[   39.579511] kauditd_printk_skb: 8 callbacks suppressed
[   39.579521] audit: type=1800 audit(1575571350.895:32): pid=7428 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="startpar" name="ssh" dev="sda1" ino=2450 res=0
[....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.
[   40.102938] audit: type=1800 audit(1575571351.415:33): pid=7428 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2465 res=0
[   40.127956] audit: type=1800 audit(1575571351.415:34): pid=7428 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2456 res=0

Debian GNU/Linux 7 syzkaller ttyS0

syzkaller login: [   42.992015] audit: type=1400 audit(1575571354.305:35): avc:  denied  { map } for  pid=7605 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1
Warning: Permanently added '10.128.0.161' (ECDSA) to the list of known hosts.
2019/12/05 18:42:41 fuzzer started
[   49.687188] audit: type=1400 audit(1575571360.995:36): avc:  denied  { map } for  pid=7614 comm="syz-fuzzer" path="/root/syz-fuzzer" dev="sda1" ino=16482 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
2019/12/05 18:42:42 dialing manager at 10.128.0.105:33571
2019/12/05 18:42:42 syscalls: 2679
2019/12/05 18:42:42 code coverage: enabled
2019/12/05 18:42:42 comparison tracing: enabled
2019/12/05 18:42:42 extra coverage: extra coverage is not supported by the kernel
2019/12/05 18:42:42 setuid sandbox: enabled
2019/12/05 18:42:42 namespace sandbox: enabled
2019/12/05 18:42:42 Android sandbox: /sys/fs/selinux/policy does not exist
2019/12/05 18:42:42 fault injection: enabled
2019/12/05 18:42:42 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled
2019/12/05 18:42:42 net packet injection: enabled
2019/12/05 18:42:42 net device setup: enabled
2019/12/05 18:42:42 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist
2019/12/05 18:42:42 devlink PCI setup: PCI device 0000:00:10.0 is not available
18:45:41 executing program 0:
perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0xce7c, 0x83630, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffbfffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x81}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$sock_kcm_SIOCKCMATTACH(0xffffffffffffffff, 0x89e0, 0x0)
sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x0, 0x0)

[  229.793894] audit: type=1400 audit(1575571541.105:37): avc:  denied  { map } for  pid=7632 comm="syz-executor.0" path="/sys/kernel/debug/kcov" dev="debugfs" ino=17098 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1
[  229.912638] IPVS: ftp: loaded support on port[0] = 21
18:45:41 executing program 1:
sched_setaffinity(0x0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x42, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = shmget$private(0x0, 0x13000, 0x0, &(0x7f0000feb000/0x13000)=nil)
shmat(r0, &(0x7f0000fed000/0x1000)=nil, 0x6ffd)

[  230.015538] chnl_net:caif_netlink_parms(): no params data found
[  230.064795] bridge0: port 1(bridge_slave_0) entered blocking state
[  230.072492] bridge0: port 1(bridge_slave_0) entered disabled state
[  230.081227] device bridge_slave_0 entered promiscuous mode
[  230.089547] bridge0: port 2(bridge_slave_1) entered blocking state
[  230.096065] bridge0: port 2(bridge_slave_1) entered disabled state
[  230.104661] device bridge_slave_1 entered promiscuous mode
[  230.137735] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  230.152646] IPVS: ftp: loaded support on port[0] = 21
[  230.159672] bond0: Enslaving bond_slave_1 as an active interface with an up link
[  230.202101] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[  230.210100] team0: Port device team_slave_0 added
[  230.217633] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[  230.224991] team0: Port device team_slave_1 added
[  230.232351] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[  230.242092] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
18:45:41 executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_REGISTER_COALESCED_MMIO(0xffffffffffffffff, 0x4010ae67, &(0x7f0000000040)={0x200c})
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000100)={'nlmon\t\x00\x7f\xed\xb1[\xe5\xa3\xcd\xb6\x00'})
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000180)={0x0, 0x0, @ioapic={0x6000, 0x0, 0x7f, 0x0, 0x0, [{}, {}, {0x1}, {0x0, 0x5}, {0x0, 0x0, 0x7f}, {}, {}, {}, {0x0, 0x0, 0x0, [], 0x89}, {}, {0x0, 0x0, 0x0, [], 0x3f}]}})
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000480)={[0x0, 0x0, 0x8001, 0x20, 0x0, 0x0, 0x4cb]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

[  230.320446] device hsr_slave_0 entered promiscuous mode
[  230.357702] device hsr_slave_1 entered promiscuous mode
[  230.398292] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready
[  230.405530] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready
[  230.421293] IPVS: ftp: loaded support on port[0] = 21
18:45:41 executing program 3:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup\x00', 0x200002, 0x0)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup\x00', 0x200002, 0x0)
r1 = openat$cgroup_subtree(r0, &(0x7f0000000140)='cgroup.subtree_control\x00', 0x2, 0x0)
close(r1)
readv(r1, &(0x7f00000002c0), 0x3a9)
ioctl$FS_IOC_FSSETXATTR(r1, 0x401c5820, &(0x7f00000002c0)={0xfff, 0x7fffffff, 0x7, 0x80000001, 0xffffffff})
r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x27849c0ca24d9ba9, 0x0)
ioctl$DRM_IOCTL_VERSION(r2, 0xc0406400, &(0x7f0000000280)={0xc00, 0x4e45504f, 0x1e, 0x192, &(0x7f0000000040)=""/116, 0xb, &(0x7f0000000100)=""/11, 0xdd, &(0x7f0000000180)=""/221})
perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x281, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xfffffdffffffffff, 0xffffffffffffffff, 0x0)
r3 = socket$inet(0x2, 0x4000000000000001, 0x0)
bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10)
r4 = socket$inet(0x2, 0x80001, 0x84)
setsockopt$EBT_SO_SET_COUNTERS(r4, 0x0, 0x81, &(0x7f0000000300)=ANY=[@ANYBLOB="6e61740000000004000000000000bd00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000208a07263635acb000000000000000000000091fb00ec0000000000000000000000000000000000000000008ad034c87126df2f44"], 0x78)
setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, 0x0, 0x0)
sendto$inet(r3, 0x0, 0xd1, 0x200007fd, &(0x7f0000e68000)={0x2, 0x2000000004e23, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10)
setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000000)='vxcan1\x00', 0xf)
sendto$inet(r3, &(0x7f0000000400)="f62ab313949355e0273e65d3abda21f068933ec46b1fdf41a833e981e7de5b6aa4a1b65d8ec8094ee099d8271d26428366e221fc061208889c5686a4dc0c2d3d4fd66741cc11c4c833102fc156857f99a8b799636ea87c35b0283036520e5953baf9c51316d8d93aa5096030bd0d0dfbbdf445006af75ad33303c89c2de7ee8ac49a59a6605f3343c51ee399b1977da2e34ffbe0425866c7b7ad499ab8611286d60c0f27a1e62be4fb4b9e41eabec273531810fb81d733a5ea29408c19aba4587f9da5920ad564ad6bb89ac4565194535c7f6f54993deceb58a75e137be85d7600", 0xffffff90, 0x60, 0x0, 0x127)

[  230.486835] bridge0: port 2(bridge_slave_1) entered blocking state
[  230.493383] bridge0: port 2(bridge_slave_1) entered forwarding state
[  230.500385] bridge0: port 1(bridge_slave_0) entered blocking state
[  230.506758] bridge0: port 1(bridge_slave_0) entered forwarding state
[  230.516639] chnl_net:caif_netlink_parms(): no params data found
[  230.613291] bridge0: port 1(bridge_slave_0) entered blocking state
[  230.637413] bridge0: port 1(bridge_slave_0) entered disabled state
[  230.644720] device bridge_slave_0 entered promiscuous mode
[  230.669587] bridge0: port 2(bridge_slave_1) entered blocking state
[  230.675965] bridge0: port 2(bridge_slave_1) entered disabled state
[  230.691535] device bridge_slave_1 entered promiscuous mode
[  230.775314] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  230.788532] chnl_net:caif_netlink_parms(): no params data found
[  230.790897] IPVS: ftp: loaded support on port[0] = 21
[  230.809375] bond0: Enslaving bond_slave_1 as an active interface with an up link
18:45:42 executing program 4:
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10)
sendto$inet(r0, 0x0, 0xd1, 0x200007fd, &(0x7f0000e68000)={0x2, 0x2000000004e23, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10)
setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0)
sendto$inet(r0, &(0x7f0000000400)="f62ab313949355e0273e65d3abda21f068933ec46b1fdf41a833e981e7de5b6aa4a1b65d8ec8094ee099d8271d26428366e221fc061208889c5686a4dc0c2d3d4fd66741cc11c4c833102fc156857f99a8b799636ea87c35b0283036520e5953baf9c51316d8d93aa5096030bd0d0dfbbdf445006af75ad33303c89c2de7ee8ac49a59a6605f3343c51ee399b1977da2e34ffbe0425866c7b7ad499ab8611286d60c0f27a1e62be4fb4b9e41eabec273531810fb81d733a5ea29408c19aba4587f9da5920ad564ad6bb89ac4565194535c7f6f54993deceb58a75e137be85d7600", 0xffffff90, 0x60, 0x0, 0x127)

