[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 57.835354] audit: type=1800 audit(1540755762.881:25): pid=6088 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 57.854673] audit: type=1800 audit(1540755762.881:26): pid=6088 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 57.874315] audit: type=1800 audit(1540755762.911:27): pid=6088 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.115' (ECDSA) to the list of known hosts. 2018/10/28 19:42:56 fuzzer started 2018/10/28 19:43:00 dialing manager at 10.128.0.26:36185 2018/10/28 19:43:01 syscalls: 1 2018/10/28 19:43:01 code coverage: enabled 2018/10/28 19:43:01 comparison tracing: CONFIG_KCOV_ENABLE_COMPARISONS is not enabled 2018/10/28 19:43:01 setuid sandbox: enabled 2018/10/28 19:43:01 namespace sandbox: enabled 2018/10/28 19:43:01 Android sandbox: /sys/fs/selinux/policy does not exist 2018/10/28 19:43:01 fault injection: enabled 2018/10/28 19:43:01 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2018/10/28 19:43:01 net packed injection: enabled 2018/10/28 19:43:01 net device setup: enabled 19:45:40 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000380)={r0, &(0x7f0000000080), &(0x7f0000000340)}, 0x20) syzkaller login: [ 236.695955] IPVS: ftp: loaded support on port[0] = 21 [ 239.140132] bridge0: port 1(bridge_slave_0) entered blocking state [ 239.146711] bridge0: port 1(bridge_slave_0) entered disabled state [ 239.155391] device bridge_slave_0 entered promiscuous mode [ 239.320143] bridge0: port 2(bridge_slave_1) entered blocking state [ 239.326744] bridge0: port 2(bridge_slave_1) entered disabled state [ 239.335409] device bridge_slave_1 entered promiscuous mode [ 239.480199] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 239.622004] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready 19:45:45 executing program 1: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x2001) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r0, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000640)={0x0, 0x0}) ioctl$SCSI_IOCTL_PROBE_HOST(0xffffffffffffffff, 0x5385, &(0x7f0000000340)={0x4e, ""/78}) pselect6(0x40, &(0x7f00000000c0), &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r1+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8}) vmsplice(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0) [ 240.082878] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 240.347976] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 240.644700] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 240.671965] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 240.707155] IPVS: ftp: loaded support on port[0] = 21 [ 240.925056] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 240.932223] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 241.654444] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 241.662846] team0: Port device team_slave_0 added [ 241.846271] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 241.854456] team0: Port device team_slave_1 added [ 242.150446] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 242.157806] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 242.166723] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 242.468741] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 242.476043] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 242.485125] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 242.779065] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 242.786788] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 242.796063] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 242.949562] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 242.957276] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 242.966367] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 244.451105] bridge0: port 1(bridge_slave_0) entered blocking state [ 244.457892] bridge0: port 1(bridge_slave_0) entered disabled state [ 244.466525] device bridge_slave_0 entered promiscuous mode [ 244.658964] bridge0: port 2(bridge_slave_1) entered blocking state [ 244.665551] bridge0: port 2(bridge_slave_1) entered disabled state [ 244.674155] device bridge_slave_1 entered promiscuous mode [ 244.874552] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 245.081671] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready 19:45:50 executing program 2: r0 = socket$inet6(0xa, 0x80003, 0x84000000000000b) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x80000000004}, 0x1c) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) sendmmsg(r2, &(0x7f0000005fc0)=[{{&(0x7f0000005680)=@sco, 0x80, &(0x7f0000005b00)}}, {{&(0x7f0000005b80)=@l2, 0x80, &(0x7f0000005c40), 0x1f4, &(0x7f0000005c80), 0x3bfb}}], 0x3e8, 0x0) [ 245.751693] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 245.814920] bridge0: port 2(bridge_slave_1) entered blocking state [ 245.821441] bridge0: port 2(bridge_slave_1) entered forwarding state [ 245.828546] bridge0: port 1(bridge_slave_0) entered blocking state [ 245.835097] bridge0: port 1(bridge_slave_0) entered forwarding state [ 245.843952] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 246.027828] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 246.226121] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 246.233284] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 246.519112] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 246.526337] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 246.602349] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 246.828357] IPVS: ftp: loaded support on port[0] = 21 [ 247.515202] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 247.523282] team0: Port device team_slave_0 added [ 247.844515] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 247.852811] team0: Port device team_slave_1 added [ 248.051422] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 248.058663] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 248.067684] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 248.407186] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 248.414890] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 248.423896] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 248.688617] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 248.696417] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 248.705530] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 249.042345] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 249.050266] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 249.059470] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 251.710972] bridge0: port 1(bridge_slave_0) entered blocking state [ 251.717687] bridge0: port 1(bridge_slave_0) entered disabled state [ 251.726472] device bridge_slave_0 entered promiscuous mode [ 252.006763] bridge0: port 2(bridge_slave_1) entered blocking state [ 252.013476] bridge0: port 2(bridge_slave_1) entered disabled state [ 252.021995] device bridge_slave_1 entered promiscuous mode [ 252.293557] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 252.303943] bridge0: port 2(bridge_slave_1) entered blocking state [ 252.310409] bridge0: port 2(bridge_slave_1) entered forwarding state [ 252.317511] bridge0: port 1(bridge_slave_0) entered blocking state [ 252.324109] bridge0: port 1(bridge_slave_0) entered forwarding state [ 252.333069] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 252.609337] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 253.302229] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 253.334245] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 253.540805] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 253.792315] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 253.799371] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 254.128111] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 254.135308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready 19:45:59 executing program 3: r0 = getpid() r1 = inotify_init1(0x0) fcntl$setown(r1, 0x8, 0xffffffffffffffff) fcntl$getownex(r1, 0x10, &(0x7f0000000080)={0x0, 0x0}) kcmp$KCMP_EPOLL_TFD(r2, r0, 0x4, 0xffffffffffffffff, &(0x7f0000000100)) open$dir(&(0x7f0000000380)='./file0\x00', 0x0, 0x0) [ 255.179770] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 255.188123] team0: Port device team_slave_0 added [ 255.567082] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 255.575295] team0: Port device team_slave_1 added [ 255.608899] IPVS: ftp: loaded support on port[0] = 21 [ 255.907862] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 255.915058] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 255.924101] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 256.276666] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 256.283846] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 256.292693] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 256.700526] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 256.708375] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 256.717659] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 257.069955] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 257.077734] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 257.086947] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 260.263086] 8021q: adding VLAN 0 to HW filter on device bond0 [ 261.176866] bridge0: port 2(bridge_slave_1) entered blocking state [ 261.183430] bridge0: port 2(bridge_slave_1) entered forwarding state [ 261.190350] bridge0: port 1(bridge_slave_0) entered blocking state [ 261.196943] bridge0: port 1(bridge_slave_0) entered forwarding state [ 261.205761] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 261.683784] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 261.961506] bridge0: port 1(bridge_slave_0) entered blocking state [ 261.968194] bridge0: port 1(bridge_slave_0) entered disabled state [ 261.976844] device bridge_slave_0 entered promiscuous mode [ 262.022089] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 262.356707] bridge0: port 2(bridge_slave_1) entered blocking state [ 262.363308] bridge0: port 2(bridge_slave_1) entered disabled state [ 262.371965] device bridge_slave_1 entered promiscuous mode [ 262.755521] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 263.161149] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 263.265307] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 263.271675] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 263.279975] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 264.226896] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 264.620544] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 264.777338] 8021q: adding VLAN 0 to HW filter on device team0 [ 264.948767] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 264.955965] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 265.326238] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 265.333441] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready 19:46:10 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f00000000c0), 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in, @in6=@ipv4={[], [], @rand_addr}, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0x0, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) [ 266.523249] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 266.531288] team0: Port device team_slave_0 added [ 266.970084] 8021q: adding VLAN 0 to HW filter on device bond0 [ 267.003240] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 267.011352] team0: Port device team_slave_1 added [ 267.249229] IPVS: ftp: loaded support on port[0] = 21 [ 267.527320] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 267.534653] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 267.543594] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 267.933496] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 267.940555] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 267.949678] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 268.342467] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 