syzkaller login: [ 61.421100][ T38] audit: type=1400 audit(1575061057.127:41): avc: denied { map } for pid=7857 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1
Warning: Permanently added '[localhost]:14119' (ECDSA) to the list of known hosts.
[ 63.187514][ T38] audit: type=1400 audit(1575061058.897:42): avc: denied { map } for pid=7869 comm="syz-fuzzer" path="/syz-fuzzer" dev="sda1" ino=16525 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:file_t:s0 tclass=file permissive=1
2019/11/29 20:57:38 fuzzer started
2019/11/29 20:57:39 dialing manager at 10.0.2.10:40921
2019/11/29 20:57:39 syscalls: 2533
2019/11/29 20:57:39 code coverage: enabled
2019/11/29 20:57:39 comparison tracing: enabled
2019/11/29 20:57:39 extra coverage: extra coverage is not supported by the kernel
2019/11/29 20:57:39 setuid sandbox: enabled
2019/11/29 20:57:39 namespace sandbox: enabled
2019/11/29 20:57:39 Android sandbox: /sys/fs/selinux/policy does not exist
2019/11/29 20:57:39 fault injection: enabled
2019/11/29 20:57:39 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled
2019/11/29 20:57:39 net packet injection: enabled
2019/11/29 20:57:39 net device setup: enabled
2019/11/29 20:57:39 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist
2019/11/29 20:57:39 devlink PCI setup: PCI device 0000:00:10.0 is not available
20:57:47 executing program 0:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x42, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = inotify_init1(0x0)
inotify_add_watch(r0, &(0x7f0000000280)='.\x00', 0x2a4)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x\x11k4\xd3\x1b\x05\xaf\xf0\x1eyRN\xc9\xc6V\x00\x02\x00\x00\x00\x00\x00\x00\x00', 0x275a, 0x0)
[ 72.145099][ T38] audit: type=1400 audit(1575061067.857:43): avc: denied { map } for pid=7892 comm="syz-executor.0" path="/sys/kernel/debug/kcov" dev="debugfs" ino=2116 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1
20:57:47 executing program 1:
r0 = open(&(0x7f0000000500)='./bus\x00', 0x8141042, 0x0)
close(r0)
r1 = syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082)
r2 = memfd_create(0x0, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x80fff)
ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2)
mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0)
fcntl$setstatus(r0, 0x4, 0x0)
pipe(&(0x7f0000000100)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
r5 = socket$inet6_tcp(0xa, 0x1, 0x0)
r6 = socket$inet_udplite(0x2, 0x2, 0x88)
r7 = fcntl$dupfd(r5, 0x0, r6)
ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200)
write(r4, &(0x7f00000001c0), 0x526987c9)
read(r3, &(0x7f0000000200)=""/250, 0x50c7e3e3)
[ 72.291963][ T7893] IPVS: ftp: loaded support on port[0] = 21
[ 72.360684][ T7893] chnl_net:caif_netlink_parms(): no params data found
[ 72.369080][ T7895] IPVS: ftp: loaded support on port[0] = 21
[ 72.398717][ T7893] bridge0: port 1(bridge_slave_0) entered blocking state
[ 72.406470][ T7893] bridge0: port 1(bridge_slave_0) entered disabled state
[ 72.415089][ T7893] device bridge_slave_0 entered promiscuous mode
[ 72.424481][ T7893] bridge0: port 2(bridge_slave_1) entered blocking state
[ 72.431207][ T7893] bridge0: port 2(bridge_slave_1) entered disabled state
[ 72.438547][ T7893] device bridge_slave_1 entered promiscuous mode
[ 72.458531][ T7893] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 72.471974][ T7893] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 72.495365][ T7893] team0: Port device team_slave_0 added
[ 72.502961][ T7893] team0: Port device team_slave_1 added
[ 72.575160][ T7893] device hsr_slave_0 entered promiscuous mode
[ 72.643362][ T7893] device hsr_slave_1 entered promiscuous mode
[ 72.727240][ T7895] chnl_net:caif_netlink_parms(): no params data found
[ 72.764345][ T7895] bridge0: port 1(bridge_slave_0) entered blocking state
[ 72.771500][ T7895] bridge0: port 1(bridge_slave_0) entered disabled state
[ 72.779436][ T7895] device bridge_slave_0 entered promiscuous mode
[ 72.779776][ T38] audit: type=1400 audit(1575061068.487:44): avc: denied { create } for pid=7893 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
[ 72.810661][ T38] audit: type=1400 audit(1575061068.487:45): avc: denied { write } for pid=7893 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
[ 72.810677][ T38] audit: type=1400 audit(1575061068.487:46): avc: denied { read } for pid=7893 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
[ 72.859626][ T7893] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 72.925049][ T7895] bridge0: port 2(bridge_slave_1) entered blocking state
[ 72.931904][ T7895] bridge0: port 2(bridge_slave_1) entered disabled state
[ 72.939386][ T7895] device bridge_slave_1 entered promiscuous mode
[ 72.951123][ T7893] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 73.014889][ T7893] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 73.088836][ T7893] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 73.177304][ T7895] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 73.188905][ T7895] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 73.212530][ T7895] team0: Port device team_slave_0 added
[ 73.220137][ T7895] team0: Port device team_slave_1 added
[ 73.233524][ T7893] bridge0: port 2(bridge_slave_1) entered blocking state
[ 73.241109][ T7893] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 73.249509][ T7893] bridge0: port 1(bridge_slave_0) entered blocking state
[ 73.257253][ T7893] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 73.304951][ T7895] device hsr_slave_0 entered promiscuous mode
[ 73.343428][ T7895] device hsr_slave_1 entered promiscuous mode
[ 73.393218][ T7895] debugfs: Directory 'hsr0' with parent '/' already present!