[  230.842503] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready
[  230.849870] 8021q: adding VLAN 0 to HW filter on device bond0
[  230.896638] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[  230.905574] team0: Port device team_slave_0 added
[  230.913430] bridge0: port 1(bridge_slave_0) entered blocking state
[  230.940803] bridge0: port 1(bridge_slave_0) entered disabled state
[  230.948484] device bridge_slave_0 entered promiscuous mode
[  230.961445] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  230.977742] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[  230.985447] team0: Port device team_slave_1 added
[  230.993109] bridge0: port 2(bridge_slave_1) entered blocking state
[  231.020146] bridge0: port 2(bridge_slave_1) entered disabled state
[  231.027664] device bridge_slave_1 entered promiscuous mode
[  231.034420] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[  231.075997] bridge0: port 1(bridge_slave_0) entered disabled state
[  231.096194] bridge0: port 2(bridge_slave_1) entered disabled state
[  231.107017] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
18:45:42 executing program 5:
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
mkdir(&(0x7f0000000140)='./file0\x00', 0x0)
mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0)
r2 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0)
r3 = openat$cgroup_subtree(r2, &(0x7f0000000340)='cgroup.subtree_control\x00', 0x2, 0x0)
write$cgroup_subtree(r3, &(0x7f00000000c0)={[{0x2b, 'cpu'}]}, 0x5)

[  231.121422] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[  231.140956] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  231.150402] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  231.210595] device hsr_slave_0 entered promiscuous mode
[  231.248588] device hsr_slave_1 entered promiscuous mode
[  231.287719] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  231.294683] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  231.305332] bond0: Enslaving bond_slave_1 as an active interface with an up link
[  231.307097] IPVS: ftp: loaded support on port[0] = 21
[  231.327030] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready
[  231.334181] 8021q: adding VLAN 0 to HW filter on device team0
[  231.343120] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready
[  231.352255] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready
[  231.364898] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[  231.373349] team0: Port device team_slave_0 added
[  231.383444] IPVS: ftp: loaded support on port[0] = 21
[  231.389707] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  231.404789] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[  231.413613] team0: Port device team_slave_1 added
[  231.421464] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  231.429600] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  231.437463] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  231.445045] bridge0: port 1(bridge_slave_0) entered blocking state
[  231.451412] bridge0: port 1(bridge_slave_0) entered forwarding state
[  231.458887] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  231.466571] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  231.474225] bridge0: port 2(bridge_slave_1) entered blocking state
[  231.480676] bridge0: port 2(bridge_slave_1) entered forwarding state
[  231.510307] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[  231.520161] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  231.543002] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[  231.558438] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  231.568754] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  231.576405] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[  231.629146] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  231.646111] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  231.658500] chnl_net:caif_netlink_parms(): no params data found
[  231.689038] device hsr_slave_0 entered promiscuous mode
[  231.747728] device hsr_slave_1 entered promiscuous mode
[  231.818349] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready
[  231.825739] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready
[  231.834467] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  231.842713] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  231.850773] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  231.868743] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  231.891002] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  231.898747] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  231.908464] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready
[  231.933455] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  231.941887] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  231.951864] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready
[  231.993152] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  232.000726] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  232.010461] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[  232.022349] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready
[  232.029131] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  232.036303] bridge0: port 1(bridge_slave_0) entered blocking state
[  232.043354] bridge0: port 1(bridge_slave_0) entered disabled state
[  232.051036] device bridge_slave_0 entered promiscuous mode
[  232.064971] bridge0: port 2(bridge_slave_1) entered blocking state
[  232.071571] bridge0: port 2(bridge_slave_1) entered disabled state
[  232.079132] device bridge_slave_1 entered promiscuous mode
[  232.096700] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  232.136389] bond0: Enslaving bond_slave_1 as an active interface with an up link
[  232.155257] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[  232.162747] team0: Port device team_slave_0 added
[  232.184066] chnl_net:caif_netlink_parms(): no params data found
[  232.201989] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[  232.209968] team0: Port device team_slave_1 added
[  232.215847] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[  232.233244] IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready
[  232.240074] chnl_net:caif_netlink_parms(): no params data found
[  232.253525] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[  232.299052] bridge0: port 1(bridge_slave_0) entered blocking state
[  232.305554] bridge0: port 1(bridge_slave_0) entered disabled state
[  232.312641] device bridge_slave_0 entered promiscuous mode
[  232.320620] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready
[  232.369286] device hsr_slave_0 entered promiscuous mode
[  232.407744] device hsr_slave_1 entered promiscuous mode
[  232.450272] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready
[  232.457812] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready
[  232.468640] 8021q: adding VLAN 0 to HW filter on device batadv0
[  232.475683] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[  232.482971] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[  232.489870] bridge0: port 2(bridge_slave_1) entered blocking state
[  232.496189] bridge0: port 2(bridge_slave_1) entered disabled state
[  232.503512] device bridge_slave_1 entered promiscuous mode
[  232.525217] bridge0: port 1(bridge_slave_0) entered blocking state
[  232.531679] bridge0: port 1(bridge_slave_0) entered disabled state
[  232.539033] device bridge_slave_0 entered promiscuous mode
[  232.551696] 8021q: adding VLAN 0 to HW filter on device bond0
[  232.565319] audit: type=1400 audit(1575571543.875:38): avc:  denied  { associate } for  pid=7633 comm="syz-executor.0" name="syz0" scontext=unconfined_u:object_r:unlabeled_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=filesystem permissive=1
[  232.605692] bridge0: port 2(bridge_slave_1) entered blocking state
[  232.619715] bridge0: port 2(bridge_slave_1) entered disabled state
[  232.626774] device bridge_slave_1 entered promiscuous mode
[  232.643156] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  232.651103] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  232.660074] bond0: Enslaving bond_slave_1 as an active interface with an up link
[  232.678809] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[  232.720364] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  232.735984] 8021q: adding VLAN 0 to HW filter on device bond0
[  232.754703] bond0: Enslaving bond_slave_0 as an active interface with an up link
18:45:44 executing program 0:
perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0xce7c, 0x83630, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffbfffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x81}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$sock_kcm_SIOCKCMATTACH(0xffffffffffffffff, 0x89e0, 0x0)
sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x0, 0x0)

[  232.765133] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  232.772181] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  232.800113] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready
[  232.806208] 8021q: adding VLAN 0 to HW filter on device team0
18:45:44 executing program 0:
r0 = socket$packet(0x11, 0x3, 0x300)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = fcntl$dupfd(r1, 0x0, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000140)={0x2, &(0x7f0000000000)=[{0x6c}, {0x80000006}]}, 0x10)
syz_emit_ethernet(0x2a, &(0x7f0000000280)={@local, @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @icmp}}}}, 0x0)

[  232.818279] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  232.826711] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  232.833814] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[  232.857147] team0: Port device team_slave_0 added
[  232.864247] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[  232.872576] team0: Port device team_slave_1 added
[  232.879043] bond0: Enslaving bond_slave_1 as an active interface with an up link
[  232.886822] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[  232.896894] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  232.905149] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  232.912272] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  232.924347] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  232.932323] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  232.939954] bridge0: port 1(bridge_slave_0) entered blocking state
[  232.946287] bridge0: port 1(bridge_slave_0) entered forwarding state
[  232.953296] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
18:45:44 executing program 0:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0)
syz_open_pts(r1, 0x291200)
r2 = syz_open_procfs(0x0, 0x0)
openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0)
prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r2)
write$P9_RXATTRCREATE(0xffffffffffffffff, 0x0, 0x0)
ftruncate(0xffffffffffffffff, 0x0)
fcntl$setstatus(r1, 0x4, 0x3fffe)
io_setup(0x2, &(0x7f00000004c0)=<r3=>0x0)
r4 = creat(&(0x7f0000000000)='./bus\x00', 0x0)
write$P9_RXATTRCREATE(r4, &(0x7f0000000180)={0x108}, 0xffffff02)
fcntl$setsig(0xffffffffffffffff, 0xa, 0x31)
getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
io_submit(r3, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}])