268.350062] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 268.359186] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 268.707867] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 268.835030] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 268.842843] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 268.851545] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 270.483483] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 270.489838] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 270.497978] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 272.079145] 8021q: adding VLAN 0 to HW filter on device team0 [ 273.967280] bridge0: port 2(bridge_slave_1) entered blocking state [ 273.973845] bridge0: port 2(bridge_slave_1) entered forwarding state [ 273.980763] bridge0: port 1(bridge_slave_0) entered blocking state [ 273.987359] bridge0: port 1(bridge_slave_0) entered forwarding state [ 273.996287] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 274.422568] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 274.593510] bridge0: port 1(bridge_slave_0) entered blocking state [ 274.600020] bridge0: port 1(bridge_slave_0) entered disabled state [ 274.608588] device bridge_slave_0 entered promiscuous mode [ 275.126899] bridge0: port 2(bridge_slave_1) entered blocking state [ 275.133649] bridge0: port 2(bridge_slave_1) entered disabled state [ 275.142265] device bridge_slave_1 entered promiscuous mode 19:46:20 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r1, r1) sendmsg$netlink(r2, &(0x7f0000028fc8)={0x0, 0x0, &(0x7f0000019000), 0x0, &(0x7f0000000040)}, 0x0) recvmmsg(r0, &(0x7f0000000b80)=[{{&(0x7f0000000200)=@l2, 0x80, &(0x7f00000005c0), 0x0, &(0x7f0000000600)=""/84, 0x54}}], 0x1, 0x62, 0x0) [ 275.621108] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 275.838866] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready 19:46:20 executing program 0: unshare(0x8000400) r0 = socket$inet_sctp(0x2, 0x5, 0x84) pselect6(0x40, &(0x7f0000000040), &(0x7f00000000c0), &(0x7f0000000100)={0x9}, &(0x7f0000000140)={0x0, 0x1c9c380}, &(0x7f00000001c0)={&(0x7f0000000180), 0x8}) fcntl$getownex(r0, 0x10, &(0x7f0000000000)={0x0, 0x0}) ptrace$getenv(0x4201, r1, 0x0, &(0x7f0000000080)) socketpair(0x10, 0x5, 0xee, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4068aea3, &(0x7f0000000240)={0x7b, 0x0, [0x7, 0x100000001, 0x7, 0x6]}) 19:46:21 executing program 0: r0 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000000)=[@in={0x2, 0x4e23, @remote}, @in={0x2, 0x4e23, @loopback}], 0x20) getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, &(0x7f0000000040)={'nat\x00'}, &(0x7f00000000c0)=0x54) r1 = syz_open_dev$usb(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x5, 0x400) sendmsg$nl_route(r1, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x60000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)=@ipv6_delroute={0x54, 0x19, 0x2, 0x70bd26, 0x25dfdbff, {0xa, 0x20, 0x0, 0x8, 0xfc, 0x1, 0xfe, 0x1, 0x1100}, [@RTA_GATEWAY={0x14, 0x5, @remote}, @RTA_GATEWAY={0x14, 0x5, @ipv4={[], [], @local}}, @RTA_EXPIRES={0x8, 0x17, 0xcc77}, @RTA_MARK={0x8, 0x10, 0x2}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x4000) ioctl$RTC_WKALM_RD(r1, 0x80287010, &(0x7f0000000140)) r2 = syz_genetlink_get_family_id$fou(&(0x7f00000001c0)='fou\x00') syz_open_dev$sndmidi(&(0x7f00000002c0)='/dev/snd/midiC#D#\x00', 0x8, 0x0) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="00002dbd7000fcdbdf250100000075f4b6fe254c00bffa0f380800040001"], 0x24}, 0x1, 0x0, 0x0, 0x881}, 0x0) 19:46:22 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r0, 0x20000003) r1 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r1, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x3}, 0x1c) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @dev={0xfe, 0x80, [], 0xf}}, 0x18) setxattr$security_smack_transmute(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='security.SMACK64TRANSMUTE\x00', &(0x7f00000000c0)='TRUE', 0x4, 0x2) accept4(r0, &(0x7f0000000180)=@hci, &(0x7f0000000100)=0x80, 0x0) [ 277.163588] bond0: Enslaving bond_slave_0 as an active interface with an up link 19:46:22 executing program 0: r0 = socket$key(0xf, 0x3, 0x2) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x0, 0x0) ioctl$TCSBRK(r1, 0x5409, 0x669) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x2, 0x3, 0x0, 0x7, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}, @sadb_sa={0x2}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}]}, 0x50}}, 0x0) [ 277.760977] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 278.152702] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 278.159753] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready 19:46:23 executing program 0: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000140)={'veth0_to_bridge\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="1200000000000000000000005d67da1e852100000000"]}) [ 278.508719] 8021q: adding VLAN 0 to HW filter on device bond0 19:46:23 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0xaaa, 0x101000) ioctl$SNDRV_TIMER_IOCTL_STATUS(r0, 0x80605414, &(0x7f0000000040)=""/112) r1 = add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000100)={'syz'}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$restrict_keyring(0x1d, r1, 0x0, 0x0) keyctl$get_persistent(0x16, 0x0, r1) [ 278.687132] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 278.694395] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready 19:46:24 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x80800) openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x400000, 0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000003fe8)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000013e95), 0x4) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000040)={'veth1_to_bond:\x00', &(0x7f0000000100)=@ethtool_sfeatures={0x1b}}) close(r2) close(r1) [ 279.987442] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 279.996045] team0: Port device team_slave_0 added [ 280.021252] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 280.336588] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 280.345104] team0: Port device team_slave_1 added [ 280.660263] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 280.667519] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 280.676331] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 280.982243] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 280.989297] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 280.998181] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 281.090202] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 281.096646] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 281.104709] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 281.278359] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 281.286188] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 281.295202] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 281.645228] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 281.652910] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 281.662141] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 282.005896] hrtimer: interrupt took 45516 ns [ 282.325587] 8021q: adding VLAN 0 to HW filter on device team0 19:46:28 executing program 1: syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x0, 0x0) bpf$MAP_CREATE(0x9903000000000000, &(0x7f0000000000)={0x40400000000005, 0x4, 0x4, 0x9, 0x20000000009, 0xffffffffffffffff, 0x0, [0x305f, 0xa]}, 0x2c) [ 284.447360] bridge0: port 2(bridge_slave_1) entered blocking state [ 284.453931] bridge0: port 2(bridge_slave_1) entered forwarding state [ 284.460836] bridge0: port 1(bridge_slave_0) entered blocking state [ 284.467456] bridge0: port 1(bridge_slave_0) entered forwarding state [ 284.476120] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 284.482716] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 286.910829] 8021q: adding VLAN 0 to HW filter on device bond0 [ 287.665043] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 288.465322] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 288.471670] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 288.479678] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 289.449659] 8021q: adding VLAN 0 to HW filter on device team0 19:46:34 executing program 2: clone(0x200, &(0x7f0000000080), &(0x7f0000000000), &(0x7f0000000100), &(0x7f0000000280)) mknod(&(0x7f0000f80000)='./file0\x00', 0x1042, 0x0) execve(&(0x7f0000000340)='./file0\x00', &(0x7f0000000300), &(0x7f0000000200)) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000540)=""/11, 0x485) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000200)) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, &(0x7f0000000140), 0xffffffffffffffff) r1 = creat(&(0x7f0000000080)="e91f7189591e9233614b00", 0x109) r2 = dup2(r0, r1) execve(&(0x7f00000000c0)="e91f7189591e9233614b00", &(0x7f0000000140), &(0x7f0000000500)) ioctl$TUNSETTXFILTER(r2, 0x400454d1, &(0x7f00000001c0)=ANY=[]) r3 = open$dir(&(0x7f00000001c0)='./file0\x00', 0x841, 0x0) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, &(0x7f0000000180), 0xffffffffffffffff) execveat(r3, &(0x7f0000000240)='./file0\x00', &(0x7f00000004c0), &(0x7f00000006c0), 0x0) ioctl$TUNSETLINK(r2, 0x400454cd, 0x0) [ 292.437583] 8021q: adding VLAN 0 to HW filter on device bond0 [ 292.998802] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready 19:46:38 executing program 3: mknod(&(0x7f0000000040)='./file0\x00', 0x8000, 0x2ddc) r0 = open(&(0x7f0000000040)='./file0\x00', 0x611, 0x0) writev(r0, &(0x7f00000025c0)=[{&(0x7f00000015c0)="3a7f76caea5c03472a9646c31c007f7789f8d0c7743f47e3fdd7854bbc8a0cea84741d264deb46f02115e205dd409a8ba5be48d105b5b6ad3d9e9df19fc3a9f3a41cd432247d1b0369e1781ec03f2decc25578fe2fa13bd030fb7a79f685f8aa970ab720aaac4d68084261ca69000714284152fb75f09e8eb6e70467ff4b433e58fd6e665eeaffdbd916bf7e9d6b7a9dc7a039f97e08c831403cfe300bd3c5cd2b05c5d7adf0598e76464bee369ef2f4b8dab9c8e19db7b7c7b65dc902cc69ead00b1065a74695448c06ec528ab0b05a0667f52ae744957d140fcad06a577cc2e8ef5cf2902c7cb9e4f8e1dbde9a68eb5797ef7f0ba8c2996fe1d52703463432b8a5a216ed009f84dca44698be0d80e4d5cd5e1fb452238b92a4e3f43494946e311b802fab1fdf36e8605b62a5891954e7739bcd82ecfea9aabe85d0dbb759496caacce62a66b58f31a2a87950a0c9599191dccc32d1b9f8bdea6ec205be3248a00708b75d3b9ea7763b843f14ae06e75f719693f1df5adae0683f5d63c575306f24b80658c27c6b87851626b1c9fd60c03ff153091aed4a3bce99b4ea219e41206a980701403d504d61588bceb2e998030a3ee8c5aa5e65fe83d60b8e7fb74614f26060bc33480944ee48b3b75a640c253a5b9a1bfe84b033d3bb80a5bba668e8b3dc02ac9845ac0711a8721bd321c449c30c72df8e3b6f6b2d828dc470f19f6ccd0a51418d0fd6362a4b16fe0961808a5e303852fbf210176571e0e30c8203509f8afd01b39cfd7a415485b94af55fd02b1ea626f20f7353c4cfedced99b0f8dee544726b1cefdd2382bc38c3a0db6f69da31468da54a6aa84e154799f9603d8085bc7283619e48e03ae8bc28536bb4171cf7df7a41f9b7efc8740ca21988a5b7c97e37f38d07cefc26d1c9efe501aefb8f5bebb0f6fb90a2576b6ea5abda27d957116d0241d562bb3ed59f4180d61979868c7a83d116d4bc8db4e11c65c81a2bb2ae894131367a85f4e3f0c9693df8767edd6515bc2fef0495648fffa98bc0993a0b9851bda5ec7f25158ec1f596e0822ad5a0b74ca85e90542b345e0a04cc90e9aba63391cb2b6b71cb82cb665a9792596eceef845d78d93f44de267f4328c9bc3d77fe8407e1703b8fc909367886b45ca72429730b00d4512bfdc360dde4f2c1dafd3a3acf36b35a0ad8736c5f2a67d6e60f0e84a3edea8602f0ac06cc65b99b39015085e304af11da061fa836cd03728101a4cc1ab8872f7e21f57f367d6c1a07a9cd7da07fbd95f2dc9e4757ffdf74a1ad07de17a3b759349d3f747bdc5bb9e2024719ea15cb39ec756b3b34f335961a4e7891cdb419a76f3182660ae68a050c60347e488a9cf07effc17adbcf2394e1cc8efeef3cfe8bdb20481c703043f6d4599cdc74a84076f0712fd5a59fcfae7a9d37265162d61a73c7a8a617ad8a12aaf9b48c417e6419110662e79a45607f76065c29f1a368cc2ab38e3fc7a9bda86531f370289c5d547aba84673196ce735dfd604987351d2845db837fb503c4748760a874438c2b6b72d92fefa57a15c9ffd3d0e121821eec2641e79d631c0b1ceb0eeffbf816829be5e386c41f7248bd2068c08187696bcd100ade4fed30c5a3429c3b64a3cedddf7b12c15b7c492f568c66cab4a2dcccbc72e0664f3026d523e71cb9e7ab3b366391f83e1ad3e5a69cf07fb791749263d081866ecb68c588e208adb006eabdeef2539784fe2a21f371d486a22e26385310fd21095a10939891dcd54986cddb63d045bb0559cb6bbf9fd29540887d26ffbbd5a61cf9fd7ee6e11b7cef1c991ca1aba9c5587ecf9134169d3edadb60fe0c190a3d6c3af1c5f81f08c747829477a84cbce41cbc383e288b0d7aee236f3d21c1e47a640037cad0da1bafbb1636066a32b707d12a50472eaa253ebd40c2d3d056afd0e334ac3653c1703365ac0c8cf3da7ee1b84234f57569dbda833d64d155d77a1c52c9fce92e86351eecc872f7a4eb86294146d6919d6cd77c1f4675781ff9cd3e73af306f1b0a53c69199fb6626d794f65cb579a80dbb22e5a16dc595b139643e0efa708d70df9e50f59aa613a43de6a13ea5987c3809f3ad69cacf61dd6d145906bb6b964bfb2b91f442ade3ce45ed9b685149f0084a3ee4b3513a8524a86d852f71262715a19219af3aae3860ec2130e151ed3315012f841eacc0a2b400ed3c3b636559963076d1ad1355fdfe7b18cba847fa155ae9eb87b626cf8303736d05008cec7c34fce49a5762cbafa42233044019a007795b7752d60c890c10ee0a5fbdf8c7ea59d993d9bafecf36ecf15d02b87d7a1ca5c9c7cc5d674f65592e8dfd218febe29ddaabdf4abbd9c235d091fe839460bb5c7c83a568740d801feac719a9064aab1624dd7fe052c290e382d2fd2e191956391aee24a7c31c0a425d298c83bfd174c4f8ba02e1a9745831a71cfb021e7cc94a91486ed27d0401e0c438b4f11be65e2f8aa62f020d899d41487fe5b473049aecd861f656972f6a90313653eaa8882f13ef56f8cc6e9c60f8b690abaff366dcb4161159bb13cd0218f262900c5a2766251dbedf9af96abfa517a8622a558558db6ac7190fd34ba91efbac1215b8db82b737cf251e83f23353492e725ecbe8ac1c17923522c489cb5b89d85ffe4d9896e884d8567f7f292ab7baa352de7d8a0bf0f7086ea51bfccb5fe72ec93dba33723bae811f5ee1def7b20612aab969ce047dab458a02a9e8fb941a4af5febb5f4195782c4ecb9e7a77c2d6e2a833f94d79453b538ac0a32692e78353b621ca5f7d17a94e53c0b4501fe4c14ed1ceb8b546ee90c34d40467ada2fabb37fb4fef79b5f8fa025374574a8fd76ed89fbc7bd83baf6f6b5657785a9971e86f394e4e22fa5409f038041fd563235379309545095ea46d5085691f45daa5cf4afa61080d7bc526716f45137713fff93914594c66f7018cb28aa6a6b381cb960af2d95ebc153f6fcbb6badc719fefc8704736fb8d3ccf61c7286490926dbc0de5df384f30e5dbe31317fd0fceaa78cbab9b1eb70ad981818f7034021dd3b94f6deb633d7104c67c8a5820b19fb4668b2d70127df9e5c172647361e74d26b2f0b1327a5d5f30162459cecce598d2dc71e9b1faeb2d8ad0cdb024b449a8b55cd26a0910bd3a742d9151e899fea139444861c33abe6f536ef659bbb1019a93e62ce7051aaab43218a701e091a18a0aab19a370425ba5417e335189934d59483c48086804662c3a88876e7182818692c6a0ba51cbe4b1b3a837536c6ac4c4fb35bb1bb42ead9158e9449b6a1daea35f4b747f6be12e9db68f4b14983f853283578a484bd2be2f5fa1637cd2633f7bc809caf15222230d899c5ed53429b18675b354061ad0b8eccc323eee8d122b9f1dd6c6c7e415a51a7147f07ec553cd315ed0a2cb703d95195cb56e7b3e06dffc6e4d3f711243b9ca27b0370c888dda428e6e28ad89fdcba96d61b4c44cb3841d82b999169ef1041e20a93a768617689a506f6271cd8a835ab6d75534a71647f5245f92ff52e2b07d4ae5b47ca3a866b39fac30dc3d6671e12a3c80eb48d9a17dbbf510d77da1faf28ee671472c7e215acbaf5b798f263774fdc3421f0a703aca86b766cb48fddcfa7ff0c13479a4ecb0ffc80202d7f6c2b62b478e745fb26bc3100f23d70740821c7b651e19a0d1ca519d1a8370cf5b5ae496b1919e89f0891509f2302a05c6abfadfcf0cbad44bbdd9ecb1780340a0441d61928c97d954fe15a9c82c859c5fd917903982c357ad570545ed21c029ed2221df98b85fc3d9cbe1305809b625bda48c1be867f921e5b961c80558314b7100ce0a977bedc764ff7a3256df6fe3848b0878cf29dc28dd45f1da909e794eed21eaf903bc517396e612121c1bfd8f84945ddb3766c568a9341aae73cc7e628f53b543c66f0d9c54471b192bd9a1efbb6057a39da0f34d2f27c72faba74351da012a09b24040141117f3373c980c737b54c144ca7467d35419ef26582170db063851281141a9ce774526f4472ac53d9666162422a04925604cffa93cf629f1b2f4b5342266feaa425bd5fdb6bef4b22a019b62c9021b32d749d25151fb982f6bf3e683673d7d3c56d2509f8c6bcace2552f8c698e6f9019e19f94b64e4e1b34af13100d5d5ece00650b651b96d8da1578bd9b02bad509e490b4f39bba15489e4ed032d7f653a5d6161816a93f7aa546e7e896a696cb01679ea742d875df9409c70573bb6bdb6ee547d63c8a057838ef4089331e98182a541c744e3b4e88c3b259ef0124ab3a5cb48a6a368eee5dfc11b597b657ad3f89a7697d58942d8629fba64cdb95761eda6d14daa81c9c2453456f921d34329c6577dab686399ad6696f6d50a989aff1b7e1b493d4fb95773538c838236dd8de451342ae5d22524682caf779052a40de923c7de07f5ba1473caeca4839ba66a927dcb9d268558304d1aea9efe5fa4e80d8c6ca1cf8ab81c43960b6672d6449bb6212906d119a18f43c191db7e3f550c45ab6d6129086e3cec2136666c971fee76bdab58eed0d42a3ce8fc3b218a42ca3741275e144169e5a61b34deccd23a3939851a3a4d32e396374b", 0xcbd}], 0x1) pwritev(r0, &(0x7f00000028c0)=[{&(0x7f0000002800)="cb3ea6fd6cdc3e1e615f69018ac63d39358a7c18ba39fb910a92f30f6dd2417cf6806cd3fc6ba3e00a59ebd5dfb0bc72e6848d7ba827d72fc784b2f7819b442f976a2a06e40091aee89f031835029488fc45ab6d17754b0838b33d7432c82d5049cb503cadc7e8ebdf9cd14496357934851b755c1639064a40dd0a4c72aee1d9cdb2b6a4bee61965b28996", 0x8b}], 0x1, 0x0) socket$inet6(0x18, 0x8001, 0x0) writev(r0, &(0x7f0000000080)=[{&(0x7f0000000280)="3128c2a3228665d8316cfba0ac631addae4f8798c4444c93796616b628cb6ab17e6fcc7077be11d137a737c4bdb968ca4e14d6c47b3ed5504e794aa187e245ba7e1e4c1f0aed83959594dfce720928e0fd8d03f6", 0x54}], 0x1) [ 293.508277] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 293.514662] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 293.522453] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 293.807097] 8021q: adding VLAN 0 to HW filter on device team0 19:46:40 executing program 4: r0 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) write$cgroup_type(r0, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) clone(0x400002100001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) setsockopt$inet6_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x29, 0x2a, &(0x7f0000000200)={0x0, {{0xa, 0x4e23, 0x0, @remote}}}, 0x88) socketpair(0x0, 0x0, 0x0, &(0x7f0000000300)) setxattr$security_smack_entry(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='security.SMACK64IPIN\x00', &(0x7f0000000100), 0x0, 0x0) 19:46:40 executing program 5: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x800, 0x0) getsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000040)=0x8, &(0x7f0000000080)=0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000000c0)={0x0, 0x5, 0x5}, &(0x7f0000000100)=0x8) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000140)={0x2, 0x5, 0x8, 0x3a2b5566, 0x7, 0x1, 0x3, 0x7fffffff, r1}, &(0x7f0000000180)=0x20) ioctl$sock_SIOCSIFBR(r0, 0x8941, &(0x7f00000001c0)=@generic={0x2, 0x80000001, 0x2}) getsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000200)=0x5f, &(0x7f0000000240)=0x4) getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000280)=@assoc_id=r2, &(0x7f00000002c0)=0x4) fcntl$F_SET_FILE_RW_HINT(r0, 0x40e, &(0x7f0000000300)=0x4) r3 = request_key(&(0x7f0000000340)='rxrpc\x00', &(0x7f0000000380)={'syz', 0x3}, &(0x7f00000003c0)="6367726f757073656375726974797d76626f786e65743028a56b657972696e67766d6e6574307070703173656c662d47504c4000", 0x0) keyctl$clear(0x7, r3) setsockopt$inet_udp_int(r0, 0x11, 0x6f, &(0x7f0000000400)=0x8d, 0x4) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000440)=0x1) ioctl$DRM_IOCTL_ADD_MAP(r0, 0xc0286415, &(0x7f0000000480)={0x0, 0x2, 0x0, 0x40, &(0x7f0000ffd000/0x3000)=nil, 0x6}) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000580)={'team0\x00', 0x0}) ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @multicast1}, @empty, @mcast2, 0x3, 0x8, 0x6, 0x500, 0x3e690f72, 0x400000, r4}) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f0000000640)={r2, @in6={{0xa, 0x4e20, 0x4, @dev={0xfe, 0x80, [], 0x14}, 0x9}}, 0x108, 0x6, 0x4c, 0xc46f, 0x3}, &(0x7f0000000700)=0x98) setsockopt$ALG_SET_AEAD_AUTHSIZE(r0, 0x117, 0x5, 0x0, 0x7) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$EVIOCGPROP(r0, 0x80404509, &(0x7f0000000740)=""/194) ioctl$KVM_S390_VCPU_FAULT(r0, 0x4008ae52, &(0x7f0000000840)=0x2ef3) setsockopt$sock_attach_bpf(r6, 0x1, 0x32, &(0x7f0000000880)=r0, 0x4) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r0, 0x660c) r7 = socket$l2tp(0x18, 0x1, 0x1) sendto$inet(r0, &(0x7f00000008c0)="f2d3ca54a1eb3f1e03fff992107b847cc1d9f7750409280b0df3d2fa788533feae0331d8fe5efe158dac39952c487044eebd284df02133808b28e875a4c56d4f5368b1ce8715f3e521ed86bf9b4ca2f3c91eb131ccb7f0883fd0fec57fb91427dfe713dc996fe43f79335c8c0d6ef57f47e067149e5f7c84975280949f0304f9c9deea082b63d506c4a4b3d2530d2645ca8f5c31b242aca9f27498f72133de1316403858da879b13e9267ff88ef2915a7cd06286fdd1c8c4b803901e0f94690de9b8062683098346e5fe20d8e348", 0xce, 0x40, &(0x7f00000009c0)={0x2, 0x4e22}, 0x10) inotify_init() getsockopt$inet_sctp_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000a00), &(0x7f0000000a40)=0x4) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x73, &(0x7f0000000a80)={r5, 0xb3f, 0x30, 0x200000, 0x8}, &(0x7f0000000ac0)=0x18) write$P9_RLERROR(r7, &(0x7f0000000b00)={0x9, 0x7, 0x2}, 0x9) sendmsg$xdp(r0, &(0x7f0000000f00)={0x0, 0x0, &(0x7f0000000e80)=[{&(0x7f0000000b40)="24c73c23cc0766c49a82d61378508697ed01a366f17180bcbe06aefb6d01fe9059ce5dc9ff57e75be92cf3dfb405fe6559ffd08283f9453e1244ff8c20444f653009c7346ff4b00a53202a30159eeff7f89f21016c6d3ef09133af00705474ce906f4a843fe09798838918d4c36b6cbadd40776bb00c2db996bceb5f3199550fba43b359b380ba9dccfa1cd09f05d3b74ba711569230a54a3820f6dfbe4eb4b6d6174ef923e8", 0xa6}, {&(0x7f0000000c00)="4e04fc9ae202d780c7188deb3d7017a8124d5bd629e5a47e8a46cc87eb63bd2b45cda65ef2296ee10436458244b82eba7271242bf47e018ccd866061a71d390ff7783896d35b632b2fb07835152faf54d6afcf3a44da31b50a7da4", 0x5b}, {&(0x7f0000000c80)="644e3a0dc62d966cab4f913923d44f6d10d230d5161e731e796bb7564451308f84bcb799be77f27ebf69514462d32762f54ebb276c65e803ad688bd7cfe0820ed2ea4bda2cd491883e225856b855a2753b333c96cff683ee4360aa6ea816605260de17f24b4c13483dec41a1163c2f69d768824e978ed8934ca1f11c10da954ba7ecf249f9ce27199def225751b8300551f04d8ebcd3a3fe9d9536b03cb9673769efecf34aede5947f453349013ccf913955f346262f79f51918b91ff3148651593d280bdb4d68836275e110439e4faf1bc0bb64dd3ac8ff1326e82ab94e068a9e2ddb4a546d5c5f94e9d9f4b7bcb785c7a467077533", 0xf6}, {&(0x7f0000000d80)="856391d3924e825d1af00637e5e48fe398b25e1beb4390fbfaad9d6fa48eb2660ee7aa478b7b239fb1257373ba0e0c7a7ead3e85f9a20d0a3a02b69922a6d8782624931cc8db", 0x46}, {&(0x7f0000000e00)="05386657ab5186838003902d8191badb4401fce6e837ac055f7c23bfbc660fbd094f0f207d1adb4403105f1a971d11678c13604c4aa3a10c4a0ba06d248a52045b61039d8d", 0x45}], 0x5, 0x0, 0x0, 0x20044010}, 0x0) getsockopt$inet_sctp_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000f40)={r5, 0x2, 0x4, 0x4}, &(0x7f0000000f80)=0x10) 19:46:40 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@textreal={0x8, &(0x7f0000000240)="ba4300b00bee0f017edaf02114650f1ea7f07f0f20e06635040000000f22e03e0fc72dbaf80c66b80fb2578d66efbafc0cb001ee0fc75ba2f40f3805800060", 0x3f}], 0x1, 0x0, &(0x7f0000000140), 0x358) mmap(&(0x7f0000000000/0x5000)=nil, 0x5000, 0xfffffffffffffffd, 0x10031, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1000, &(0x7f0000ffe000/0x1000)=nil}) 19:46:40 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") r1 = memfd_create(&(0x7f0000000400)="e83779d80efa45bb7f48bebc95870bd0cd39bd2830ee47afe7b33fc778bde252c50d2e", 0x0) r2 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x1) r3 = dup2(r2, r1) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r3, 0xc08c5332, &(0x7f0000000340)={0x0, 0x0, 0x0, 'queue0\x00'}) write$sndseq(r1, &(0x7f0000000000)=[{0x5, 0x0, 0x0, 0x0, @tick, {}, {}, @connect}], 0xffffff76) 19:46:40 executing program 2: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000080), 0xc, &(0x7f0000000900)={&(0x7f0000000940)={0x14, 0x16, 0x201}, 0x14}}, 0x0) 19:46:40 executing program 3: r0 = socket(0x10, 0x3, 0x0) ioctl$sock_ifreq(r0, 0x894a, &(0x7f0000000080)={'ip_vti0\x00', @ifru_data=&(0x7f0000000000)="b06f31673d3da2b793d4f9a507e3c9133ba7ce8f5e6e538ecf8829b08f7f4aae"}) [ 296.023589] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/l1tf.html for details. 