[ 73.414898][ T257] bridge0: port 1(bridge_slave_0) entered disabled state
[ 73.433574][ T257] bridge0: port 2(bridge_slave_1) entered disabled state
[ 73.458096][ T7895] netdevsim netdevsim1 netdevsim0: renamed from eth0
[ 73.544932][ T7895] netdevsim netdevsim1 netdevsim1: renamed from eth1
[ 73.596088][ T7895] netdevsim netdevsim1 netdevsim2: renamed from eth2
[ 73.644674][ T7895] netdevsim netdevsim1 netdevsim3: renamed from eth3
[ 73.738076][ T7893] 8021q: adding VLAN 0 to HW filter on device bond0
[ 73.753630][ T3340] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 73.761551][ T3340] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 73.772683][ T7893] 8021q: adding VLAN 0 to HW filter on device team0
[ 73.785962][ T3858] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 73.794536][ T3858] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 73.802920][ T3858] bridge0: port 1(bridge_slave_0) entered blocking state
[ 73.810330][ T3858] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 73.824091][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 73.833930][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 73.843634][ T18] bridge0: port 2(bridge_slave_1) entered blocking state
[ 73.851862][ T18] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 73.865026][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[ 73.876942][ T2957] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[ 73.889669][ T3858] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[ 73.897990][ T3858] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 73.909168][ T3858] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 73.919030][ T7895] 8021q: adding VLAN 0 to HW filter on device bond0
[ 73.933471][ T7895] 8021q: adding VLAN 0 to HW filter on device team0
[ 73.939833][ T2957] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[ 73.949014][ T2957] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 73.957788][ T2957] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[ 73.965933][ T2957] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 73.973989][ T2957] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 73.981239][ T2957] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 73.988889][ T2957] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[ 73.997078][ T2957] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 74.007392][ T7893] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 74.016739][ T7902] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 74.025261][ T7902] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 74.034255][ T7902] bridge0: port 1(bridge_slave_0) entered blocking state
[ 74.041066][ T7902] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 74.051587][ T28] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[ 74.075076][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 74.083592][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 74.091817][ T37] bridge0: port 2(bridge_slave_1) entered blocking state
[ 74.098938][ T37] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 74.106888][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[ 74.115457][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[ 74.123746][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[ 74.132529][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 74.140550][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[ 74.148901][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 74.157135][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[ 74.165335][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 74.173391][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[ 74.181315][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 74.190564][ T37] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 74.200916][ T7895] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 74.215021][ T3858] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[ 74.222266][ T3858] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[ 74.234187][ T7893] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 74.246553][ T2957] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[ 74.247196][ T38] audit: type=1400 audit(1575061069.957:47): avc: denied { associate } for pid=7893 comm="syz-executor.0" name="syz0" scontext=unconfined_u:object_r:unlabeled_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=filesystem permissive=1
[ 74.255215][ T2957] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[ 74.289307][ T7895] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 74.342737][ T38] audit: type=1400 audit(1575061070.047:48): avc: denied { open } for pid=7905 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=perf_event permissive=1
[ 74.371494][ T38] audit: type=1400 audit(1575061070.047:49): avc: denied { kernel } for pid=7905 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=perf_event permissive=1