[  232.969841] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[  233.000114] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  233.009353] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready
[  233.015427] 8021q: adding VLAN 0 to HW filter on device team0
[  233.031188] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  233.040259] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  233.050522] bridge0: port 2(bridge_slave_1) entered blocking state
[  233.056866] bridge0: port 2(bridge_slave_1) entered forwarding state
[  233.073695] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[  233.082694] team0: Port device team_slave_0 added
[  233.088754] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[  233.095955] team0: Port device team_slave_1 added
18:45:44 executing program 0:
prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x50000}]})
r0 = syz_open_dev$ptys(0xc, 0x3, 0x1)
setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, 0x0, 0x0)

[  233.102765] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[  233.110350] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[  233.121132] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  233.177108] device hsr_slave_0 entered promiscuous mode
18:45:44 executing program 0:
r0 = gettid()
prctl$PR_SET_SECCOMP(0x16, 0x0, 0x0)
timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000))
accept4$inet(0xffffffffffffffff, 0x0, 0x0, 0x0)
gettid()
tkill(0x0, 0x0)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0)
open(0x0, 0x0, 0x0)
gettid()
tkill(0x0, 0x0)
socket$inet6(0x10, 0x0, 0x0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x1c9c380}, {0x0, 0x9}}, 0x0)
socket$netlink(0x10, 0x3, 0x0)
getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0)
clock_gettime(0xc9445abb5825ce55, 0x0)
setsockopt$netlink_NETLINK_CAP_ACK(0xffffffffffffffff, 0x10e, 0xa, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_QUERY_BPF(0xffffffffffffffff, 0xc008240a, 0x0)
tkill(r0, 0x1000000000016)

[  233.217744] device hsr_slave_1 entered promiscuous mode
[  233.259194] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready
[  233.266554] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready
[  233.290360] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  233.298192] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
18:45:44 executing program 0:
r0 = gettid()
prctl$PR_SET_SECCOMP(0x16, 0x0, 0x0)
timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000))
accept4$inet(0xffffffffffffffff, 0x0, 0x0, 0x0)
gettid()
ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0)
open(0x0, 0x0, 0x0)
gettid()
tkill(0x0, 0x0)
socket$inet6(0x10, 0x0, 0x0)
r1 = open(&(0x7f0000000100)='./file0\x00', 0x153042, 0x0)
write$P9_RCLUNK(0xffffffffffffffff, 0x0, 0x0)
open(0x0, 0x0, 0x0)
write$P9_RCLUNK(0xffffffffffffffff, 0x0, 0x0)
syz_open_pts(0xffffffffffffffff, 0x0)
write$P9_RWSTAT(0xffffffffffffffff, 0x0, 0x0)
syz_open_pts(0xffffffffffffffff, 0x0)
setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r1, 0x6, 0x15, 0x0, 0x0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x1c9c380}, {0x0, 0x9}}, 0x0)
ioctl$PERF_EVENT_IOC_QUERY_BPF(0xffffffffffffffff, 0xc008240a, 0x0)
write$P9_RLINK(0xffffffffffffffff, 0x0, 0x245)
ioctl$sock_SIOCGIFVLAN_SET_VLAN_NAME_TYPE_CMD(0xffffffffffffffff, 0x8982, 0x0)
tkill(r0, 0x1000000000016)

[  233.305969] bridge0: port 1(bridge_slave_0) entered blocking state
[  233.312367] bridge0: port 1(bridge_slave_0) entered forwarding state
[  233.319661] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  233.334928] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  233.350696] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
18:45:44 executing program 0:
prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x50000}]})
r0 = syz_open_dev$ttys(0xc, 0x2, 0x1)
ioctl$sock_TIOCOUTQ(r0, 0x5411, 0x0)

[  233.403143] device hsr_slave_0 entered promiscuous mode
[  233.459800] device hsr_slave_1 entered promiscuous mode
[  233.498615] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready
[  233.505924] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready
[  233.519470] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  233.532509] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  233.542988] bridge0: port 2(bridge_slave_1) entered blocking state
[  233.549431] bridge0: port 2(bridge_slave_1) entered forwarding state
[  233.563102] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  233.574069] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  233.593158] 8021q: adding VLAN 0 to HW filter on device bond0
[  233.609874] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[  233.628925] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  233.645974] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  233.656494] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  233.671317] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  233.688805] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  233.705535] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[  233.715154] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  233.723122] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  233.735099] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  233.744877] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  233.752804] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  233.759881] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  233.766686] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  233.775108] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  233.783316] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  233.795762] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready
[  233.802165] 8021q: adding VLAN 0 to HW filter on device team0
[  233.808584] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  233.816279] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  233.836250] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  233.844479] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready
[  233.857851] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  233.866838] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  233.878382] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  233.885850] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  233.893950] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  233.902117] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  233.909857] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  233.918061] bridge0: port 1(bridge_slave_0) entered blocking state
[  233.924403] bridge0: port 1(bridge_slave_0) entered forwarding state
[  233.931433] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  233.938762] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  233.950122] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready
[  233.960425] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  233.970837] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  233.981453] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready
[  233.988939] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  233.996416] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  234.004336] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  234.012229] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  234.019851] bridge0: port 2(bridge_slave_1) entered blocking state
[  234.026166] bridge0: port 2(bridge_slave_1) entered forwarding state
[  234.033094] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  234.041105] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  234.048787] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  234.056182] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  234.064876] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready
[  234.071303] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  234.098188] 8021q: adding VLAN 0 to HW filter on device bond0
[  234.106392] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  234.120466] IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready
[  234.128538] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready
[  234.138004] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  234.144590] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  234.152930] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  234.160874] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  234.170807] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  234.181169] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  234.190286] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  234.198766] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  234.206315] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  234.214934] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready
[  234.226815] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  234.234706] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready
[  234.248582] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  234.258192] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready
[  234.264339] 8021q: adding VLAN 0 to HW filter on device team0
[  234.278169] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[  234.284864] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[  234.294517] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  234.302628] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  234.321771] 8021q: adding VLAN 0 to HW filter on device batadv0
[  234.332736] 8021q: adding VLAN 0 to HW filter on device bond0
[  234.340373] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  234.352035] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  234.360281] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  234.368576] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  234.377635] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  234.389430] IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready
[  234.399551] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  234.405710] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  234.413731] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  234.421462] bridge0: port 1(bridge_slave_0) entered blocking state
[  234.427866] bridge0: port 1(bridge_slave_0) entered forwarding state
[  234.440974] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready
[  234.452981] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready
[  234.462270] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  234.470545] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  234.478360] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  234.485784] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  234.493345] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[  234.500564] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[  234.507205] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  234.515096] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  234.522664] bridge0: port 2(bridge_slave_1) entered blocking state
[  234.529029] bridge0: port 2(bridge_slave_1) entered forwarding state
[  234.538365] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready
[  234.546849] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[  234.558219] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready
[  234.564327] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  234.583899] 8021q: adding VLAN 0 to HW filter on device batadv0
[  234.592479] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  234.606044] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  234.615541] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  234.634350] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  234.641832] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  234.652191] IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready
[  234.660567] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready
[  234.676246] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  234.683778] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[  234.690958] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[  234.699048] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  234.712072] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready
[  234.718937] 8021q: adding VLAN 0 to HW filter on device team0
[  234.728227] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  234.741035] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  234.756728] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
18:45:46 executing program 1:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x42, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x3}, 0x0, 0x2, 0x1, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1)
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
setxattr$trusted_overlay_upper(&(0x7f0000006bc0)='./file0\x00', &(0x7f0000006c00)='trusted.overlay.upper\x00', &(0x7f0000000480)=ANY=[@ANYBLOB="00fb03023f3664dbb8aa6053b0cd45b7ff7d51bf020ad239a4ffaafb67ebe491debc88c5dda3db6dcb41aace88618348633eb76f58d4f265bd7e384b56d79d1c27d4c71aea93322fe9de1599026b5680cf42478f8a0a5001b28dd7389fba62505c15a0578ad91027429dfdbb652885ee487e9ac3cf0d1c12968e7d243e20b7bd52d5fbee32751ff7c11cf12d592e0d481c157ff29ac2b0b5d3199faff29fcabfcba30ee0e74c24ab205d8ab1af31b9f478a03e022884edb6e4b955a2dda34d586323b707d299d394af00e0d32d9b1cdaf25bb6ad1dc0e833370ea04116e2cd3ddd17383d9a8da72b35d4b72eccac99ca90ddc65e21881d4237cfa2a422cdbe5f2ac7fd47d26193e35a798f61b0032ec7ada52e5855bfe845034ec20f5737dc1ce14a3ebdf47d006e7b39364e7fbc00c74ec01e2b49b1183d702109bbec5b1aa3ee70bfe659e567a7989c32bbda452af54ea7baedd4517cff4d2e8707934900ddef9b2608176fe63b1e4e8fb7efe8975597d9adc796317a4ba005fec8ee04e1baa891135c804b34226d2140114fcc7cc8aba2140fac2c5df75d7d3744c9da40868afe837ac06a1ae4272011f0afbad3fd60459daffeb89ec2b95dcdc6f80b6406666695930b712113ca41420051914ce31b380e2a962a970e79643c8b39616aae1f5eac193409c15a92556af09cdc7e3e658cdd9b2d29ea2f398887bd7ccd699fda0758a6708876beeda8cc7af10acc7c77997df0f80be44dc818b2e173be77fd117efd4f919c12b4b6031c"], 0x103, 0x0)
setxattr$trusted_overlay_upper(0x0, &(0x7f0000006ac0)='trusted.overlay.upper\x00', &(0x7f0000006b00)=ANY=[@ANYBLOB="00fbf4815ef7c3885a6c2d5a31a526d315110925f4"], 0x15, 0xf1395dc5d9f55562)
mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000280)='devtmpfs\x00', 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x64, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
chdir(&(0x7f0000000300)='./file0\x00')
rmdir(&(0x7f0000000140)='./file0\x00')
r0 = gettid()
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$int_in(r1, 0x5452, &(0x7f0000b28000)=0x6)
fcntl$setsig(r1, 0xa, 0x12)
poll(&(0x7f0000b2c000)=[{r2}], 0x1, 0xffffffffffbffff8)
fcntl$setown(r1, 0x8, r0)
tkill(r0, 0x16)
syz_open_procfs(0x0, &(0x7f0000000000)='personality\x00')
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000440)='memory.stat\x00', 0x275a, 0x0)
prctl$PR_GET_SECCOMP(0x15)
r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000003c0)='mem\x00\x00\x00\x00\x00\x00<s\x8c\')tU\x19\x9a)S\xa7b\xce\xd8\xde\x95\xf6\xc3\\n\xc1\xa2)o\xee\x97\xdf\xe9\xf3\xfdJ\xe8`7iY\x86~\xd8\xecy\xc00.\x90\xfc\xac\xa0\xb8\x1d\x1a\x7f\xec\xea\np\xb4\xd5l\xb5\xc3\xc7w%\x16a~]P\x04\xc7 \xf7\x92\x8b\x8f\x9d&\\\xf9\xa3\x96G<\xd4\x80\x16/\x81\xe7(\x8b\xde9]\xaf\xbc\xb0\r}Ne\xfaX\xb0\x8a\xbd\x1d\xfc\xd4\x91\x95\x00\v\x14a0_\xd9\x1f\xc7\xb5\xc3FS\x16\x03~\xbbc*\xa3\xab`\x06\xf0\xbc\xacJY\xe7\xb2\x8cw\xa4U.\xa4\xe2u\x1d!jVL}#O\t\xb2`\x0e\xe9\xc6*\xf7\xf8Uh\x8e\x01\xf1b\xf5;\x8a\x17\x9a\x0fq\x01\x91pSR\x82-H\n\x1fP\xb6*\xc9\xfd\x89\xb5\x7f\x87m\"\xaa\xce\xed\a\xf2\xfd<\x10\xb8\xcf\xfac\xcc\x0f\xd2\xdd\xcd#8\"\x8b\xf2\xccA\v\xdf\xf5\x8d\xa5-\x02\xaa|\xdd\xd0az\xc8,)\xedf\x89x>\a\x13', 0x275a, 0x0)
preadv(r3, &(0x7f0000000200)=[{&(0x7f0000000140)=""/12, 0xc}], 0x1, 0xfffbc000)
fallocate(r3, 0x16, 0xfffffffffffffffe, 0x110002)
shmget(0x2, 0x2000, 0x0, &(0x7f0000ffc000/0x2000)=nil)
pipe2(0x0, 0x0)
r4 = socket(0x0, 0x4000000000080002, 0x0)
bind$packet(r4, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, 0x14)
sendmmsg(r4, &(0x7f0000000d00), 0x1bdd307, 0x0)
ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000180)={'vcan0\x00'})
socket$inet_udplite(0x2, 0x2, 0x88)
r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
fcntl$dupfd(r5, 0x0, r5)
socket$inet_icmp_raw(0x2, 0x3, 0x1)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000007c0), &(0x7f0000000840)=0x2)