19:46:41 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x5}, 0x1c) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f0000000100)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) sendmmsg(r2, &(0x7f0000005fc0), 0x80000000000006a, 0x0) 19:46:41 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$inet(0x2, 0x4, 0x8001, &(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) kexec_load(0x201ef1c0, 0x10, &(0x7f0000000180)=[{&(0x7f00000001c0), 0x2, 0x0, 0x1000000}], 0x0) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/vsock\x00', 0x0, 0x0) perf_event_open$cgroup(&(0x7f00000004c0)={0x0, 0x70, 0x100000001, 0x8, 0x8, 0xe351, 0x0, 0x5, 0x2000, 0x7, 0x401, 0x8, 0x6, 0x5, 0x400, 0x40, 0x6, 0x0, 0xe, 0x3, 0x7, 0x4, 0x5e7, 0x0, 0x8, 0x7, 0x8, 0xa0, 0x10000, 0x4, 0x400, 0x800, 0x81, 0x100, 0x6, 0xb65, 0xff, 0x401, 0x0, 0x8, 0x4, @perf_config_ext={0x3, 0x80000001}, 0x20080, 0x1, 0x5, 0x6, 0x10001, 0x0, 0x7}, r1, 0x6, 0xffffffffffffff9c, 0x6) ioctl$ASHMEM_SET_PROT_MASK(r1, 0x40087705, &(0x7f0000000540)={0x0, 0x8}) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000580)={0x0, 0x71, "7a823fce00140193ab60147feadd9342a8a6cf8eba4c842d55c8b65a3aae96165563bf52adabc93f6555ce4993feb50ae29a354d6475b61d4c2ac513128f226f71c64008c005b7f3feee9e94012f49d957b509d05b5c5a35ceee9a1b08d03ceae20b2ec836a2b09f7ab51a6fa4e2370ca9"}, &(0x7f0000000600)=0x79) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r1, 0x84, 0x66, &(0x7f0000000640)={r2, 0xd086}, &(0x7f0000000680)=0x8) ioctl$FS_IOC_GETVERSION(r1, 0x80087601, &(0x7f0000000000)) chmod(&(0x7f00000000c0)='./file0\x00', 0x1) setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f0000000200)="a737da1b29130c4db94b61e4b57cc0dad558ef9f16155584ac711285ab12e97ac96227cbcf3e4c6fdeb5f71489250d4408f541266132e417a77550319e173b8156d677e9445d186683c9ce5dc08ac65592e75006748ec9575c24b9b034bad536fc23166540dc63cba4c854d3ae934d7f6b7f0e4ed90154991543808af18bddb5da13e8a028655e9d0dc6192e168b864c577e7f6b4a1bc57ca6ed072bb5fca088e18a503349b12f51e6477ba67b269adda437abe9478ac9e0be566e982eb11d85057f46f892a844b84427104ed40106", 0xcf) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000440)={0xffffffffffffffff}, 0x113, 0x100f}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r1, &(0x7f0000000380)={0x16, 0x98, 0xfa00, {&(0x7f0000000100)={0xffffffffffffffff}, 0x1, r3, 0x1c, 0x1, @in6={0xa, 0x4e20, 0x3, @dev={0xfe, 0x80, [], 0xf}, 0x80000000}}}, 0xfffffffffffffca0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000300)={0x11, 0x10, 0xfa00, {&(0x7f00000001c0), r4}}, 0x18) syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x0) 19:46:41 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) perf_event_open$cgroup(&(0x7f0000000080)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0xfff, 0x10001, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@textreal={0x8, &(0x7f0000000240)="ba4300b00bee0f017edaf02114650f1ea7f07f0f20e06635040000000f22e03e0fc72dbaf80c66b80fb2578d66efbafc0cb001ee0fc75ba2f40f3805800060", 0x3f}], 0x1, 0x0, &(0x7f0000000140), 0x358) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) mmap(&(0x7f0000000000/0x5000)=nil, 0x5000, 0xfffffffffffffffd, 0x10031, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000040)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000ffe000/0x1000)=nil}) [ 296.594887] Unknown ioctl 1074296581 [ 296.665664] Unknown ioctl -2146929151 19:46:41 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@textreal={0x8, &(0x7f0000000240)="ba4300b00bee0f017edaf02114650f1ea7f07f0f20e06635040000000f22e03e0fc72dbaf80c66b80fb2578d66efbafc0cb001ee0fc75ba2f40f3805800060", 0x3f}], 0x1, 0x0, &(0x7f0000000140), 0x358) mmap(&(0x7f0000000000/0x5000)=nil, 0x5000, 0xfffffffffffffffd, 0x10031, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1000, &(0x7f0000ffe000/0x1000)=nil}) [ 296.901965] Unknown ioctl -2146929151 [ 296.907477] Unknown ioctl 1074296581 19:46:42 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@textreal={0x8, &(0x7f0000000240)="ba4300b00bee0f017edaf02114650f1ea7f07f0f20e06635040000000f22e03e0fc72dbaf80c66b80fb2578d66efbafc0cb001ee0fc75ba2f40f3805800060", 0x3f}], 0x1, 0x0, &(0x7f0000000140), 0x358) mmap(&(0x7f0000000000/0x5000)=nil, 0x5000, 0xfffffffffffffffd, 0x10031, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1000, &(0x7f0000ffe000/0x1000)=nil}) 19:46:42 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) syz_open_dev$mouse(&(0x7f0000000100)='/dev/input/mouse#\x00', 0x0, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") socketpair(0x0, 0x0, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e23, @multicast1}, 0x10) finit_module(r0, &(0x7f00000000c0)='wlan1lo()eth1wlan1\'[user\x00', 0x0) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000080)={0xffffffffffffffff, &(0x7f00000002c0)}, 0x3) sendto$inet(r2, &(0x7f0000a88f88), 0xff7f, 0x20000000, &(0x7f0000e68000)={0x2, 0x4004e23, @dev={0xac, 0x14, 0x14, 0x13}}, 0x10) shmget(0xffffffffffffffff, 0x2000, 0x0, &(0x7f0000ffe000/0x2000)=nil) add_key(&(0x7f0000000400)='.request_key_auth\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480), 0x0, 0xfffffffffffffffa) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)={0x12, 0xc0, 0x4, 0x400000000078}, 0x2c) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000340)) setpgid(0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000180)={r3, &(0x7f0000000000), &(0x7f0000000140)}, 0x20) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000380)={[{0x101, 0x6, 0x0, 0x20000, 0xac, 0x3, 0x0, 0xbda9, 0x0, 0x9, 0x0, 0x7, 0x1000}, {0x8, 0x0, 0x0, 0xba, 0x1, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb1b3}, {0x0, 0x0, 0x5, 0x37f, 0x0, 0x2f, 0x0, 0x6, 0x27f7}], 0x40}) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000280)={r3, &(0x7f0000000040), &(0x7f0000000200)=""/70}, 0x18) 19:46:42 executing program 4: [ 297.784695] IPVS: ftp: loaded support on port[0] = 21 [ 299.227963] bridge0: port 1(bridge_slave_0) entered blocking state [ 299.234466] bridge0: port 1(bridge_slave_0) entered disabled state [ 299.242272] device bridge_slave_0 entered promiscuous mode [ 299.322537] bridge0: port 2(bridge_slave_1) entered blocking state [ 299.328940] bridge0: port 2(bridge_slave_1) entered disabled state [ 299.337010] device bridge_slave_1 entered promiscuous mode [ 299.414949] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 299.493089] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 299.727919] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 299.808936] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 299.889909] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 299.896988] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 299.977384] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 299.984503] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 300.227972] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 300.235663] team0: Port device team_slave_0 added [ 300.315852] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 300.323545] team0: Port device team_slave_1 added [ 300.402929] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 300.483539] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 300.563705] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 300.571010] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 300.580026] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 300.719296] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 300.727018] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 300.735853] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 301.686630] bridge0: port 2(bridge_slave_1) entered blocking state [ 301.693113] bridge0: port 2(bridge_slave_1) entered forwarding state [ 301.699842] bridge0: port 1(bridge_slave_0) entered blocking state [ 301.706378] bridge0: port 1(bridge_slave_0) entered forwarding state [ 301.715004] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 301.882382] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 304.947216] 8021q: adding VLAN 0 to HW filter on device bond0 [ 305.255289] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 305.548480] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 305.554843] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 305.562653] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 305.859474] 8021q: adding VLAN 0 to HW filter on device team0 19:46:52 executing program 5: 19:46:52 executing program 3: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000), 0xc, &(0x7f0000000080)={&(0x7f0000003540)={0x14, 0x1a, 0x201}, 0x14}}, 0x0) recvmmsg(r0, &(0x7f0000002400)=[{{0x0, 0x0, &(0x7f0000000040), 0x0, &(0x7f0000001840)=""/165, 0xa5}}, {{&(0x7f0000001540), 0x80, &(0x7f0000002040)}}], 0x2, 0x0, &(0x7f0000002500)={0x0, 0x1c9c380}) 19:46:52 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) perf_event_open$cgroup(&(0x7f0000000080)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0xfff, 0x10001, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@textreal={0x8, &(0x7f0000000240)="ba4300b00bee0f017edaf02114650f1ea7f07f0f20e06635040000000f22e03e0fc72dbaf80c66b80fb2578d66efbafc0cb001ee0fc75ba2f40f3805800060", 0x3f}], 0x1, 0x0, &(0x7f0000000140), 0x358) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) mmap(&(0x7f0000000000/0x5000)=nil, 0x5000, 0xfffffffffffffffd, 0x10031, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000040)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000ffe000/0x1000)=nil}) 19:46:52 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@textreal={0x8, &(0x7f0000000240)="ba4300b00bee0f017edaf02114650f1ea7f07f0f20e06635040000000f22e03e0fc72dbaf80c66b80fb2578d66efbafc0cb001ee0fc75ba2f40f3805800060", 0x3f}], 0x1, 0x0, &(0x7f0000000140), 0x358) mmap(&(0x7f0000000000/0x5000)=nil, 0x5000, 0xfffffffffffffffd, 0x10031, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1000, &(0x7f0000ffe000/0x1000)=nil}) 19:46:52 executing program 4: 19:46:52 executing program 2: 19:46:53 executing program 4: 19:46:53 executing program 5: 19:46:53 executing program 2: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mount(&(0x7f00000000c0), &(0x7f0000000080)='./file0\x00', &(0x7f0000000000)='cgroup2\x00', 0x0, 0x0) 19:46:53 executing program 1: r0 = socket$inet(0x2, 0x100000000805, 0x0) listen(r0, 0x3c) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f0000000040)=0xfffffffffffffff9, 0x4) 19:46:53 executing program 3: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000), 0xc, &(0x7f0000000080)={&(0x7f0000003540)={0x14, 0x1a, 0x201}, 0x14}}, 0x0) recvmmsg(r0, &(0x7f0000002400)=[{{0x0, 0x0, &(0x7f0000000040), 0x0, &(0x7f0000001840)=""/165, 0xa5}}, {{&(0x7f0000001540), 0x80, &(0x7f0000002040)}}], 0x2, 0x0, &(0x7f0000002500)={0x0, 0x1c9c380}) 19:46:53 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="153f62344889d25d766070") syz_emit_ethernet(0x3e, &(0x7f00000000c0)={@random="0d5d34252d8e", @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x32, 0x0, @remote, @dev}, @icmp=@parameter_prob={0x3, 0x6, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local={0xac, 0x70}, @dev}}}}}}, &(0x7f0000000000)={0x0, 0x2, [0x0, 0xe44]}) 19:46:53 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x1, &(0x7f0000000040)=0x3, 0x4) setsockopt$inet6_udp_int(r0, 0x11, 0x67, &(0x7f00000000c0)=0x8000, 0x4) sendto$inet6(r0, &(0x7f0000000140), 0x219, 0x0, &(0x7f0000000100)={0xa, 0x4e21, 0x0, @mcast2}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x1, &(0x7f0000000080), 0x4) 19:46:53 executing program 4: unshare(0x24020400) mknod(&(0x7f00000056c0)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000f8aff8)='./file0\x00', &(0x7f0000000140), &(0x7f0000000240)) open(&(0x7f0000000000)='./file0\x00', 0x401, 0x0) 19:46:54 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) perf_event_open$cgroup(&(0x7f0000000080)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0xfff, 0x10001, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@textreal={0x8, &(0x7f0000000240)="ba4300b00bee0f017edaf02114650f1ea7f07f0f20e06635040000000f22e03e0fc72dbaf80c66b80fb2578d66efbafc0cb001ee0fc75ba2f40f3805800060", 0x3f}], 0x1, 0x0, &(0x7f0000000140), 0x358) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 19:46:54 executing program 1: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mount(&(0x7f00000000c0), &(0x7f0000000080)='./file0\x00', &(0x7f0000000000)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000100), 0x12) 19:46:54 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x0, 0x48b, &(0x7f0000000000)={0x1, 'bond0\x00'}, 0x18) 19:46:54 executing program 0: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x8912, &(0x7f0000000100)="153f6234488dd25d766070") r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.events\x00', 