[....] Starting OpenBSD Secure Shell server: sshd[ 49.740362] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. [ 50.097021] audit: type=1800 audit(1538986180.146:29): pid=5841 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 50.116759] audit: type=1800 audit(1538986180.146:30): pid=5841 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 [ 51.142972] random: sshd: uninitialized urandom read (32 bytes read) Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 51.604543] random: sshd: uninitialized urandom read (32 bytes read) [ 53.187596] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.0.120' (ECDSA) to the list of known hosts. [ 58.882052] random: sshd: uninitialized urandom read (32 bytes read) 2018/10/08 08:09:50 fuzzer started [ 62.914394] random: cc1: uninitialized urandom read (8 bytes read) 2018/10/08 08:09:55 dialing manager at 10.128.0.26:36867 2018/10/08 08:09:55 syscalls: 1 2018/10/08 08:09:55 code coverage: enabled 2018/10/08 08:09:55 comparison tracing: CONFIG_KCOV_ENABLE_COMPARISONS is not enabled 2018/10/08 08:09:55 setuid sandbox: enabled 2018/10/08 08:09:55 namespace sandbox: enabled 2018/10/08 08:09:55 Android sandbox: /sys/fs/selinux/policy does not exist 2018/10/08 08:09:55 fault injection: enabled 2018/10/08 08:09:55 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2018/10/08 08:09:55 net packed injection: enabled 2018/10/08 08:09:55 net device setup: enabled [ 67.569007] random: crng init done 08:11:31 executing program 0: sendmsg(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000100)=@pptp={0x18, 0x2, {0x0, @multicast1}}, 0x213, &(0x7f0000000980), 0x0, &(0x7f0000000100)}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'bpq0\x00', 0x21}) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='ns\x00') getdents(r1, &(0x7f0000000040)=""/46, 0x2e) socketpair(0x1, 0x5, 0x0, &(0x7f0000000740)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$FS_IOC_GETFSMAP(0xffffffffffffffff, 0xc0c0583b, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, [], [{0x0, 0x0, 0x0, 0x7, 0x7f}]}) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x89f1, &(0x7f0000000080)='ip6tnl0\x00') [ 162.313880] IPVS: ftp: loaded support on port[0] = 21 [ 164.206713] bridge0: port 1(bridge_slave_0) entered blocking state [ 164.213399] bridge0: port 1(bridge_slave_0) entered disabled state [ 164.221390] device bridge_slave_0 entered promiscuous mode [ 164.326235] bridge0: port 2(bridge_slave_1) entered blocking state [ 164.332850] bridge0: port 2(bridge_slave_1) entered disabled state [ 164.340760] device bridge_slave_1 entered promiscuous mode [ 164.442707] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 164.544298] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 164.871934] bond0: Enslaving bond_slave_0 as an active interface with an up link 08:11:35 executing program 1: bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000080), 0x4) [ 164.980410] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 165.149664] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 165.157514] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 165.521287] IPVS: ftp: loaded support on port[0] = 21 [ 165.707215] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 165.715015] team0: Port device team_slave_0 added [ 165.825216] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 165.832978] team0: Port device team_slave_1 added [ 166.053073] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 166.060148] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 166.068644] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 166.187370] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 166.194518] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 166.203204] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 166.326855] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 166.334542] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 166.343354] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 166.549159] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 166.556781] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 166.565397] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 168.144146] bridge0: port 1(bridge_slave_0) entered blocking state [ 168.150665] bridge0: port 1(bridge_slave_0) entered disabled state [ 168.158809] device bridge_slave_0 entered promiscuous mode [ 168.336300] bridge0: port 2(bridge_slave_1) entered blocking state [ 168.342887] bridge0: port 2(bridge_slave_1) entered disabled state [ 168.350761] device bridge_slave_1 entered promiscuous mode [ 168.517437] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 168.670936] bridge0: port 2(bridge_slave_1) entered blocking state [ 168.677568] bridge0: port 2(bridge_slave_1) entered forwarding state [ 168.684477] bridge0: port 1(bridge_slave_0) entered blocking state [ 168.690897] bridge0: port 1(bridge_slave_0) entered forwarding state [ 168.699385] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 168.739328] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 168.824459] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 169.269868] bond0: Enslaving bond_slave_0 as an active interface with an up link 08:11:39 executing program 2: r0 = syz_open_dev$loop(&(0x7f0000000080)='/dev/loop#\x00', 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000005880)='attr/keycreate\x00') ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x7fffffff, 0x4, 0x0, 0x0, 0x0, 0x0, "27e9ed97c445a668acd4fe04cd639c70de76363cd797dab4aa1b4576180aa2addb613dc85d748366ee9a23afd4e9fe7e9d08538ba2673e78a3bd3f5fa50a0fc7", "0443695b2e216370a1c22cb77af8384ffda34f7a55e58a76fe262935137fde5351387dc53c36a33167eb73ca38dc4c62dc401602178441b1147e87730ef45c88", "843731f36d26ccf60106503e4dd40c203ecadd0ae5c0515ac12f0bac87661dfd", [0x0, 0xbe]}) [ 169.518637] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 169.893127] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 169.900227] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 170.282141] IPVS: ftp: loaded support on port[0] = 21 [ 170.623483] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 170.631951] team0: Port device team_slave_0 added [ 170.825285] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 170.833208] team0: Port device team_slave_1 added [ 171.111199] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 171.118353] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 171.126892] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 171.380202] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 171.387367] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 171.396150] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 171.640307] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 