[  234.784127] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details.
[  234.800399] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  234.816385] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  234.843811] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  234.859081] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  234.872090] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  234.881429] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  234.894947] 8021q: adding VLAN 0 to HW filter on device batadv0
[  234.902513] hrtimer: interrupt took 35870 ns
[  234.919409] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready
[  234.931398] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready
18:45:46 executing program 2:
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000003c0)='mem\x00\x00\x00\x00\x00\x00<s\x8c\')tU\x19\x9a)S\xa7b\xce\xd8\xde\x95\xf6\xc3\\n\xc1\xa2)o\xee\x97\xdf\xe9\xf3\xfdJ\xe8`7iY\x86~\xd8\xecy\xc00.\x90\xfc\xac\xa0\xb8\x1d\x1a\x7f\xec\xea\np\xb4\xd5l\xb5\xc3\xc7w%\x16a~]P\x04\xc7 \xf7\x92\x8b\x8f\x9d&\\\xf9\xa3\x96G<\xd4\x80\x16/\x81\xe7(\x8b\xde9]\xaf\xbc\xb0\r}Ne\xfaX\xb0\x8a\xbd\x1d\xfc\xd4\x91\x95\x00\v\x14a0_\xd9\x1f\xc7\xb5\xc3FS\x16\x03~\xbbc*\xa3\xab`\x06\xf0\xbc\xacJY\xe7\xb2\x8cw\xa4U.\xa4\xe2u\x1d!jVL}#O\t\xb2`\x0e\xe9\xc6*\xf7\xf8Uh\x8e\x01\xf1b\xf5;\x8a\x17\x9a\x0fq\x01\x91pSR\x82-H\n\x1fP\xb6*\xc9\xfd\x89\xb5\x7f\x87m\"\xaa\xce\xed\a\xf2\xfd<\x10\xb8\xcf\xfac\xcc\x0f\xd2\xdd\xcd#8\"\x8b\xf2\xccA\v\xdf\xf5\x8d\xa5-\x02\xaa|\xdd\xd0az\xc8,)\xedf\x89x>\a\x13', 0x275a, 0x0)
ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x100, 0x100000001, 0x100000000, 0x8, 0x8})

[  234.940635] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  234.948131] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  234.958573] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  234.978790] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  234.986297] EXT4-fs warning (device sda1): ext4_group_add:1644: No reserved GDT blocks, can't resize
[  234.986480] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  235.009365] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  235.017960] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  235.030804] bridge0: port 1(bridge_slave_0) entered blocking state
[  235.037166] bridge0: port 1(bridge_slave_0) entered forwarding state
[  235.046869] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready
[  235.053520] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  235.072726] IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready
[  235.082306] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  235.092014] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  235.106600] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  235.130316] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  235.139055] bridge0: port 2(bridge_slave_1) entered blocking state
[  235.145438] bridge0: port 2(bridge_slave_1) entered forwarding state
[  235.154326] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready
[  235.163184] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  235.171257] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[  235.182558] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[  235.193536] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  235.214662] 8021q: adding VLAN 0 to HW filter on device batadv0
[  235.229260] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  235.243383] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  235.270729] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  235.295506] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  235.312930] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  235.346469] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  235.389126] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready
[  235.404831] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready
[  235.414848] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  235.432329] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  235.478673] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  235.486450] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  235.494500] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  235.502479] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  235.510604] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  235.523412] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready
[  235.534420] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  235.580116] IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready
[  235.593953] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready
[  235.604865] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[  235.618615] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
18:45:46 executing program 3:
r0 = socket$inet6(0xa, 0x80003, 0x6b)
ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071")
r1 = socket$unix(0x1, 0x5, 0x0)
bind$unix(r1, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
listen(r1, 0x0)
r2 = socket$unix(0x1, 0x5, 0x0)
connect(r2, &(0x7f0000931ff4)=@un=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(r1)

18:45:46 executing program 0:
gettid()
r0 = memfd_create(&(0x7f0000003380)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>\x9b\x94a\xac\xf8R?\x1c\xe2\xb5!\xfa\xcb\xd4\xb6\xe1_\xb4d>\xf6\xb7h\xb9Uql\b<zP\xf5\x96\xb0*5\xa2\xd6\xf2Ym\x13\xf1qj\x14\x9e\x9d\xee\xd9X\xf7{b\xab\a6m\xd2%\xebL\x1f\xb3m\xde\xddUC\x984ZZ\xc4\n\t\xd3\x0eO\xa1\xbc)\xb0n\xe85\xa0\x95\t8\x95\f\xa3\xca\xea\xe8^\xcbj\x1d\xc5\x17!\xf0`\xefHz\xddl\xa7\xc3\xcb\xcfM\xc9\xde\xechl\x11\x81\xca2\xe4\x1e\x006\xc61\xda\xa8\x87PQ5,\xba\x87\xda,\xc3\xf3-Xl\x12\x8aY\xa7\x9f\xa2-3\xe9\x1a6\xecj\xa3\x12\xea4\xbb\x99\'|9I\x9e\x05u\xe5\b\xd8\x1a_\xd3\xbaRY\xfbgp\xf62\x8a\xd9\x8c\xd8\xb4\xa1\x1fr ', 0x0)
write$binfmt_misc(r0, &(0x7f0000000c40)=ANY=[@ANYRES32], 0x1000000d8)
lseek(r0, 0x0, 0x4)
socket$alg(0x26, 0x5, 0x0)