0x26e1, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x7a05, 0x1700) write$binfmt_script(r1, &(0x7f0000000400)=ANY=[@ANYBLOB='U'], 0x1) pwrite64(r2, &(0x7f0000000200)="4ebefa1e923f1e018b6e53bf4815b78e1f2ef9212b93090c1ff6b35c208d50aef3fd759f995b53dd37c58cf8332b8a6b66575478e02ef0145bf122ba2e2c53a7ec45e375683475a6495f8d7b7a088f5e32dc266569074319bf8c8d3d8007cc92e2ba0d9082c41b63e330f353a3f675a98d2e74a08e38400f7f5eb113a0e25fd90115d57a7acdcab1128cf4f9c719f3f29d460c507f8a2a6594d259217d32eae9be93c6ed17a67ae2e7e689a31fa8449da12fd62bf423cff702b09e6ee1ff0e698b8bb517819eb712ba2b34b54b28b79d9399d920d5a5507e8a85f37060dfe3051f06f8d7cc9b068495ee5d5fcce85410bcd9f91d1f198353ce94b2e03370e43875c1a035bb88fd26fbb5b1252e2056d6b67e2b2f424051a40ad9170e76a81a6ca4f149ff643db76f8f2c1aa8024a6279952027489bbad6479e47ea5ba9e47d8136df398665f6cdfd15e93cfbf2ce1151afe9321ed63fe7100e704b232646fc1e0e936b90cceaaa70225ce71640e10316d2cc637355eddb3c4e16ff1635fa4e65a66eb5ab2cbf9d6f063e05f0e46fcc14bf31eedfb9f33c215fc14946cc6f7493924442e939f71ac4bd3e35e78857f9624c663f3669a47a7146e3249ee3eaaf681f371d515af5b934f9252c7ac2a164bf318fc2b194ee087b2b28ed5e4618c0906fc3f32c43a3b9e08a2e0d509f65a7de909e8c3c535f1d8cb9c236716e5ad709", 0x200, 0x3200) 19:46:54 executing program 5: syz_open_procfs(0x0, &(0x7f0000000000)="2f65786500000000000489004bddd9de91be10eebf000ee91e18f0c76fbb232a07424ae1e901d2da75af1f0200f5ab26d7e071fb35331ce39c5a0000") 19:46:54 executing program 4: syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x2, 0x2001) socket$inet6(0xa, 0x0, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r0, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000640)={0x0, 0x0}) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000980)=ANY=[], &(0x7f0000000440)) pselect6(0x40, &(0x7f00000000c0), &(0x7f00000004c0), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r1+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8}) [ 309.353450] IPVS: sync thread started: state = MASTER, mcast_ifn = bond0, syncid = 0, id = 0 19:46:54 executing program 1: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r0, 0x84, 0x24, &(0x7f0000000000), 0x4) 19:46:54 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0xfffffffffffffffd) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x100000000000, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x1012, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="000000000000dd00"], 0x0, 0x0, &(0x7f0000000180)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) r2 = fcntl$dupfd(r0, 0x406, r0) getsockopt$inet_sctp_SCTP_INITMSG(r2, 0x84, 0x2, &(0x7f0000000080), &(0x7f00000000c0)=0x8) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000480)}) 19:46:54 executing program 5: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000002fdd)={&(0x7f0000015ff4), 0xc, &(0x7f0000015000)={&(0x7f000000bf20)=ANY=[]}}, 0x0) 19:46:54 executing program 0: getpgid(0x0) 19:46:54 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x11) setsockopt$sock_attach_bpf(r0, 0x29, 0x1b, &(0x7f0000000040)=r0, 0x52d) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000140), 0x7}, 0x20) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r2, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r2, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208d549d7c403469d7f6e6a6ac7d846ed2fa163e15ffb509e", 0x29}], 0x1}, 0x0) socketpair(0x0, 0x0, 0x0, &(0x7f0000002380)) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, 0x80, &(0x7f0000000400), 0x0, &(0x7f0000002400)=ANY=[]}, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000010c0)={&(0x7f0000000f00)=@can, 0x80, &(0x7f0000000f80), 0x0, &(0x7f0000000fc0)=""/230, 0xe6}, 0x0) [ 310.087730] Dead loop on virtual device ip6_vti0, fix it urgently! [ 310.147155] binder: 7998:8010 ERROR: BC_REGISTER_LOOPER called without request [ 310.155331] binder: 8010 RLIMIT_NICE not set 19:46:55 executing program 0: r0 = socket$inet6(0xa, 0x100000000002, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @local, 0x8}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={[], [], @dev}}, 0x1c) [ 310.301918] binder: 7998:8001 unknown command 0 [ 310.307257] binder: 7998:8001 ioctl c0306201 200002c0 returned -22 19:46:55 executing program 5: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = timerfd_create(0x0, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000080)={{{@in=@local, @in6=@mcast1}}, {{@in6=@mcast1}, 0x0, @in=@dev}}, &(0x7f0000000000)=0xe8) timerfd_gettime(r2, &(0x7f0000eb8000)) 19:46:55 executing program 2: 19:46:55 executing program 1: r0 = socket(0x848000000015, 0x805, 0x0) getsockopt(r0, 0x114, 0x2717, &(0x7f0000af0fe7)=""/13, &(0x7f0000000040)=0xd) [ 310.756612] binder: BINDER_SET_CONTEXT_MGR already set [ 310.762558] binder: 7998:8001 ioctl 40046207 0 returned -16 [ 310.776418] binder: 7998:8001 ERROR: BC_REGISTER_LOOPER called without request [ 310.784217] binder: 8001 RLIMIT_NICE not set 19:46:55 executing program 4: [ 310.805216] binder: 7998:8031 unknown command 0 [ 310.810171] binder: 7998:8031 ioctl c0306201 200002c0 returned -22 19:46:56 executing program 2: 19:46:56 executing program 0: 19:46:56 executing program 3: 19:46:56 executing program 5: 19:46:56 executing program 1: r0 = socket(0x848000000015, 0x805, 0x0) getsockopt(r0, 0x114, 0x2717, &(0x7f0000af0fe7)=""/13, &(0x7f0000000040)=0xd) 19:46:56 executing program 4: 19:46:56 executing program 0: 19:46:56 executing program 5: 19:46:56 executing program 2: 19:46:56 executing program 3: 19:46:56 executing program 4: 19:46:57 executing program 3: 19:46:57 executing program 1: 19:46:57 executing program 2: 19:46:57 executing program 5: 19:46:57 executing program 0: 19:46:57 executing program 4: 19:46:57 executing program 1: 19:46:57 executing program 2: 19:46:57 executing program 3: 19:46:57 executing program 0: 19:46:57 executing program 1: 19:46:57 executing program 3: 19:46:57 executing program 5: 19:46:57 executing program 4: 19:46:58 executing program 2: 19:46:58 executing program 0: 19:46:58 executing program 0: 19:46:58 executing program 1: getpgrp(0xffffffffffffffff) 19:46:58 executing program 4: socket$inet6(0xa, 0x2000000000000001, 0x8010000000000084) bind$inet6(0xffffffffffffffff, &(0x7f00002aafe4)={0xa, 0x0, 0x0, @ipv4}, 0x1c) listen(0xffffffffffffffff, 0x2) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r0, &(0x7f0000000100)='F', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) clock_getres(0x0, &(0x7f0000000000)) socket$netlink(0x10, 0x3, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='trusted.overlay.upper\x00', &(0x7f0000000180)=ANY=[], 0x0, 0x0) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4), 0xc) openat$vhci(0xffffffffffffff9c, &(0x7f0000000200)='/dev/vhci\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_RX_RING(0xffffffffffffffff, 0x10e, 0x6, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x80000001}, 0x10) 19:46:58 executing program 2: keyctl$reject(0x13, 0x0, 0x0, 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000001200)=""/148, 0x94}], 0x100000c7, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/rt_acct\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000167, 0x0) 19:46:58 executing program 5: r0 = socket$inet6(0xa, 0x3, 0x800000000000004) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d5c6070") bpf$MAP_CREATE(0x0, &(0x7f0000000140)={0xa, 0x100000003, 0x3ff, 0x1, 0x2}, 0x1f) 19:46:58 executing program 3: bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xb, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x0, 0x25}}, &(0x7f0000000000)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195}, 0x48) 19:46:58 executing program 1: pipe2$9p(&(0x7f0000000040), 0x0) write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000080)={0x13, 0x65, 0xffff, 0x6, 0x6, '9P2000'}, 0x13) perf_event_open(&(0x7f000001d000)={0x200000002, 0x70, 0x5, 0x108000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={&(0x7f0000000000), 0xc, &(0x7f00000001c0)={&(0x7f0000000200)=@ipv4_newroute={0x24, 0x18, 0x101, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, [@RTA_GATEWAY={0x8, 0x5, @dev}]}, 0x24}}, 0x0) 19:46:58 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) poll(&(0x7f0000000000)=[{r2, 0x200}], 0x1, 0xfffffffffffffbff) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x14) dup3(r0, r2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) tkill(r1, 0x1000000000016) 19:46:59 executing program 5: r0 = socket(0x15, 0x80005, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000000040), 0x0, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @loopback}, 0x1c) recvmsg(r0, &(0x7f00000013c0)={&(0x7f0000000100)=@hci, 0x80, &(0x7f0000001280), 0x0, &(0x7f00000012c0)=""/244, 0xf4}, 0x0) 19:46:59 executing program 3: sched_setscheduler(0x0, 0x2, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvfrom(0xffffffffffffffff, &(0x7f00000022c0)=""/4096, 0xffffffffffffffd9, 0x0, &(0x7f0000002240)=@ipx={0x4, 0x0, 0x0, "5d6f634e9e66"}, 0x80) r0 = open(&(0x7f0000103ff8)='./file0\x00', 0x141042, 0x0) ftruncate(r0, 0x2) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x802, 0x0) sendfile(r1, r0, &(0x7f0000000240), 0x40800fff) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000080)=""/4, 0x4}], 0x2dc) 19:46:59 executing program 4: sched_setscheduler(0x0, 0x0, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvfrom(0xffffffffffffffff, &(0x7f00000022c0)=""/4096, 0xffffffffffffffd9, 0x0, &(0x7f0000002240)=@ipx={0x4, 0x0, 0x0, "5d6f634e9e66"}, 0x80) r0 = open(&(0x7f0000103ff8)='./file0\x00', 0x141042, 0x0) ftruncate(r0, 0x2) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x802, 0x0) sendfile(r1, r0, &(0x7f0000000240), 0x40800fff) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000080)=""/4, 0x4}], 0x2dc) 19:46:59 executing program 1: perf_event_open(&(0x7f0000000040)={0x1, 0x70}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) r1 = creat(&(0x7f00000000c0)='./file1\x00', 0x2) ftruncate(r0, 0x80003) sendfile(r1, r0, &(0x7f0000000080), 0x8000fffffffe) 19:46:59 executing program 2: getgroups(0x7, &(0x7f0000000000)=[0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff]) setgid(r0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) setgroups(0x0, &(0x7f00000000c0)) setuid(0xffffffffffffffff) r1 = msgget(0x0, 0x0) msgsnd(r1, &(0x7f0000000180), 0x8, 0x0) 19:46:59 executing program 5: r0 = socket(0x15, 0x80005, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000000040), 0x0, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @loopback}, 0x1c) recvmsg(r0, &(0x7f00000013c0)={&(0x7f0000000100)=@hci, 0x80, &(0x7f0000001280), 0x0, &(0x7f00000012c0)=""/244, 0xf4}, 0x0) 19:46:59 executing program 3: r0 = syz_open_dev$adsp(&(0x7f00000000c0)='/dev/adsp#\x00', 0x1, 0x101042) write$P9_RRENAMEAT(r0, &(0x7f0000000100)={0x7}, 0x7) 19:46:59 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) poll(&(0x7f0000000000)=[{r2, 0x200}], 0x1, 0xfffffffffffffbff) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x14) dup3(r0, r2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) tkill(r1, 0x1000000000016) 19:46:59 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x3, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x15, 0x25}}, &(0x7f0000000000)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195}, 0x48) 19:46:59 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) getsockname(r0, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, &(0x7f00000000c0)=0x80) dup3(r0, r1, 0x0) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000007640)={0x1, &(0x7f0000007600)=[{0x6}]}, 0x10) 19:47:00 executing program 5: r0 = socket(0x15, 0x80005, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000000040), 0x0, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @loopback}, 0x1c) recvmsg(r0, &(0x7f00000013c0)={&(0x7f0000000100)=@hci, 0x80, &(0x7f0000001280), 0x0, &(0x7f00000012c0)=""/244, 0xf4}, 0x0) 19:47:00 executing program 1: r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x88040, 0x0) close(r0) socket$inet6_udplite(0xa, 0x2, 0x88) sendto$inet6(r0, &(0x7f0000000040), 0x0, 0x0, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) 