[ 74.398310][ T38] audit: type=1400 audit(1575061070.057:50): avc: denied { map } for pid=7906 comm="syz-executor.1" path="/dev/loop0" dev="devtmpfs" ino=130 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file permissive=1
[ 74.424178][ T38] audit: type=1400 audit(1575061070.107:51): avc: denied { watch } for pid=7905 comm="syz-executor.0" path="/syzkaller-testdir139814380/syzkaller.PEWMsT/0" dev="sda1" ino=16545 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:file_t:s0 tclass=dir permissive=1
20:57:50 executing program 0:
r0 = socket$inet6(0xa, 0x2000000080803, 0x2f)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc)
dup(0xffffffffffffffff)
syz_genetlink_get_family_id$tipc2(0x0)
sendmsg$TIPC_NL_LINK_RESET_STATS(0xffffffffffffffff, 0x0, 0x0)
sendmsg$TIPC_NL_BEARER_DISABLE(0xffffffffffffffff, 0x0, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000100)={{{@in6=@local, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@empty, 0x0, 0x32}, 0x0, @in=@multicast1, 0x0, 0x0, 0x0, 0x6}}, 0xe8)
accept4(0xffffffffffffffff, 0x0, 0x0, 0x0)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0)
dup2(0xffffffffffffffff, 0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
socket$inet6(0xa, 0x0, 0x0)
connect$inet6(0xffffffffffffffff, 0x0, 0x0)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0)
getrusage(0x0, 0x0)
creat(0x0, 0x0)
socket$inet_udplite(0x2, 0x2, 0x88)
dup(0xffffffffffffffff)
r2 = socket$inet_udplite(0x2, 0x2, 0x88)
r3 = dup(r2)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @local}}, 0x1c)
20:57:50 executing program 0:
r0 = socket$inet6(0xa, 0x2000000080803, 0x2f)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc)
dup(0xffffffffffffffff)
syz_genetlink_get_family_id$tipc2(0x0)
sendmsg$TIPC_NL_LINK_RESET_STATS(0xffffffffffffffff, 0x0, 0x0)
sendmsg$TIPC_NL_BEARER_DISABLE(0xffffffffffffffff, 0x0, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000100)={{{@in6=@local, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@empty, 0x0, 0x32}, 0x0, @in=@multicast1, 0x0, 0x0, 0x0, 0x6}}, 0xe8)
accept4(0xffffffffffffffff, 0x0, 0x0, 0x0)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0)
dup2(0xffffffffffffffff, 0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
socket$inet6(0xa, 0x0, 0x0)
connect$inet6(0xffffffffffffffff, 0x0, 0x0)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0)
getrusage(0x0, 0x0)
creat(0x0, 0x0)
socket$inet_udplite(0x2, 0x2, 0x88)
dup(0xffffffffffffffff)
r2 = socket$inet_udplite(0x2, 0x2, 0x88)
r3 = dup(r2)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @local}}, 0x1c)
20:57:50 executing program 0:
r0 = socket$inet6(0xa, 0x2000000080803, 0x2f)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc)
dup(0xffffffffffffffff)
syz_genetlink_get_family_id$tipc2(0x0)
sendmsg$TIPC_NL_LINK_RESET_STATS(0xffffffffffffffff, 0x0, 0x0)
sendmsg$TIPC_NL_BEARER_DISABLE(0xffffffffffffffff, 0x0, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000100)={{{@in6=@local, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@empty, 0x0, 0x32}, 0x0, @in=@multicast1, 0x0, 0x0, 0x0, 0x6}}, 0xe8)
accept4(0xffffffffffffffff, 0x0, 0x0, 0x0)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0)
dup2(0xffffffffffffffff, 0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
socket$inet6(0xa, 0x0, 0x0)
connect$inet6(0xffffffffffffffff, 0x0, 0x0)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0)
getrusage(0x0, 0x0)
creat(0x0, 0x0)
socket$inet_udplite(0x2, 0x2, 0x88)
dup(0xffffffffffffffff)
r2 = socket$inet_udplite(0x2, 0x2, 0x88)
r3 = dup(r2)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @local}}, 0x1c)
20:57:50 executing program 0:
r0 = socket$inet6(0xa, 0x2000000080803, 0x2f)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc)
dup(0xffffffffffffffff)
syz_genetlink_get_family_id$tipc2(0x0)
sendmsg$TIPC_NL_LINK_RESET_STATS(0xffffffffffffffff, 0x0, 0x0)
sendmsg$TIPC_NL_BEARER_DISABLE(0xffffffffffffffff, 0x0, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000100)={{{@in6=@local, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@empty, 0x0, 0x32}, 0x0, @in=@multicast1, 0x0, 0x0, 0x0, 0x6}}, 0xe8)
accept4(0xffffffffffffffff, 0x0, 0x0, 0x0)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0)
dup2(0xffffffffffffffff, 0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
socket$inet6(0xa, 0x0, 0x0)
connect$inet6(0xffffffffffffffff, 0x0, 0x0)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0)
getrusage(0x0, 0x0)
creat(0x0, 0x0)
socket$inet_udplite(0x2, 0x2, 0x88)
dup(0xffffffffffffffff)
r2 = socket$inet_udplite(0x2, 0x2, 0x88)
r3 = dup(r2)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @local}}, 0x1c)
20:57:50 executing program 1:
creat(&(0x7f0000000040)='./bus\x00', 0x0)
io_setup(0x8, &(0x7f00000004c0))
syz_open_procfs(0x0, &(0x7f0000000080)='map_files\x00')
setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x9, 0x8d}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
open(0x0, 0x8001141042, 0x110)
r1 = socket$inet6(0xa, 0x2, 0x0)
recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0)
syz_open_procfs(0x0, &(0x7f0000000100)='net/arp\x00')
syz_open_procfs(0x0, &(0x7f0000000080)='comm\x00')
pipe(&(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
fcntl$setpipe(r3, 0x407, 0x0)
ioctl$EXT4_IOC_PRECACHE_EXTENTS(0xffffffffffffffff, 0x6612)
connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @empty}, 0x10)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
fgetxattr(0xffffffffffffffff, &(0x7f0000000180)=@known='trusted.overlay.redirect\x00', &(0x7f0000000280)=""/58, 0x3a)
r4 = inotify_init()
fsetxattr$trusted_overlay_nlink(r4, &(0x7f0000000140)='trusted.overlay.nlink\x00', &(0x7f0000000340)={'L+', 0x7}, 0x28, 0x0)
write(r3, &(0x7f0000000340), 0x41395527)
vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
r5 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB], 0x58, 0x0, &(0x7f00000002c0)="92b34184571a823b1ecc54ee9733389d8768924379d730e19ef192077b6f5f3bb9b3b3281b152da2fa1191d5302a4335470e770b00a77ce3ce578d0017e7ba5fe0a470a69010de2a1fe82363a569612734762e3cb82fd609"})
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$sock_inet6_SIOCSIFADDR(r5, 0x89a1, &(0x7f00000000c0)={@local={0xfe, 0x80, [0x600, 0x3ef, 0x0, 0x3f00000000000000, 0x100000000000000, 0x0, 0x1103, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0xfffffffe})
ioctl$sock_inet6_SIOCADDRT(r5, 0x89a0, &(0x7f00000005c0)={@local={0xfe, 0x80, [0x0, 0xfeff0000]}, @remote, @remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x42})
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0)
20:57:50 executing program 0:
r0 = socket$inet6(0xa, 0x2000000080803, 0x2f)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc)
dup(0xffffffffffffffff)
syz_genetlink_get_family_id$tipc2(0x0)
sendmsg$TIPC_NL_LINK_RESET_STATS(0xffffffffffffffff, 0x0, 0x0)
sendmsg$TIPC_NL_BEARER_DISABLE(0xffffffffffffffff, 0x0, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000100)={{{@in6=@local, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@empty, 0x0, 0x32}, 0x0, @in=@multicast1, 0x0, 0x0, 0x0, 0x6}}, 0xe8)
accept4(0xffffffffffffffff, 0x0, 0x0, 0x0)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0)
dup2(0xffffffffffffffff, 0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
socket$inet6(0xa, 0x0, 0x0)
connect$inet6(0xffffffffffffffff, 0x0, 0x0)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0)
getrusage(0x0, 0x0)
creat(0x0, 0x0)
socket$inet_udplite(0x2, 0x2, 0x88)
dup(0xffffffffffffffff)
r2 = socket$inet_udplite(0x2, 0x2, 0x88)
dup(r2)
connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @local}}, 0x1c)
20:57:50 executing program 0:
r0 = socket$inet6(0xa, 0x2000000080803, 0x2f)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc)
dup(0xffffffffffffffff)
syz_genetlink_get_family_id$tipc2(0x0)
sendmsg$TIPC_NL_LINK_RESET_STATS(0xffffffffffffffff, 0x0, 0x0)
sendmsg$TIPC_NL_BEARER_DISABLE(0xffffffffffffffff, 0x0, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000100)={{{@in6=@local, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@empty, 0x0, 0x32}, 0x0, @in=@multicast1, 0x0, 0x0, 0x0, 0x6}}, 0xe8)
accept4(0xffffffffffffffff, 0x0, 0x0, 0x0)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0)
dup2(0xffffffffffffffff, 0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
socket$inet6(0xa, 0x0, 0x0)
connect$inet6(0xffffffffffffffff, 0x0, 0x0)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0)
getrusage(0x0, 0x0)
creat(0x0, 0x0)
socket$inet_udplite(0x2, 0x2, 0x88)
dup(0xffffffffffffffff)
socket$inet_udplite(0x2, 0x2, 0x88)
connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @local}}, 0x1c)
20:57:51 executing program 0:
r0 = socket$inet6(0xa, 0x2000000080803, 0x2f)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc)
dup(0xffffffffffffffff)
syz_genetlink_get_family_id$tipc2(0x0)
sendmsg$TIPC_NL_LINK_RESET_STATS(0xffffffffffffffff, 0x0, 0x0)
sendmsg$TIPC_NL_BEARER_DISABLE(0xffffffffffffffff, 0x0, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000100)={{{@in6=@local, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@empty, 0x0, 0x32}, 0x0, @in=@multicast1, 0x0, 0x0, 0x0, 0x6}}, 0xe8)
accept4(0xffffffffffffffff, 0x0, 0x0, 0x0)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0)
dup2(0xffffffffffffffff, 0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
socket$inet6(0xa, 0x0, 0x0)
connect$inet6(0xffffffffffffffff, 0x0, 0x0)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0)
getrusage(0x0, 0x0)
creat(0x0, 0x0)
socket$inet_udplite(0x2, 0x2, 0x88)
dup(0xffffffffffffffff)
connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @local}}, 0x1c)
[ 75.543048][ C1] hrtimer: interrupt took 24867 ns
[ 335.833372][ T1113] INFO: task kworker/1:3:3103 blocked for more than 143 seconds.