171.647966] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 171.656744] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 171.886821] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 171.894746] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 171.903339] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 173.908887] bridge0: port 1(bridge_slave_0) entered blocking state [ 173.915530] bridge0: port 1(bridge_slave_0) entered disabled state [ 173.923653] device bridge_slave_0 entered promiscuous mode [ 174.152796] bridge0: port 2(bridge_slave_1) entered blocking state [ 174.159269] bridge0: port 2(bridge_slave_1) entered disabled state [ 174.167265] device bridge_slave_1 entered promiscuous mode [ 174.394202] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 174.532490] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 174.568235] bridge0: port 2(bridge_slave_1) entered blocking state [ 174.574760] bridge0: port 2(bridge_slave_1) entered forwarding state [ 174.581570] bridge0: port 1(bridge_slave_0) entered blocking state [ 174.588088] bridge0: port 1(bridge_slave_0) entered forwarding state [ 174.596104] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 174.952534] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 175.106099] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 175.336763] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 175.642824] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 175.649847] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 175.898828] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 175.906017] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready 08:11:46 executing program 3: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdir(&(0x7f0000000040)='./control\x00', 0x0) rmdir(&(0x7f0000000000)='./control\x00') [ 176.643360] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 176.650987] team0: Port device team_slave_0 added [ 176.834409] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 176.842341] team0: Port device team_slave_1 added [ 177.054782] IPVS: ftp: loaded support on port[0] = 21 [ 177.115868] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 177.123042] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 177.131432] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 177.415108] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 177.422277] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 177.430490] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 177.754105] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 177.761925] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 177.770452] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 177.990805] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 177.998284] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 178.007080] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 178.216170] 8021q: adding VLAN 0 to HW filter on device bond0 [ 179.460504] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 180.462821] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 180.469230] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 180.477071] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 181.231857] bridge0: port 2(bridge_slave_1) entered blocking state [ 181.238328] bridge0: port 2(bridge_slave_1) entered forwarding state [ 181.245326] bridge0: port 1(bridge_slave_0) entered blocking state [ 181.251799] bridge0: port 1(bridge_slave_0) entered forwarding state [ 181.259986] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 181.266802] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 181.530992] 8021q: adding VLAN 0 to HW filter on device team0 [ 181.680287] bridge0: port 1(bridge_slave_0) entered blocking state [ 181.686956] bridge0: port 1(bridge_slave_0) entered disabled state [ 181.695601] device bridge_slave_0 entered promiscuous mode [ 181.931570] bridge0: port 2(bridge_slave_1) entered blocking state [ 181.938128] bridge0: port 2(bridge_slave_1) entered disabled state [ 181.946406] device bridge_slave_1 entered promiscuous mode [ 182.258691] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 182.589221] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 183.363123] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 183.623461] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 183.899247] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 183.906409] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 184.138201] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 184.145306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready 08:11:54 executing program 4: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f00000009c0)=""/246) preadv(r0, &(0x7f0000000540)=[{&(0x7f0000000140)=""/131, 0x83}], 0x1, 0x0) [ 185.040725] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 185.048753] team0: Port device team_slave_0 added [ 185.415354] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 185.423178] team0: Port device team_slave_1 added [ 185.713495] IPVS: ftp: loaded support on port[0] = 21 [ 185.752274] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 185.759678] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 185.768271] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 185.786870] 8021q: adding VLAN 0 to HW filter on device bond0 [ 186.062688] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 186.069749] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 186.078249] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 186.383159] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 186.390626] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 186.399432] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 186.705526] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 186.713176] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 186.721729] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 186.972490] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 188.236500] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 188.242950] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 188.250612] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 08:11:59 executing program 0: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdir(&(0x7f0000000040)='./control\x00', 0x0) open(&(0x7f0000000000)='./control\x00', 0xc40beb2474dfd22a, 0x0) [ 189.585129] 8021q: adding VLAN 0 to HW filter on device team0 08:11:59 executing program 0: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f00000004c0)=""/246) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f0000000000)={0x100000001}) ioctl$EVIOCGREP(r0, 0x40047451, &(0x7f0000000000)=""/174) ioctl$sock_inet_tcp_SIOCINQ(r0, 0x541b, &(0x7f00000000c0)) 08:12:00 executing