16533 res=1 [ 130.560002][ T26] audit: type=1804 audit(1570400883.684:32): pid=8697 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir959603970/syzkaller.Mln8FE/0/memory.events" dev="sda1" ino=16533 res=1 22:28:03 executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000040)={@dev={0xfe, 0x80, [], 0x13}, 0x9, 0x2, 0x2, 0x4, 0x0, 0xf2a}, &(0x7f0000000180)=0x20) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x7a05, 0x1700) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)={[{0x0, 'memory'}]}, 0x200600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0x0, 0x5000000) write$cgroup_subtree(r0, &(0x7f0000001600)=ANY=[], 0x23fa00) [ 130.648814][ T8695] syz-executor.4 (8695) used greatest stack depth: 23064 bytes left [ 130.652684][ T8701] netlink: 152 bytes leftover after parsing attributes in process `syz-executor.5'. 22:28:03 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000040)={@dev={0xfe, 0x80, [], 0x13}, 0x9, 0x2, 0x2, 0x4, 0x0, 0xf2a}, &(0x7f0000000180)=0x20) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x7a05, 0x1700) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)={[{0x0, 'memory'}]}, 0x200600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0x0, 0x5000000) write$cgroup_subtree(r0, &(0x7f0000001600)=ANY=[], 0x23fa00) 22:28:03 executing program 2: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x40000000000a132, 0xffffffffffffffff, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r1 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r1, 0x101, 0x19, &(0x7f0000003680), &(0x7f0000000280)=0x4) 22:28:03 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$inet6_int(r1, 0x29, 0xcf, &(0x7f0000b67000), &(0x7f00007d0000)=0x3) 22:28:03 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) r1 = socket$packet(0x11, 0x2, 0x300) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000140)={0x0, 0x0, 0x8de7d8f023d06bd7}, 0x4) sendmmsg(r2, &(0x7f00000092c0), 0x4f, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4f, 0x0) 22:28:03 executing program 3: syz_emit_ethernet(0x3c, &(0x7f0000000140)={@local, @link_local, [], {@ipv6={0x86dd, {0x0, 0x6, "6c48a3", 0x14, 0x82f, 0x0, @dev, @dev, {[], @tcp={{0xa0008000, 0x6558, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000000c0)) [ 130.710018][ T26] audit: type=1804 audit(1570400883.834:33): pid=8704 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir959603970/syzkaller.Mln8FE/1/memory.events" dev="sda1" ino=16533 res=1 22:28:03 executing program 3: syz_emit_ethernet(0x3c, &(0x7f0000000140)={@local, @link_local, [], {@ipv6={0x86dd, {0x0, 0x6, "6c48a3", 0x14, 0x82f, 0x0, @dev, @dev, {[], @tcp={{0xa0008000, 0x6558, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000000c0)) 22:28:04 executing program 2: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x40000000000a132, 0xffffffffffffffff, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r1 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r1, 0x101, 0x19, &(0x7f0000003680), &(0x7f0000000280)=0x4) 22:28:04 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$inet6_int(r1, 0x29, 0xcf, &(0x7f0000b67000), &(0x7f00007d0000)=0x3) [ 130.999472][ T26] audit: type=1804 audit(1570400884.124:34): pid=8716 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir920076164/syzkaller.YbeGt4/1/memory.events" dev="sda1" ino=16550 res=1 [ 131.031677][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 131.037708][ C0] protocol 88fb is buggy, dev hsr_slave_1 22:28:04 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) r1 = socket$packet(0x11, 0x2, 0x300) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000140)={0x0, 0x0, 0x8de7d8f023d06bd7}, 0x4) sendmmsg(r2, &(0x7f00000092c0), 0x4f, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4f, 0x0) 22:28:04 executing program 2: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x40000000000a132, 0xffffffffffffffff, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r1 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r1, 0x101, 0x19, &(0x7f0000003680), &(0x7f0000000280)=0x4) 22:28:04 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) r1 = socket$packet(0x11, 0x2, 0x300) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000140)={0x0, 