[ 335.842281][ T1113] Not tainted 5.4.0-syzkaller #0
[ 335.848881][ T1113] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[ 335.859896][ T1113] kworker/1:3 D26936 3103 2 0x80004000
[ 335.867750][ T1113] Workqueue: events xfrm_state_gc_task
[ 335.874499][ T1113] Call Trace:
[ 335.878599][ T1113] __schedule+0x8e1/0x1f30
[ 335.884044][ T1113] ? __sched_text_start+0x8/0x8
[ 335.889827][ T1113] ? _raw_spin_unlock_irq+0x59/0x80
[ 335.896487][ T1113] schedule+0xdc/0x2b0
[ 335.901302][ T1113] schedule_timeout+0x717/0xc50
[ 335.907329][ T1113] ? __kasan_check_read+0x11/0x20
[ 335.913174][ T1113] ? usleep_range+0x170/0x170
[ 335.918617][ T1113] ? mark_held_locks+0xa4/0xf0
[ 335.924259][ T1113] ? _raw_spin_unlock_irq+0x23/0x80
[ 335.930298][ T1113] ? wait_for_completion+0x294/0x440
[ 335.936966][ T1113] ? _raw_spin_unlock_irq+0x23/0x80
[ 335.942457][ T1113] ? lockdep_hardirqs_on+0x421/0x5e0
[ 335.948350][ T1113] ? trace_hardirqs_on+0x67/0x240
[ 335.953887][ T1113] wait_for_completion+0x29c/0x440
[ 335.959953][ T1113] ? wait_for_completion_interruptible+0x470/0x470
[ 335.967620][ T1113] ? wake_up_q+0x140/0x140
[ 335.972693][ T1113] __wait_rcu_gp+0x225/0x2f0
[ 335.978058][ T1113] synchronize_rcu.part.0+0xcf/0xe0
[ 335.984143][ T1113] ? synchronize_rcu_expedited+0x5f0/0x5f0
[ 335.990835][ T1113] ? __call_rcu+0x740/0x740
[ 335.996201][ T1113] ? __local_bh_enable_ip+0x15a/0x270
[ 336.002392][ T1113] ? rcu_gp_is_expedited+0x70/0x70
[ 336.008726][ T1113] synchronize_rcu+0x27/0xa0
[ 336.014131][ T1113] xfrm_state_gc_task+0xc3/0x170
[ 336.019916][ T1113] ? ___xfrm_state_destroy+0x6f0/0x6f0
[ 336.026349][ T1113] ? rcu_read_lock_any_held.part.0+0x50/0x50
[ 336.033341][ T1113] ? trace_hardirqs_on+0x67/0x240
[ 336.039120][ T1113] process_one_work+0x9af/0x1740
[ 336.044928][ T1113] ? pwq_dec_nr_in_flight+0x320/0x320
[ 336.051068][ T1113] ? lock_acquire+0x190/0x410
[ 336.056559][ T1113] worker_thread+0x7be/0xe40
[ 336.061780][ T1113] ? trace_hardirqs_on+0x67/0x240
[ 336.067654][ T1113] kthread+0x361/0x430
[ 336.072139][ T1113] ? process_one_work+0x1740/0x1740
[ 336.078077][ T1113] ? kthread_mod_delayed_work+0x1f0/0x1f0
[ 336.084142][ T1113] ret_from_fork+0x24/0x30
[ 336.088653][ T1113]
[ 336.088653][ T1113] Showing all locks held in the system:
[ 336.096468][ T1113] 3 locks held by kworker/0:0/5:
[ 336.101425][ T1113] #0: ffff888075122128 ((wq_completion)ipv6_addrconf){+.+.}, at: process_one_work+0x88b/0x1740
[ 336.111985][ T1113] #1: ffff88802c42fdc0 ((addr_chk_work).work){+.+.}, at: process_one_work+0x8c1/0x1740
[ 336.122027][ T1113] #2: ffffffff8a094100 (rtnl_mutex){+.+.}, at: rtnl_lock+0x17/0x20
[ 336.129973][ T1113] 1 lock held by khungtaskd/1113:
[ 336.135039][ T1113] #0: ffffffff895a4080 (rcu_read_lock){....}, at: debug_show_all_locks+0x5f/0x279
[ 336.144318][ T1113] 2 locks held by kworker/1:3/3103:
[ 336.149507][ T1113] #0: ffff88802cc27d28 ((wq_completion)events){+.+.}, at: process_one_work+0x88b/0x1740
[ 336.159259][ T1113] #1: ffff88802571fdc0 (xfrm_state_gc_work){+.+.}, at: process_one_work+0x8c1/0x1740
[ 336.168945][ T1113] 3 locks held by kworker/0:2/3858:
[ 336.174341][ T1113] #0: ffff88802cc27d28 ((wq_completion)events){+.+.}, at: process_one_work+0x88b/0x1740
[ 336.184079][ T1113] #1: ffff8880226c7dc0 ((linkwatch_work).work){+.+.}, at: process_one_work+0x8c1/0x1740
[ 336.193783][ T1113] #2: ffffffff8a094100 (rtnl_mutex){+.+.}, at: rtnl_lock+0x17/0x20