program 0: socket$inet_udp(0x2, 0x2, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000006000/0x1000)=nil, 0x1000, 0x0, 0x20011, r0, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0xa00, 0x0, 0x12, r0, 0x0) r1 = syz_open_dev$sndpcmp(&(0x7f0000000080)='/dev/snd/pcmC#D#p\x00', 0x4, 0x2001) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x1004001fd) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/bnep\x00') ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f0000000040)) keyctl$restrict_keyring(0xb, 0xfffffffffffffffb, &(0x7f00000000c0)='blacklist\x00', &(0x7f0000000100)='\x00') [ 190.411048] bridge0: port 2(bridge_slave_1) entered blocking state [ 190.417570] bridge0: port 2(bridge_slave_1) entered forwarding state [ 190.424555] bridge0: port 1(bridge_slave_0) entered blocking state [ 190.430993] bridge0: port 1(bridge_slave_0) entered forwarding state [ 190.439223] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 190.488153] binder_alloc: binder_alloc_mmap_handler: 6769 20ffc000-20ffd000 already mapped failed -16 [ 190.536180] binder_alloc: binder_alloc_mmap_handler: 6769 20006000-20007000 already mapped failed -16 08:12:00 executing program 0: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000961fe4)=[@in6={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff}, 0x100000001}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f00000000c0)=ANY=[@ANYBLOB="e9ffffffffff001e0402b0ba315cbbe5f3f3abbe1663e4a4290e612ee42f0c290d06ed7fe5d61beef994805e6e2c36896b3111431d1c093dfb90be1ca6d43f6bc97c16ec5bcd527f6da04fbf830f0510c808efa887f6f703da247f44a0a6f14fd225d9061abf1b1e33bcc35fd627416519e06d2907bb203d02c62876b501486ecb6547677f2c807efe43dbb09b0407947d7ceef1704cdb928d2c52c3d21966a7a6d53d6685c8de4c57eed3dc7ca75d4f8a7681a5b56791dc8110582019c56d50a7d5fac0de7b6442f7dfd6f85327796e300b2464371c8fa6f862ccfb30f4ee55c134e0007cf91a6503c92b7de00481057a40ae61febf9e90491ea94dba495b8d326a9337f56901b10a03a13280bea6f247deb80314debc5131038dc622bb01abbfb564e168223bebcba87db78304ea9085d1950000000000000000be5951c7f796a8fcba822bc7f2", @ANYRES32=0x0], &(0x7f000095dffc)=0x8) r2 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x0, 0x80202) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffff9c, 0xc0206434, &(0x7f0000000040)={0x80000001, 0x0, 0x10001, 0x1}) ioctl$DRM_IOCTL_AGP_BIND(r2, 0x40106436, &(0x7f0000000080)={r3, 0x1f}) setrlimit(0x7, &(0x7f000046eff0)) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, &(0x7f000095cffe)={r1}, &(0x7f000095c000)=0x8) [ 191.002375] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 191.564791] bridge0: port 1(bridge_slave_0) entered blocking state [ 191.571250] bridge0: port 1(bridge_slave_0) entered disabled state [ 191.579594] device bridge_slave_0 entered promiscuous mode 08:12:01 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r0, 0x1, 0xa, &(0x7f0000cecffc), 0x4) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000000)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) recvmmsg(r0, &(0x7f0000004540), 0x0, 0x0, &(0x7f00000046c0)={0x77359400}) recvmsg(r0, &(0x7f0000000780)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000680), 0x0, &(0x7f0000000700)=""/102, 0xfffffffffffffe23}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000240)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001c000600000000000000000000000000"], 0x14}}, 0x0) [ 191.929469] bridge0: port 2(bridge_slave_1) entered blocking state [ 191.936190] bridge0: port 2(bridge_slave_1) entered disabled state [ 191.944401] device bridge_slave_1 entered promiscuous mode [ 192.061411] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 192.194104] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 192.368865] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready 08:12:02 executing program 0: mknodat(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', 0xa001, 0x8001) 08:12:02 executing program 0: open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x5a) openat$uhid(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uhid\x00', 0x0, 0x0) unshare(0x100) openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x20000, 0x0) pselect6(0x40, &(0x7f0000000000)={0x8}, &(0x7f0000000040), &(0x7f0000000300), &(0x7f0000000280)={0x0, 0x1c9c380}, &(0x7f00000003c0)={&(0x7f0000000380), 0x8}) [ 192.728009] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready 08:12:03 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f00000003c0)=ANY=[@ANYBLOB="bacbd5abf8b13e6c4c11c212ed0f712c49c15f90e225c594b04ff5a4b6c2b7956562cf01a90c9c322107c9571f82739d3da9fb404013d30d9faca71ddceb9ad38c41e52044ee3c4e06d130520e408346c0af5a0ec4d672e4d96b2f3461411968dfae066d268b2f949dfb33e521857dbfda778483a9f67e23fbe744a85fdb56964142935f160b367d8053d3486f3ea93165291afdb7d5971075c044222edb0900c35b"], &(0x7f00000002c0)=0x1) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f00000004c0)={{{@in6=@remote, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast2}}, &(0x7f0000000300)=0xffffffffffffffe3) ioctl$sock_inet6_SIOCDIFADDR(0xffffffffffffffff, 0x8936, &(0x7f0000000280)={@loopback, 0x2c, r2}) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0xfb, &(0x7f00000001c0), 0x4) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev}, 0x1c) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bond_slave_0\x00', 0x0}) r5 = msgget(0x2, 0x10) msgsnd(r5, &(0x7f0000000680)={0x3, "f1465ca15ef7c36cf8f61186db52dd7575dcbb68fe731502a62f0621aa5e6b0b873333"}, 0x2b, 0x800) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f00000000c0)={@remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8]}, 0x75, r4}) r6 = syz_open_dev$mouse(&(0x7f0000000100)='/dev/input/mouse#\x00', 0xc88, 0x2000) ioctl$VHOST_SET_VRING_KICK(r6, 0x4008af20, &(0x7f0000000140)={0x0, r1}) clock_nanosleep(0x2, 0x1, &(0x7f0000000340)={0x0, 0x1c9c380}, &(0x7f0000000380)) socket$l2tp(0x18, 0x1, 0x1) r7 = semget$private(0x0, 0x2, 0x10a) fcntl$F_SET_RW_HINT(r6, 0x40c, &(0x7f0000000480)=0x3) stat(&(0x7f0000000700)='./file0\x00', &(0x7f0000000740)) fstat(r0, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) semctl$IPC_SET(r7, 0x0, 0x1, &(0x7f0000000840)={{0x3ff, r3, 0x0, r3, r8, 0x40, 0x34c5}, 0x6, 0x9, 0xfff}) ioctl$sock_inet6_udp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000180)) openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x509000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r9 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r9, &(0x7f0000e33fe0)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x0, 0x0, @loopback}, 0x1c) [ 193.362703] hrtimer: interrupt took 34896 ns [ 193.826045] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 194.144843] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 194.414102] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 