19:47:00 executing program 2: r0 = socket$inet(0x2, 0x3, 0x102) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000040)=@un=@abs, 0x8, &(0x7f00000000c0), 0x0, &(0x7f0000000000)=ANY=[]}, 0x0) shutdown(r0, 0x1) getsockopt$sock_cred(0xffffffffffffffff, 0xffff, 0x1022, &(0x7f00000019c0), &(0x7f0000001a00)=0xc) 19:47:00 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) poll(&(0x7f0000000000)=[{r2, 0x200}], 0x1, 0xfffffffffffffbff) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x14) dup3(r0, r2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) tkill(r1, 0x1000000000016) 19:47:00 executing program 5: r0 = socket(0x15, 0x80005, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000000040), 0x0, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @loopback}, 0x1c) recvmsg(r0, &(0x7f00000013c0)={&(0x7f0000000100)=@hci, 0x80, &(0x7f0000001280), 0x0, &(0x7f00000012c0)=""/244, 0xf4}, 0x0) 19:47:00 executing program 4: socketpair(0x1e, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000389000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x5, 0x3, &(0x7f0000346fc8), &(0x7f00000001c0)='GPL\x00', 0xfffffffffffffffc, 0xfb, &(0x7f0000000080)=""/251}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) close(r1) 19:47:00 executing program 1: 19:47:00 executing program 2: 19:47:01 executing program 3: socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000103ff8)='./file0\x00', 0x141042, 0x0) ftruncate(r0, 0x2) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x802, 0x0) sendfile(r1, r0, &(0x7f0000000240), 0x40800fff) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000080)=""/4, 0x4}], 0x2dc) 19:47:01 executing program 5: r0 = socket(0x15, 0x80005, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x1c) recvmsg(r0, &(0x7f00000013c0)={&(0x7f0000000100)=@hci, 0x80, &(0x7f0000001280), 0x0, &(0x7f00000012c0)=""/244, 0xf4}, 0x0) 19:47:01 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f2, &(0x7f0000000b00)={'ip6gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="3b00000000000000cd52610bd1ce32dbe3540f52d5c92fa0fbaedaf86a6d13afd03ed231ed0a0c41ab9629bd7adffbf1ce19af87501f08941e49097ef1341e947b01e9b4"]}) 19:47:01 executing program 4: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) r1 = creat(&(0x7f0000000040)='./file1\x00', 0x0) write$P9_RMKNOD(r1, &(0x7f00000000c0)={0x14, 0x13, 0x2, {0x4, 0x0, 0x1}}, 0x14) ftruncate(r0, 0x80003) write$P9_RLCREATE(r1, &(0x7f0000000100)={0x18, 0xf, 0x1, {{0x10, 0x1, 0x3}, 0xb3c}}, 0x18) sendfile(r1, r0, &(0x7f0000000080), 0x8000fffffffe) 19:47:01 executing program 1: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000000c0), &(0x7f0000000100)=0xc) sched_setscheduler(0x0, 0x0, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvfrom(0xffffffffffffffff, &(0x7f00000022c0)=""/4096, 0xffffffffffffffd9, 0x0, &(0x7f0000002240)=@ipx={0x4, 0x0, 0x0, "5d6f634e9e66"}, 0x80) r0 = open(&(0x7f0000103ff8)='./file0\x00', 0x141042, 0x0) ftruncate(r0, 0x2) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x802, 0x0) sendfile(r1, r0, &(0x7f0000000240), 0x40800fff) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000080)=""/4, 0x4}], 0x2dc) 19:47:01 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) poll(&(0x7f0000000000)=[{r2, 0x200}], 0x1, 0xfffffffffffffbff) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x14) dup3(r0, r2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) tkill(r1, 0x1000000000016) 19:47:01 executing program 1: 19:47:01 executing program 2: 19:47:02 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) poll(&(0x7f0000000000)=[{r2, 0x200}], 0x1, 0xfffffffffffffbff) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x14) dup3(r0, r2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) 19:47:02 executing program 3: 19:47:02 executing program 4: 19:47:02 executing program 3: 19:47:02 executing program 1: 19:47:02 executing program 5: r0 = socket(0x15, 0x80005, 0x0) sendto$inet6(r0, &(0x7f0000000040), 0x0, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @loopback}, 0x1c) recvmsg(r0, &(0x7f00000013c0)={&(0x7f0000000100)=@hci, 0x80, &(0x7f0000001280), 0x0, &(0x7f00000012c0)=""/244, 0xf4}, 0x0) 19:47:02 executing program 2: 19:47:02 executing program 4: 19:47:02 executing program 3: 19:47:02 executing program 1: 19:47:02 executing program 2: 19:47:03 executing program 3: 19:47:03 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) poll(&(0x7f0000000000)=[{r2, 0x200}], 0x1, 0xfffffffffffffbff) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x14) dup3(r0, r2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)) tkill(r1, 0x1000000000016) 19:47:03 executing program 1: 19:47:03 executing program 2: 19:47:03 executing program 4: 19:47:03 executing program 3: 19:47:03 executing program 5: bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendto$inet6(0xffffffffffffffff, &(0x7f0000000040), 0x0, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @loopback}, 0x1c) recvmsg(0xffffffffffffffff, &(0x7f00000013c0)={&(0x7f0000000100)=@hci, 0x80, &(0x7f0000001280), 0x0, &(0x7f00000012c0)=""/244, 0xf4}, 0x0) 19:47:03 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) poll(&(0x7f0000000000)=[{r2, 0x200}], 0x1, 0xfffffffffffffbff) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x14) dup3(r0, r2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)) tkill(r1, 0x1000000000016) 19:47:03 executing program 1: 19:47:03 executing program 2: 19:47:03 executing program 4: 19:47:03 executing program 3: 19:47:04 executing program 4: 19:47:04 executing program 1: 19:47:04 executing program 2: 19:47:04 executing program 3: 19:47:04 executing program 5: r0 = socket(0x0, 0x80005, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000000040), 0x0, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @loopback}, 0x1c) recvmsg(r0, &(0x7f00000013c0)={&(0x7f0000000100)=@hci, 0x80, &(0x7f0000001280), 0x0, &(0x7f00000012c0)=""/244, 0xf4}, 0x0) 19:47:04 executing program 4: r0 = socket(0xa, 0x1, 0x0) setsockopt$IP_VS_SO_SET_STOPDAEMON(0xffffffffffffffff, 0x0, 0x48c, &(0x7f0000000000)={0x0, "6e72303db4862c67c3da87001900", 0x2}, 0x18) ioctl(r0, 0x8936, &(0x7f0000000000)) 19:47:04 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x34000}, 0xc, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB="2c00000029000100000000000000000001000000180000000b40000100000018000000000000ffffac1414bb"], 0x1}}, 0x0) 19:47:04 executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./file0/file0\x00', 0x0) read$FUSE(r0, &(0x7f00000040c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) openat(0xffffffffffffffff, &(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) futimesat(0xffffffffffffffff, &(0x7f0000000040)='./file0/file0\x00', &(0x7f00000000c0)) write$FUSE_ENTRY(r0, &(0x7f0000003000)={0x90, 0x0, 0x3, {0x2, 0x0, 0x0, 0x4, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001}}}, 0x90) 19:47:04 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) poll(&(0x7f0000000000)=[{r2, 0x200}], 0x1, 0xfffffffffffffbff) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x14) dup3(r0, r2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)) tkill(r1, 0x1000000000016) 19:47:04 executing program 2: r0 = socket(0x848000000015, 0x805, 0x0) getsockopt(r0, 0x114, 0x2713, &(0x7f0000000040)=""/13, &(0x7f0000000080)=0xd) 19:47:05 executing program 4: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) r1 = creat(&(0x7f0000000040)='./file1\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x8000011) ftruncate(r0, 0x80003) sendfile(r1, r0, &(0x7f0000000080), 0x8000fffffffe) 19:47:05 executing program 1: sync() getsockopt$IPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x41, &(0x7f0000000180)={'raw\x00'}, &(0x7f0000000200)=0x24) 19:47:05 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) poll(&(0x7f0000000000)=[{r2, 0x200}], 0x1, 0xfffffffffffffbff) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x14) dup3(r0, r2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) tkill(r1, 0x1000000000016) 19:47:05 executing program 5: r0 = socket(0x15, 0x0, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000000040), 0x0, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @loopback}, 0x1c) recvmsg(r0, &(0x7f00000013c0)={&(0x7f0000000100)=@hci, 0x80, &(0x7f0000001280), 0x0, &(0x7f00000012c0)=""/244, 0xf4}, 0x0) 19:47:05 executing program 3: getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(0xffffffffffffff9c, 0x84, 0x6d, &(0x7f00000001c0), &(0x7f00000002c0)=0x8) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = epoll_create(0x6) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000100)) epoll_wait(r2, &(0x7f00000005c0)=[{}], 0x123b, 0x1ff) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:47:05 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000240)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[@ANYRES16, @ANYRES32], 0x4b) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000280)=0x1) readv(r0, &(0x7f0000000040)=[{&(0x7f0000000080)=""/33, 0x5}], 0x1) 19:47:05 executing program 1: r0 = socket(0x848000000015, 0x805, 0x0) getsockopt(r0, 0x114, 0x2713, &(0x7f0000af0fe7)=""/13, &(0x7f0000000040)=0xd) 19:47:05 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) poll(&(0x7f0000000000)=[{r2, 0x200}], 0x1, 0xfffffffffffffbff) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x14) dup3(r0, r2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) tkill(r1, 0x1000000000016) [ 320.647135] sg_write: data in/out 65499/33 bytes for SCSI command 0x0-- guessing data in; [ 320.647135] program syz-executor2 not setting count and/or reply_len properly [ 320.754922] sg_write: data in/out 65499/33 bytes for SCSI command 0x0-- guessing data in; [ 320.754922] program syz-executor2 not setting count and/or reply_len properly 19:47:06 executing program 5: r0 = socket(0x15, 0x80005, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000000040), 0x0, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @loopback}, 0x1c) recvmsg(r0, &(0x7f00000013c0)={&(0x7f0000000100)=@hci, 0x80, &(0x7f0000001280), 0x0, &(0x7f00000012c0)=""/244, 0xf4}, 0x0) 19:47:06 executing program 2: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) r1 = creat(&(0x7f0000000040)='./file1\x00', 0x0) ftruncate(r0, 0x80003) sendfile(r1, r0, &(0x7f0000000080), 0x8000fffffffe) 19:47:06 executing program 1: timer_create(0x3, &(0x7f0000000040)={0x0, 0x0, 0x1, @thr={&(0x7f00000001c0), &(0x7f00000011c0)}}, &(0x7f0000000000)) exit(0x0) timer_delete(0x0) 19:47:06 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) poll(&(0x7f0000000000)=[{r2, 0x200}], 0x1, 0xfffffffffffffbff) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x14) dup3(r0, r2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) tkill(r1, 0x1000000000016) 19:47:06 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_setup(0x517c, &(0x7f00000016c0)) 19:47:06 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendmmsg(r0, &(0x7f0000004e00)=[{{0x0, 0x0, &(0x7f0000001f80), 0x0, &(0x7f0000001fc0), 0xb}}], 0x4000000000003f0, 0x0) 19:47:06 executing program 0: socket$inet6(0xa, 0x1000000000002, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) poll(&(0x7f0000000000)=[{r1, 0x200}], 0x1, 0xfffffffffffffbff) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r0, 0x14) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x1000000000016) 19:47:06 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000340)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, &(0x7f0000000180), 0x10) 19:47:06 executing program 4: request_key(&(0x7f0000000340)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000003c0)='/selinux/avc/cache_threshold\x00', 0xfffffffffffffffc) 19:47:07 executing program 3: epoll_create1(0x80000) r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) ioctl$BLKROSET(r0, 0x125d, &(0x7f00000002c0)=0x7fff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RNDCLEARPOOL(r0, 0x5206, &(0x7f0000000240)) mount(&(0x7f0000000240)=ANY=[], &(0x7f0000000180)='./file0\x00', &(0x7f0000000100)='nfs\x00', 