[ 336.201634][ T1113] 3 locks held by kworker/0:3/3934:
[ 336.206962][ T1113] 1 lock held by rsyslogd/7712:
[ 336.211639][ T1113] #0: ffff888025ba4ba0 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0xee/0x110
[ 336.220182][ T1113] 2 locks held by getty/7835:
[ 336.225163][ T1113] #0: ffff888020356090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40
[ 336.234174][ T1113] #1: ffffc900026f62e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1c10
[ 336.243896][ T1113] 2 locks held by getty/7836:
[ 336.248499][ T1113] #0: ffff8880266af090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40
[ 336.257650][ T1113] #1: ffffc900040122e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1c10
[ 336.267422][ T1113] 2 locks held by getty/7837:
[ 336.271968][ T1113] #0: ffff88802c6a0090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40
[ 336.280972][ T1113] #1: ffffc9000400e2e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1c10
[ 336.290745][ T1113] 2 locks held by getty/7838:
[ 336.295721][ T1113] #0: ffff8880221fc090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40
[ 336.304823][ T1113] #1: ffffc9000400a2e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1c10
[ 336.314328][ T1113] 2 locks held by getty/7839:
[ 336.319081][ T1113] #0: ffff8880250a9090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40
[ 336.328260][ T1113] #1: ffffc900026f22e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1c10
[ 336.337779][ T1113] 2 locks held by getty/7840:
[ 336.342321][ T1113] #0: ffff888025688090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40
[ 336.351190][ T1113] #1: ffffc900026fe2e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1c10
[ 336.360337][ T1113] 2 locks held by getty/7841:
[ 336.365023][ T1113] #0: ffff88802b7e5090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40
[ 336.373936][ T1113] #1: ffffc900026e22e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1c10
[ 336.383282][ T1113] 3 locks held by kworker/u16:2/7897:
[ 336.388619][ T1113] #0: ffff88802d437398 (&rq->lock){-.-.}, at: newidle_balance+0xa28/0xe80
[ 336.397443][ T1113] #1: ffffffff895a4080 (rcu_read_lock){....}, at: __update_idle_core+0x45/0x3f0
[ 336.406471][ T1113] #2: ffff88802d427258 (&base->lock){-.-.}, at: lock_timer_base+0x56/0x1b0
[ 336.415084][ T1113] 2 locks held by syz-executor.1/7959:
[ 336.420300][ T1113]
[ 336.422428][ T1113] =============================================
[ 336.422428][ T1113]
[ 336.430941][ T1113] NMI backtrace for cpu 3
[ 336.435167][ T1113] CPU: 3 PID: 1113 Comm: khungtaskd Not tainted 5.4.0-syzkaller #0
[ 336.442836][ T1113] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
[ 336.445118][ T1113] Call Trace:
[ 336.445118][ T1113] dump_stack+0x197/0x210
[ 336.445118][ T1113] nmi_cpu_backtrace.cold+0x70/0xb2
[ 336.445118][ T1113] ? vprintk_func+0x86/0x189
[ 336.445118][ T1113] ? lapic_can_unplug_cpu.cold+0x3a/0x3a
[ 336.445118][ T1113] nmi_trigger_cpumask_backtrace+0x23b/0x28b
[ 336.445118][ T1113] arch_trigger_cpumask_backtrace+0x14/0x20
[ 336.445118][ T1113] watchdog+0xb11/0x10c0
[ 336.445118][ T1113] kthread+0x361/0x430
[ 336.445118][ T1113] ? reset_hung_task_detector+0x30/0x30
[ 336.445118][ T1113] ? kthread_mod_delayed_work+0x1f0/0x1f0
[ 336.445118][ T1113] ret_from_fork+0x24/0x30
[ 336.513232][ T1113] Sending NMI from CPU 3 to CPUs 0-2:
[ 336.518813][ C1] NMI backtrace for cpu 1 skipped: idling at native_safe_halt+0xe/0x10
[ 336.518825][ C2] NMI backtrace for cpu 2 skipped: idling at native_safe_halt+0xe/0x10
[ 336.519316][ C0] NMI backtrace for cpu 0
[ 336.519320][ C0] CPU: 0 PID: 7959 Comm: syz-executor.1 Not tainted 5.4.0-syzkaller #0
[ 336.519325][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
[ 336.519328][ C0] RIP: 0010:interrupt_entry+0xa0/0xc0
[ 336.519346][ C0] Code: 45 31 f6 41 57 45 31 ff 56 48 8d 6c 24 09 f6 84 24 90 00 00 00 03 74 05 e8 22 5e 40 f9 48 8d 7c 24 08 65 ff 04 25 8c 1e 02 00 <75> 12 65 48 89 3c 25 f8 9f 00 00 65 48 8b 24 25 90 1e 02 00 57 ff
[ 336.519349][ C0] RSP: 0018:ffff88807208f2d0 EFLAGS: 00000056
[ 336.519354][ C0] RAX: 1ffffffff12a668d RBX: 0000000000000000 RCX: 0000000000000000
[ 336.519357][ C0] RDX: 0000000000000000 RSI: ffffffff87c0171a RDI: ffff88807208f2d8
[ 336.519360][ C0] RBP: ffff88807208f2d9 R08: 0000000000000000 R09: 0000000000000000
[ 336.519363][ C0] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[ 336.519366][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 336.519370][ C0] FS: 00007f8ca6d89700(0000) GS:ffff88802d200000(0000) knlGS:0000000000000000
[ 336.519372][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 336.519375][ C0] CR2: ffffffffff600400 CR3: 000000000946d000 CR4: 00000000003406f0
[ 336.519378][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 336.519381][ C0] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 336.519383][ C0] Call Trace:
[ 336.519385][ C0] ? apic_timer_interrupt+0xa/0x20
[ 336.519387][ C0] ? preempt_schedule_irq+0xab/0x160
[ 336.519390][ C0] ? preempt_schedule_irq+0x8d/0x160
[ 336.519392][ C0] retint_kernel+0x1b/0x2b
[ 336.519394][ C0] RIP: 0010:qlist_free_all+0x36/0x150
[ 336.519401][ C0] Code: 49 89 f4 53 48 83 ec 08 48 8b 37 48 85 f6 0f 84 0d 01 00 00 4d 85 e4 49 89 fe 4d 89 e7 0f 84 8c 00 00 00 49 63 87 34 01 00 00 <4c> 8b 2e 48 29 c6 48 83 3d bc 24 a1 07 00 0f 84 f2 00 00 00 9c 58
[ 336.519403][ C0] RSP: 0018:ffff88807208f460 EFLAGS: 00010246 ORIG_RAX: ffffffffffffff13
[ 336.519408][ C0] RAX: 0000000000000000 RBX: 0000000000000282 RCX: ffffea00006ebb87
[ 336.519412][ C0] RDX: 0000000000000000 RSI: ffff88801baf0000 RDI: 0000000000000007
[ 336.519415][ C0] RBP: ffff88807208f490 R08: ffff888020570180 R09: fffffbfff15d29a0
[ 336.519418][ C0] R10: fffffbfff15d299f R11: ffffffff8ae94cff R12: 0000000000000000
[ 336.519421][ C0] R13: ffff88801baf0000 R14: ffff88807208f4a0 R15: ffff88802cc02000
[ 336.519423][ C0] quarantine_reduce+0x15e/0x1a0
[ 336.519425][ C0] __kasan_kmalloc.constprop.0+0xa3/0xe0
[ 336.519427][ C0] kasan_slab_alloc+0xf/0x20
[ 336.519430][ C0] kmem_cache_alloc_trace+0x141/0x790
[ 336.519432][ C0] ? trace_hardirqs_on_thunk+0x1a/0x1c
[ 336.519434][ C0] ? lockdep_hardirqs_on+0x421/0x5e0
[ 336.519436][ C0] ? retint_kernel+0x2b/0x2b
[ 336.519438][ C0] netdevice_event+0x1c8/0x810
[ 336.519441][ C0] ? update_gid_event_work_handler+0xc0/0xc0
[ 336.519443][ C0] ? _roce_del_all_netdev_gids+0x30/0x30
[ 336.519445][ C0] ? roce_gid_type_mask_support+0xf0/0xf0
[ 336.519447][ C0] ? notifier_call_chain+0x18f/0x230
[ 336.519450][ C0] notifier_call_chain+0xc2/0x230
[ 336.519456][ C0] raw_notifier_call_chain+0x2e/0x40
[ 336.519458][ C0] call_netdevice_notifiers_info+0xba/0x130
[ 336.519460][ C0] ? tun_show_group+0x180/0x180
[ 336.519463][ C0] rollback_registered_many+0x850/0x10d0