194.421214] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 194.622335] 8021q: adding VLAN 0 to HW filter on device bond0 [ 194.716531] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 194.723850] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 195.596289] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 195.604418] team0: Port device team_slave_0 added [ 195.696488] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 195.811541] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 195.819665] team0: Port device team_slave_1 added [ 195.994244] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 196.004910] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 196.013330] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 196.268570] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 196.275967] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 196.284578] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 196.506346] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 196.515362] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 196.523988] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 196.542213] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 196.548888] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 196.556647] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 196.746435] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 196.754074] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 196.762723] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready 08:12:07 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000000)={0x40000000, 0x4000000000000000, &(0x7f0000000380)={&(0x7f0000000300)={0x2, 0x2, 0x0, 0x9, 0x10, 0x0, 0x0, 0x0, [@sadb_x_sa2={0x2, 0x13, 0x2}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb]}}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @mcast1={0x11e, 0x17, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0x17}}}]}, 0x80}}, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000480), 0x1000000000000064, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) [ 197.507333] 8021q: adding VLAN 0 to HW filter on device team0 [ 198.909084] bridge0: port 2(bridge_slave_1) entered blocking state [ 198.915654] bridge0: port 2(bridge_slave_1) entered forwarding state [ 198.922547] bridge0: port 1(bridge_slave_0) entered blocking state [ 198.928974] bridge0: port 1(bridge_slave_0) entered forwarding state [ 198.937026] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 198.943744] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 200.625114] 8021q: adding VLAN 0 to HW filter on device bond0 [ 201.172531] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready 08:12:11 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x8000000000005, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000200), &(0x7f0000000240)=0x8) getsockopt$inet_sctp6_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000000340), &(0x7f0000000380)=0x8) [ 201.778784] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 201.785273] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 201.792911] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 202.257881] 8021q: adding VLAN 0 to HW filter on device team0 [ 204.616003] 8021q: adding VLAN 0 to HW filter on device bond0 08:12:15 executing program 3: r0 = syz_open_dev$amidi(&(0x7f0000000080)='/dev/amidi#\x00', 0x0, 0x0) geteuid() io_setup(0x8, &(0x7f0000000040)) ioctl$SNDRV_TIMER_IOCTL_PARAMS(0xffffffffffffffff, 0x40505412, &(0x7f00000002c0)={0x0, 0x6, 0x4}) clone(0x802122001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0xe, &(0x7f0000001000)=ANY=[@ANYBLOB="b700000005ed0050bfa30000000000000703000028feffff7a0af0fff8ffffff71a4f0ff00000000b7060000000000012d400500000000005504000001ed00001d040000000000002c460000000000006b0a00fe000000008500000007000000b7000000000000009500000000000000"], &(0x7f0000000100)='EPL\x00'}, 0x48) perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4002, 0x0, 0x1, 0x0, 0x0, 0x8, 0xfff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe48, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x961a, 0xb56f, 0x80000001, 0x1, 0x101, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x7, 0x1, @perf_config_ext={0x7}, 0x0, 0x0, 0xfffffffffffffffc}, 0xffffffffffffffff, 0x5, 0xffffffffffffffff, 0x2) exit(0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100)={0x0}, &(0x7f00000000c0)=0xffffffffffffff40) openat$vcs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vcs\x00', 0x40, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000280)={0x0, 0x3, 0xb31, 0x4}) ptrace(0xffffffffffffffff, r1) [ 205.041281] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 205.318667] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 205.325092] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 205.332837] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 205.579850] 8021q: adding VLAN 0 to HW filter on device team0 08:12:17 executing program 4: socket$netlink(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x10001, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) timer_gettime(0x0, &(0x7f0000002080)) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000480)="2f67726f3c23fb57e6c60f1f4b45b74d999a9a8c2ce15b26e518a4cb3a9cd12dcea440d899c22c652b3a471b4a7db7f3fef6e02e2be389de133945a385bd81e9bdeeee03000000000000005b540745df4b1dee483b157624c5bc719a099e6a3509000000398c34", 0x2761, 0x0) write$cgroup_pid(r0, &(0x7f0000000080), 0xfffffe38) openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000000100)=0xc) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1a1, 0x0) r1 = gettid() sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000d40)={&(0x7f0000000100)=@proc={0x10, 0x0, 0x25dfdbfd}, 0xc, &(0x7f0000000440)=[{&(0x7f00000002c0)={0x10, 0x34}, 0x10}], 0x1, &(0x7f0000000d00)}, 0x0) getpeername$netlink(0xffffffffffffffff, &(0x7f0000000300), &(0x7f0000000340)=0xc) getsockopt$IPT_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x0, 0x43, &(0x7f0000000580)={'icmp6\x00'}, &(0x7f00000005c0)=0x1e) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x660c, 0x0) get_robust_list(0x0, &(0x7f0000000680)=&(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)}, &(0x7f00000006c0)=0x18) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000500)={[], 0x7, 0x7, 0x9, 0x4, 0x0, r1}) writev(0xffffffffffffffff, &(0x7f0000e11ff0), 0x0) mount(&(0x7f0000000740)=ANY=[], &(0x7f0000000900)='./file0\x00', &(0x7f0000000940)='ramfs\x00', 0x0, &(0x7f00000008c0)='\x00') socketpair(0x9, 0x6, 0x1, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$FS_IOC_FSSETXATTR(r2, 0x401c5820, &(0x7f00000003c0)={0xddb7, 0x0, 0x0, 0x0, 0xfffffffffffff49c}) 08:12:17 