[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [ 89.616438][ T9621] sshd (9621) used greatest stack depth: 22544 bytes left [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 89.935964][ T27] kauditd_printk_skb: 2 callbacks suppressed [ 89.935977][ T27] audit: type=1800 audit(1580264449.447:29): pid=9553 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 89.962582][ T27] audit: type=1800 audit(1580264449.447:30): pid=9553 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.198' (ECDSA) to the list of known hosts. 2020/01/29 02:20:58 fuzzer started 2020/01/29 02:21:00 dialing manager at 10.128.0.26:43683 2020/01/29 02:21:00 syscalls: 2935 2020/01/29 02:21:00 code coverage: enabled 2020/01/29 02:21:00 comparison tracing: enabled 2020/01/29 02:21:00 extra coverage: enabled 2020/01/29 02:21:00 setuid sandbox: enabled 2020/01/29 02:21:00 namespace sandbox: enabled 2020/01/29 02:21:00 Android sandbox: /sys/fs/selinux/policy does not exist 2020/01/29 02:21:00 fault injection: enabled 2020/01/29 02:21:00 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2020/01/29 02:21:00 net packet injection: enabled 2020/01/29 02:21:00 net device setup: enabled 2020/01/29 02:21:00 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2020/01/29 02:21:00 devlink PCI setup: PCI device 0000:00:10.0 is not available 02:23:41 executing program 0: r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) bind$rose(r0, &(0x7f0000001c00)=@full={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, 0x1, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @default]}, 0x40) 02:23:41 executing program 1: r0 = socket(0x1e, 0x1, 0x0) ioctl$SIOCX25SSUBSCRIP(r0, 0x89e1, &(0x7f0000001b00)={'bridge_slave_0\x00'}) syzkaller login: [ 262.303294][ T9722] IPVS: ftp: loaded support on port[0] = 21 [ 262.445118][ T9724] IPVS: ftp: loaded support on port[0] = 21 02:23:42 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe8478071") bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000640)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x2, [@union={0x0, 0x2, 0x0, 0x2, 0x0, 0x0, [{}]}]}}, &(0x7f0000000340)=""/142, 0x32, 0x8e, 0x8}, 0x20) [ 262.543063][ T9722] chnl_net:caif_netlink_parms(): no params data found [ 262.655878][ T9722] bridge0: port 1(bridge_slave_0) entered blocking state [ 262.664970][ T9722] bridge0: port 1(bridge_slave_0) entered disabled state [ 262.674269][ T9722] device bridge_slave_0 entered promiscuous mode [ 262.692564][ T9724] chnl_net:caif_netlink_parms(): no params data found [ 262.706018][ T9722] bridge0: port 2(bridge_slave_1) entered blocking state [ 262.714494][ T9722] bridge0: port 2(bridge_slave_1) entered disabled state [ 262.724750][ T9722] device bridge_slave_1 entered promiscuous mode [ 262.790872][ T9728] IPVS: ftp: loaded support on port[0] = 21 [ 262.816146][ T9722] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 262.852703][ T9722] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 262.862096][ T9724] bridge0: port 1(bridge_slave_0) entered blocking state [ 262.869171][ T9724] bridge0: port 1(bridge_slave_0) entered disabled state [ 262.878952][ T9724] device bridge_slave_0 entered promiscuous mode 02:23:42 executing program 3: r0 = socket(0x11, 0x800000003, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000002080)=ANY=[@ANYBLOB='T\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r1, @ANYBLOB="ddffffff0000fffff2ff00000800010075333200200002001400050000000000000000000000000000000000080003000080000008000b0009000000"], 0x54}}, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmmsg$alg(r2, &(0x7f0000000140), 0x4924b68, 0x0) [ 262.909985][ T9724] bridge0: port 2(bridge_slave_1) entered blocking state [ 262.917082][ T9724] bridge0: port 2(bridge_slave_1) entered disabled state [ 262.926391][ T9724] device bridge_slave_1 entered promiscuous mode [ 262.938778][ T9722] team0: Port device team_slave_0 added [ 262.973614][ T9722] team0: Port device team_slave_1 added [ 262.991729][ T9724] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 263.042588][ T9724] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 263.067169][ T9722] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 263.081893][ T9722] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 263.134811][ T9722] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 263.182677][ T9722] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 263.189655][ T9722] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 263.223099][ T9730] IPVS: ftp: loaded support on port[0] = 21 [ 263.252083][ T9722] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active 02:23:42 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x2a9, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r4, @ANYBLOB="000000000000000028001200090001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="0000b20000000000"], 0x48}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r4, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x38}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000006d80)=@newtfilter={0x87c, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {}, {0xfff1}}, [@filter_kind_options=@f_route={{0xa, 0x1, 'route\x00'}, {0x84c, 0x2, [@TCA_ROUTE4_POLICE={0x848, 0x5, [@TCA_POLICE_PEAKRATE={0x404}, @TCA_POLICE_RATE={0x404}, @TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x0, 0x0, 0x0, 0x0, {0x61, 0x0, 0x0, 0x0, 0x0, 0x278f}, {0x8, 0x2, 0x0, 0x0, 0x0, 0x2}}}]}]}}]}, 0x87c}}, 0x0) [ 263.305228][ T9724] team0: Port device team_slave_0 added [ 263.393926][ T9722] device hsr_slave_0 entered promiscuous mode [ 263.460092][ T9722] device hsr_slave_1 entered promiscuous mode [ 263.514611][ T9724] team0: Port device team_slave_1 added [ 263.526639][ T9728] chnl_net:caif_netlink_parms(): no params data found 02:23:43 executing program 5: socket$inet_tcp(0x2, 0x1, 0x0) socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) socket$kcm(0x2, 0x2, 0x0) socket$kcm(0x2, 0x2, 0x0) socket$kcm(0xa, 0x6, 0x0) socket$kcm(0x2b, 0x1, 0x0) socketpair$tipc(0x1e, 0x0, 0x0, &(0x7f0000000000)) r0 = socket$kcm(0x11, 0x2, 0x0) setsockopt$sock_attach_bpf(r0, 0x107, 0x14, &(0x7f0000000080), 0x4) sendmsg$kcm(r0, &(0x7f0000007780)={&(0x7f0000000000)=@caif, 0x80, 0x0}, 0x0) [ 263.567579][ T9733] IPVS: ftp: loaded support on port[0] = 21 [ 263.627740][ T9724] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 263.638071][ T9724] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 263.669409][ T9724] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 263.710056][ T9724] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 263.717060][ T9724] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 263.743070][ T9724] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 263.786574][ T9735] IPVS: ftp: loaded support on port[0] = 21 [ 263.823881][ T9728] bridge0: port 1(bridge_slave_0) entered blocking state [ 263.831300][ T9728] bridge0: port 1(bridge_slave_0) entered disabled state [ 263.838996][ T9728] device bridge_slave_0 entered promiscuous mode [ 263.878313][ T9728] bridge0: port 2(bridge_slave_1) entered blocking state [ 263.885541][ T9728] bridge0: port 2(bridge_slave_1) entered disabled state [ 263.895102][ T9728] device bridge_slave_1 entered promiscuous mode [ 263.972861][ T9724] device hsr_slave_0 entered promiscuous mode [ 264.040020][ T9724] device hsr_slave_1 entered promiscuous mode [ 264.119833][ T9724] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 264.127549][ T9724] Cannot create hsr debugfs directory [ 264.176429][ T9728] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 264.194905][ T9730] chnl_net:caif_netlink_parms(): no params data found [ 264.228629][ T9728] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 264.311306][ T9728] team0: Port device team_slave_0 added [ 264.343301][ T9728] team0: Port device team_slave_1 added [ 264.353843][ T9730] bridge0: port 1(bridge_slave_0) entered blocking state [ 264.363383][ T9730] bridge0: port 1(bridge_slave_0) entered disabled state [ 264.371465][ T9730] device bridge_slave_0 entered promiscuous mode [ 264.383080][ T9730] bridge0: port 2(bridge_slave_1) entered blocking state [ 264.390296][ T9730] bridge0: port 2(bridge_slave_1) entered disabled state [ 264.398744][ T9730] device bridge_slave_1 entered promiscuous mode [ 264.445650][ T9730] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 264.480902][ T9722] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 264.512126][ T9733] chnl_net:caif_netlink_parms(): no params data found [ 264.522023][ T9728] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 264.529093][ T9728] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 264.555917][ T9728] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 264.568525][ T9730] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 264.591222][ T9722] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 264.649937][ T9728] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 264.657001][ T9728] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 264.683791][ T9728] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 264.725421][ T9722] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 264.785933][ T9722] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 264.872472][ T9730] team0: Port device team_slave_0 added [ 264.943180][ T9728] device hsr_slave_0 entered promiscuous mode [ 264.980655][ T9728] device hsr_slave_1 entered promiscuous mode [ 265.019880][ T9728] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 265.027725][ T9728] Cannot create hsr debugfs directory [ 265.045092][ T9730] team0: Port device team_slave_1 added [ 265.057870][ T9735] chnl_net:caif_netlink_parms(): no params data found [ 265.121972][ T9724] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 265.189669][ T9733] bridge0: port 1(bridge_slave_0) entered blocking state [ 265.196862][ T9733] bridge0: port 1(bridge_slave_0) entered disabled state [ 265.205366][ T9733] device bridge_slave_0 entered promiscuous mode [ 265.213237][ T9730] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 265.220477][ T9730] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 265.247883][ T9730] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 265.263862][ T9724] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 265.312562][ T9724] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 265.354534][ T9724] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 265.411405][ T9733] bridge0: port 2(bridge_slave_1) entered blocking state [ 265.418511][ T9733] bridge0: port 2(bridge_slave_1) entered disabled state [ 265.427416][ T9733] device bridge_slave_1 entered promiscuous mode [ 265.445134][ T9730] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 265.452157][ T9730] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 265.479613][ T9730] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 265.531019][ T9733] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 265.551432][ T9735] bridge0: port 1(bridge_slave_0) entered blocking state [ 265.558695][ T9735] bridge0: port 1(bridge_slave_0) entered disabled state [ 265.567834][ T9735] device bridge_slave_0 entered promiscuous mode [ 265.577305][ T9733] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 265.623311][ T9735] bridge0: port 2(bridge_slave_1) entered blocking state [ 265.630782][ T9735] bridge0: port 2(bridge_slave_1) entered disabled state [ 265.641720][ T9735] device bridge_slave_1 entered promiscuous mode [ 265.681823][ T9730] device hsr_slave_0 entered promiscuous mode [ 265.733864][ T9730] device hsr_slave_1 entered promiscuous mode [ 265.789855][ T9730] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 265.798626][ T9730] Cannot create hsr debugfs directory [ 265.833676][ T9733] team0: Port device team_slave_0 added [ 265.867048][ T9733] team0: Port device team_slave_1 added [ 265.882196][ T9735] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 265.916414][ T9735] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 265.982690][ T9735] team0: Port device team_slave_0 added [ 265.993297][ T9733] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 266.002134][ T9733] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 266.030148][ T9733] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 266.047419][ T9733] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 266.054526][ T9733] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 266.082462][ T9733] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 266.107263][ T9735] team0: Port device team_slave_1 added [ 266.141002][ T9728] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 266.202315][ T9735] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 266.210298][ T9735] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 266.237585][ T9735] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 266.254955][ T9735] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 266.263038][ T9735] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 266.290517][ T9735] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 266.306599][ T9728] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 266.354238][ T9728] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 266.413462][ T9722] 8021q: adding VLAN 0 to HW filter on device bond0 [ 266.473124][ T9733] device hsr_slave_0 entered promiscuous mode [ 266.510230][ T9733] device hsr_slave_1 entered promiscuous mode [ 266.549867][ T9733] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 266.557474][ T9733] Cannot create hsr debugfs directory [ 266.579391][ T9728] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 266.683117][ T9735] device hsr_slave_0 entered promiscuous mode [ 266.720179][ T9735] device hsr_slave_1 entered promiscuous mode [ 266.759901][ T9735] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 266.767496][ T9735] Cannot create hsr debugfs directory [ 266.827722][ T9724] 8021q: adding VLAN 0 to HW filter on device bond0 [ 266.853045][ T2936] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 266.862269][ T2936] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 266.874341][ T9722] 8021q: adding VLAN 0 to HW filter on device team0 [ 266.925660][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 266.935054][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 266.948313][ T9724] 8021q: adding VLAN 0 to HW filter on device team0 [ 266.978671][ T2947] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 266.991043][ T2947] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 266.999478][ T2947] bridge0: port 1(bridge_slave_0) entered blocking state [ 267.006778][ T2947] bridge0: port 1(bridge_slave_0) entered forwarding state [ 267.051886][ T2947] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 267.060251][ T2947] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 267.068867][ T2947] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 267.077606][ T2947] bridge0: port 2(bridge_slave_1) entered blocking state [ 267.084760][ T2947] bridge0: port 2(bridge_slave_1) entered forwarding state [ 267.093241][ T2947] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 267.102330][ T2947] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 267.110867][ T2947] bridge0: port 1(bridge_slave_0) entered blocking state [ 267.117934][ T2947] bridge0: port 1(bridge_slave_0) entered forwarding state [ 267.125696][ T2947] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 267.135920][ T9730] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 267.192902][ T9730] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 267.266763][ T9730] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 267.324826][ T9730] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 267.414012][ T2947] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 267.458057][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 267.466974][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 267.478957][ T2835] bridge0: port 2(bridge_slave_1) entered blocking state [ 267.486122][ T2835] bridge0: port 2(bridge_slave_1) entered forwarding state [ 267.494097][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 267.502834][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 267.511499][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 267.520550][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 267.547921][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 267.556525][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 267.566124][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 267.577185][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 267.586705][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 267.596520][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 267.605084][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 267.613663][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 267.622585][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 267.631898][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 267.640814][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 267.693501][ T2936] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 267.706359][ T2936] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 267.715430][ T2936] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 267.724738][ T2936] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 267.748856][ T9724] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 267.768356][ T9724] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 267.779294][ T9722] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 267.800817][ T9733] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 267.844525][ T2938] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 267.853177][ T2938] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 267.873259][ T9735] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 267.915578][ T9733] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 267.976973][ T9733] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 268.049813][ T2832] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 268.057324][ T2832] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 268.072769][ T9735] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 268.136187][ T9733] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 268.183460][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 268.194158][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 268.202161][ T9735] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 268.239050][ T9728] 8021q: adding VLAN 0 to HW filter on device bond0 [ 268.247246][ T9735] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 268.287213][ T9722] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 268.306746][ T9724] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 268.380916][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 268.388856][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 268.403246][ T9728] 8021q: adding VLAN 0 to HW filter on device team0 [ 268.435021][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 268.444016][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 268.453085][ T2835] bridge0: port 1(bridge_slave_0) entered blocking state [ 268.460214][ T2835] bridge0: port 1(bridge_slave_0) entered forwarding state [ 268.467834][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 268.477500][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 268.516651][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 268.525490][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 268.534999][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 268.543683][ T2835] bridge0: port 2(bridge_slave_1) entered blocking state [ 268.550775][ T2835] bridge0: port 2(bridge_slave_1) entered forwarding state [ 268.559292][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 268.569939][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 268.595158][ T9730] 8021q: adding VLAN 0 to HW filter on device bond0 [ 268.616539][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 268.646562][ T9724] device veth0_vlan entered promiscuous mode [ 268.673685][ T2832] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 268.682250][ T2832] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 268.693044][ T2832] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 268.702667][ T2832] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 268.711194][ T2832] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 268.720393][ T2832] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 268.729104][ T2832] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 268.738645][ T2832] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 268.747147][ T2832] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 268.755867][ T2832] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 268.778178][ T9730] 8021q: adding VLAN 0 to HW filter on device team0 [ 268.792427][ T9733] 8021q: adding VLAN 0 to HW filter on device bond0 [ 268.816896][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 268.830465][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 268.838895][ T2835] bridge0: port 1(bridge_slave_0) entered blocking state [ 268.846148][ T2835] bridge0: port 1(bridge_slave_0) entered forwarding state [ 268.854606][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 268.863265][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 268.872124][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 268.880795][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 268.889415][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 268.908971][ T9728] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 268.933423][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 268.942366][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 268.951520][ T2835] bridge0: port 2(bridge_slave_1) entered blocking state [ 268.959580][ T2835] bridge0: port 2(bridge_slave_1) entered forwarding state [ 268.967489][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 268.975993][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 268.984420][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 268.992800][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 269.025309][ T9724] device veth1_vlan entered promiscuous mode [ 269.043861][ T2834] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 269.052284][ T2834] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 269.062572][ T2834] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 269.070349][ T2834] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 269.077980][ T2834] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 269.087390][ T2834] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 269.096264][ T2834] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 269.104885][ T2834] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 269.113772][ T2834] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 269.121622][ T2834] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 269.129328][ T2834] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 269.140532][ T9722] device veth0_vlan entered promiscuous mode [ 269.173773][ T9728] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 269.184022][ T9733] 8021q: adding VLAN 0 to HW filter on device team0 [ 269.201836][ T2832] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 269.214372][ T2832] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 269.224139][ T2832] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 269.233932][ T2832] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 269.248678][ T9722] device veth1_vlan entered promiscuous mode [ 269.277746][ T9730] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 269.291695][ T9730] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 269.313404][ T9735] 8021q: adding VLAN 0 to HW filter on device bond0 [ 269.328380][ T2936] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 269.337025][ T2936] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 269.346238][ T2936] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 269.355150][ T2936] bridge0: port 1(bridge_slave_0) entered blocking state [ 269.362291][ T2936] bridge0: port 1(bridge_slave_0) entered forwarding state [ 269.370435][ T2936] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 269.378876][ T2936] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 269.388273][ T2936] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 269.409987][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 269.418326][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 269.434431][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 269.443225][ T2835] bridge0: port 2(bridge_slave_1) entered blocking state [ 269.450358][ T2835] bridge0: port 2(bridge_slave_1) entered forwarding state [ 269.458101][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 269.476006][ T9724] device veth0_macvtap entered promiscuous mode [ 269.516068][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 269.528179][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 269.538461][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 269.548155][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 269.557520][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 269.565532][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 269.573331][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 269.582725][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 269.592861][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 269.603818][ T9735] 8021q: adding VLAN 0 to HW filter on device team0 [ 269.617923][ T9724] device veth1_macvtap entered promiscuous mode [ 269.630141][ T2936] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 269.638862][ T2936] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 269.652536][ T9730] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 269.688150][ T9722] device veth0_macvtap entered promiscuous mode [ 269.720929][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 269.734450][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 269.743153][ T2835] bridge0: port 1(bridge_slave_0) entered blocking state [ 269.750426][ T2835] bridge0: port 1(bridge_slave_0) entered forwarding state [ 269.758379][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 269.767001][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 269.775409][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 269.784400][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 269.793387][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 269.802891][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 269.812079][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 269.821622][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 269.830442][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 269.838990][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 269.848573][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 269.856870][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 269.865372][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 269.873451][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 269.882004][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 269.893698][ T9728] device veth0_vlan entered promiscuous mode [ 269.903934][ T9722] device veth1_macvtap entered promiscuous mode [ 269.914612][ T9724] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 269.943422][ T2832] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 269.953369][ T2832] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 269.964756][ T2832] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 269.973893][ T2832] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 269.982351][ T2832] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 269.991742][ T2832] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 270.000407][ T2832] bridge0: port 2(bridge_slave_1) entered blocking state [ 270.007463][ T2832] bridge0: port 2(bridge_slave_1) entered forwarding state [ 270.015324][ T2832] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 270.029209][ T9724] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 270.043564][ T9733] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 270.074291][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 270.083048][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 270.092098][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 270.123893][ T9728] device veth1_vlan entered promiscuous mode [ 270.145194][ T9722] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 270.156855][ T9722] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 270.169202][ T9722] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 270.190391][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 270.199283][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 270.208689][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 270.218113][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 270.227176][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 270.237248][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 270.247626][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 270.256549][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 270.266358][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 270.300848][ T2936] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 270.309374][ T2936] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 270.321572][ T2936] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 270.330781][ T2936] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 270.339015][ T2936] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 270.348970][ T2936] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 270.362282][ T2936] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 270.370825][ T2936] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 270.380060][ T9722] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 270.391700][ T9722] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 270.403179][ T9722] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 270.415935][ T9730] device veth0_vlan entered promiscuous mode [ 270.435816][ T2832] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 270.460895][ T2832] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 02:23:50 executing program 1: openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cachefiles\x00', 0x408000, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000280)={0x1}, 0x8) socket$inet6(0xa, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x5}, 0x2c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x4}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, 0x0) listen(r0, 0x7) readv(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_IOEVENTFD(0xffffffffffffffff, 0x4040ae79, &(0x7f00000002c0)={0x100000, 0x0}) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @local}, 0x1c) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = accept4(r0, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f00000001c0)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) readv(0xffffffffffffffff, &(0x7f0000000040)=[{&(0x7f0000002400)=""/4096, 0x10b6}], 0x1) close(r2) [ 270.502709][ T9730] device veth1_vlan entered promiscuous mode [ 270.512139][ T9735] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 270.535630][ T9728] device veth0_macvtap entered promiscuous mode [ 270.569104][ T9733] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 270.609399][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 270.619207][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 270.628029][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 270.636429][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 270.649447][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 270.663265][ T9728] device veth1_macvtap entered promiscuous mode [ 270.694020][ C0] hrtimer: interrupt took 45316 ns [ 270.711439][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 270.719647][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 270.745523][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 270.763073][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 270.780419][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready 02:23:50 executing program 0: [ 270.853513][ T9735] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 270.886224][ T9730] device veth0_macvtap entered promiscuous mode [ 270.901746][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 270.921287][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 270.946959][ T9728] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 270.972877][ T9728] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 270.983308][ T9728] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 270.994131][ T9728] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! 