[ 336.519465][ C0] ? generic_xdp_install+0x4a0/0x4a0
[ 336.519467][ C0] ? preempt_schedule_irq+0xf3/0x160
[ 336.519469][ C0] ? rollback_registered+0x101/0x1d0
[ 336.519471][ C0] rollback_registered+0x109/0x1d0
[ 336.519474][ C0] ? rollback_registered_many+0x10d0/0x10d0
[ 336.519476][ C0] unregister_netdevice_queue+0x1ee/0x2c0
[ 336.519478][ C0] __tun_detach+0xe6d/0x1150
[ 336.519480][ C0] tun_chr_close+0xe0/0x180
[ 336.519482][ C0] __fput+0x2ff/0x890
[ 336.519484][ C0] ? __tun_detach+0x1150/0x1150
[ 336.519486][ C0] ____fput+0x16/0x20
[ 336.519488][ C0] task_work_run+0x145/0x1c0
[ 336.519490][ C0] do_exit+0x8e7/0x2ef0
[ 336.519492][ C0] ? mm_update_next_owner+0x7c0/0x7c0
[ 336.519494][ C0] ? lock_downgrade+0x920/0x920
[ 336.519496][ C0] ? _raw_spin_unlock_irq+0x23/0x80
[ 336.519498][ C0] ? get_signal+0x392/0x24f0
[ 336.519501][ C0] ? _raw_spin_unlock_irq+0x23/0x80
[ 336.519503][ C0] do_group_exit+0x135/0x360
[ 336.519504][ C0] get_signal+0x47c/0x24f0
[ 336.519507][ C0] ? __fd_install+0x1fb/0x640
[ 336.519508][ C0] ? fd_install+0x4d/0x60
[ 336.519510][ C0] do_signal+0x87/0x1700
[ 336.519513][ C0] ? perf_event_set_output+0x4e0/0x4e0
[ 336.519515][ C0] ? setup_sigcontext+0x7d0/0x7d0
[ 336.519517][ C0] ? put_timespec64+0xda/0x140
[ 336.519519][ C0] ? exit_to_usermode_loop+0x43/0x380
[ 336.519521][ C0] ? do_syscall_64+0x676/0x790
[ 336.519524][ C0] ? exit_to_usermode_loop+0x43/0x380
[ 336.519526][ C0] ? lockdep_hardirqs_on+0x421/0x5e0
[ 336.519528][ C0] ? trace_hardirqs_on+0x67/0x240
[ 336.519530][ C0] exit_to_usermode_loop+0x286/0x380
[ 336.519532][ C0] do_syscall_64+0x676/0x790
[ 336.519535][ C0] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 336.519536][ C0] RIP: 0033:0x45a759
[ 336.519538][ C0] Code: Bad RIP value.
[ 336.519541][ C0] RSP: 002b:00007f8ca6d88c88 EFLAGS: 00000246 ORIG_RAX: 000000000000012a
[ 336.519546][ C0] RAX: 000000000000000c RBX: 000000000071c0f8 RCX: 000000000045a759
[ 336.519549][ C0] RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 000000002001d000
[ 336.519552][ C0] RBP: 0000000000000005 R08: 0000000000000000 R09: 0000000000000000
[ 336.519555][ C0] R10: ffffffffffffffff R11: 0000000000000246 R12: 00007f8ca6d896d4
[ 336.519558][ C0] R13: 00000000004aec2b R14: 00000000006f1ca8 R15: 00000000ffffffff
[ 336.519807][ T1113] Kernel panic - not syncing: hung_task: blocked tasks
[ 336.523156][ T1113] CPU: 3 PID: 1113 Comm: khungtaskd Not tainted 5.4.0-syzkaller #0
[ 336.523156][ T1113] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
[ 336.523156][ T1113] Call Trace:
[ 336.523156][ T1113] dump_stack+0x197/0x210
[ 336.523156][ T1113] panic+0x2e3/0x75c
[ 336.523156][ T1113] ? add_taint.cold+0x16/0x16
[ 336.523156][ T1113] ? lapic_can_unplug_cpu.cold+0x3a/0x3a
[ 336.523156][ T1113] ? ___preempt_schedule+0x16/0x18
[ 336.523156][ T1113] ? nmi_trigger_cpumask_backtrace+0x21b/0x28b
[ 336.523156][ T1113] ? nmi_trigger_cpumask_backtrace+0x24c/0x28b
[ 336.523156][ T1113] ? nmi_trigger_cpumask_backtrace+0x256/0x28b
[ 336.523156][ T1113] ? nmi_trigger_cpumask_backtrace+0x21b/0x28b
[ 336.523156][ T1113] watchdog+0xb22/0x10c0
[ 336.523156][ T1113] kthread+0x361/0x430
[ 336.523156][ T1113] ? reset_hung_task_detector+0x30/0x30
[ 336.523156][ T1113] ? kthread_mod_delayed_work+0x1f0/0x1f0
[ 336.523156][ T1113] ret_from_fork+0x24/0x30
[ 336.523156][ T1113] Kernel Offset: disabled
[ 336.523156][ T1113] Rebooting in 86400 seconds..