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu_sys\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x1b) sendmsg$nl_xfrm(r0, &(0x7f0000001fc0)={&(0x7f00000002c0), 0xc, &(0x7f0000001f80)={&(0x7f00000019c0)=@newsa={0x138, 0x10, 0x409, 0x0, 0x0, {{@in6=@dev, @in=@local}, {@in6=@mcast2, 0x0, 0x32}, @in6, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'wp256-generic\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x45}, 0x4044) write$uinput_user_dev(r1, &(0x7f0000000300)={'syz1\x00', {0x5, 0x7f, 0x4, 0x2}, 0x43, [0x4, 0x2, 0xff, 0x0, 0x5, 0x7ff, 0x8001, 0xfffffffffffffffa, 0x2, 0x5, 0x20, 0x2, 0x9, 0x3f, 0x1, 0x100000001, 0x2, 0x0, 0x0, 0x8b4, 0xfffffffffffffffa, 0x7fff8000000, 0x2, 0x1c200, 0x3, 0x8001, 0x3, 0x8, 0x8, 0x3f, 0x8000, 0x9, 0x4, 0x9, 0x20, 0x2d, 0x5371, 0x7fffffff, 0x400, 0x9, 0x2, 0x8873, 0x5, 0x1, 0x3, 0x3, 0x0, 0x4, 0x5, 0x0, 0x1, 0x10000, 0x101, 0x3, 0x726, 0x4, 0x1, 0x2, 0x0, 0x4, 0x4, 0x3f, 0x5, 0x800], [0x2, 0x6, 0x7, 0x9, 0x8, 0x20, 0x5, 0x1, 0x5, 0x3, 0x6, 0x6, 0x5, 0xf2, 0x6, 0xee, 0x80000001, 0x7fffffff, 0x5, 0x0, 0xf94, 0x4, 0x2, 0x0, 0x0, 0x100000001, 0x8, 0x4, 0x6, 0x46b, 0x0, 0x6, 0x9, 0x1, 0x9, 0x7, 0x0, 0xf7, 0x1, 0x4, 0x23895d8e, 0x10001, 0x6, 0x100, 0xffff, 0x4, 0x100, 0x2, 0x80000000, 0xffffffff, 0xffff, 0x1ff, 0x80000001, 0x800, 0x3, 0x7, 0x2, 0x1, 0xfffffffffffffffe, 0x1000, 0xa8, 0xfff, 0x7f, 0x6], [0x2f6, 0x5b, 0x6, 0x2, 0x8, 0x1, 0x1, 0x8001, 0x0, 0x3ff, 0x9, 0x17, 0x7ff, 0xbc45, 0x8, 0x7f, 0x8, 0x0, 0xfffffffffffffffc, 0x3, 0x474f1ac9, 0x9, 0x0, 0x1a2015ad, 0x2, 0x2226, 0xec8, 0x9, 0x1, 0x401, 0xffffffff, 0x5, 0xfffffffffffffe00, 0x2, 0x401, 0x50, 0x2fa4, 0x6, 0x1, 0x81, 0x9, 0x80000001, 0x100000000, 0xff, 0x1, 0x2, 0x5, 0x6, 0xfffffffffffffff7, 0x1, 0xfffffffffffff157, 0x800, 0x8000, 0x80000001, 0x4, 0x40008000000000, 0x100000000, 0x29, 0x7f, 0xffffffff, 0x1, 0x4, 0x28, 0x3ff], [0xfffffffffffffffe, 0x8, 0x1ff, 0x8, 0x0, 0x3, 0x8, 0x0, 0x3, 0x9, 0x8, 0x7, 0x3, 0x7, 0x9, 0x10000000000, 0x9, 0x6, 0x9, 0x5, 0x0, 0xc7e4, 0x5, 0x9, 0x2, 0x7125bfce, 0x40, 0x8000, 0x7f000, 0x4, 0xffffffffffff0001, 0x101, 0xfffffffffffffffe, 0x8, 0xe1a9, 0x6, 0x2, 0x0, 0xc978, 0x9, 0x3, 0x1800, 0xfffffffffffffeff, 0x3, 0x4ad, 0x9, 0x7, 0x3, 0x7, 0x3, 0x1f, 0x101, 0x5, 0xfff, 0x3, 0xffff, 0x100, 0xbcf, 0x4, 0x7, 0x7f, 0x401, 0x57b, 0x6]}, 0x45c) 08:12:17 executing program 2: r0 = socket(0xa, 0x3, 0x8) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f00000002c0)=ANY=[], &(0x7f00000001c0)) r1 = socket(0xa, 0x3, 0x8) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000000)={"6272696467653000070100"}) r2 = syz_open_dev$sndpcmc(&(0x7f0000004fee)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000200)='./bus\x00', 0x0) ftruncate(r3, 0x8200) r4 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r4, 0x0) ioctl(r2, 0xc0804124, &(0x7f0000001f64)) eventfd(0x7f) fstat(r0, &(0x7f0000000300)) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000380)={{{@in6=@mcast2, @in=@loopback}}, {{@in6=@remote}, 0x0, @in=@dev}}, &(0x7f0000000280)=0xe8) r5 = syz_open_dev$admmidi(&(0x7f0000000040)='/dev/admmidi#\x00', 0x90, 0x40400) pwritev(r5, &(0x7f0000000540)=[{&(0x7f0000000500)="479b4b28479ab3faaf1b9ad89b", 0xd}], 0x1, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000140)) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000080)={"62726964676530000000000000012200", 0xfffffffffffffffd}) 08:12:17 executing program 5: ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000000)=0x0) process_vm_writev(r0, &(0x7f00000012c0)=[{&(0x7f0000000040)=""/200, 0xc8}, {&(0x7f0000000140)=""/180, 0xb4}, {&(0x7f0000000200)=""/22, 0x16}, {&(0x7f0000000240)=""/4096, 0x1000}, {&(0x7f0000001240)=""/70, 0x46}], 0x5, &(0x7f00000017c0)=[{&(0x7f0000001340)=""/88, 0x58}, {&(0x7f00000013c0)=""/115, 0x73}, {&(0x7f0000001440)=""/200, 0xc8}, {&(0x7f0000001540)=""/232, 0xe8}, {&(0x7f0000001640)=""/53, 0x35}, {&(0x7f0000001680)=""/83, 0x53}, {&(0x7f0000001700)=""/130, 0x82}], 0x7, 0x0) r1 = shmget$private(0x0, 0x2000, 0x3, &(0x7f0000ffd000/0x2000)=nil) shmctl$SHM_UNLOCK(r1, 0xc) r2 = inotify_init1(0x800) inotify_add_watch(r2, &(0x7f0000001840)='./file0\x00', 0x10000080) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFBRDADDR(r3, 0x891a, &(0x7f0000001880)={'vcan0\x00', {0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x13}}}) fsync(r3) r4 = accept(r3, &(0x7f00000018c0)=@in6={0xa, 0x0, 0x0, @ipv4}, &(0x7f0000001940)=0x80) setsockopt$XDP_UMEM_FILL_RING(r4, 0x11b, 0x5, &(0x7f0000001980)=0x400, 0x4) r5 = syz_open_dev$audion(&(0x7f00000019c0)='/dev/audio#\x00', 0x5, 0x100) ioctl$BLKGETSIZE(r5, 0x1260, &(0x7f0000001a00)) setsockopt$inet6_MCAST_LEAVE_GROUP(r4, 0x29, 0x2d, &(0x7f0000001a40)={0x40, {{0xa, 0x4e22, 0x9, @dev={0xfe, 0x80, [], 0x1c}, 0x1}}}, 0x88) modify_ldt$read_default(0x2, &(0x7f0000001b00)=""/4096, 0x1000) write$eventfd(r5, &(0x7f0000002b00)=0x8, 0x8) getsockopt$packet_int(r4, 0x107, 0x10, &(0x7f0000002b40), &(0x7f0000002b80)=0x4) sendto$inet6(r5, &(0x7f0000002bc0)="f949b3451c6c7248620de453a54797d2991044b51f754c77ab605728321dcd320c582c50fbe62741e661c6f0d6ba06e773d58b5fe6c96ce3d29d7cb4882ba69e51f875", 0x43, 0x4000000, &(0x7f0000002c40)={0xa, 0x4e22, 0x9, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1a}}, 0xae}, 0x1c) getsockopt$inet_sctp_SCTP_NODELAY(r5, 0x84, 0x3, &(0x7f0000002c80), &(0x7f0000002cc0)=0x4) shmctl$SHM_UNLOCK(r1, 0xc) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000002d40)='IPVS\x00') sendmsg$IPVS_CMD_GET_DEST(r4, &(0x7f0000002e40)={&(0x7f0000002d00)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000002e00)={&(0x7f0000002d80)={0x68, r6, 0x300, 0x70bd27, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DEST={0x4c, 0x2, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast2}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@ipv4={[], [], @broadcast}}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0xc24c}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x9}, @IPVS_DEST_ATTR_U_THRESH={0x8}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x616a}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x2}]}, 0x68}, 0x1, 0x0, 0x0, 0x8000}, 0x8080) r7 = dup(r3) ioctl$sock_inet_SIOCSIFNETMASK(r7, 0x891c, &(0x7f0000002e80)={'ip6_vti0\x00', {0x2, 0x4e20}}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r7, 0xc08c5336, &(0x7f0000002ec0)={0x6, 0x7, 0x4b4, 'queue0\x00'}) r8 = openat(0xffffffffffffff9c, &(0x7f0000002f80)='./file0\x00', 0x101201, 0x0) ioctl$sock_proto_private(r5, 0x89e4, &(0x7f0000002fc0)="bc674a02a2b62d0c940fdb216d6fbcb95a06daa8f3ce827b68865b9849d5750e4dd426c457ab317e5e822851b23d3936c7b1773b6c031a04d19ce33bd85fc9498003c713f1ab3b436b80164d1707681dddea9f3d3429d54c913ece0446a4916f2ff157e439f8e1cb6fe3f378d9667e590a2b709444ddb3e339dff54ca6a42c8aaab2debcff5e3da0cd64d9d069d9f725b78b353ec16d2aaad5820edff8fc4f4d3e15787f42dcd1c491f95461f33dd9db45728311947c5de00f4538d0333d6cb2b03b184aefca2ca6919b8687bbb8e1a9b927de7b26b685ce0adc06b0d1c691e3ddce3f61d197") ioctl$sock_inet_SIOCGIFBRDADDR(r5, 