0x0, 0x8de7d8f023d06bd7}, 0x4) sendmmsg(r2, &(0x7f00000092c0), 0x4f, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4f, 0x0) 22:28:04 executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000040)={@dev={0xfe, 0x80, [], 0x13}, 0x9, 0x2, 0x2, 0x4, 0x0, 0xf2a}, &(0x7f0000000180)=0x20) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x7a05, 0x1700) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)={[{0x0, 'memory'}]}, 0x200600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0x0, 0x5000000) write$cgroup_subtree(r0, &(0x7f0000001600)=ANY=[], 0x23fa00) [ 131.431037][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 131.436938][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 131.451201][ T26] audit: type=1804 audit(1570400884.574:35): pid=8745 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir959603970/syzkaller.Mln8FE/2/memory.events" dev="sda1" ino=16533 res=1 22:28:04 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000040)={@dev={0xfe, 0x80, [], 0x13}, 0x9, 0x2, 0x2, 0x4, 0x0, 0xf2a}, &(0x7f0000000180)=0x20) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x7a05, 0x1700) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)={[{0x0, 'memory'}]}, 0x200600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0x0, 0x5000000) write$cgroup_subtree(r0, &(0x7f0000001600)=ANY=[], 0x23fa00) 22:28:04 executing program 0: r0 = socket$rds(0x15, 0x5, 0x0) bind$rds(r0, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r0, &(0x7f0000001600)={&(0x7f0000000000)={0x2, 0x0, @remote={0xac, 0x7ffff}}, 0x10, 0x0, 0x0, &(0x7f0000000a40)=ANY=[@ANYBLOB="580000000000000014010000070000000000000000000000e0ffffffffffffff00"/87], 0x58}, 0x0) 22:28:04 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") getsockopt$inet6_opts(r0, 0x29, 0x35, &(0x7f0000325f23)=""/221, &(0x7f0000000080)=0xdd) 22:28:04 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) r1 = socket$packet(0x11, 0x2, 0x300) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000140)={0x0, 0x0, 0x8de7d8f023d06bd7}, 0x4) sendmmsg(r2, &(0x7f00000092c0), 0x4f, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4f, 0x0) 22:28:04 executing program 0: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpu.stat\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x2343a726) sendto(0xffffffffffffffff, &(0x7f0000000240)="38d4502279515dbf07f02557f967b27ebc1089545f8dd18c34a6594ee915b525eaa4003c1d5425cb90a73d4924fc64884e6de6889d073c8b6f91d1157219d990e65f70b04ab43ee06f206e54da7ace9ed1153aa0622268717c927e6f759dacab14773cf527a01fab848ab97ec6cb72ec35d757edfbc53d167bef715565008d481947d043f37a1ddd222a5ac2", 0x8c, 0x4000, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) ioctl$sock_inet_SIOCSARP(0xffffffffffffffff, 0x8955, &(0x7f0000000080)={{0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, @random="a3096ddc1dc7"}, 0x10, {0x2, 0x0, @remote}, 'ip6erspan0\x00'}) ioctl$sock_inet_SIOCDARP(r0, 0x8953, &(0x7f0000000100)={{0x2, 0x4e20, @rand_addr=0x9}, {0x6, @dev={[], 0xb}}, 0x2, {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xc}}, 'veth0_to_hsr\x00'}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'gcm_base(ctr(aes-aesni),ghash-generic)\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000200)="ad56b6cc0400aeb995298992ea5400c2", 0x10) recvmmsg(r2, &(0x7f0000002440), 0x3ffffffffffff67, 0x0, 0x0) 22:28:04 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) r1 = socket$packet(0x11, 0x2, 0x300) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000140)={0x0, 0x0, 0x8de7d8f023d06bd7}, 0x4) sendmmsg(r2, &(0x7f00000092c0), 0x4f, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4f, 0x0) 22:28:04 executing program 2: socket$inet6(0xa, 0x0, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)={0x18, 0x41000000000013, 0xfffffffffffdfffb, 0x0, 0x0, {0x38}, [@typed={0x4, 0x16}]}, 0x18}, 0x1, 0x68}, 0x0) [ 131.777361][ T26] audit: type=1804 audit(1570400884.904:36): pid=8755 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir920076164/syzkaller.YbeGt4/2/memory.events" dev="sda1" ino=16528 res=1 22:28:05 executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000040)={@dev={0xfe, 0x80, [], 0x13}, 0x9, 0x2, 0x2, 0x4, 