[  235.630934] 8021q: adding VLAN 0 to HW filter on device batadv0
18:45:47 executing program 5:
socket$kcm(0x2c, 0x3, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
socket$kcm(0x11, 0xa, 0x300)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000800))
socket$kcm(0x2c, 0x3, 0x0)
socket$kcm(0x2, 0x1000000000000002, 0x0)
socket$kcm(0x29, 0x5, 0x0)
socket$kcm(0x29, 0x2, 0x0)
socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/group.stat\x00<#\xfbW*\x1f\x02\x94\xe6\xf3x\xb4\x1a\xd5KM\x9d\x9a\x1fc\xf8xZ\xd1\x88\xa7\xe1\xc8\x88u\xe0[\x18\xa4\xcb:\x9c\xd1-\xce\xa4@\xd8\x99\xc2,e+:G\x1bJ\x7f\xa2\xf3\xfd\xf6\xe04\xd8\x04\xe5\xf0\xdfK\x1d\xeeH;\x15v$\xc5\x9c\x01\x00\xe8\x9ej5|\x00\x00\x00', 0x2761, 0x0)
socket$kcm(0x29, 0x5, 0x0)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0)
openat$cgroup_int(r0, &(0x7f0000000000)='cpuset.mems\x00', 0x2, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0)
r2 = socket$kcm(0x2, 0x2, 0x0)
setsockopt$sock_attach_bpf(r2, 0x1, 0x3e, &(0x7f00000002c0)=r1, 0x161)
sendmsg$kcm(r2, &(0x7f0000003d00)={&(0x7f0000000380)=@in={0x2, 0x4e23, @multicast1}, 0x80, 0x0}, 0xfd00)
write$cgroup_subtree(r2, &(0x7f0000000040)=ANY=[@ANYBLOB='\x00'/20], 0x14)

18:45:47 executing program 2:
sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0)
sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x5}, 0x0)
r0 = memfd_create(&(0x7f0000001840)='q6C\xb9\xa21\x00', 0x0)
r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x1)
r2 = dup2(r1, r0)
ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'})
write$sndseq(r2, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @connect}], 0x72c6831c)

18:45:47 executing program 3:
creat(&(0x7f0000000380)='./bus\x00', 0x0)
r0 = open(&(0x7f0000000500)='./bus\x00', 0x0, 0x0)
mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x0, 0x12, r0, 0x0)
mbind(&(0x7f0000004000/0x4000)=nil, 0x4000, 0x3, &(0x7f0000000000)=0x7, 0x2, 0x0)

18:45:47 executing program 4:
openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttyS3\x00', 0x0, 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000004c0)={'vet\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a})
ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f00000002c0)={0x1, &(0x7f0000000000)=[{0x4000006}]})
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60)
r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0)
ioctl$KVM_SET_VAPIC_ADDR(r5, 0x4008ae93, &(0x7f0000000040)=0x1)
ioctl$KVM_RUN(r5, 0xae80, 0x0)
syz_kvm_setup_cpu$x86(r2, r5, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff77, 0x0, 0x0, 0x210)
ioctl$FS_IOC_GETFLAGS(r2, 0x80086601, &(0x7f0000000100))
socketpair$unix(0x1, 0x40000000000001, 0x0, &(0x7f0000000140))
pipe(0x0)
vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0)
socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000000))
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
getpid()
write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
r6 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f00000003c0)={'syz'}, 0x0, 0x0, 0xfffffffffffffffc)
add_key$keyring(&(0x7f0000000280)='keyring\x00', &(0x7f00000000c0)={'syz'}, 0x0, 0x0, r6)
keyctl$revoke(0x3, r6)

18:45:47 executing program 2:
socket$kcm(0x2b, 0x0, 0x0)
setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000180), 0x127)
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0)
perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x2}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700)
write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000440), 0x12)
write$cgroup_subtree(r0, &(0x7f0000000040)=ANY=[@ANYPTR64], 0xff39)
write$cgroup_pid(r1, &(0x7f0000000000), 0x10000000d)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001c00)='memory.events\x00', 0x7a10, 0x1700)
bpf$OBJ_PIN_MAP(0x6, 0x0, 0x0)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0)
ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r2, 0xc020660b, 0x711000)
openat$cgroup_procs(r2, &(0x7f0000000200)='tasks\x00', 0x2, 0x0)
ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(0xffffffffffffffff, 0xc020660b, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0)
close(0xffffffffffffffff)
perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(0xffffffffffffffff, 0xc020660b, 0x711003)

[  235.854339] audit: type=1804 audit(1575571547.165:39): pid=7735 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir342497740/syzkaller.Lwl3LE/2/bus" dev="sda1" ino=16544 res=1
18:45:47 executing program 3:
ioctl$RTC_PIE_ON(0xffffffffffffffff, 0x7005)
creat(&(0x7f0000000300)='./file0\x00', 0x0)
clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000340)='devpts\x00', 0x0, &(0x7f00000001c0)='/selinux/policy\x00')
r0 = gettid()
tkill(r0, 0x38)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r1 = getpid()
sched_setattr(r1, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
r2 = socket$inet6(0xa, 0x2, 0x0)
recvmmsg(r2, &(0x7f0000008880), 0x4000000000000be, 0x0, 0x0)
pipe(&(0x7f00000002c0)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
fcntl$setpipe(r4, 0x407, 0x0)
write(r4, &(0x7f0000000340), 0x41395527)
vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext, 0x20}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r5 = socket$inet6_tcp(0xa, 0x1, 0x0)
openat$ashmem(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ashmem\x00', 0x100, 0x0)
open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x0, 0x4002011, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, 0xffffffffffffffff, 0x0)
unlinkat(0xffffffffffffffff, &(0x7f0000000300)='./file1\x00', 0x200)
open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0)
mkdirat(0xffffffffffffffff, 0x0, 0x0)
unlinkat(0xffffffffffffffff, 0x0, 0x0)
open(0x0, 0x0, 0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000002980)='/dev/null\x00', 0x1, 0x0)
accept4$alg(0xffffffffffffffff, 0x0, 0x0, 0x800)
accept4$inet6(0xffffffffffffffff, 0x0, &(0x7f00000029c0), 0x0)
bind$inet6(r5, &(0x7f0000d84000)={0xa, 0x2}, 0x1c)
sendto$inet6(r5, &(0x7f0000000380)="13ba0e6d24ef4d953069273a07078fec25a554c13414ec361e56b277cd523df88978fc44bdce393183cf732f102df6c17586442a07d7b7869efdb51a8ee85d63af031c7f636a3438b5ee0eb8f8025cc5ef2813d8a23ae1ba27e252345d6b1dd1c608781d58dcd9", 0x67, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0xffffffff}, 0x1c)
sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0)
sched_getaffinity(0x0, 0x8, &(0x7f0000000400))
ioctl$EXT4_IOC_SWAP_BOOT(0xffffffffffffffff, 0x6611)

[  235.945554] audit: type=1804 audit(1575571547.165:40): pid=7735 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir342497740/syzkaller.Lwl3LE/2/bus" dev="sda1" ino=16544 res=1
[  235.993165] audit: type=1804 audit(1575571547.175:41): pid=7735 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir342497740/syzkaller.Lwl3LE/2/bus" dev="sda1" ino=16544 res=1
18:45:47 executing program 5:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$sndtimer(&(0x7f0000000100)='/dev/snd/timer\x00', 0x0, 0x0)
ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000280))