0x8919, &(0x7f00000030c0)={'yam0\x00', {0x2, 0x4e23, @multicast1}}) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r7, 0x54a2) ioctl$TUNGETFILTER(r8, 0x801054db, &(0x7f0000003100)=""/4096) 08:12:17 executing program 1: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00') openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x1, 0x0) flock(r0, 0x1) preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 08:12:17 executing program 3: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r0, 0x5) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) [ 207.503686] bridge0: port 2(bridge_slave_1) entered disabled state [ 207.510765] bridge0: port 1(bridge_slave_0) entered disabled state [ 207.621673] bridge0: port 2(bridge_slave_1) entered blocking state [ 207.629759] bridge0: port 2(bridge_slave_1) entered forwarding state [ 207.638656] bridge0: port 1(bridge_slave_0) entered blocking state [ 207.647695] bridge0: port 1(bridge_slave_0) entered forwarding state [ 207.657638] device bridge0 entered promiscuous mode 08:12:17 executing program 1: r0 = socket$inet6(0xa, 0x3, 0x800000000000004) ioctl(r0, 0x200008912, &(0x7f0000000000)="153f6234488dd25d5c6070") r1 = socket$inet6(0xa, 0x3, 0x31) connect$inet6(r1, &(0x7f00000000c0), 0x1c) [ 207.682371] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready 08:12:17 executing program 3: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x20000000000000, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x7fff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000600), 0xffffffffffffffff) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000640)={{{@in6=@loopback, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@multicast1}}, &(0x7f0000000580)=0xe8) r2 = getuid() setreuid(r1, r2) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0xe, 0x24, &(0x7f0000001000)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000003d03010000000000950000000000000071260000000000006706000002000000bf25000000000000620500000e0000007365000000000000bf540000000000000704000004faff003d4301000000000095000000000000005d54090000000000bf2500000000f2000f65000000000000070500000e000000bf5400000000000007040000040000003d4301000000000095000000000000006154000000000000bf25000000000000070500000e0000001f6500000000000007050000040000000f65000000000000bf5400000000000007040000040000003d3201000000000095000000000000004d54000000000000b7000000000000009500000000000000"], &(0x7f0000000100)='GPL\x00'}, 0x48) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000200)) nanosleep(&(0x7f0000000080)={0x77359400}, &(0x7f00000000c0)) fstat(r0, &(0x7f0000000500)) ioprio_get$uid(0x0, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000280)='coredump_filter\x00') setsockopt$inet6_MRT6_DEL_MFC(0xffffffffffffffff, 0x29, 0xcd, &(0x7f00000002c0)={{0xa, 0x4e22, 0x4, @remote}, {0xa, 0x4e21, 0x0, @ipv4={[], [], @multicast1}}, 0x80000001, [0x7, 0x0, 0x1, 0x80000000, 0x7, 0x1000, 0x4, 0x3f]}, 0x5c) ioctl$BLKGETSIZE(r3, 0x1260, &(0x7f00000005c0)) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(0xffffffffffffffff, 0x84, 0x15, &(0x7f00000004c0)={0x7}, 0x1) ioctl$VHOST_GET_VRING_BASE(0xffffffffffffffff, 0xc008af12, &(0x7f0000000240)) perf_event_open(&(0x7f0000000180)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001, 0x1, 0x0, 0x0, 0x100000001, 0x9, 0x0, 0x8, 0xfff, 0x0, 0x0, 0x0, 0x0, 0xb54, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x85c}, 0x0, 0x0, 0xffffffffffffffff, 0x3) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000000340)={0x0, 0xa5, "a8b7b1061abaf679303b053de5b0e93155199ef0054580167cae312322ad3fc74ca8765af10a97043dc1cb95524efe9e132e0ad2dbca91c5bb4a529b8d557180701c97e3da332ed00991fa2dc3de3bbde618020f59a4c68c24ba21e3d8c83950adfa25f830495faddd8c750fe0f4c177133d2b732ee7ec6ccb5a38bbfcb70f8349825acc931a2d64f0a914b48e88944d019617bbd70a157a8964827636c5daf0fd547a0e06"}, &(0x7f0000000400)=0xad) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000440)={r4, 0x2}, &(0x7f0000000480)=0x8) sendto$inet6(0xffffffffffffffff, &(0x7f0000000040), 0x0, 0x20000001, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) 08:12:17 executing program 0: r0 = syz_open_dev$amidi(&(0x7f0000000080)='/dev/amidi#\x00', 0x0, 0x0) geteuid() io_setup(0x8, &(0x7f0000000040)) ioctl$SNDRV_TIMER_IOCTL_PARAMS(0xffffffffffffffff, 0x40505412, &(0x7f00000002c0)={0x0, 0x6, 0x4}) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)='cpuacct.usage_percpu_sys\x00', 0x0, 0x0) clone(0x802122001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0xe, &(0x7f0000001000)=ANY=[@ANYBLOB="b700000005ed0050bfa30000000000000703000028feffff7a0af0fff8ffffff71a4f0ff00000000b7060000000000012d400500000000005504000001ed00001d040000000000002c460000000000006b0a00fe000000008500000007000000b7000000000000009500000000000000"], &(0x7f0000000100)='EPL\x00'}, 0x48) perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4002, 0x0, 0x1, 0x0, 0x0, 0x8, 0xfff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe48, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x3, 0x0, 0xb56f, 0x80000001, 0x1, 0x101, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x7, 0x1, @perf_config_ext={0x7}, 0x0, 0x0, 0xfffffffffffffffc}, r1, 0x5, 0xffffffffffffffff, 0x2) exit(0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100)={0x0}, &(0x7f00000000c0)=0xffffffffffffff40) openat$vcs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vcs\x00', 0x40, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000280)={0x0, 0x3, 0xb31, 0x4}) ptrace(0xffffffffffffffff, r2) [ 207.815902] bridge0: port 2(bridge_slave_1) entered disabled state [ 207.822626] bridge0: port 1(bridge_slave_0) entered disabled state [ 207.829353] device bridge0 left promiscuous mode 08:12:18 executing program 3: clone(0x80007ff, 0x0, 0xfffffffffffffffe, &(0x7f00000013c0), 0xffffffffffffffff) r0 = socket$inet(0x2, 0x1, 0x0) getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x83, &(0x7f0000000080)={'f\nlter\x00', 0x0, 0x0, 0xfffffefb, [], 0x21c, &(0x7f0000000040), &(0x7f0000000200)=""/4096}, &(0x7f0000000140)=0x108) [ 207.920356] bridge0: port 2(bridge_slave_1) entered blocking state [ 207.926979] bridge0: port 2(bridge_slave_1) entered forwarding state [ 207.934046] bridge0: port 1(bridge_slave_0) entered blocking state [ 207.940569] bridge0: port 1(bridge_slave_0) entered forwarding state [ 207.947685] device bridge0 entered promiscuous mode [ 207.953905] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready 08:12:18 executing program 2: r0 = socket(0xa, 0x3, 0x8) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f00000002c0)=ANY=[], &(0x7f00000001c0)) r1 = socket(0xa, 0x3, 0x8) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000000)={"6272696467653000070100"}) r2 = syz_open_dev$sndpcmc(&(0x7f0000004fee)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000200)='./bus\x00', 0x0) ftruncate(r3, 0x8200) r4 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r4, 0x0) ioctl(r2, 0xc0804124, &(0x7f0000001f64)) eventfd(0x7f) fstat(r0, &(0x7f0000000300)) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000380)={{{@in6=@mcast2, @in=@loopback}}, {{@in6=@remote}, 0x0, @in=@dev}}, &(0x7f0000000280)=0xe8) r5 = syz_open_dev$admmidi(&(0x7f0000000040)='/dev/admmidi#\x00', 0x90, 0x40400) pwritev(r5, &(0x7f0000000540)=[{&(0x7f0000000500)="479b4b28479ab3faaf1b9ad89b", 0xd}], 0x1, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000140)) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000080)={"62726964676530000000000000012200", 0xfffffffffffffffd}) 08:12:18 executing program 1: r0 = epoll_create1(0x0) r1 = timerfd_create(0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RXATTRWALK(r3, &(0x7f00000003c0)={0xf, 0x1f, 0x2, 0x2}, 0xf) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000080)) r4 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timerfd_settime(r1, 0x0, &(0x7f0000000040)={{}, {0x0, 0x989680}}, &(0x7f0000037000)) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vsock\x00', 0x0, 0x0) write(r2, &(0x7f0000000500)="8542dce1d671c3ddbaa5320bd7ff23245f21fae27697befcf7ffe010de9285e30fb462ac172faee2e9b8c5a4331e05e02641d6c0a83d37287e59dd46b94269e31172f6cff3b605a3d7e1f88fde74ad3f8738723920c9e2d3b337667608dbd67051573b2f2993549eecd721bc1e2715fe5fddad5860726eb6abf8dad8cd6e79db20ae977b4e4d437631b25f3c5145073f5021373eaa79134a5394a8df7530a85883399489568895f55e528869b88fbcb376cbf7836acddddc139776fde871db61774039592da62a8952b722609c0c68c3b8e481958c4a188b33d558d5dd1838d25364", 0xe2) setsockopt$RDS_GET_MR(r5, 0x114, 0x2, &(0x7f0000000300)={{&(0x7f0000000480)=""/110, 0x6e}, &(0x7f00000001c0), 0x9}, 0x20) epoll_wait(r0, &(0x7f00000000c0)=[{}], 0x1, 0xffffffff80000001) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r1, &(0x7f0000000440)={0x7}) timerfd_gettime(r1, &(0x7f0000000000)) fsetxattr(r4, &(0x7f0000000100)=@random={'btrfs.', 'self$md5sum@-wlan0\x00'}, &(0x7f0000000140)='\x00', 0x1, 0x0) ioctl$SG_NEXT_CMD_LEN(r5, 0x2283, &(0x7f0000000340)=0xbb) [ 208.345297] bridge0: port 2(bridge_slave_1) entered disabled state [ 208.353555] bridge0: port 1(bridge_slave_0) entered disabled state [ 208.361821] device bridge0 left promiscuous mode [ 208.421772] Unknown ioctl 8835 [ 208.480291] Unknown ioctl 8835 [ 208.489161] bridge0: port 2(bridge_slave_1) entered blocking state [ 208.496673] bridge0: port 2(bridge_slave_1) entered forwarding state [ 208.504865] bridge0: port 1(bridge_slave_0) entered blocking state [ 208.511792] bridge0: port 1(bridge_slave_0) entered forwarding state [ 208.522489] device bridge0 entered promiscuous mode 08:12:18 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={[], [], @local}}, 0x1c) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) bind$alg(0xffffffffffffffff, &(0x7f0000000100)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(hmac(sha256-generic))\x00'}, 0x58) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @thr={&(0x7f0000000280), &(0x7f0000000380)}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000016) 08:12:18 executing program 3: syz_emit_ethernet(0x2a, &(0x7f0000000100)={@link_local, @random="7d73cf61100f", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast}, @igmp={0x12, 0x0, 0x0, @multicast2=0xe000003c}}}}}, &(0x7f0000000180)) [ 208.539832] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 208.554564] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready 08:12:18 executing program 1: openat$pfkey(0xffffffffffffff9c, &(0x7f0000000280)='/proc/self/net/pfkey\x00', 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, &(0x7f00000001c0)}}], 0x1, 0x0, &(0x7f0000003280)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='fd/3\x00') preadv(r0, &(0x7f00000017c0), 0x1a1, 0x0) [ 208.873251] IPVS: ftp: loaded support on port[0] = 21 [ 210.109128] bridge0: port 1(bridge_slave_0) entered blocking state [ 210.115699] bridge0: port 1(bridge_slave_0) entered disabled state [ 210.123734] device bridge_slave_0 entered promiscuous mode [ 210.190982] bridge0: port 2(bridge_slave_1) entered blocking state [ 210.197546] bridge0: port 2(bridge_slave_1) entered disabled state [ 210.205452] device bridge_slave_1 entered promiscuous mode [ 210.272678] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 210.340462] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 210.546328] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 210.619437] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 210.960658] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 210.968234] team0: Port device team_slave_0 added [ 211.040869] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 211.049107] team0: Port device team_slave_1 added [ 211.124720] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 211.202773] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 211.276124] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 211.283526] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 211.292082] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 211.362956] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 211.370248] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 211.378789] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 212.129860] bridge0: port 2(bridge_slave_1) entered blocking state [ 212.136292] bridge0: port 2(bridge_slave_1) entered forwarding state [ 212.143110] bridge0: port 1(bridge_slave_0) entered blocking state [ 212.149568] bridge0: port 1(bridge_slave_0) entered forwarding state [ 212.157402] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 212.822304] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 214.933231] 8021q: adding VLAN 0 to HW filter on device bond0 [ 215.181202] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 215.438099] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 215.444620] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 215.452257] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 215.705492] 8021q: adding VLAN 0 to HW filter on device team0 08:12:27 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=@newsa={0x13c, 0x10, 0x713, 0x0, 0x0, {{@in6=@dev, @in=@rand_addr}, {@in6=@mcast2, 0x0, 0x32}, @in6=@ipv4, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_aead={0x4c, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0x0, 0x60}}]}, 0x13c}}, 0x0) 08:12:27 executing program 0: r0 = syz_open_dev$amidi(&(0x7f0000000080)='/dev/amidi#\x00', 0x0, 