0x0, &(0x7f0000000000)) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) getsockopt$EBT_SO_GET_INIT_INFO(0xffffffffffffffff, 0x0, 0x82, &(0x7f0000000080)={'filter\x00'}, &(0x7f0000000100)=0x78) setsockopt$l2tp_PPPOL2TP_SO_RECVSEQ(0xffffffffffffffff, 0x111, 0x2, 0x0, 0x4) perf_event_open(&(0x7f000000a000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0xa00000400, 0x0, 0x8000010004}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='nfs\x00', 0x0, &(0x7f000000a000)) 19:47:07 executing program 5: r0 = socket(0x15, 0x80005, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendto$inet6(0xffffffffffffffff, &(0x7f0000000040), 0x0, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @loopback}, 0x1c) recvmsg(r0, &(0x7f00000013c0)={&(0x7f0000000100)=@hci, 0x80, &(0x7f0000001280), 0x0, &(0x7f00000012c0)=""/244, 0xf4}, 0x0) 19:47:07 executing program 4: request_key(&(0x7f0000000340)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f00000003c0)='/selinux/avc/cache_threshold\x00', 0xfffffffffffffffc) 19:47:07 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000080)) ioctl$KVM_GET_PIT2(r1, 0x8070ae9f, &(0x7f00000000c0)) 19:47:07 executing program 2: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000340)={0x26, 'aead\x00', 0x0, 0x0, 'gcm_base(ctr(aes-aesni),ghash-generic)\x00'}, 0x58) r1 = accept4(r0, 0x0, &(0x7f0000000000)=0xfffffffffffffcbe, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820faeb995298992ea54c7beef915d56534c90c2", 0x18) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000080)) recvmmsg(r1, &(0x7f0000001bc0), 0xfe, 0x0, &(0x7f0000001d00)={0x77359400}) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) 19:47:07 executing program 4: [ 322.928913] rpcbind: RPC call returned error 22 19:47:08 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) poll(&(0x7f0000000000)=[{r2, 0x200}], 0x1, 0xfffffffffffffbff) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) dup3(r0, r2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) tkill(r1, 0x1000000000016) 19:47:08 executing program 1: socket$key(0xf, 0x3, 0x2) setxattr$security_capability(&(0x7f0000000280)='./file0\x00', &(0x7f0000000040)='security.capability\x00', &(0x7f00000002c0)=@v3, 0x18, 0x80000000000) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f00000000c0), 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in, @in6=@ipv4={[], [], @rand_addr}, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0x0, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x8000000000000000) 19:47:08 executing program 5: r0 = socket(0x15, 0x80005, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000000040), 0x0, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @loopback}, 0x1c) recvmsg(0xffffffffffffffff, &(0x7f00000013c0)={&(0x7f0000000100)=@hci, 0x80, &(0x7f0000001280), 0x0, &(0x7f00000012c0)=""/244, 0xf4}, 0x0) 19:47:08 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000380)={r0, &(0x7f0000000080), &(0x7f0000000340)}, 0x20) [ 323.378000] rpcbind: RPC call returned error 22 19:47:09 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) poll(&(0x7f0000000000)=[{r2, 0x200}], 0x1, 0xfffffffffffffbff) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) dup3(r0, r2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) tkill(r1, 0x1000000000016) 19:47:09 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x1d}, 0xe) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x5, &(0x7f0000000100)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0xffffffd5}, [@ldst={0x7, 0x44f, 0x0, 0x1d7521, 0xa}]}, &(0x7f0000003ff6)='syzkaller\x00', 0x5, 0x450, &(0x7f000000cf3d)=""/195}, 0x48) 19:47:10 executing program 3: epoll_create1(0x80000) r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) ioctl$BLKROSET(r0, 0x125d, &(0x7f00000002c0)=0x7fff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RNDCLEARPOOL(r0, 0x5206, &(0x7f0000000240)) mount(&(0x7f0000000240)=ANY=[], &(0x7f0000000180)='./file0\x00', &(0x7f0000000100)='nfs\x00', 0x0, &(0x7f0000000000)) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) getsockopt$EBT_SO_GET_INIT_INFO(0xffffffffffffffff, 0x0, 0x82, &(0x7f0000000080)={'filter\x00'}, &(0x7f0000000100)=0x78) setsockopt$l2tp_PPPOL2TP_SO_RECVSEQ(0xffffffffffffffff, 0x111, 0x2, 0x0, 0x4) perf_event_open(&(0x7f000000a000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0xa00000400, 0x0, 0x8000010004}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='nfs\x00', 0x0, &(0x7f000000a000)) 19:47:10 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000010000/0x3000)=nil, 0x3000, 0x0, 0x100000000020011, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000500)={0x4, 0x0, &(0x7f0000000480)=[@enter_looper], 0x1, 0x0, &(0x7f00000004c0)='8'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000000c0)={0x0, @rand_addr}, &(0x7f0000000100)=0xc) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000002c0)={{{@in6, @in6}, {0x0, 0x0, 0x0, 0x8}, {0x0, 0x0, 0x0, 0x7}}, {{@in=@rand_addr}, 0x0, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}}, 0xe8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000000040)}) dup3(r1, r0, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 19:47:10 executing program 1: 19:47:10 executing program 4: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r0, 0xc0405519, &(0x7f0000000600)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00', 0x81e}, 0x3, 0x0, 0x5, 0x0, 0x1, 0x101, 'syz0\x00', &(0x7f0000000000)=["4c65746831813d2900"], 0x9, [], [0x5]}) 19:47:10 executing program 2: [ 325.403187] binder: 8447 RLIMIT_NICE not set 19:47:10 executing program 1: epoll_create1(0x80000) r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) ioctl$BLKROSET(r0, 0x125d, &(0x7f00000002c0)=0x7fff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RNDCLEARPOOL(r0, 0x5206, &(0x7f0000000240)) mount(&(0x7f0000000240)=ANY=[], &(0x7f0000000180)='./file0\x00', &(0x7f0000000100)='nfs\x00', 0x0, &(0x7f0000000000)) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) getsockopt$EBT_SO_GET_INIT_INFO(0xffffffffffffffff, 0x0, 0x82, &(0x7f0000000080)={'filter\x00'}, &(0x7f0000000100)=0x78) setsockopt$l2tp_PPPOL2TP_SO_RECVSEQ(0xffffffffffffffff, 0x111, 0x2, 0x0, 0x4) perf_event_open(&(0x7f000000a000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0xa00000400, 0x0, 0x8000010004}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='nfs\x00', 0x0, &(0x7f000000a000)) 19:47:10 executing program 4: 19:47:10 executing program 2: [ 325.494784] binder: 8447 RLIMIT_NICE not set [ 325.510423] binder: release 8446:8449 transaction 3 out, still active [ 325.517256] binder: undelivered TRANSACTION_COMPLETE [ 325.525945] binder: release 8446:8447 transaction 3 in, still active [ 325.532817] binder: send failed reply for transaction 3, target dead [ 325.573458] binder_alloc: binder_alloc_mmap_handler: 8446 20010000-20013000 already mapped failed -16 19:47:10 executing program 2: [ 325.801349] binder: 8449 RLIMIT_NICE not set [ 325.845866] binder: BINDER_SET_CONTEXT_MGR already set [ 325.851220] binder: 8446:8447 ioctl 40046207 0 returned -16 [ 326.032901] rpcbind: RPC call returned error 22 [ 326.062296] binder_alloc: 8446: binder_alloc_buf, no vma [ 326.068097] binder: 8446:8462 transaction failed 29189/-3, size 0-0 line 2970 [ 326.080739] binder: undelivered TRANSACTION_ERROR: 29189 19:47:11 executing program 4: 19:47:12 executing program 2: 19:47:12 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) poll(&(0x7f0000000000)=[{r2, 0x200}], 0x1, 0xfffffffffffffbff) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) dup3(r0, r2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) tkill(r1, 0x1000000000016) 19:47:14 executing program 3: 19:47:14 executing program 4: 19:47:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000010000/0x3000)=nil, 0x3000, 0x0, 0x100000000020011, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000500)={0x4, 0x0, &(0x7f0000000480)=[@enter_looper], 0x1, 0x0, &(0x7f00000004c0)='8'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000000c0)={0x0, @rand_addr}, &(0x7f0000000100)=0xc) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000002c0)={{{@in6, @in6}, {0x0, 0x0, 0x0, 0x8}, {0x0, 0x0, 0x0, 0x7}}, {{@in=@rand_addr}, 0x0, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}}, 0xe8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000000040)}) dup3(r1, r0, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 19:47:14 executing program 2: [ 329.194409] binder: 8480 RLIMIT_NICE not set [ 329.272856] binder: 8480 RLIMIT_NICE not set 19:47:14 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) poll(&(0x7f0000000000)=[{r2, 0x200}], 0x1, 0xfffffffffffffbff) tkill(r1, 0x14) dup3(r0, r2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) tkill(r1, 0x1000000000016) [ 329.339489] binder: release 8479:8482 transaction 6 out, still active [ 329.346289] binder: undelivered TRANSACTION_COMPLETE [ 329.776411] binder: release 8479:8480 transaction 6 in, still active [ 329.783296] binder: send failed reply for transaction 6, target dead 19:47:15 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000a40)="2f65786500e1ffffff0409004bddd9de91be10eebf000ee9a90f798058439eff54fa07424adee901d2da75af1f02acc7edbcd7a071fbbc7864c3cf7318e89c6e97ca49e252438d54c646dd47000000001900020006000000c8ed780fc8de13aac81a5393802cac9b30bd34f4b1aa91950e3300000000686d0e4d0e354ffbecf9b6cb56df37daad793393cdf9b660c334d7dee99d58bb98ec8fbae88509abe32fd44239abb4ccf659f55c76c288ae1d12b8aef689f19c39d9cdd8a249969185b3f229a48ef301365dc622f49796f3f6ceb28f38833071221f0d81aee58fc8a61050486d5641c3dfc84c25baa2b3712cb8251267e70159894f6dd8f293e8cd44ea35ca1c52f1c165b6391d779405fabfaf835c2928c61282a10cfee523c694139d9b158c8ac9c2068deae9563a8661cef5dfb8714969cc727f52139996dd2f575b0af9cc013f275d3651000000000000000000000005c22e1e188b8b7b7eaa209ddd95daeb9f1978f70c379c4c35e29e1e7c60ba2116807d06257f83a30dbae330d1c2dae0fd22ca7daf23da377a93c97a8b90586301843890c7ee07b2e35eb824f5780ab38de49a22305a26c31df9abc50d884578b6d660ee5d58f0f341875dd61c82301f4ae5e736b1399bc049514ad56ca11840ce3894f222185d5d976c9e7cf3e178b8") fgetxattr(r0, &(0x7f00000002c0)=@known='user.syz\x00', &(0x7f00000001c0), 0xfffffffffffffce2) 19:47:15 executing program 2: 19:47:15 executing program 4: 19:47:15 executing program 5: clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) init_module(&(0x7f0000000240)='em0\x00', 0x662ec5, &(0x7f0000000500)='team0\x00') 19:47:15 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x400000000000000a) clone(0x0, &(0x7f0000000240), &(0x7f0000001ffc), &(0x7f0000000040), &(0x7f0000000040)) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000001980)) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000002480)={{{@in6=@mcast1, @in6=@ipv4={[], [], @multicast1}}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000002580)=0xe8) stat(&(0x7f0000006080)='./file0\x00', &(0x7f00000060c0)) getgroups(0x1, &(0x7f0000006140)=[0xee01]) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x200000000000000f, 0x0) 19:47:15 executing program 5: io_setup(0x5, &(0x7f0000000100)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={"6f7800000000fffffffffffffff800", 0x20000001001}) io_submit(r0, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x8, 0x0, r1, &(0x7f0000000280)="cadac6ecca", 0x5}]) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000200)={@mcast2}, 0x14) 19:47:16 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@textreal={0x8, &(0x7f00000001c0)="3ef00fc78b95cfb807008ee065650f06f36ebaf80c66b889c52e8f66efbafc0cec66b8186e00000f23d00f21f866350000000e0f23f80f01cbd03d670fc75d622e0f01cb", 0x44}], 0x1, 0x0, &(0x7f00000000c0), 0x0) r4 = fcntl$dupfd(r3, 0x0, r1) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x1000, &(0x7f0000013000/0x1000)=nil}) ioctl$KVM_RUN(r4, 0xae80, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f0000000140)=[@text16={0x10, &(0x7f0000000080)="0f21ac9ae2001e01640f880070ba2100b8b000efba210066b8e1a8b6b666ef66b97a03000066b83700000066ba000000000f30b8d7008ec80f0ff70cded9ba6100ed", 0x42}], 0x1, 0x0, &(0x7f0000000040), 0xffffef3) ioctl$KVM_RUN(r4, 0xae80, 0x0) 19:47:16 