[  236.047885] devpts: called with bogus options
[  236.123806] audit: type=1400 audit(1575571547.235:42): avc:  denied  { create } for  pid=7731 comm="syz-executor.5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
[  236.300425] audit: type=1804 audit(1575571547.605:43): pid=7757 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir342497740/syzkaller.Lwl3LE/3/file0" dev="sda1" ino=16547 res=1
18:45:47 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x297, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="300000001500010000000000000000f30100f1ff07000b00", @ANYRES32=0x0, @ANYBLOB="1400010000000001010000000000009ec2a5d23cfb63e0d3a0a7e8bf76d468ba4eb3793df7579ef209f61360710ea8dcce8f5035916ac42307af992d6944ca34e6f6d27992e06a52e522fc5c193b96873dc1153d497113dcf80d5c1813f6e6eeef09b07086971934d0194648fff97c884bd821428205f57aacad9a930e84709072034c6e7dce0ddab83aa19d79f890b207000000c6219df609884b09de81e5002325172c03381d887df0b43d8953d917d7abe094c24bfba7bd18a349e1ebe0359439662cd1dce9314ab356d0540b2f5afa389d01e7119a5850a3d5a83894d937b24be7b0aaba6e12491a2fc453dcf1b911a9e31895539acc619f5405beff2f6d698685c6b4e0c0036e17e1f5e821bc716695dac72a63aef505796a5521488312ef247cb38595ebd4f5d7223c3118367f09d2109a1e6f421ca904007da6bbe6011147d6fd35249eb6760576c18a09bea2db99d7cbb712cc975cb31f25ae36185cf087f434f5f76fd90b972a1209a43b1c138bc0d04bcbdbc97891f9ae1f81cdecb91af1ec000000"], 0x30}}, 0x800)

[  236.571780] audit: type=1400 audit(1575571547.885:44): avc:  denied  { write } for  pid=7766 comm="syz-executor.5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
[  236.763383] audit: type=1804 audit(1575571548.075:45): pid=7755 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir572349962/syzkaller.nhDJGk/3/memory.events" dev="sda1" ino=16542 res=1
[  236.796402] audit: type=1800 audit(1575571548.075:46): pid=7755 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed(directio) comm="syz-executor.2" name="memory.events" dev="sda1" ino=16542 res=0
[  236.884001] audit: type=1804 audit(1575571548.195:47): pid=7750 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir572349962/syzkaller.nhDJGk/3/memory.events" dev="sda1" ino=16542 res=1
[  236.917253] audit: type=1800 audit(1575571548.195:48): pid=7750 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed(directio) comm="syz-executor.2" name="memory.events" dev="sda1" ino=16542 res=0
18:45:49 executing program 1:
r0 = socket$kcm(0x10, 0x2, 0x4)
setsockopt$sock_attach_bpf(r0, 0x10e, 0x8, 0x0, 0x0)

18:45:49 executing program 0:
r0 = perf_event_open(&(0x7f0000000000)={0x1000000002, 0x70, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={<r1=>0xffffffffffffffff})
r2 = socket$inet_udplite(0x2, 0x2, 0x88)
r3 = fcntl$dupfd(r2, 0x0, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r3)

18:45:49 executing program 5:
socketpair$unix(0x1, 0x0, 0x0, 0x0)
fcntl$getflags(0xffffffffffffffff, 0x0)
r0 = gettid()
prctl$PR_SET_NAME(0xf, 0x0)
r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x0, 0x0)
connect$inet(r1, 0x0, 0x0)
creat(0x0, 0x0)
getsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0)
timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0))
ioctl$sock_inet6_udp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0)
timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0)
tkill(0x0, 0x0)
socket$inet6(0xa, 0x0, 0x0)
fsetxattr$trusted_overlay_redirect(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
tkill(r0, 0x1000000000016)

18:45:49 executing program 4:
r0 = socket(0x1, 0x1, 0x0)
getsockopt(r0, 0x0, 0x0, 0x0, 0x0)

18:45:49 executing program 3:
socketpair$unix(0x1, 0x0, 0x0, 0x0)
fcntl$getflags(0xffffffffffffffff, 0x0)
r0 = gettid()
prctl$PR_SET_NAME(0xf, 0x0)
openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0)
connect$inet(0xffffffffffffffff, 0x0, 0x0)
creat(0x0, 0x0)
getsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0)
timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0))
ioctl$sock_inet6_udp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0)
timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0)
tkill(0x0, 0x0)
socket$inet6(0xa, 0x0, 0x0)
fsetxattr$trusted_overlay_redirect(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
tkill(r0, 0x1000000000016)

18:45:49 executing program 2:
r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
close(r0)

18:45:49 executing program 4:
sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x2a1}, 0x0)
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cX \x04^\x1dm\xa4x\x88\xc7\xcd\xf0\xe5q\x04{^\xea)pu', 0x26e1, 0x0)
ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x4030582a, &(0x7f0000000040))
ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x6612, 0x0)

18:45:49 executing program 2:

18:45:49 executing program 1:

18:45:49 executing program 0:

18:45:49 executing program 5:

18:45:49 executing program 3:

18:45:49 executing program 2:

18:45:49 executing program 4:

18:45:49 executing program 1:

18:45:49 executing program 5:

18:45:49 executing program 0:

18:45:49 executing program 2:

18:45:49 executing program 3:

18:45:49 executing program 5:

18:45:49 executing program 4:

18:45:49 executing program 0:

18:45:49 executing program 3:

18:45:49 executing program 1:

18:45:49 executing program 2:

18:45:49 executing program 4:

18:45:50 executing program 0:

18:45:50 executing program 5:

18:45:50 executing program 1:

18:45:50 executing program 3:

18:45:50 executing program 2:

18:45:50 executing program 4:

18:45:50 executing program 5:

18:45:50 executing program 0:

18:45:50 executing program 3:

18:45:50 executing program 2:

18:45:50 executing program 1:

18:45:50 executing program 4:

18:45:50 executing program 5:

18:45:50 executing program 3:

18:45:50 executing program 2:

18:45:50 executing program 0:

18:45:50 executing program 1:

18:45:50 executing program 4:

18:45:50 executing program 3:

18:45:50 executing program 5:

18:45:50 executing program 2:

18:45:50 executing program 0:

18:45:50 executing program 5:

18:45:50 executing program 2:

18:45:50 executing program 4:

18:45:50 executing program 1:

18:45:50 executing program 3:

18:45:50 executing program 5:

18:45:50 executing program 1:

18:45:50 executing program 0:
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
wait4(0x0, 0x0, 0x80000000, 0x0)
ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014)
r0 = getpid()
tkill(r0, 0x9)
ioctl$KVM_SET_VCPU_EVENTS(0xffffffffffffffff, 0x4040aea0, 0x0)
gettid()
ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f00000002c0))
dup2(0xffffffffffffffff, 0xffffffffffffffff)
perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080))
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0)
timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=<r1=>0x0)
timer_settime(r1, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0)
futex(&(0x7f000000cffc)=0x4, 0x0, 0x4, 0x0, 0x0, 0x6)

18:45:50 executing program 2:

18:45:50 executing program 4:

18:45:50 executing program 3:

18:45:50 executing program 1:

18:45:50 executing program 5:

18:45:50 executing program 2:

18:45:50 executing program 3:

18:45:51 executing program 4:

18:45:51 executing program 2:

18:45:51 executing program 5:

18:45:51 executing program 1:

18:45:51 executing program 0:
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
wait4(0x0, 0x0, 0x80000000, 0x0)
ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014)
r0 = getpid()
tkill(r0, 0x9)
ioctl$KVM_SET_VCPU_EVENTS(0xffffffffffffffff, 0x4040aea0, 0x0)
gettid()
ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f00000002c0))
dup2(0xffffffffffffffff, 0xffffffffffffffff)
perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080))
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0)
timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=<r1=>0x0)
timer_settime(r1, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0)
futex(&(0x7f000000cffc)=0x4, 0x0, 0x4, 0x0, 0x0, 0x6)

18:45:51 executing program 3:

18:45:51 executing program 4:

18:45:51 executing program 2:

18:45:51 executing program 1:

18:45:51 executing program 5:

18:45:51 executing program 4:

18:45:51 executing program 5:

18:45:51 executing program 1:

18:45:51 executing program 3:

18:45:51 executing program 2:

18:45:52 executing program 1:

18:45:52 executing program 0:
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
wait4(0x0, 0x0, 0x80000000, 0x0)
ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014)
r0 = getpid()
tkill(r0, 0x9)
ioctl$KVM_SET_VCPU_EVENTS(0xffffffffffffffff, 0x4040aea0, 0x0)
gettid()
ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f00000002c0))
dup2(0xffffffffffffffff, 0xffffffffffffffff)
perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080))
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0)
timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=<r1=>0x0)
timer_settime(r1, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0)
futex(&(0x7f000000cffc)=0x4, 0x0, 0x4, 0x0, 0x0, 0x6)

18:45:52 executing program 5:

18:45:52 executing program 3:

18:45:52 executing program 2:

18:45:52 executing program 4:

18:45:52 executing program 1:

18:45:52 executing program 2:

18:45:52 executing program 3:

18:45:52 executing program 4:

18:45:52 executing program 1:

18:45:52 executing program 5:

18:45:52 executing program 0:
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
wait4(0x0, 0x0, 0x80000000, 0x0)
ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014)
r0 = getpid()
tkill(r0, 0x9)
ioctl$KVM_SET_VCPU_EVENTS(0xffffffffffffffff, 0x4040aea0, 0x0)
gettid()
ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f00000002c0))
dup2(0xffffffffffffffff, 0xffffffffffffffff)
perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080))
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0)
timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=<r1=>0x0)
timer_settime(r1, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0)
futex(&(0x7f000000cffc)=0x4, 0x0, 0x4, 0x0, 0x0, 0x6)

18:45:52 executing program 3:

18:45:52 executing program 4:

18:45:52 executing program 2:

18:45:52 executing program 1:

18:45:52 executing program 5:

18:45:53 executing program 3:

18:45:53 executing program 3:

18:45:53 executing program 4:

18:45:53 executing program 5:

18:45:53 executing program 1:

18:45:53 executing program 2:

18:45:53 executing program 0:
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
wait4(0x0, 0x0, 0x80000000, 0x0)
ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014)
r0 = getpid()
tkill(r0, 0x9)
ioctl$KVM_SET_VCPU_EVENTS(0xffffffffffffffff, 0x4040aea0, 0x0)
gettid()
ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f00000002c0))
dup2(0xffffffffffffffff, 0xffffffffffffffff)
perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080))
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0)
timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040))
futex(&(0x7f000000cffc)=0x4, 0x0, 0x4, 0x0, 0x0, 0x6)

18:45:53 executing program 4:

18:45:53 executing program 2:

18:45:53 executing program 3:

18:45:53 executing program 5:

18:45:53 executing program 1:

18:45:53 executing program 1:

18:45:53 executing program 2:

18:45:53 executing program 5:

18:45:53 executing program 3:

18:45:53 executing program 4:

18:45:53 executing program 5:

18:45:54 executing program 0:
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
wait4(0x0, 0x0, 0x80000000, 0x0)
ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014)
r0 = getpid()
tkill(r0, 0x9)
ioctl$KVM_SET_VCPU_EVENTS(0xffffffffffffffff, 0x4040aea0, 0x0)
gettid()
ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f00000002c0))
dup2(0xffffffffffffffff, 0xffffffffffffffff)
perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080))
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0)
timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040))
futex(&(0x7f000000cffc)=0x4, 0x0, 0x4, 0x0, 0x0, 0x6)

18:45:54 executing program 4:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000080)="baa100b000eef36cba2100ec66b9800000c00f326635001000000f30bad104ecc80080d267d9f8f30f1bb429000f20c06635200000000f22c067f3af", 0x3c}], 0x1, 0x0, 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000010c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fffffff}]})
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000010c0)={0x0, 0x0})
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getpid()
removexattr(0x0, 0x0)
syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x4100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x1000, &(0x7f0000000000/0x1000)=nil})
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000580)={[0xffffffffffffff0f, 0x0, 0x0, 0x2, 0x1ff, 0x0, 0x9, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000000000], 0x1f000})
ioctl$KVM_RUN(r2, 0xae80, 0x0)

18:45:54 executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000500)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_GET_CPUID2(r2, 0xc008ae91, &(0x7f0000000140))
setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0)
setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
creat(0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

18:45:54 executing program 2:
perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
creat(0x0, 0x0)
socket$inet6_tcp(0xa, 0x1, 0x0)
perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open$cgroup(&(0x7f0000000240)={0x3, 0x70, 0x40, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0xab8f8b23b3e5e218, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x3, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={&(0x7f0000000040)}, 0x0, 0x0, 0x0, 0x6, 0xf, 0x0, 0x8}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x8)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
wait4(0x0, 0x0, 0x80000000, 0x0)
getpid()
tkill(0x0, 0x9)
r0 = socket$inet6(0xa, 0x400000000803, 0x5f)
close(r0)
openat$vcsu(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcsu\x00', 0x1, 0x0)
write$FUSE_POLL(0xffffffffffffffff, &(0x7f0000000180)={0x18, 0x0, 0x4, {0x44a8}}, 0x18)
r1 = open(&(0x7f0000000100)='./file1\x00', 0x143042, 0x0)
ftruncate(r1, 0x200004)
sendfile(r0, r1, 0x0, 0x80001d00c0d0)

18:45:54 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000500)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_GET_CPUID2(r2, 0xc008ae91, &(0x7f0000000140))
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0)
prctl$PR_SVE_SET_VL(0x32, 0x0)
setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0)
write$FUSE_ENTRY(0xffffffffffffffff, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)
ioctl$KVM_SET_REGS(r2, 0x4090ae82, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

18:45:54 executing program 5:
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
setxattr$security_selinux(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='security.selinux\x00', &(0x7f0000000100)='system_u:object_r:dhcpc_state_t:s0\x00', 0x23, 0x1)
r2 = dup3(r0, r1, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
r3 = gettid()
rt_sigqueueinfo(r3, 0x0, &(0x7f0000000000)={0x0, 0x0, 0xfffffffa})
syz_open_procfs$namespace(r3, &(0x7f0000000140)='ns/pid\x00')
r4 = socket$inet(0x2, 0x3, 0x4)
sendto$inet(r4, 0x0, 0x0, 0x200007fd, 0x0, 0x0)
fdatasync(r4)