02:23:50 executing program 0: [ 271.006792][ T9728] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 271.023044][ T9730] device veth1_macvtap entered promiscuous mode 02:23:50 executing program 0: [ 271.058342][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 271.070001][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 271.079087][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 271.123349][ T9728] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 271.146759][ T9728] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 271.160870][ T9728] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 02:23:50 executing program 0: [ 271.171957][ T9728] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 271.183824][ T9728] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 271.222553][ T2936] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 271.235348][ T2936] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 02:23:50 executing program 0: [ 271.275500][ T2936] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 271.294285][ T2936] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 271.327623][ T9730] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 271.347506][ T9730] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 271.359415][ T9730] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 271.377144][ T9730] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 271.388495][ T9730] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 02:23:50 executing program 0: [ 271.422856][ T9730] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 271.446966][ T9730] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 271.498093][ T9733] device veth0_vlan entered promiscuous mode [ 271.525555][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready 02:23:51 executing program 1: shmctl$SHM_INFO(0x0, 0xe, &(0x7f0000000240)=""/171) [ 271.540791][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 271.555223][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 271.568303][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 271.597658][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 271.628438][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 271.652596][ T9730] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 271.671681][ T9730] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 271.687421][ T9730] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 271.699525][ T9730] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 271.718833][ T9730] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 271.729367][ T9730] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 271.741736][ T9730] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 271.757154][ T9733] device veth1_vlan entered promiscuous mode [ 271.771504][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 271.779621][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 271.806883][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 271.816304][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 271.826528][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 271.852183][ T9786] BPF:[1] PTR (anon) [ 271.856730][ T9786] BPF:type_id=0 [ 271.889909][ T9786] BPF: [ 271.893700][ T9786] BPF:vlen != 0 [ 271.897279][ T9786] BPF: [ 271.897279][ T9786] [ 271.911169][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready 02:23:51 executing program 0: r0 = syz_open_dev$vbi(&(0x7f0000000300)='/dev/vbi#\x00', 0x1, 0x2) ioctl$VIDIOC_CREATE_BUFS(r0, 0xc100565c, &(0x7f0000000340)={0x0, 0x800, 0x1, {0x5, @pix={0x0, 0x0, 0x34324142, 0x0, 0x0, 0x0, 0x0, 0x3}}}) [ 271.940779][ T9733] device veth0_macvtap entered promiscuous mode [ 271.982489][ T2936] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 272.000658][ T2936] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 272.009379][ T2936] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 272.027247][ T2936] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 272.038791][ T9735] device veth0_vlan entered promiscuous mode [ 272.063428][ T9733] device veth1_macvtap entered promiscuous mode [ 272.084723][ T2936] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 272.100850][ T2936] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 272.109047][ T2936] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 272.122275][ T2936] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 272.138990][ T9735] device veth1_vlan entered promiscuous mode 02:23:51 executing program 3: r0 = socket$unix(0x1, 0x2, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/partitions\x00', 0x0, 0x0) preadv(r2, &(0x7f0000001580)=[{&(0x7f0000000040)=""/145, 0x91}, {&(0x7f00000016c0)=""/191, 0xbf}], 0x2, 0x0) [ 272.187552][ T9733] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 272.200549][ T9733] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 272.210508][ T9733] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 272.221256][ T9733] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 272.232796][ T9733] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 272.244510][ T9733] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 272.254413][ T9733] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 272.265169][ T9733] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 272.277176][ T9733] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 272.311876][ T2936] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 272.320581][ T2936] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 272.328870][ T2936] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 272.338282][ T2936] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 272.350712][ T9733] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 272.362627][ T9733] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 272.372809][ T9733] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 272.383293][ T9733] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 272.393994][ T9733] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 272.404885][ T9733] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 272.415570][ T9733] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 272.426022][ T9733] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 272.437740][ T9733] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 272.452412][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 272.462009][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 272.474329][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 272.483360][ T2974] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 272.498299][ T9735] device veth0_macvtap entered promiscuous mode [ 272.539470][ T9735] device veth1_macvtap entered promiscuous mode [ 272.581540][ T9735] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 272.592446][ T9735] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 272.602336][ T9735] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 272.612874][ T9735] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 272.623285][ T9735] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 272.635257][ T9735] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 272.646115][ T9735] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 272.656712][ T9735] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 272.666734][ T9735] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 272.677298][ T9735] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 272.688770][ T9735] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 272.697415][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 272.706360][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 272.714598][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 272.723282][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 272.735008][ T9735] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 02:23:52 executing program 4: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/cuse\x00', 0x82, 0x0) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) r2 = dup3(r1, r0, 0x0) bind$inet(r2, 0x0, 0x0) [ 272.735042][ T9735] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 272.735053][ T9735] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 272.735059][ T9735] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 272.735071][ T9735] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 272.735078][ T9735] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 272.735088][ T9735] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 272.735094][ T9735] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 272.735105][ T9735] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 272.735111][ T9735] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 272.736736][ T9735] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 272.999435][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 273.008379][ T2835] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 02:23:52 executing program 5: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='stat\x00') r0 = open(&(0x7f0000000480)='./file0\x00', 0x0, 0x100) fchdir(r0) r1 = memfd_create(&(0x7f0000000300)='\xd8\xe9GXY1 \xf6\xb3', 0x2) write$FUSE_DIRENT(r1, &(0x7f0000000080)=ANY=[], 0x29) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x81, 0x11, r1, 0x0) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) pread64(r2, 0x0, 0x0, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) 02:23:52 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) write$binfmt_elf32(r0, &(0x7f00000015c0)=ANY=[@ANYBLOB="7f454c4607050503020000000000000002000600070000002500000038000000000000800200000001012000010080000900030000000000040000000900000000100000050000000800000003000000ffffff7f060000000400000005000000070000005f0000000100000020000000020000003b000000cdf4607c8b00761b860a723289c3e03fc836d19cf7aa1723da7503674620e9d7782a5b615834b5a4ff44a6ff2939009c8afedd830b6998a508e6325938eb167c67cc140456f0aa1ceb2fd0b7b1ceccaf6c54c6f5e862ce4ce0e7f9bcfd368ac8879e6b6b1414d60c2c5ed0d2a24c30e9ab0e53dbb097179bb41f968c9867f66a224fa327625302eb57e7b3681fac2ad9e06fb09b869cb63c6412d8b7ef9d181edbe2ba539d4a66e33ecba837f22d6701a9e6302f8839eb16cfbe22b66868eb3405e242d569cf81da89204c58ad10c7c591af2a36b54789c92c774ff7191c73cf85e9f3ea9b215fc34cfdf6910a6d7122edef4f982da43a32fbb27c3f0f78620b5b400a228c731a729df85a38ca3179410c9e9246f5608fbf05c31cd249cf1ed4464238aaf758c769183125fa7b0e7387d3178a32c6208dae601c388ffc7040c067e506aa0806e84977e1105b9b476395994420e0b187498c31bac42ad7d1928fcea8d0f72619697e48e7fe45d282897288a0f374f1cf0466ddfa46933136a377950815770ef22c7ad899146b6995b890abff404056554c13c1bb1ee67c1dea8eb68ac402a246a7e9341291b251ead1e5be66cf24352ac6b628f8bb0f12cc1f5d22f03562f425a821f7a2ef01a8445819ce819c9358d3aba1fe3702807ecdc3b418b3f3520b4554a25afc37b10720115516d796dd39e47e876f261a3170b07e7f264c9200f98701186fd88201dd98b0faee78079bc5810fa6943c33c3f63b6ff94f9f70ec73e5652b66c42c56efcae600424001aba843d7a67a50b614b5a00040eadcf5d2fc695d2a5a5c3003d1d301b3da823dfeccbd41f7a1"], 0x2d1) r1 = syz_open_procfs(0x0, &(0x7f0000000140)='clear_refs\x00') writev(r1, 0x0, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) getsockopt$inet_sctp6_SCTP_RTOINFO(r2, 0x84, 0xd, &(0x7f0000000080)={r4}, &(0x7f0000000140)=0x10) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000000000)={0x2, 0xa3af, 0xa, 0x6, 0x3, 0x9, 0x40, 0x10001, r4}, 0x20) 02:23:52 executing program 2: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x0, 0xfffffffffffffffc}, 0x4) fcntl$notify(0xffffffffffffffff, 0x402, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) fcntl$setpipe(r1, 0x407, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) bind$inet(r3, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) ioctl$VIDIOC_S_PRIORITY(0xffffffffffffffff, 0x40045644, 0x400007) connect$inet(r3, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_bp={0x0, 0x4}, 