0x0) geteuid() io_setup(0x8, &(0x7f0000000040)) ioctl$SNDRV_TIMER_IOCTL_PARAMS(0xffffffffffffffff, 0x40505412, &(0x7f00000002c0)={0x0, 0x6, 0x4}) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)='cpuacct.usage_percpu_sys\x00', 0x0, 0x0) clone(0x802122001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0xe, &(0x7f0000001000)=ANY=[@ANYBLOB="b700000005ed0050bfa30000000000000703000028feffff7a0af0fff8ffffff71a4f0ff00000000b7060000000000012d400500000000005504000001ed00001d040000000000002c460000000000006b0a00fe000000008500000007000000b7000000000000009500000000000000"], &(0x7f0000000100)='EPL\x00'}, 0x48) perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4002, 0x0, 0x1, 0x0, 0x0, 0x8, 0xfff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe48, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x3, 0x0, 0xb56f, 0x80000001, 0x1, 0x101, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x7, 0x1, @perf_config_ext={0x7}, 0x0, 0x0, 0xfffffffffffffffc}, r1, 0x5, 0xffffffffffffffff, 0x2) exit(0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100)={0x0}, &(0x7f00000000c0)=0xffffffffffffff40) openat$vcs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vcs\x00', 0x40, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000280)={0x0, 0x3, 0xb31, 0x4}) ptrace(0xffffffffffffffff, r2) 08:12:27 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000000)=[@textreal={0x8, &(0x7f00000005c0)="82780000260f017731f3d87e0b0f20e06635000020000f22e066b9800000c00f326635002000000f30640f02d766b8008000000f23d80f21f86635400000f00f23f8db13b85f078ee82e0f01cf"}], 0xaaaaaaaaaaaac60, 0x0, &(0x7f0000000100), 0x330) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000040)={0x2, 0x0, [0x4b564d02, 0x1]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 08:12:27 executing program 2: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000180)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x4004e23, @local}, 0x10) sendmmsg(r0, &(0x7f00000001c0)=[{{&(0x7f0000000240)=@alg={0x26, 'aead\x00', 0x0, 0x0, 'morus640-generic\x00'}, 0x80, &(0x7f0000000100), 0x0, &(0x7f0000000700)=[{0x10, 0x1}], 0x10}}], 0x1, 0x0) 08:12:27 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x800000002) setreuid(0x0, 0x0) write$P9_RREAD(r0, &(0x7f0000000600)={0xb}, 0xb) 08:12:27 executing program 4: r0 = syz_open_dev$sndtimer(&(0x7f00000000c0)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000029fcc)={{0x0, 0x2, 0x0, 0xffefffffffffffff}}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x6800, 0x0) [ 217.676210] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/l1tf.html for details. [ 217.706090] sg_write: process 271 (syz-executor1) changed security contexts after opening file descriptor, this is not allowed. [ 217.830659] ================================================================== [ 217.838081] BUG: KMSAN: uninit-value in vmx_create_vcpu+0x10df/0x7920 [ 217.844673] CPU: 0 PID: 7692 Comm: syz-executor3 Not tainted 4.19.0-rc4+ #63 [ 217.851862] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 217.861220] Call Trace: [ 217.863821] dump_stack+0x306/0x460 [ 217.867458] ? _raw_spin_lock_irqsave+0x227/0x340 [ 217.872311] ? vmx_create_vcpu+0x10df/0x7920 [ 217.876735] kmsan_report+0x1a3/0x2d0 [ 217.880554] __msan_warning+0x7c/0xe0 [ 217.884566] vmx_create_vcpu+0x10df/0x7920 [ 217.888817] ? kmsan_set_origin_inline+0x6b/0x120 [ 217.893675] ? __msan_poison_alloca+0x17a/0x210 [ 217.898363] ? vmx_vm_init+0x340/0x340 [ 217.902264] kvm_arch_vcpu_create+0x25d/0x2f0 [ 217.906774] kvm_vm_ioctl+0x13fd/0x33d0 [ 217.910767] ? __msan_poison_alloca+0x17a/0x210 [ 217.915454] ? do_vfs_ioctl+0x18a/0x2810 [ 217.919526] ? __se_sys_ioctl+0x1da/0x270 [ 217.923697] ? vcpu_stat_clear_per_vm+0x420/0x420 [ 217.928553] ? vcpu_stat_clear_per_vm+0x420/0x420 [ 217.933403] do_vfs_ioctl+0xcf3/0x2810 [ 217.937295] ? security_file_ioctl+0x92/0x200 [ 217.941801] __se_sys_ioctl+0x1da/0x270 [ 217.945792] __x64_sys_ioctl+0x4a/0x70 [ 217.949679] do_syscall_64+0xbe/0x100 [ 217.953493] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 217.958685] RIP: 0033:0x457579 [ 217.961885] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 217.980790] RSP: 002b:00007fe1a1c46c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 217.988505] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457579 [ 217.995781] RDX: 0000000000000001 RSI: 000000000000ae41 RDI: 0000000000000004 [ 218.003054] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 218.010329] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe1a1c476d4 [ 218.017604] R13: 00000000004bfc18 R14: 00000000004cfca0 R15: 00000000ffffffff [ 218.024904] [ 218.026529] Local variable description: ----c.i.i.i.i.i.i@vmx_create_vcpu [ 218.033446] Variable was created at: [ 218.037169] vmx_create_vcpu+0xd5/0x7920 [ 218.041244] kvm_arch_vcpu_create+0x25d/0x2f0 [ 218.045731] ================================================================== [ 218.053084] Disabling lock debugging due to kernel taint [ 218.058528] Kernel panic - not syncing: panic_on_warn set ... [ 218.058528] [ 218.065908] CPU: 0 PID: 7692 Comm: syz-executor3 Tainted: G B 4.19.0-rc4+ #63 [ 218.074595] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 218.083951] Call Trace: [ 218.086551] dump_stack+0x306/0x460 [ 218.090208] panic+0x54c/0xafa [ 218.093446] kmsan_report+0x2cd/0x2d0 [ 218.097257] __msan_warning+0x7c/0xe0 [ 218.101068] vmx_create_vcpu+0x10df/0x7920 [ 218.105309] ? kmsan_set_origin_inline+0x6b/0x120 [ 218.110154] ? __msan_poison_alloca+0x17a/0x210 [ 218.114851] ? vmx_vm_init+0x340/0x340 [ 218.118743] kvm_arch_vcpu_create+0x25d/0x2f0 [ 218.123253] kvm_vm_ioctl+0x13fd/0x33d0 [ 218.127243] ? __msan_poison_alloca+0x17a/0x210 [ 218.131922] ? do_vfs_ioctl+0x18a/0x2810 [ 218.135992] ? __se_sys_ioctl+0x1da/0x270 [ 218.140146] ? vcpu_stat_clear_per_vm+0x420/0x420 [ 218.144997] ? vcpu_stat_clear_per_vm+0x420/0x420 [ 218.149845] do_vfs_ioctl+0xcf3/0x2810 [ 218.153741] ? security_file_ioctl+0x92/0x200 [ 218.158240] __se_sys_ioctl+0x1da/0x270 [ 218.162221] __x64_sys_ioctl+0x4a/0x70 [ 218.166109] do_syscall_64+0xbe/0x100 [ 218.169918] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 218.175115] RIP: 0033:0x457579 [ 218.178305] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 218.197206] RSP: 002b:00007fe1a1c46c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 218.204923] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457579 [ 218.212198] RDX: 0000000000000001 RSI: 000000000000ae41 RDI: 0000000000000004 [ 218.219466] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 218.226754] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe1a1c476d4 [ 218.234024] R13: 00000000004bfc18 R14: 00000000004cfca0 R15: 00000000ffffffff [ 218.242848] Kernel Offset: disabled [ 218.246475] Rebooting in 86400 seconds..