0x0, 0xf2a}, &(0x7f0000000180)=0x20) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x7a05, 0x1700) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)={[{0x0, 'memory'}]}, 0x200600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0x0, 0x5000000) write$cgroup_subtree(r0, &(0x7f0000001600)=ANY=[], 0x23fa00) [ 131.876625][ T8773] kasan: CONFIG_KASAN_INLINE enabled [ 131.899742][ T8773] kasan: GPF could be caused by NULL-ptr deref or user memory access [ 131.911005][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 131.916818][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 131.997664][ T8773] general protection fault: 0000 [#1] PREEMPT SMP KASAN [ 132.004669][ T8773] CPU: 0 PID: 8773 Comm: syz-executor.2 Not tainted 5.4.0-rc1+ #0 [ 132.012480][ T8773] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 132.022660][ T8773] RIP: 0010:devlink_get_from_attrs+0x32/0x300 [ 132.028741][ T8773] Code: 41 55 41 54 53 48 89 f3 48 83 ec 10 48 89 7d c8 e8 03 f6 bf fb 48 8d 7b 08 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 84 02 00 00 4c 8b 6b 08 4d 85 ed 0f 84 d9 01 00 [ 132.048361][ T8773] RSP: 0018:ffff888066d07438 EFLAGS: 00010202 [ 132.054445][ T8773] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffc9000a568000 [ 132.062431][ T8773] RDX: 0000000000000001 RSI: ffffffff85b31cdd RDI: 0000000000000008 [ 132.070430][ T8773] RBP: ffff888066d07470 R08: 1ffffffff13360d4 R09: fffffbfff13360d5 [ 132.078414][ T8773] R10: ffff888066d07470 R11: ffffffff899b06a7 R12: ffff88808ee55078 [ 132.086431][ T8773] R13: 0000000000000000 R14: 0000000000000000 R15: ffff88808ee550f0 22:28:05 executing program 0: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpu.stat\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x2343a726) sendto(0xffffffffffffffff, &(0x7f0000000240)="38d4502279515dbf07f02557f967b27ebc1089545f8dd18c34a6594ee915b525eaa4003c1d5425cb90a73d4924fc64884e6de6889d073c8b6f91d1157219d990e65f70b04ab43ee06f206e54da7ace9ed1153aa0622268717c927e6f759dacab14773cf527a01fab848ab97ec6cb72ec35d757edfbc53d167bef715565008d481947d043f37a1ddd222a5ac2", 0x8c, 0x4000, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) ioctl$sock_inet_SIOCSARP(0xffffffffffffffff, 0x8955, &(0x7f0000000080)={{0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, @random="a3096ddc1dc7"}, 0x10, {0x2, 0x0, @remote}, 'ip6erspan0\x00'}) ioctl$sock_inet_SIOCDARP(r0, 0x8953, &(0x7f0000000100)={{0x2, 0x4e20, @rand_addr=0x9}, {0x6, @dev={[], 0xb}}, 0x2, {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xc}}, 'veth0_to_hsr\x00'}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'gcm_base(ctr(aes-aesni),ghash-generic)\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000200)="ad56b6cc0400aeb995298992ea5400c2", 0x10) recvmmsg(r2, &(0x7f0000002440), 0x3ffffffffffff67, 0x0, 0x0) [ 132.094417][ T8773] FS: 00007fc179fe3700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 [ 132.103360][ T8773] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 132.109951][ T8773] CR2: 00007f2d93860000 CR3: 0000000091bda000 CR4: 00000000001406f0 [ 132.117935][ T8773] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 132.125929][ T8773] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 132.133917][ T8773] Call Trace: [ 132.137225][ T8773] devlink_nl_cmd_health_reporter_dump_get_dumpit+0x15b/0x930 [ 132.144813][ T8773] ? devlink_fmsg_prepare_skb+0x7b0/0x7b0 [ 132.150562][ T8773] genl_lock_dumpit+0x86/0xc0 [ 132.155263][ T8773] netlink_dump+0x558/0xfb0 [ 132.159799][ T8773] ? netlink_broadcast+0x50/0x50 [ 132.164760][ T8773] __netlink_dump_start+0x5b1/0x7d0 [ 132.169980][ T8773] ? __netlink_ns_capable+0x104/0x140 [ 132.175368][ T8773] ? genl_lock_dumpit+0xc0/0xc0 [ 132.180238][ T8773] genl_rcv_msg+0xc9b/0x1000 [ 132.184860][ T8773] ? genl_family_rcv_msg_attrs_parse.isra.0+0x3a0/0x3a0 [ 132.191946][ T8773] ? genl_lock_dumpit+0xc0/0xc0 [ 132.196816][ T8773] ? genl_unlock+0x20/0x20 [ 132.201248][ T8773] ? genl_parallel_done+0x1c0/0x1c0 [ 132.206464][ T8773] ? mark_held_locks+0xf0/0xf0 [ 132.211243][ T8773] ? find_held_lock+0x35/0x130 [ 132.216028][ T8773] netlink_rcv_skb+0x177/0x450 [ 132.220810][ T8773] ? genl_family_rcv_msg_attrs_parse.isra.0+0x3a0/0x3a0 [ 132.227761][ T8773] ? netlink_ack+0xb50/0xb50 [ 132.232372][ T8773] ? __kasan_check_write+0x14/0x20 [ 132.237498][ T8773] ? netlink_deliver_tap+0x254/0xbf0 [ 132.242909][ T8773] genl_rcv+0x29/0x40 [ 132.246905][ T8773] netlink_unicast+0x531/0x710 [ 132.251690][ T8773] ? netlink_attachskb+0x7c0/0x7c0 [ 132.256808][ T8773] ? _copy_from_iter_full+0x25d/0x8c0 [ 132.262190][ T8773] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 132.267923][ T8773] ? __check_object_size+0x3d/0x437 [ 132.273137][ T8773] netlink_sendmsg+0x8a5/0xd60 [ 132.277909][ T8773] ? netlink_unicast+0x710/0x710 [ 132.282957][ T8773] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 132.288522][ T8773] ? apparmor_socket_sendmsg+0x2a/0x30 [ 132.293988][ T8773] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 132.300236][ T8773] ? security_socket_sendmsg+0x8d/0xc0 [ 132.305696][ T8773] ? netlink_unicast+0x710/0x710 [ 132.310633][ T8773] sock_sendmsg+0xd7/0x130 [ 132.315055][ T8773] ___sys_sendmsg+0x803/0x920 [ 132.319735][ T8773] ? copy_msghdr_from_user+0x440/0x440 [ 132.325192][ T8773] ? __kasan_check_read+0x11/0x20 [ 132.330218][ T8773] ? __fget+0x384/0x560 [ 132.334379][ T8773] ? ksys_dup3+0x3e0/0x3e0 [ 132.338801][ T8773] ? __fget_light+0x1a9/0x230 [ 132.343480][ T8773] ? __fdget+0x1b/0x20 [ 132.347557][ T8773] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 132.353800][ T8773] __sys_sendmsg+0x105/0x1d0 [ 132.358389][ T8773] ? __sys_sendmsg_sock+0xd0/0xd0 [ 132.363421][ T8773] ? trace_hardirqs_on_thunk+0x1a/0x20 [ 132.368884][ T8773] ? do_syscall_64+0x26/0x760 [ 132.373572][ T8773] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 132.379669][ T8773] ? do_syscall_64+0x26/0x760 [ 132.384362][ T8773] __x64_sys_sendmsg+0x78/0xb0 [ 132.389158][ T8773] do_syscall_64+0xfa/0x760 [ 132.393676][ T8773] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 132.399560][ T8773] RIP: 0033:0x459a59 [ 132.403454][ T8773] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 132.423058][ T8773] RSP: 002b:00007fc179fe2c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 132.431470][ T8773] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000459a59 [ 132.439436][ T8773] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000000000004 [ 132.447402][ T8773] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 132.455387][ T8773] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc179fe36d4 [ 132.463362][ T8773] R13: 00000000004c7bad R14: 00000000004dd938 R15: 00000000ffffffff [ 132.471338][ T8773] Modules linked in: [ 132.477047][ T26] audit: type=1804 audit(1570400885.124:37): pid=8778 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir959603970/syzkaller.Mln8FE/3/memory.events" dev="sda1" ino=16533 res=1 [ 132.482167][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 132.504468][ T3881] kobject: 'loop0' (00000000b23be29f): kobject_uevent_env [ 132.507862][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 132.521120][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 132.526899][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 132.533151][ T8773] ---[ end trace dac953571c409e6d ]--- [ 132.537500][ T3881] kobject: 'loop0' (00000000b23be29f): fill_kobj_path: path = '/devices/virtual/block/loop0' 22:28:05 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) r1 = socket$packet(0x11, 0x2, 0x300) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000140)={0x0, 0x0, 0x8de7d8f023d06bd7}, 0x4) sendmmsg(r2, &(0x7f00000092c0), 0x4f, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4f, 0x0) [ 132.546115][ T8773] RIP: 0010:devlink_get_from_attrs+0x32/0x300 22:28:05 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000040)={@dev={0xfe, 0x80, [], 0x13}, 0x9, 0x2, 0x2, 0x4, 0x0, 0xf2a}, &(0x7f0000000180)=0x20) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x7a05, 0x1700) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)={[{0x0, 'memory'}]}, 0x200600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0x0, 0x5000000) write$cgroup_subtree(r0, &(0x7f0000001600)=ANY=[], 0x23fa00) 22:28:05 executing program 4: r0 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, 0x0, 0xff33) [ 132.601045][ T8773] Code: 