0x1000, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffdfff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x80400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) splice(r0, 0x0, r3, 0x0, 0x30005, 0x0) 02:23:52 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000880)=@filter={'filter\x00', 0xe, 0x4, 0x390, 0x1a0, 0xd0, 0x0, 0x0, 0xd0, 0x2c0, 0x2c0, 0x2c0, 0x2c0, 0x2c0, 0x4, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@CLASSIFY={0x28, 'CLASSIFY\x00'}}, {{@ipv6={@initdev={0xfe, 0x88, [], 0x0, 0x0}, @ipv4={[], [], @local}, [], [], 'hsr0\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x0, 0x6}}}, {{@ipv6={@local, @initdev={0xfe, 0x88, [], 0x0, 0x0}, [], [], 'bridge_slave_1\x00', 'netpci0\x00', {}, {}, 0x11}, 0x0, 0xf8, 0x120, 0x0, {}, [@common=@inet=@multiport={{0x50, 'multiport\x00'}}]}, @REJECT={0x28, 'REJECT\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3f0) 02:23:52 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0xff3b, &(0x7f00000000c0)=[{&(0x7f0000000000)="2e00000022008151e00f80ecdb4cb904044865160b005b0010000000000004140e000a0002000000dc2976d153b4", 0x235}], 0x1}, 0x0) 02:23:52 executing program 4: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f00000000c0)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.events\x00', 0x26e1, 0x0) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x40086602, 0x0) write$cgroup_int(r1, &(0x7f0000000080), 0x87f1a7) [ 273.256537][ T9818] x_tables: duplicate underflow at hook 2 02:23:52 executing program 0: socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_GET_DEST(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYRES16=r0], 0x1}}, 0x651d5ab5d514c246) pipe2(&(0x7f0000000040), 0x0) sendmsg$IPVS_CMD_GET_DEST(0xffffffffffffffff, 0x0, 0x1) mount$fuse(0x0, &(0x7f0000000340)='./file0\x00', 0x0, 0x0, 0x0) io_submit(0x0, 0x24, 0x0) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/cuse\x00', 0x2, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000140)='/dev/snapshot\x00', 0x20a000, 0x0) r2 = socket(0xa, 0x2, 0x0) getsockopt$EBT_SO_GET_INIT_ENTRIES(r2, 0x0, 0x83, 0x0, &(0x7f0000000340)) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=ANY=[@ANYRES16=r4, @ANYBLOB="170e09000100000000010000"], 0x2}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000200)={&(0x7f00000000c0), 0xc, &(0x7f0000000180)={&(0x7f0000000800)=ANY=[@ANYBLOB="1e007800a7c775614e2d06835d75de8a3aa736abe8a9d272fe759ab15b5a811bf36e175e23880bd336dc7456dc3103ef522a6b17a2778d2d23cb65", @ANYRES16=r4], 0x2}, 0x1, 0x0, 0x0, 0x44060}, 0x10) r5 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x1ff, &(0x7f00000004c0)=0x0) io_submit(r6, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r5, &(0x7f0000000000), 0x10000}]) io_submit(0x0, 0x1, &(0x7f0000000440)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f00000001c0)}]) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(0xffffffffffffffff, 0xc0105303, &(0x7f0000000240)={0x4}) socket$inet(0x10, 0x2, 0x6) r7 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x80000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_REFRESH(r7, 0x2402, 0xf17) socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$KDSKBSENT(0xffffffffffffffff, 0x4b49, 0x0) unshare(0x40040400) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x300, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000480)='IPVS\x00') sendmsg$IPVS_CMD_ZERO(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000780)={&(0x7f0000000640)={0x68, 0x0, 0x100, 0x70bd2b, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_SERVICE={0x1c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'wrr\x00'}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x8e6c}]}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0xa915373571ba77fb}}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0xc}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e20}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x100}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x4}]}, 0x68}, 0x1, 0x0, 0x0, 0x1}, 0x4000) 02:23:52 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x0, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x686987548330b3, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) r4 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_opts(r4, 0x0, 0x4, 0x0, 0x0) 02:23:52 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000000080)={0x0, 0x382, &(0x7f0000000140)={0x0, 0xb7ff}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001280)=ANY=[@ANYBLOB="3400000010000104000009040000000000000000", @ANYRES32=r2, @ANYBLOB="0000000000000000140012000c00010062726964676500000300020092ab29e6bc90313f5c14a818e765b4fd2a0e0ffabd5f884b8215627962f7a4aab6691329692afb3fdcc3e7378871f430fe0e63a139f8432b7c88d952fec2b4b0543063914575e89dce08917ef4c83982304f91f231dc1ecf62c4bf0541ff2b5060b6a4d69b9403c96422fd8632e43e946636599dedd725bcd83c8971198e43e29e4b1c15388e01dee5bf7c4e128ff5b5c146c15db0684e76186c1d4209d8b4158f7b359d8efa69231277e09c47884e9fb0b010687409fc6fa73c91c9504b4460a91a865e0897f10dc1c1e0edc0d560f18478d67cc5cf8dbb0ee5003f6cc7185e99bc93bcb9eb76abba12076a8d076c853092edf73f4224c4e770006630b3a7e43c7e4c90ce6a20fac946584d406aa1cc75103f746d1f026456e44c9a39c62eecdb8bb82ca275e24c5c9095cbc8a6701a2447f9f6e6e4a372717366f176f0e4df46e9e28ede8a00e2a8b3dc"], 0x34}}, 0x0) r3 = socket(0x1, 0x803, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000380)=@ipv6_newaddr={0x2c, 0x14, 0x9535393fea6295b5, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r4}, [@IFA_LOCAL={0x14, 0x2, @ipv4={[], [], @dev}}]}, 0x2c}}, 0x0) r6 = socket(0x10, 0x803, 0x0) r7 = socket(0x1, 0x803, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@ipv6_newaddr={0x2c, 0x14, 0x9535393fea6295b5, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r8}, [@IFA_LOCAL={0x14, 0x2, @ipv4}]}, 0x2c}}, 0x0) r9 = socket(0x10, 0x803, 0x0) r10 = socket(0x1, 0x803, 0x0) getsockname$packet(r10, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)=@ipv6_newaddr={0x2c, 0x14, 0x9535393fea6295b5, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r11}, [@IFA_LOCAL={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x0, 0x0}}]}, 0x2c}}, 0x0) [ 273.572005][ T9839] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.1'. [ 273.605390][ T9835] IPVS: ftp: loaded support on port[0] = 21 02:23:53 executing program 5: clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=.']) [ 273.704478][ T9846] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.1'. 02:23:53 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000000080)={0x0, 0x382, &(0x7f0000000140)={0x0, 0xb7ff}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001280)=ANY=[@ANYBLOB], 0x1}}, 0x0) r2 = socket(0x10, 0x803, 0x0) r3 = socket(0x1, 0x803, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@ipv6_newaddr={0x2c, 0x14, 0x9535393fea6295b5, 0x0, 0x0, {0xa, 0x40, 0x0, 0x0, r4}, [@IFA_LOCAL={0x14, 0x2, @ipv4}]}, 0x2c}}, 0x0) r5 = socket(0x10, 0x803, 0x0) r6 = socket(0x1, 0x803, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)=@ipv6_newaddr={0x40, 0x14, 0x9535393fea6295b5, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r7}, [@IFA_CACHEINFO={0x14, 0x6, {0x8, 0x9, 0x101, 0x3}}, @IFA_LOCAL={0x14, 0x2, @ipv4}]}, 0x40}}, 0x0) 02:23:53 executing program 5: prctl$PR_SET_SECUREBITS(0x1c, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x8, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000ac0)={0x38, 0x2, 0x0, 0x0, 0x5, 0xfffffffffffffffd, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000000b00), 0x6, 0x1, 0x0) r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nvme-fabrics\x00', 0x440, 0x0) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000480)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f00000006c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000640)={&(0x7f00000004c0)={0x154, r3, 0x8, 0x70bd25, 0x25dfdbff, {}, [@ETHTOOL_A_LINKMODES_AUTONEG={0x5, 0x2, 0x7}, @ETHTOOL_A_LINKMODES_AUTONEG={0x5, 0x2, 0x7}, @ETHTOOL_A_LINKMODES_OURS={0x118, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0xef}, @ETHTOOL_A_BITSET_MASK={0xf6, 0x5, "1c3b14342664ffe3a23d24df563f50f4ad27514e0d7e83fc2deb403351b2a7d7e4e41c0bd9484ed8caeed3f10f30ad416c723ce49b4f02bb00c2afb2a795ee6544a7585de79b1b0428b0fa0983f18ae5b408bdfa5b3d6bc189a4b42ac21cedcce307310cb4ceee28921df42ae52c73f8f6d06329c8f10588beb55803aaf0302fb16ea5e35963b158a1445dd16e2810e2b28c1eac28af13bd410a0d42f4e39bfc60db5c75e2acfda3ea41d4d98038ced90b70f78dd7d83858892b56185371ff58e349597ff9a3913247e26ec15b445a9d3ecda8b03b89a58dc35f9217cf430a8b08ebb668924de194f7125120b21fa97f3aa5"}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x401}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x9e8}]}, @ETHTOOL_A_LINKMODES_AUTONEG={0x5, 0x2, 0x1}, @ETHTOOL_A_LINKMODES_SPEED={0x8, 0x5, 0x80000000}, @ETHTOOL_A_LINKMODES_AUTONEG={0x5, 0x2, 0x4}]}, 0x154}, 0x1, 0x0, 0x0, 0x4}, 0x4050) pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) write$FUSE_LSEEK(r4, &(0x7f00000001c0)={0xfffffdb3, 0x0, 0x0, {0xfffffffffffffffe}}, 0x18) ioctl$FS_IOC_SETVERSION(r5, 0x40087602, &(0x7f0000000340)=0x1) ioctl$BLKROTATIONAL(r5, 0x127e, &(0x7f0000000100)) r6 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r7 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r7, 0x84, 0x1d, &(0x7f00000003c0)=ANY=[@ANYBLOB="1001000030a395396f58fdcf5853299c9e8af44202a6c007c7c47de95f4891b4ddc155336e603faf6c493284cd9203428302470b58c4e36e463e6ff6b8dd84b7c15868264dd40b414bb14948ddedef25a5f97462c8260e9c501e6e76a4a93ac7844eb6b9fdc89763dddd77f71e8b82e496d4b8c0c160fa971ca8e3b3535d9508ab0b301a9440"], &(0x7f000095dffc)=0x1) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000000040), 0x20) setsockopt$inet_sctp_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f0000000780)={0x0, 0x0, 0x9, 0x0, 0x1, 0xffff}, 0x14) fcntl$setpipe(r5, 0x407, 0x0) write(r5, &(0x7f0000000340), 0x41395527) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) write$cgroup_subtree(r8, 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r6, 0x84, 0x12, &(0x7f0000000140)=0x6, 0x4) r9 = syz_init_net_socket$llc(0x1a, 0x801, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000180)='/dev/dsp\x00', 0x100802, 0x0) connect$llc(r9, &(0x7f0000000380)={0x1a, 0x1, 0x0, 0x9}, 0x10) sendmmsg(r9, &(0x7f0000001380), 0x40003ad, 0x2000000) [ 273.885069][ T9844] IPVS: ftp: loaded support on port[0] = 21 02:23:53 executing program 1: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0x1e, 0x1, 0x0) sendmsg(r0, &(0x7f0000000000)={&(0x7f0000fdbf80)=@generic={0x10000000001e, "02ff0100000001000000000000000ae77f5bf86c480200020000de010300000000e4ff064b3f013a00fb48a16700008f00000000ac50d5fe32c4000000007fffffff6a008356edb9a6341c1fd45624281e00070ecddd0206c39750c40000fd00000900010000000b0000db000004da3600"}, 0x80, 0x0}, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa0c, {&(0x7f0000000280)}}, 0x457d10) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SNDCTL_DSP_SETTRIGGER(0xffffffffffffffff, 0x40045010, 0x0) openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_open_dev$vcsn(0x0, 0x0, 0x0) inotify_init1(0x0) syz_open_dev$vivid(0x0, 0x0, 0x2) inotify_init1(0x0) poll(0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$EVIOCSCLOCKID(0xffffffffffffffff, 0x400445a0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) [ 