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DAEMON(r0, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="010000000000000000000a000000040003001800020014000100fe80000000000000000000000000000008000100000000000000"], 0x1}}, 0x0) 19:47:16 executing program 1: r0 = socket$inet6(0xa, 0x3, 0x3) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x6}, 0x1c) sendmmsg(r0, &(0x7f0000006840)=[{{0x0, 0x0, &(0x7f0000000140), 0x0, &(0x7f0000000140)=[{0x18, 0x29, 0x37, "8935"}], 0x18}}], 0x1, 0x0) 19:47:16 executing program 5: r0 = socket$inet(0x15, 0x5, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @rand_addr=0x100}, 0x10) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)}, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000001080)={{}, {0x0, 0x1c9c380}}, &(0x7f00000010c0)) tkill(r1, 0x1000000000016) 19:47:16 executing program 1: r0 = socket(0x11, 0x2, 0x140009) r1 = syz_open_dev$midi(&(0x7f0000000100)='/dev/midi#\x00', 0x1, 0x0) ioctl$LOOP_SET_DIRECT_IO(r1, 0x4c08, 0xffffffff) fcntl$setstatus(r0, 0x4, 0x2000) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$EVIOCSKEYCODE(r1, 0x40084504, &(0x7f00000003c0)=[0x400]) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r0, 0x84, 0x6c, &(0x7f0000000400)=ANY=[@ANYBLOB="c9000000b7e83ea758d897b4a64e84dd17309de547eeef589b298ee0609915a18d2fff66d3b3049050cc675c5bc11d937931e80871caaea66e7df63729a4493ff412cafd48e5af9838eef7eee56ce5241275edea99b70b3785b187faadbc22d0f048e2350ea8ceefab94705ae1d37a5ae21053f0deab696326f9cf921ad843e02b342c571fd8fce68bafa21aac666be2139f0aca723dfd3543f568ea5725952b4c42e52219eba17cdb6d10735210518eeae6d96274c3b4c6bf61047feec2203d8db8df1a59ace691b9941777cb547fa1e62a16"], &(0x7f0000000280)=0x1) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f00000002c0)={0x0, @in={{0x2, 0x4e24, @rand_addr=0x7}}}, &(0x7f0000000380)=0x84) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00027, 0x0, &(0x7f00000000c0), 0x1, 0x2000000000002) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind(r0, &(0x7f00005a2000)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write$FUSE_NOTIFY_POLL(r4, &(0x7f0000000080)={0x18}, 0x1ca) close(r4) openat$cuse(0xffffffffffffff9c, &(0x7f0000000300)='/dev/cuse\x00', 0x2, 0x0) ioctl$UI_DEV_DESTROY(r3, 0x5502) pipe2(&(0x7f0000000000), 0x84000) splice(r3, 0x0, r4, &(0x7f00000002c0), 0x0, 0x1000000000003) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000000)={'lo\x00'}) modify_ldt$write(0x1, &(0x7f0000000140)={0x2, 0xffffffffffffffff, 0x1000, 0xfed, 0x9, 0x2, 0x6, 0xa9, 0x3, 0x7}, 0x10) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) 19:47:17 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) poll(&(0x7f0000000000)=[{r2, 0x200}], 0x1, 0xfffffffffffffbff) tkill(r1, 0x14) dup3(r0, r2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) tkill(r1, 0x1000000000016) 19:47:17 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000a40)="2f65786500e1ffffff0409004bddd9de91be10eebf000ee9a90f798058439eff54fa07424adee901d2da75af1f02acc7edbcd7a071fbbc7864c3cf7318e89c6e97ca49e252438d54c646dd47000000001900020006000000c8ed780fc8de13aac81a5393802cac9b30bd34f4b1aa91950e3300000000686d0e4d0e354ffbecf9b6cb56df37daad793393cdf9b660c334d7dee99d58bb98ec8fbae88509abe32fd44239abb4ccf659f55c76c288ae1d12b8aef689f19c39d9cdd8a249969185b3f229a48ef301365dc622f49796f3f6ceb28f38833071221f0d81aee58fc8a61050486d5641c3dfc84c25baa2b3712cb8251267e70159894f6dd8f293e8cd44ea35ca1c52f1c165b6391d779405fabfaf835c2928c61282a10cfee523c694139d9b158c8ac9c2068deae9563a8661cef5dfb8714969cc727f52139996dd2f575b0af9cc013f275d3651000000000000000000000005c22e1e188b8b7b7eaa209ddd95daeb9f1978f70c379c4c35e29e1e7c60ba2116807d06257f83a30dbae330d1c2dae0fd22ca7daf23da377a93c97a8b90586301843890c7ee07b2e35eb824f5780ab38de49a22305a26c31df9abc50d884578b6d660ee5d58f0f341875dd61c82301f4ae5e736b1399bc049514ad56ca11840ce3894f222185d5d976c9e7cf3e178b8") fgetxattr(r0, &(0x7f0000000040)=@known='user.syz\x00', &(0x7f0000000080), 0x17c) 19:47:17 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x0, 0x48b, &(0x7f0000000000)={0x1, 'ip6tnl0\x00'}, 0x18) 19:47:17 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = socket$inet(0x2b, 0x1, 0x0) bind$inet(r1, &(0x7f0000000600)={0x2, 0x4e23, @multicast2}, 0x10) connect$inet(r1, &(0x7f00000001c0)={0x2, 0x4e23, @rand_addr}, 0x10) recvfrom(0xffffffffffffffff, &(0x7f0000000040)=""/58, 0x3a, 0x0, &(0x7f00000002c0)=@nfc_llcp={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "e3bce8e03e2c2cc7a20e8fe10994b1973daef3f0910897033de04cd2029d8fe354c58f3c2450fcf4e890a25bdc7621cbc08a69818e22ad9e4e446db9d48320"}, 0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f0000000cc0)={&(0x7f0000000200), 0xc, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB], 0x1}}, 0x0) 19:47:17 executing program 3: [ 332.905060] device lo entered promiscuous mode [ 332.914765] device lo left promiscuous mode 19:47:18 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) poll(&(0x7f0000000000)=[{r2}], 0x1, 0xfffffffffffffbff) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x14) dup3(r0, r2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) tkill(r1, 0x1000000000016) 19:47:18 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, &(0x7f00000002c0)=""/247) semctl$SETVAL(0x0, 0x7, 0x10, &(0x7f00000003c0)) getsockopt$IP_VS_SO_GET_DESTS(0xffffffffffffffff, 0x0, 0x484, &(0x7f0000000080)=""/35, &(0x7f00000000c0)=0x23) recvmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000000100)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, 0x80, &(0x7f0000002580)=[{&(0x7f00000012c0)=""/115, 0x73}], 0x1}}], 0x1, 0x0, &(0x7f0000000240)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000180)=0x0) r2 = syz_open_procfs(r1, &(0x7f0000000280)='cmdline\x00') ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000000040)=0x1ff) preadv(r2, &(0x7f0000000480), 0x10000000000002a1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r3) io_setup(0x4, &(0x7f0000000040)) semctl$SEM_STAT(0x0, 0x3, 0x12, &(0x7f0000000400)=""/92) r4 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_PIT2(r4, 0x4070aea0, &(0x7f0000000000)={[{0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$ASHMEM_GET_NAME(0xffffffffffffffff, 0x81007702, &(0x7f0000000100)=""/119) 19:47:18 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$ION_IOC_HEAP_QUERY(0xffffffffffffffff, 0xc0184908, &(0x7f0000000240)={0x34, 0x0, &(0x7f0000000140)}) sendmsg$IPVS_CMD_GET_DEST(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000000), 0xc, &(0x7f00000003c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="0a0000000000fcdbdf2508"], 0x1}}, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, &(0x7f00000002c0)="b8010000000f01c166b8e2000f00d8b9800000c00f3235004000000f304a0fc75f20c44379608d00000100f22e0f01ca67440ff6143f66ba4000b846c95182ef0f01cf400f01df", 0x47}], 0x26a, 0x0, &(0x7f0000000100), 0xffffffffffffe82) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) pselect6(0x40, &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140)={0x1b7}, &(0x7f0000000200), &(0x7f0000000300)={&(0x7f00000002c0), 0x8}) [ 333.745855] ================================================================== [ 333.753302] BUG: KMSAN: kernel-infoleak in kvm_write_guest_page+0x366/0x4c0 [ 333.760428] CPU: 1 PID: 8574 Comm: syz-executor2 Not tainted 4.19.0-rc8+ #70 [ 333.767649] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 333.777023] Call Trace: [ 333.779652] dump_stack+0x306/0x460 [ 333.783317] ? kvm_write_guest_page+0x366/0x4c0 [ 333.788033] kmsan_report+0x1a2/0x2e0 [ 333.791879] kmsan_internal_check_memory+0x374/0x460 [ 333.797030] ? __msan_metadata_ptr_for_store_4+0x13/0x20 [ 333.802539] kmsan_copy_to_user+0x89/0xe0 [ 333.806726] kvm_write_guest_page+0x366/0x4c0 [ 333.811292] kvm_write_guest+0x1d6/0x350 [ 333.815417] kvm_emulate_hypercall+0x1cb9/0x20d0 [ 333.816457] device lo entered promiscuous mode [ 333.820280] handle_vmcall+0x41/0x50 [ 333.820310] ? handle_rdpmc+0x80/0x80 [ 333.820336] vmx_handle_exit+0x20f5/0xb900 [ 333.820393] ? vmx_flush_tlb_gva+0x450/0x450 [ 333.820422] kvm_arch_vcpu_ioctl_run+0xa22b/0x10ab0 [ 333.820580] ? futex_wait+0x745/0xa40 [ 333.850081] ? kmsan_set_origin+0x83/0x140 [ 333.854364] ? kmsan_internal_unpoison_shadow+0x83/0xe0 [ 333.859817] ? __msan_get_context_state+0x9/0x30 [ 333.864606] ? INIT_BOOL+0xc/0x30 [ 333.868089] ? mutex_lock_killable+0x2c5/0x420 [ 333.872717] kvm_vcpu_ioctl+0x11a7/0x20b0 [ 333.876935] ? do_vfs_ioctl+0x187/0x2ca0 [ 333.881062] ? __se_sys_ioctl+0x1da/0x270 [ 333.885244] ? kvm_vm_release+0x90/0x90 [ 333.889243] do_vfs_ioctl+0xf28/0x2ca0 [ 333.893198] ? security_file_ioctl+0x92/0x200 [ 333.897742] __se_sys_ioctl+0x1da/0x270 [ 333.901752] __x64_sys_ioctl+0x4a/0x70 [ 333.905671] do_syscall_64+0xbe/0x100 [ 333.909507] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 333.914721] RIP: 0033:0x457569 [ 333.917935] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 333.936876] RSP: 002b:00007fc291021c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 333.944642] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457569 [ 333.951927] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 333.959223] RBP: 000000000072bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 333.966527] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc2910226d4 [ 333.973817] R13: 00000000004c0027 R14: 00000000004d0108 R15: 00000000ffffffff [ 333.981128] [ 333.982769] Local variable description: ----clock_pairing.i@kvm_emulate_hypercall [ 333.990396] Variable was created at: [ 333.994139] kvm_emulate_hypercall+0x60/0x20d0 [ 333.998750] handle_vmcall+0x41/0x50 [ 334.002456] [ 334.004108] Bytes 28-63 of 64 are uninitialized [ 334.008803] Memory access of size 64 starts at ffff88017fddf440 [ 334.014873] ================================================================== [ 334.022253] Disabling lock debugging due to kernel taint [ 334.027727] Kernel panic - not syncing: panic_on_warn set ... [ 334.027727] [ 334.035127] CPU: 1 PID: 8574 Comm: syz-executor2 Tainted: G B 4.19.0-rc8+ #70 [ 334.043720] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 334.053093] Call Trace: [ 334.055714] dump_stack+0x306/0x460 [ 334.059392] panic+0x54c/0xafa [ 334.062680] ? __msan_metadata_ptr_for_store_1+0x13/0x20 [ 334.068192] kmsan_report+0x2d3/0x2e0 [ 334.072036] kmsan_internal_check_memory+0x374/0x460 [ 334.077207] ? __msan_metadata_ptr_for_store_4+0x13/0x20 [ 334.082707] kmsan_copy_to_user+0x89/0xe0 [ 334.086888] kvm_write_guest_page+0x366/0x4c0 [ 334.091446] kvm_write_guest+0x1d6/0x350 [ 334.095581] kvm_emulate_hypercall+0x1cb9/0x20d0 [ 334.100438] handle_vmcall+0x41/0x50 [ 334.104213] ? handle_rdpmc+0x80/0x80 [ 334.108032] vmx_handle_exit+0x20f5/0xb900 [ 334.112333] ? vmx_flush_tlb_gva+0x450/0x450 [ 334.116784] kvm_arch_vcpu_ioctl_run+0xa22b/0x10ab0 [ 334.121959] ? futex_wait+0x745/0xa40 [ 334.125819] ? kmsan_set_origin+0x83/0x140 [ 334.130059] ? kmsan_internal_unpoison_shadow+0x83/0xe0 [ 334.135427] ? __msan_get_context_state+0x9/0x30 [ 334.140194] ? INIT_BOOL+0xc/0x30 [ 334.143682] ? mutex_lock_killable+0x2c5/0x420 [ 334.148295] kvm_vcpu_ioctl+0x11a7/0x20b0 [ 334.152505] ? do_vfs_ioctl+0x187/0x2ca0 [ 334.156579] ? __se_sys_ioctl+0x1da/0x270 [ 334.160735] ? kvm_vm_release+0x90/0x90 [ 334.164721] do_vfs_ioctl+0xf28/0x2ca0 [ 334.168649] ? security_file_ioctl+0x92/0x200 [ 334.173172] __se_sys_ioctl+0x1da/0x270 [ 334.177153] __x64_sys_ioctl+0x4a/0x70 [ 334.181067] do_syscall_64+0xbe/0x100 [ 334.184908] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 334.190126] RIP: 0033:0x457569 [ 334.193336] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 334.212252] RSP: 002b:00007fc291021c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 334.219991] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457569 [ 334.227272] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 334.234572] RBP: 000000000072bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 334.241849] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc2910226d4 [ 334.249132] R13: 00000000004c0027 R14: 00000000004d0108 R15: 00000000ffffffff [ 334.257408] Kernel Offset: disabled [ 334.261197] Rebooting in 86400 seconds..