[  243.471510] ==================================================================
[  243.471621] BUG: KASAN: slab-out-of-bounds in vcs_scr_readw+0xc2/0xd0
[  243.471632] Read of size 2 at addr ffff8882197c1400 by task syz-executor.2/8056
[  243.471636] 
[  243.471651] CPU: 0 PID: 8056 Comm: syz-executor.2 Not tainted 4.19.88-syzkaller #0
[  243.471659] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  243.471664] Call Trace:
[  243.471725]  dump_stack+0x197/0x210
[  243.471742]  ? vcs_scr_readw+0xc2/0xd0
[  243.471758]  print_address_description.cold+0x7c/0x20d
[  243.471773]  ? vcs_scr_readw+0xc2/0xd0
[  243.471787]  kasan_report.cold+0x8c/0x2ba
[  243.471807]  __asan_report_load2_noabort+0x14/0x20
[  243.471820]  vcs_scr_readw+0xc2/0xd0
[  243.471835]  vcs_write+0x646/0xcf0
[  243.471861]  ? vcs_size+0x240/0x240
[  243.471878]  ? find_get_entry+0x3e1/0xa00
[  243.471905]  __vfs_write+0x114/0x810
[  243.471918]  ? ondemand_readahead+0x54b/0xcd0
[  243.471931]  ? vcs_size+0x240/0x240
[  243.471944]  ? kernel_read+0x120/0x120
[  243.471957]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  243.471971]  ? copy_page_to_iter+0x45a/0xd50
[  243.472005]  __kernel_write+0x110/0x390
[  243.472022]  write_pipe_buf+0x15d/0x1f0
[  243.472036]  ? do_splice_direct+0x2a0/0x2a0
[  243.472050]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  243.472063]  ? splice_from_pipe_next.part.0+0x255/0x2f0
[  243.472075]  ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20
[  243.472089]  __splice_from_pipe+0x391/0x7d0
[  243.472101]  ? do_splice_direct+0x2a0/0x2a0
[  243.472120]  ? do_splice_direct+0x2a0/0x2a0
[  243.472132]  splice_from_pipe+0x108/0x170
[  243.472148]  ? splice_shrink_spd+0xd0/0xd0
[  243.472172]  ? security_file_permission+0x89/0x230
[  243.472190]  default_file_splice_write+0x3c/0x90
[  243.472202]  ? generic_splice_sendpage+0x50/0x50
[  243.472218]  direct_splice_actor+0x123/0x190
[  243.472234]  splice_direct_to_actor+0x2e7/0x890
[  243.472246]  ? generic_pipe_buf_nosteal+0x10/0x10
[  243.472258]  ? do_splice_to+0x180/0x180
[  243.472267]  ? security_file_permission+0x89/0x230
[  243.472279]  ? rw_verify_area+0x118/0x360
[  243.472303]  do_splice_direct+0x1da/0x2a0
[  243.472315]  ? splice_direct_to_actor+0x890/0x890
[  243.472328]  ? security_file_permission+0x89/0x230
[  243.472359]  ? rw_verify_area+0x118/0x360
[  243.472371]  do_sendfile+0x597/0xce0
[  243.472388]  ? do_compat_pwritev64+0x1c0/0x1c0
[  243.472397]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[  243.472410]  ? put_timespec64+0xda/0x140
[  243.472428]  __x64_sys_sendfile64+0x1dd/0x220
[  243.472440]  ? __ia32_sys_sendfile+0x230/0x230
[  243.472450]  ? do_syscall_64+0x26/0x620
[  243.472462]  ? lockdep_hardirqs_on+0x415/0x5d0
[  243.472473]  ? trace_hardirqs_on+0x67/0x220
[  243.472486]  do_syscall_64+0xfd/0x620
[  243.472543]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  243.472551] RIP: 0033:0x45a679
[  243.472561] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[  243.472566] RSP: 002b:00007f86a59a1c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
[  243.472576] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000045a679
[  243.472581] RDX: 0000000000000000 RSI: 0000000000000007 RDI: 0000000000000006
[  243.472587] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
[  243.472593] R10: 000080001d00c0d0 R11: 0000000000000246 R12: 00007f86a59a26d4
[  243.472598] R13: 00000000004c8f39 R14: 00000000004e0a98 R15: 00000000ffffffff
[  243.472611] 
[  243.472616] Allocated by task 1:
[  243.472626]  save_stack+0x45/0xd0
[  243.472634]  kasan_kmalloc+0xce/0xf0
[  243.472641]  __kmalloc+0x15d/0x750
[  243.472649]  vc_do_resize+0x262/0x14a0
[  243.472656]  vc_resize+0x4d/0x60
[  243.472682]  fbcon_init+0x1062/0x1b00
[  243.472689]  visual_init+0x337/0x620
[  243.472696]  do_bind_con_driver+0x549/0x8c0
[  243.472704]  do_take_over_console+0x449/0x590
[  243.472711]  do_fbcon_takeover+0x116/0x220
[  243.472719]  fbcon_event_notify+0x1786/0x1dba
[  243.472730]  notifier_call_chain+0xc2/0x230
[  243.472739]  blocking_notifier_call_chain+0x94/0xb0
[  243.472762]  fb_notifier_call_chain+0x25/0x30
[  243.472770]  register_framebuffer+0x61d/0xa70
[  243.472792]  vga16fb_probe+0x711/0x825
[  243.472816]  platform_drv_probe+0x93/0x160
[  243.472823]  really_probe+0x4a0/0x650
[  243.472830]  driver_probe_device+0x103/0x1b0
[  243.472838]  __device_attach_driver+0x225/0x290
[  243.472861]  bus_for_each_drv+0x16c/0x1f0
[  243.472868]  __device_attach+0x237/0x350
[  243.472875]  device_initial_probe+0x1b/0x20
[  243.472887]  bus_probe_device+0x1f7/0x2a0
[  243.472895]  device_add+0xb42/0x1760
[  243.472903]  platform_device_add+0x366/0x6f0
[  243.472911]  vga16fb_init+0x15f/0x1d6
[  243.472920]  do_one_initcall+0x107/0x78c
[  243.472939]  kernel_init_freeable+0x4d4/0x5c8
[  243.472947]  kernel_init+0x12/0x1c4
[  243.472954]  ret_from_fork+0x24/0x30
[  243.472956] 
[  243.472960] Freed by task 0:
[  243.472962] (stack is not available)
[  243.472965] 
[  243.472974] The buggy address belongs to the object at ffff8882197c0140
[  243.472974]  which belongs to the cache kmalloc-8192 of size 8192
[  243.472984] The buggy address is located 4800 bytes inside of
[  243.472984]  8192-byte region [ffff8882197c0140, ffff8882197c2140)
[  243.472988] The buggy address belongs to the page:
[  243.472997] page:ffffea000865f000 count:1 mapcount:0 mapping:ffff88812c315080 index:0x0 compound_mapcount: 0
[  243.473007] flags: 0x57ffe0000008100(slab|head)
[  243.473020] raw: 057ffe0000008100 ffffea0008688108 ffffea0008631008 ffff88812c315080
[  243.473030] raw: 0000000000000000 ffff8882197c0140 0000000100000001 0000000000000000
[  243.473034] page dumped because: kasan: bad access detected
[  243.473036] 
[  243.473039] Memory state around the buggy address:
[  243.473046]  ffff8882197c1300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[  243.473053]  ffff8882197c1380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[  243.473059] >ffff8882197c1400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  243.473062]                    ^
[  243.473069]  ffff8882197c1480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  243.473076]  ffff8882197c1500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  243.473079] ==================================================================
[  243.473082] Disabling lock debugging due to kernel taint
[  243.477047] kobject: 'kvm' (0000000032fb01bf): kobject_uevent_env
[  243.477095] kobject: 'kvm' (0000000032fb01bf): fill_kobj_path: path = '/devices/virtual/misc/kvm'
[  243.491718] Kernel panic - not syncing: panic_on_warn set ...
[  243.491718] 
[  243.491735] CPU: 0 PID: 8056 Comm: syz-executor.2 Tainted: G    B             4.19.88-syzkaller #0
[  243.491742] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  243.491746] Call Trace:
[  243.491764]  dump_stack+0x197/0x210
[  243.491780]  ? vcs_scr_readw+0xc2/0xd0
[  243.491791]  panic+0x26a/0x50e
[  243.491801]  ? __warn_printk+0xf3/0xf3
[  243.491814]  ? vcs_scr_readw+0xc2/0xd0
[  243.491827]  ? preempt_schedule+0x4b/0x60
[  243.491841]  ? ___preempt_schedule+0x16/0x18
[  243.491854]  ? trace_hardirqs_on+0x5e/0x220
[  243.491868]  ? vcs_scr_readw+0xc2/0xd0
[  243.491888]  kasan_end_report+0x47/0x4f
[  243.491900]  kasan_report.cold+0xa9/0x2ba
[  243.491916]  __asan_report_load2_noabort+0x14/0x20
[  243.491927]  vcs_scr_readw+0xc2/0xd0
[  243.491940]  vcs_write+0x646/0xcf0
[  243.491959]  ? vcs_size+0x240/0x240
[  243.491972]  ? find_get_entry+0x3e1/0xa00
[  243.491988]  __vfs_write+0x114/0x810
[  243.492000]  ? ondemand_readahead+0x54b/0xcd0
[  243.492012]  ? vcs_size+0x240/0x240
[  243.492024]  ? kernel_read+0x120/0x120
[  243.492037]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  243.492049]  ? copy_page_to_iter+0x45a/0xd50
[  243.492072]  __kernel_write+0x110/0x390
[  243.492085]  write_pipe_buf+0x15d/0x1f0
[  243.492098]  ? do_splice_direct+0x2a0/0x2a0
[  243.492109]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  243.492121]  ? splice_from_pipe_next.part.0+0x255/0x2f0
[  243.492133]  ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20
[  243.492146]  __splice_from_pipe+0x391/0x7d0
[  243.492158]  ? do_splice_direct+0x2a0/0x2a0
[  243.492172]  ? do_splice_direct+0x2a0/0x2a0
[  243.492183]  splice_from_pipe+0x108/0x170
[  243.492196]  ? splice_shrink_spd+0xd0/0xd0
[  243.492215]  ? security_file_permission+0x89/0x230
[  243.492229]  default_file_splice_write+0x3c/0x90
[  243.492240]  ? generic_splice_sendpage+0x50/0x50
[  243.492251]  direct_splice_actor+0x123/0x190
[  243.492263]  splice_direct_to_actor+0x2e7/0x890
[  243.492275]  ? generic_pipe_buf_nosteal+0x10/0x10
[  243.492298]  ? do_splice_to+0x180/0x180
[  243.492308]  ? security_file_permission+0x89/0x230
[  243.492320]  ? rw_verify_area+0x118/0x360
[  243.492332]  do_splice_direct+0x1da/0x2a0
[  243.492343]  ? splice_direct_to_actor+0x890/0x890
[  243.492356]  ? security_file_permission+0x89/0x230
[  243.492384]  ? rw_verify_area+0x118/0x360
[  243.492397]  do_sendfile+0x597/0xce0
[  243.492415]  ? do_compat_pwritev64+0x1c0/0x1c0
[  243.492426]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[  243.492440]  ? put_timespec64+0xda/0x140
[  243.492457]  __x64_sys_sendfile64+0x1dd/0x220
[  243.492470]  ? __ia32_sys_sendfile+0x230/0x230
[  243.492483]  ? do_syscall_64+0x26/0x620
[  243.492496]  ? lockdep_hardirqs_on+0x415/0x5d0
[  243.492508]  ? trace_hardirqs_on+0x67/0x220
[  243.492523]  do_syscall_64+0xfd/0x620
[  243.492537]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  243.492547] RIP: 0033:0x45a679
[  243.492560] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[  243.492567] RSP: 002b:00007f86a59a1c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
[  243.492579] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000045a679
[  243.492585] RDX: 0000000000000000 RSI: 0000000000000007 RDI: 0000000000000006
[  243.492592] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
[  243.492600] R10: 000080001d00c0d0 R11: 0000000000000246 R12: 00007f86a59a26d4
[  243.492607] R13: 00000000004c8f39 R14: 00000000004e0a98 R15: 00000000ffffffff
[  243.493845] Kernel Offset: disabled
[  244.452195] Rebooting in 86400 seconds..