273.966221][ T1130] tipc: TX() has been purged, node left! 02:23:53 executing program 2: perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x10006, 0x80011, r0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = openat$dlm_monitor(0xffffffffffffff9c, 0x0, 0x8500, 0x0) ioctl$TCSETXF(r2, 0x5434, &(0x7f00000000c0)={0x7fff, 0x4d31, [0x1, 0x5, 0x0, 0xff, 0x80], 0x1}) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) r3 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r1, r3, &(0x7f0000000040)=0x100060, 0xa808) fadvise64(0xffffffffffffffff, 0x6, 0xf640, 0x0) 02:23:53 executing program 4: r0 = memfd_create(&(0x7f0000000300)='\xd8\xe9GXY1 \xf6\xb3', 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x11, r0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getsockname$l2tp6(r2, 0x0, 0x0) 02:23:53 executing program 5: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/seq/timer\x00', 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$dupfd(r3, 0x0, r2) fcntl$setsig(r1, 0xa, 0x34) prctl$PR_TASK_PERF_EVENTS_DISABLE(0x1f) getdents(0xffffffffffffffff, &(0x7f0000000000)=""/62, 0xd6147cbb00000018) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, @perf_bp={0x0, 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x618401, 0x0) r5 = syz_genetlink_get_family_id$team(&(0x7f0000000180)='team\x00') sendmsg$TEAM_CMD_OPTIONS_SET(r4, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x5}, 0xc, &(0x7f0000000200)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r5, @ANYBLOB="00112bcc2b772a93c7ace7000000521f6534bc87b89046712d716ee932bae2ac911380eca7c06120fff0d4eaa61b8b59d4fea198f763b77d4a93881c25832b9b2ad803195438d99bc60d781578284491c9f6e1eb1e1887835b190c1018b3eccd559e1a9fb7640ce78c52be7df2f8c509be48fd6f774e696a3152351f5ff826cdf17c83ed62b59e0e09047f8f26fa28f7b5b751ee78d74ab8bed4ed92ae2f146b93a7d959"], 0x14}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) r6 = syz_open_dev$loop(&(0x7f0000000380)='/dev/loop#\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_MIGRATE_ID(r1, &(0x7f0000000440)={0x12, 0x10, 0xfa00, {&(0x7f0000000400), 0xffffffffffffffff, r0}}, 0x18) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/thread-self\x00', 0xa02, 0x0) r7 = semget(0x2, 0x3, 0x50) semctl$GETPID(r7, 0x2, 0xb, &(0x7f0000000300)=""/105) sysinfo(&(0x7f00000007c0)=""/154) write$binfmt_aout(r6, &(0x7f0000000880)=ANY=[@ANYBLOB="cc000805240000009f000000ffffff7fea01000004000000000000000000000081c114efee87f065987b6a42c43f591e4990080553a68bbc8098e6dbe49401d70000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060b7af8db74b9960c8e1b16236800000000000000000000000000000000000000000000000000147bc46ab02177c7bccf00"/330], 0x140) ioctl$BLKPG(r6, 0x1269, &(0x7f0000000240)={0x1, 0x0, 0x0, &(0x7f0000000800)}) open(&(0x7f0000000080)='./file0\x00', 0x40c5, 0x0) r8 = socket$inet6(0xa, 0x18080b, 0x81) dup3(r3, r8, 0x80000) r9 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x0) ioctl$PPPIOCGCHAN(0xffffffffffffffff, 0x80047437, &(0x7f0000000140)) open_by_handle_at(r9, &(0x7f0000000480)=ANY=[@ANYBLOB="09000000010000000bc2ac1660096e037c451beed9969bcd317db4cd3ca7ea06c0fe8d986108d62ea5f13ad87b883e79c52883cb02f8774930796c2727b39fd63c6d5ecd912ca447dc70190b75aa954a88110b8154e2943a7cdcb3cf6d96a2883ba8968fe253c6ba58239ca08bd8697d469787c61be1f3c0280ab8641e4156492db59de4598a4f4db1f8e93e118ee49925fbf484d018a2d20bb005773eaf9bd5e9fe2d1ad7b0c00c10e04af1938c7b5e718f690390a9c7b18f6c053c537f5b399a9b4e10e1592e0ffe6d9104568c4a22d98b50f0576ac4135ed7a15fee8b314565976ca42483c634dca54c147c06256f758d3fe10f09f45dac6d4eb87199f8d00289c064e632727f39"], 0x0) setsockopt$inet_sctp_SCTP_MAX_BURST(r9, 0x84, 0x14, &(0x7f0000000240)=@int=0x1, 0x4) preadv(r1, &(0x7f00000017c0), 0x19e, 0x0) syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x40) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) 02:23:53 executing program 0: socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_GET_DEST(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYRES16=r0, @ANYBLOB="10aa00f19df9355a659b7bf1eaa1bed00f0a4da72d81343c2c334cd6e9869e"], 0x2}}, 0x651d5ab5d514c246) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) sendmsg$IPVS_CMD_GET_DEST(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=ANY=[@ANYBLOB="14000000f22b5c089688dfbaff33ef90d68acfa5840000", @ANYRES16=0x0, @ANYBLOB="00000000407b639591be8500000000000008000000"], 0x3}, 0x1, 0x0, 0x0, 0x8000}, 0x1) sendmsg$IPVS_CMD_SET_CONFIG(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x1000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0xfa634958e7e38cad}, 0x0) mount$fuse(0x0, &(0x7f0000000340)='./file0\x00', 0x0, 0x0, 0x0) io_setup(0x3ff, &(0x7f0000000280)=0x0) io_submit(r2, 0x24, 0x0) r3 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/cuse\x00', 0x2, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000140)='/dev/snapshot\x00', 0x20a000, 0x0) r4 = socket(0xa, 0x2, 0x0) getsockopt$EBT_SO_GET_INIT_ENTRIES(r4, 0x0, 0x83, &(0x7f00000006c0)={'filter\x00', 0x0, 0x0, 0x0, [], 0x0, 0x0, 0x0}, &(0x7f0000000340)=0x78) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=ANY=[@ANYRES16=r6, @ANYBLOB="170e0900010000000001000000"], 0x2}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000180)={&(0x7f0000000800)=ANY=[@ANYBLOB="1e007800a7c775614e2d06835d75de8a3aa736abe8a9d272fe759ab15b5a811bf36e175e23880bd336dc7456dc3103ef522a6b17a2778d2d23cb65", @ANYRES16=r6, @ANYBLOB="010028bd7000fbdbdf25010000000600000600020001000000060001000400fd00050013001000004e987cb2004e220000060003002ba700a08a89d9ce096efa74d400060001001200"/88], 0x54}, 0x1, 0x0, 0x0, 0x44060}, 0x10) creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x1ff, &(0x7f00000004c0)=0x0) io_submit(r7, 0x1, &(0x7f0000000540)=[0x0]) io_submit(r2, 0x1, &(0x7f0000000440)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, r3, &(0x7f00000001c0)}]) io_getevents(0x0, 0x3, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(0xffffffffffffffff, 0xc0105303, &(0x7f0000000240)={0x4}) socket$inet(0x10, 0x2, 0x6) ioctl(0xffffffffffffffff, 0x0, &(0x7f00000001c0)='\b') r8 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x80000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_REFRESH(r8, 0x2402, 0xf17) r9 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_AUTOCLOSE(r9, 0x84, 0x4, 0x0, 0x0) ioctl$KDSKBSENT(r0, 0x4b49, 0x0) unshare(0x40040400) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x300, 0x0) sendmsg$IPVS_CMD_ZERO(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000400), 0xc, &(0x7f0000000780)={&(0x7f0000000640)={0x68, 0x0, 0x100, 0x70bd2b, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_SERVICE={0x1c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'wrr\x00'}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x8e6c}]}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0xa915373571ba77fb}}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0xc}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e20}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x100}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x4}]}, 0x68}, 0x1, 0x0, 0x0, 0x1}, 0x4000) 02:23:53 executing program 3: r0 = syz_open_dev$vbi(&(0x7f0000000300)='/dev/vbi#\x00', 0x1, 0x2) ioctl$VIDIOC_G_AUDOUT(r0, 0x80345631, &(0x7f0000000000)) 02:23:54 executing program 1: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x2000000000000074, 0x25d) bind$inet(r0, &(0x7f00000003c0)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) writev(r0, &(0x7f0000000440)=[{&(0x7f00000002c0)="0a99b3e3930870dcd4c6d68e6abe088af4ccdbe6dc85ed63bcee4834cd53f8a19cfad53574230c17377bd7b3eb23d9008f0c69b08db538753bcf550f05d219f8c6ca03228dd8d293261ba079190f47d70c95a97fe5d4cb7511e180f73e8ef5e2f7ee4f47c1a036e37e", 0x69}], 0x1) 02:23:54 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x0, 0x0) ioctl$EXT4_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000001c0)=0x20008088) sendfile(r0, r1, 0x0, 0x8000fffffffe) 02:23:54 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='stat\x00') r0 = open(&(0x7f0000000480)='./file0\x00', 0x0, 0x100) fchdir(r0) r1 = memfd_create(&(0x7f0000000300)='\xd8\xe9GXY1 \xf6\xb3', 0x2) write$FUSE_DIRENT(r1, &(0x7f0000000080)=ANY=[], 0x29) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x81, 0x11, r1, 0x0) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) pread64(r2, 0x0, 0x0, 0x0) 02:23:54 executing program 4: r0 = syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x0, 0x2) ioctl$VIDIOC_S_FREQUENCY(r0, 0x402c5639, &(0x7f0000000080)={0x0, 0x1}) [ 274.717255][ T9886] IPVS: ftp: loaded support on port[0] = 21 [ 274.782078][ T27] audit: type=1804 audit(1580264634.297:31): pid=9896 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir000796964/syzkaller.7ndy02/3/bus" dev="sda1" ino=16548 res=1 02:23:54 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x14) [ 274.899645][ T27] audit: type=1804 audit(1580264634.297:32): pid=9896 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir000796964/syzkaller.7ndy02/3/bus" dev="sda1" ino=16548 res=1 02:23:54 executing program 1: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/cuse\x00', 0x82, 0x0) io_setup(0x9, &(0x7f0000000100)=0x0) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) r3 = dup3(r2, r0, 0x0) bind$x25(r3, &(0x7f0000000040)={0x9, @null=' \x00'}, 0x12) io_submit(r1, 0x1, &(0x7f0000000440)=[&(0x7f0000000000)={0x4, 0x960000, 0x0, 0x1, 0x0, r0, 0x0}]) 02:23:54 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x200000d, 0x50, 0xffffffffffffffff, 0x63876000) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet(0x2, 0x4000000805, 0x0) r3 = socket$inet_sctp(0x2, 0x5, 0x84) r4 = dup3(r2, r3, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000d6cff0)=[@in={0x2, 0x4e20, @loopback}], 0x10) sendto$inet(r4, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendto$inet(r3, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r4, 0x84, 0xe, &(0x7f000059aff8)={r5}, &(0x7f000034f000)=0x2059b000) setsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000000080)={r5}, 0x8) mount$9p_tcp(&(0x7f0000000040)='127.0.0.1\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000280)='9p\x00', 0x0, 0x0) exit_group(0x0) 02:23:54 executing program 5: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x10006, 0x80011, r0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) ioctl$TCSETXF(0xffffffffffffffff, 0x5434, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) r2 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r1, r2, &(0x7f0000000040)=0x100060, 0xa808) fadvise64(0xffffffffffffffff, 0x6, 0xf640, 0x0) 02:23:54 executing program 3: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1000, &(0x7f0000000000/0x1000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000001c0)={[0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x4cb]}) openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x0, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000040), 0x4) ioctl$KVM_RUN(r2, 0xae80, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 275.237476][ T9897] IPVS: ftp: loaded support on port[0] = 21 02:23:54 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x14) [ 275.392173][ T9932] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 275.447423][ T9914] 9pnet_virtio: no channels available for device 127.0.0.1 02:23:59 executing program 2: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/cuse\x00', 0x82, 0x0) io_setup(0x9, &(0x7f0000000100)=0x0) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) r3 = dup3(r2, r0, 0x0) bind$x25(r3, &(0x7f0000000040)={0x9, @null=' \x00'}, 0x12) io_submit(r1, 0x1, &(0x7f0000000440)=[&(0x7f0000000000)={0x4, 0x960000, 0x0, 0x1, 0x0, r0, 0x0}]) 02:23:59 executing program 1: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/cuse\x00', 0x82, 0x0) io_setup(0x9, &(0x7f0000000100)=0x0) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) r3 = dup3(r2, r0, 0x0) bind$x25(r3, &(0x7f0000000040)={0x9, @null=' \x00'}, 0x12) io_submit(r1, 0x1, &(0x7f0000000440)=[&(0x7f0000000000)={0x4, 0x960000, 0x0, 0x1, 0x0, r0, 0x0}]) 02:23:59 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="3401000010000507be00"/20, @ANYRES32=0x0, @ANYBLOB="0000000004000000080112000c0001006d6163766c616e00f80002004c0005000a00040000000000000000000a00ebffd11bf5466bca000002000400ea9c2f85340b00000a000400aaaaaaaaaaaa00000a000400aaaaaaaaaabb20000a000400aaaaaac8aabb00000a000400aaaaaaaaaabb000008000100100000000a000400aaaaaaaaaaaa00000a000400aaaaaaaaaa230000080003000300000009bc030002000000640005000a1904000180c200000300000a000400ffffffffffff00000a000400aaaaaaaaaa2400000a000400ffffffffffff00000a00040000000000000000000afd030000000000000000000a0004000180c200000200000a00040010c784011564000008000300000000020a00050004000000000000008cebcfede90c55c31ad137113554103dd0e6e3aef5c1ef84f27b535b60131f591dd4464468822ffb399f5b35992fce4ba75b5d4549fe212ccbfb1fe64794c22c97601edd8c5be3ac4e10d40001b58b222c3b29b009bc07e0a5b801000000000000008e82c976fb92f6934ba62de4ab266be7a8aacd9fe1cb8a55e4645005d16a4eab6cf578ca8879b71ccac6766e4b4e0d58dd22a49d9492daf93eab6586dded12b188d31f89c15054f7c532e20f90412d1d9446a593efb12e65ae2b01f9a74299c31e0fb5991300000000f6603b389e34f193cc94f61527418a02a89935ff0dec3ad48e2628d0d27ca32c719cb9c6b93177246e46e94a0d4e230e3de615035665b2feb8add3cf3bce0ed5853a8b21e8541b046d5ecaebf9832f0b"], 0x134}}, 0x10) 02:23:59 executing program 5: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x10006, 0x80011, r0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) ioctl$TCSETXF(0xffffffffffffffff, 0x5434, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) r2 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r1, r2, &(0x7f0000000040)=0x100060, 0xa808) fadvise64(0xffffffffffffffff, 0x6, 0xf640, 0x0) 02:23:59 executing program 0: perf_event_open(&(0x7f0000000440)={0x0, 0x70, 0xb8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-monitor\x00', 0x8500, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) sendfile(r0, r1, &(0x7f0000000040)=0x100060, 0xa808) fadvise64(0xffffffffffffffff, 0x6, 0x0, 0x0) 02:23:59 executing program 4: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x10006, 0x80011, r0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) ioctl$TCSETXF(0xffffffffffffffff, 0x5434, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) r2 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r1, r2, &(0x7f0000000040)=0x100060, 0xa808) fadvise64(0xffffffffffffffff, 0x6, 0xf640, 0x0) [ 279.727176][ T9970] netlink: 'syz-executor.3': attribute type 5 has an invalid length. [ 279.765082][ T9970] netlink: 116 bytes leftover after parsing attributes in process `syz-executor.3'. [ 279.780214][ T1130] tipc: TX() has been purged, node left! [ 279.788377][ T1130] tipc: TX() has been purged, node left! 02:23:59 executing program 1: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/cuse\x00', 0x82, 0x0) io_setup(0x9, &(0x7f0000000100)=0x0) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) r3 = dup3(r2, r0, 0x0) bind$x25(r3, &(0x7f0000000040)={0x9, @null=' \x00'}, 0x12) io_submit(r1, 0x1, &(0x7f0000000440)=[&(0x7f0000000000)={0x4, 0x960000, 0x0, 0x1, 0x0, r0, 0x0}]) 02:23:59 executing program 2: prctl$PR_SET_SECUREBITS(0x1c, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x8, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000ac0)={0x38, 0x2, 0x0, 0x0, 0x5, 0xfffffffffffffffd, 0x4}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000000b00), 0x6, 0x1, 0x0) openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nvme-fabrics\x00', 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000480)='ethtool\x00') pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) write$FUSE_LSEEK(0xffffffffffffffff, &(0x7f00000001c0)={0xfffffdb3, 0x0, 0x0, {0xfffffffffffffffe}}, 0x18) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f00000003c0)=ANY=[], &(0x7f000095dffc)) setsockopt$inet_sctp_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f0000000780)={0x0, 0x0, 0x9, 0x0, 0x1, 0xffff}, 0x14) write(r0, &(0x7f0000000340), 0x41395527) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) write$cgroup_subtree(r1, 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(0xffffffffffffffff, 0x84, 0x12, &(0x7f0000000140)=0x6, 0x4) r2 = syz_init_net_socket$llc(0x1a, 0x801, 0x0) fstat(0xffffffffffffffff, &(0x7f00000002c0)) connect$llc(r2, &(0x7f0000000380)={0x1a, 0x1, 0x0, 0x9}, 0x10) sendmmsg(r2, 0x0, 0x0, 0x2000000) 02:23:59 executing program 4: openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/seq/timer\x00', 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) fcntl$setsig(0xffffffffffffffff, 0xa, 0x0) prctl$PR_TASK_PERF_EVENTS_DISABLE(0x1f) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$bsg(0xffffffffffffff9c, 0x0, 0x618401, 0x0) syz_genetlink_get_family_id$team(0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000380)='/dev/loop#\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_MIGRATE_ID(0xffffffffffffffff, 0x0, 0x0) openat$thread_pidfd(0xffffffffffffff9c, 0x0, 0xa02, 0x0) sysinfo(0x0) ioctl$BLKPG(r1, 0x1269, 0x0) open(0x0, 0x4544c7, 0x0) socket$inet6(0xa, 0x0, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) preadv(r0, &(0x7f00000017c0), 0x19e, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x800, 0x0) 02:23:59 executing program 0: openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/seq/timer\x00', 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) fcntl$dupfd(0xffffffffffffffff, 0x0, r1) fcntl$setsig(r0, 0xa, 0x0) prctl$PR_TASK_PERF_EVENTS_DISABLE(0x1f) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, @perf_bp={0x0, 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(r0, &(0x7f00000017c0), 0x19e, 0x0) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x0, 0x0) 02:23:59 executing program 5: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x10006, 0x80011, r0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) ioctl$TCSETXF(0xffffffffffffffff, 0x5434, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) r2 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r1, r2, &(0x7f0000000040)=0x100060, 0xa808) fadvise64(0xffffffffffffffff, 0x6, 0xf640, 0x0) 02:23:59 executing program 1: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/cuse\x00', 0x82, 0x0) io_setup(0x9, &(0x7f0000000100)=0x0) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) r3 = dup3(r2, r0, 0x0) bind$x25(r3, &(0x7f0000000040)={0x9, @null=' \x00'}, 0x12) io_submit(r1, 0x1, &(0x7f0000000440)=[&(0x7f0000000000)={0x4, 0x960000, 0x0, 0x1, 0x0, r0, 0x0}]) [ 280.127594][ T9991] netlink: 'syz-executor.3': attribute type 5 has an invalid length. [ 280.196756][ T9991] netlink: 116 bytes leftover after parsing attributes in process `syz-executor.3'. 02:23:59 executing program 2: gettid() pkey_free(0xffffffffffffffff) socket$inet6(0xa, 0x10000000000001, 0x0) fstat(0xffffffffffffffff, 0x0) ioctl$EVIOCGUNIQ(0xffffffffffffffff, 0x80404508, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000280)='/dev/ttyprintk\x00', 0x40002, 0x0) writev(r0, &(0x7f00000002c0)=[{&(0x7f0000000380)='\n', 0x300}], 0x1) [ 280.456453][T10009] [U] 02:24:00 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="3401000010000507be00"/20, @ANYRES32=0x0, @ANYBLOB="0000000004000000080112000c0001006d6163766c616e00f80002004c0005000a00040000000000000000000a00ebffd11bf5466bca000002000400ea9c2f85340b00000a000400aaaaaaaaaaaa00000a000400aaaaaaaaaabb20000a000400aaaaaac8aabb00000a000400aaaaaaaaaabb000008000100100000000a000400aaaaaaaaaaaa00000a000400aaaaaaaaaa230000080003000300000009bc030002000000640005000a1904000180c200000300000a000400ffffffffffff00000a000400aaaaaaaaaa2400000a000400ffffffffffff00000a00040000000000000000000afd030000000000000000000a0004000180c200000200000a00040010c784011564000008000300000000020a00050004000000000000008cebcfede90c55c31ad137113554103dd0e6e3aef5c1ef84f27b535b60131f591dd4464468822ffb399f5b35992fce4ba75b5d4549fe212ccbfb1fe64794c22c97601edd8c5be3ac4e10d40001b58b222c3b29b009bc07e0a5b801000000000000008e82c976fb92f6934ba62de4ab266be7a8aacd9fe1cb8a55e4645005d16a4eab6cf578ca8879b71ccac6766e4b4e0d58dd22a49d9492daf93eab6586dded12b188d31f89c15054f7c532e20f90412d1d9446a593efb12e65ae2b01f9a74299c31e0fb5991300000000f6603b389e34f193cc94f61527418a02a89935ff0dec3ad48e2628d0d27ca32c719cb9c6b93177246e46e94a0d4e230e3de615035665b2feb8add3cf3bce0ed5853a8b21e8541b046d5ecaebf9832f0b"], 0x134}}, 0x10) [ 280.504656][T10006] [U] 02:24:00 executing program 5: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x10006, 0x80011, r0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) ioctl$TCSETXF(0xffffffffffffffff, 0x5434, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) r2 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r1, r2, &(0x7f0000000040)=0x100060, 0xa808) fadvise64(0xffffffffffffffff, 0x6, 0xf640, 0x0) 02:24:00 executing program 1: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/cuse\x00', 0x82, 0x0) io_setup(0x9, &(0x7f0000000100)=0x0) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) dup3(r2, r0, 0x0) io_submit(r1, 0x1, &(0x7f0000000440)=[&(0x7f0000000000)={0x4, 0x960000, 0x0, 0x1, 0x0, r0, 0x0}]) 02:24:00 executing program 2: prctl$PR_SET_SECUREBITS(0x1c, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x8, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000ac0)={0x38, 0x2, 0x0, 0x0, 0x5, 0xfffffffffffffffd, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000000b00), 0x6, 0x1, 0x0) r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000200)='/dev/nvme-fabrics\x00', 0x440, 0x0) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000480)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f00000006c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000640)={&(0x7f00000004c0)={0x154, r3, 0x8, 0x70bd25, 0x25dfdbff, {}, [@ETHTOOL_A_LINKMODES_AUTONEG={0x5, 0x2, 0x7}, @ETHTOOL_A_LINKMODES_AUTONEG={0x5, 0x2, 0x7}, @ETHTOOL_A_LINKMODES_OURS={0x118, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0xef}, @ETHTOOL_A_BITSET_MASK={0xf6, 0x5, "1c3b14342664ffe3a23d24df563f50f4ad27514e0d7e83fc2deb403351b2a7d7e4e41c0bd9484ed8caeed3f10f30ad416c723ce49b4f02bb00c2afb2a795ee6544a7585de79b1b0428b0fa0983f18ae5b408bdfa5b3d6bc189a4b42ac21cedcce307310cb4ceee28921df42ae52c73f8f6d06329c8f10588beb55803aaf0302fb16ea5e35963b158a1445dd16e2810e2b28c1eac28af13bd410a0d42f4e39bfc60db5c75e2acfda3ea41d4d98038ced90b70f78dd7d83858892b56185371ff58e349597ff9a3913247e26ec15b445a9d3ecda8b03b89a58dc35f9217cf430a8b08ebb668924de194f7125120b21fa97f3aa5"}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x401}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x9e8}]}, @ETHTOOL_A_LINKMODES_AUTONEG={0x5, 