41 55 41 54 53 48 89 f3 48 83 ec 10 48 89 7d c8 e8 03 f6 bf fb 48 8d 7b 08 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 84 02 00 00 4c 8b 6b 08 4d 85 ed 0f 84 d9 01 00 [ 132.613479][ T3881] kobject: 'loop3' (00000000e011cd07): kobject_uevent_env 22:28:05 executing program 0: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpu.stat\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x2343a726) sendto(0xffffffffffffffff, &(0x7f0000000240)="38d4502279515dbf07f02557f967b27ebc1089545f8dd18c34a6594ee915b525eaa4003c1d5425cb90a73d4924fc64884e6de6889d073c8b6f91d1157219d990e65f70b04ab43ee06f206e54da7ace9ed1153aa0622268717c927e6f759dacab14773cf527a01fab848ab97ec6cb72ec35d757edfbc53d167bef715565008d481947d043f37a1ddd222a5ac2", 0x8c, 0x4000, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) ioctl$sock_inet_SIOCSARP(0xffffffffffffffff, 0x8955, &(0x7f0000000080)={{0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, @random="a3096ddc1dc7"}, 0x10, {0x2, 0x0, @remote}, 'ip6erspan0\x00'}) ioctl$sock_inet_SIOCDARP(r0, 0x8953, &(0x7f0000000100)={{0x2, 0x4e20, @rand_addr=0x9}, {0x6, @dev={[], 0xb}}, 0x2, {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xc}}, 'veth0_to_hsr\x00'}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'gcm_base(ctr(aes-aesni),ghash-generic)\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000200)="ad56b6cc0400aeb995298992ea5400c2", 0x10) recvmmsg(r2, &(0x7f0000002440), 0x3ffffffffffff67, 0x0, 0x0) [ 132.666369][ T3881] kobject: 'loop3' (00000000e011cd07): fill_kobj_path: path = '/devices/virtual/block/loop3' [ 132.671772][ T8773] RSP: 0018:ffff888066d07438 EFLAGS: 00010202 [ 132.705072][ T8773] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffc9000a568000 22:28:05 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) r1 = socket$packet(0x11, 0x2, 0x300) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000140)={0x0, 0x0, 0x8de7d8f023d06bd7}, 0x4) sendmmsg(r2, &(0x7f00000092c0), 0x4f, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4f, 0x0) 22:28:05 executing program 4: r0 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, 0x0, 0xff33) [ 132.734823][ T3881] kobject: 'loop4' (00000000a3527e27): kobject_uevent_env [ 132.744629][ T8773] RDX: 0000000000000001 RSI: ffffffff85b31cdd RDI: 0000000000000008 [ 132.773715][ T3881] kobject: 'loop4' (00000000a3527e27): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 132.791742][ T8773] RBP: ffff888066d07470 R08: 1ffffffff13360d4 R09: fffffbfff13360d5 [ 132.816828][ T3881] kobject: 'loop5' (00000000899ec383): kobject_uevent_env [ 132.824152][ T8773] R10: ffff888066d07470 R11: ffffffff899b06a7 R12: ffff88808ee55078 22:28:06 executing program 4: r0 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, 0x0, 0xff33) [ 132.833605][ T26] audit: type=1804 audit(1570400885.964:38): pid=8796 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir920076164/syzkaller.YbeGt4/3/memory.events" dev="sda1" ino=16537 res=1 [ 132.833834][ T3881] kobject: 'loop5' (00000000899ec383): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 132.878893][ T8773] R13: 0000000000000000 R14: 0000000000000000 R15: ffff88808ee550f0 22:28:06 executing program 4: r0 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, 0x0, 0xff33) [ 132.895931][ T8773] FS: 00007fc179fe3700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 22:28:06 executing program 3: r0 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, 0x0, 0xff33) [ 132.939250][ T8773] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 132.957997][ T8773] CR2: 000000000075c000 CR3: 0000000091bda000 CR4: 00000000001406e0 [ 132.983360][ T8773] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 132.990404][ T3881] kobject: 'loop1' (00000000a0fa04b1): kobject_uevent_env [ 133.013072][ T3881] kobject: 'loop1' (00000000a0fa04b1): fill_kobj_path: path = '/devices/virtual/block/loop1' [ 133.017176][ T8773] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 133.046810][ T3881] kobject: 'loop0' (00000000b23be29f): kobject_uevent_env [ 133.056236][ T8773] Kernel panic - not syncing: Fatal exception [ 133.063703][ T8773] Kernel Offset: disabled [ 133.068040][ T8773] Rebooting in 86400 seconds..