0x2, 0x1}, @ETHTOOL_A_LINKMODES_SPEED={0x8, 0x5, 0x80000000}, @ETHTOOL_A_LINKMODES_AUTONEG={0x5, 0x2, 0x4}]}, 0x154}, 0x1, 0x0, 0x0, 0x4}, 0x4050) pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) write$FUSE_LSEEK(r4, &(0x7f00000001c0)={0xfffffdb3, 0x0, 0x0, {0xfffffffffffffffe}}, 0x18) ioctl$FS_IOC_SETVERSION(r5, 0x40087602, &(0x7f0000000340)=0x1) ioctl$BLKROTATIONAL(r5, 0x127e, &(0x7f0000000100)) r6 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r7 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r7, 0x84, 0x1d, &(0x7f00000003c0)=ANY=[@ANYBLOB="1001000030a395396f58fdcf5853299c9e8af44202a6c007c7c47de95f4891b4ddc155336e603faf6c493284cd9203428302470b58c4e36e463e6ff6b8dd84b7c15868264dd40b414bb14948ddedef25a5f97462c8260e9c501e6e76a4a93ac7844eb6b9fdc89763dddd77f71e8b82e496d4b8c0c160fa971ca8e3b3535d9508ab0b301a9440"], &(0x7f000095dffc)=0x1) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000000040), 0x20) setsockopt$inet_sctp_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f0000000780)={0x0, 0x0, 0x9, 0x0, 0x1, 0xffff}, 0x14) fcntl$setpipe(r5, 0x407, 0x0) write(r5, &(0x7f0000000340), 0x41395527) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) write$cgroup_subtree(r8, 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r6, 0x84, 0x12, &(0x7f0000000140)=0x6, 0x4) r9 = syz_init_net_socket$llc(0x1a, 0x801, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000180)='/dev/dsp\x00', 0x100802, 0x0) fstat(0xffffffffffffffff, &(0x7f00000002c0)) connect$llc(r9, &(0x7f0000000380)={0x1a, 0x1, 0x0, 0x9}, 0x10) sendmmsg(r9, &(0x7f0000001380), 0x40003ad, 0x2000000) [ 280.782227][T10014] netlink: 'syz-executor.3': attribute type 5 has an invalid length. [ 280.825664][T10014] netlink: 116 bytes leftover after parsing attributes in process `syz-executor.3'. [ 280.869517][ T9992] ================================================================== [ 280.878030][ T9992] BUG: KASAN: use-after-free in snd_timer_resolution+0xf1/0x110 [ 280.885682][ T9992] Read of size 8 at addr ffff888094e29400 by task syz-executor.0/9992 [ 280.893835][ T9992] [ 280.896182][ T9992] CPU: 1 PID: 9992 Comm: syz-executor.0 Not tainted 5.5.0-rc6-next-20200116-syzkaller #0 [ 280.905990][ T9992] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 280.916067][ T9992] Call Trace: [ 280.919491][ T9992] dump_stack+0x197/0x210 [ 280.923849][ T9992] ? snd_timer_resolution+0xf1/0x110 [ 280.929215][ T9992] print_address_description.constprop.0.cold+0xd4/0x30b [ 280.936254][ T9992] ? snd_timer_resolution+0xf1/0x110 [ 280.941668][ T9992] ? snd_timer_resolution+0xf1/0x110 [ 280.946981][ T9992] __kasan_report.cold+0x1b/0x32 [ 280.951953][ T9992] ? snd_timer_resolution+0xf1/0x110 [ 280.957266][ T9992] kasan_report+0x12/0x20 [ 280.961783][ T9992] __asan_report_load8_noabort+0x14/0x20 [ 280.967452][ T9992] snd_timer_resolution+0xf1/0x110 [ 280.972866][ T9992] snd_seq_info_timer_read+0x95/0x2f1 [ 280.978270][ T9992] snd_info_seq_show+0xcb/0x120 [ 280.983265][ T9992] seq_read+0x4ca/0x1170 [ 280.987551][ T9992] ? seq_open_private+0x50/0x50 [ 280.992515][ T9992] proc_reg_read+0x1f8/0x2b0 [ 280.997135][ T9992] ? proc_reg_unlocked_ioctl+0x2a0/0x2a0 [ 281.002859][ T9992] do_iter_read+0x4a4/0x660 [ 281.009195][ T9992] ? dup_iter+0x260/0x260 [ 281.013552][ T9992] vfs_readv+0xf0/0x160 [ 281.017732][ T9992] ? compat_rw_copy_check_uvector+0x4c0/0x4c0 [ 281.023811][ T9992] ? __kasan_check_read+0x11/0x20 [ 281.028857][ T9992] ? do_dup2+0x4f0/0x4f0 [ 281.033162][ T9992] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 281.039537][ T9992] ? debug_smp_processor_id+0x33/0x18a [ 281.045424][ T9992] ? __fget_light+0x1ad/0x270 [ 281.050135][ T9992] do_preadv+0x1c4/0x280 [ 281.054409][ T9992] ? do_readv+0x330/0x330 [ 281.058835][ T9992] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 281.064331][ T9992] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 281.069822][ T9992] ? do_syscall_64+0x26/0x790 [ 281.074602][ T9992] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 281.080802][ T9992] ? do_syscall_64+0x26/0x790 [ 281.085503][ T9992] __x64_sys_preadv+0x9a/0xf0 [ 281.090216][ T9992] do_syscall_64+0xfa/0x790 [ 281.094748][ T9992] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 281.100683][ T9992] RIP: 0033:0x45b349 [ 281.104602][ T9992] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 281.124239][ T9992] RSP: 002b:00007f1582537c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 281.132776][ T9992] RAX: ffffffffffffffda RBX: 00007f15825386d4 RCX: 000000000045b349 [ 281.140760][ T9992] RDX: 000000000000019e RSI: 00000000200017c0 RDI: 0000000000000004 [ 281.148749][ T9992] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 281.156732][ T9992] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 281.164724][ T9992] R13: 000000000000084f R14: 00000000004c9c13 R15: 000000000075bf2c [ 281.172720][ T9992] [ 281.175066][ T9992] Allocated by task 10002: [ 281.179504][ T9992] save_stack+0x23/0x90 [ 281.183683][ T9992] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 281.189334][ T9992] kasan_kmalloc+0x9/0x10 [ 281.193678][ T9992] kmem_cache_alloc_trace+0x158/0x790 [ 281.199088][ T9992] snd_timer_instance_new+0x4a/0x300 [ 281.204817][ T9992] snd_seq_timer_open+0x1c0/0x590 [ 281.209858][ T9992] queue_use+0xf1/0x270 [ 281.214112][ T9992] snd_seq_queue_alloc+0x2c5/0x4d0 [ 281.219297][ T9992] snd_seq_ioctl_create_queue+0xb0/0x330 [ 281.224945][ T9992] snd_seq_kernel_client_ctl+0xf8/0x140 [ 281.230616][ T9992] alloc_seq_queue.isra.0+0xdc/0x180 [ 281.235914][ T9992] snd_seq_oss_open+0x2ff/0x960 [ 281.240785][ T9992] odev_open+0x70/0x90 [ 281.244931][ T9992] soundcore_open+0x453/0x610 [ 281.249676][ T9992] chrdev_open+0x245/0x6b0 [ 281.254108][ T9992] do_dentry_open+0x4ca/0x1350 [ 281.258886][ T9992] vfs_open+0xa0/0xd0 [ 281.262882][ T9992] path_openat+0x12fd/0x34d0 [ 281.267481][ T9992] do_filp_open+0x192/0x260 [ 281.272003][ T9992] do_sys_openat2+0x633/0x840 [ 281.276693][ T9992] do_sys_open+0xfc/0x190 [ 281.281034][ T9992] __x64_sys_openat+0x9d/0x100 [ 281.285813][ T9992] do_syscall_64+0xfa/0x790 [ 281.290429][ T9992] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 281.296319][ T9992] [ 281.298651][ T9992] Freed by task 9984: [ 281.302746][ T9992] save_stack+0x23/0x90 [ 281.306919][ T9992] __kasan_slab_free+0x102/0x150 [ 281.311876][ T9992] kasan_slab_free+0xe/0x10 [ 281.316400][ T9992] kfree+0x10a/0x2c0 [ 281.320414][ T9992] snd_timer_instance_free+0x7c/0xa0 [ 281.325714][ T9992] snd_seq_timer_close+0x99/0xe0 [ 281.330782][ T9992] queue_delete+0x52/0xb0 [ 281.335129][ T9992] snd_seq_queue_delete+0x4e/0x70 [ 281.340175][ T9992] snd_seq_ioctl_delete_queue+0x6a/0x90 [ 281.345734][ T9992] snd_seq_kernel_client_ctl+0xf8/0x140 [ 281.351287][ T9992] delete_seq_queue.part.0+0xb6/0x120 [ 281.356767][ T9992] snd_seq_oss_release+0x116/0x150 [ 281.361905][ T9992] odev_release+0x54/0x80 [ 281.366256][ T9992] __fput+0x2ff/0x890 [ 281.370254][ T9992] ____fput+0x16/0x20 [ 281.374369][ T9992] task_work_run+0x145/0x1c0 [ 281.378983][ T9992] exit_to_usermode_loop+0x316/0x380 [ 281.384280][ T9992] do_syscall_64+0x676/0x790 [ 281.388994][ T9992] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 281.394902][ T9992] [ 281.397248][ T9992] The buggy address belongs to the object at ffff888094e29400 [ 281.397248][ T9992] which belongs to the cache kmalloc-256 of size 256 [ 281.411320][ T9992] The buggy address is located 0 bytes inside of [ 281.411320][ T9992] 256-byte region [ffff888094e29400, ffff888094e29500) [ 281.424418][ T9992] The buggy address belongs to the page: [ 281.430128][ T9992] page:ffffea0002538a40 refcount:1 mapcount:0 mapping:ffff8880aa4008c0 index:0x0 [ 281.439246][ T9992] flags: 0xfffe0000000200(slab) [ 281.444123][ T9992] raw: 00fffe0000000200 ffffea00025ddd88 ffffea00029add08 ffff8880aa4008c0 [ 281.452736][ T9992] raw: 0000000000000000 ffff888094e29000 0000000100000008 0000000000000000 [ 281.461337][ T9992] page dumped because: kasan: bad access detected [ 281.467754][ T9992] [ 281.470090][ T9992] Memory state around the buggy address: [ 281.475735][ T9992] ffff888094e29300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 281.483821][ T9992] ffff888094e29380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 281.491898][ T9992] >ffff888094e29400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 281.499964][ T9992] ^ [ 281.504050][ T9992] ffff888094e29480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 281.512247][ T9992] ffff888094e29500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc 02:24:01 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='devpts\x00', 0x0, &(0x7f00000001c0)='/selinux/policy\x00') r1 = gettid() tkill(r1, 0x3c) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) socket$inet6(0xa, 0x2, 0x0) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f0000000340), 0x41395527) socket(0xa, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0) sched_setattr(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_bp={&(0x7f0000000680)}, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) close(r0) socket$nl_xfrm(0x10, 0x3, 0x6) 02:24:01 executing program 3: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/seq/timer\x00', 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') fcntl$setsig(0xffffffffffffffff, 0xa, 0x0) prctl$PR_TASK_PERF_EVENTS_DISABLE(0x1f) getdents(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$team(0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x4000000) r2 = syz_open_dev$loop(&(0x7f0000000380)='/dev/loop#\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_MIGRATE_ID(0xffffffffffffffff, &(0x7f0000000440)={0x12, 0x10, 0xfa00, {0x0, 0xffffffffffffffff, r0}}, 0x18) ioctl$BLKPG(r2, 0x1269, &(0x7f0000000240)={0x1, 0x0, 0x0, &(0x7f0000000800)}) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) open(&(0x7f00000000c0)='.\x00', 0x0, 0x0) preadv(r1, &(0x7f00000017c0), 0x19e, 0x0) syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x40) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000200)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) [ 281.520434][ T9992] ================================================================== [ 281.528500][ T9992] Disabling lock debugging due to kernel taint [ 281.539465][T10030] devpts: called with bogus options [ 281.561144][ T9992] Kernel panic - not syncing: panic_on_warn set ... [ 281.567794][ T9992] CPU: 1 PID: 9992 Comm: syz-executor.0 Tainted: G B 5.5.0-rc6-next-20200116-syzkaller #0 [ 281.578973][ T9992] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 281.589055][ T9992] Call Trace: [ 281.592417][ T9992] dump_stack+0x197/0x210 [ 281.596833][ T9992] panic+0x2e3/0x75c [ 281.600745][ T9992] ? add_taint.cold+0x16/0x16 [ 281.605422][ T9992] ? snd_timer_resolution+0xf1/0x110 [ 281.610718][ T9992] ? preempt_schedule+0x4b/0x60 [ 281.615578][ T9992] ? ___preempt_schedule+0x16/0x18 [ 281.620765][ T9992] ? trace_hardirqs_on+0x5e/0x240 [ 281.625928][ T9992] ? snd_timer_resolution+0xf1/0x110 [ 281.631228][ T9992] end_report+0x47/0x4f [ 281.635374][ T9992] ? snd_timer_resolution+0xf1/0x110 [ 281.640658][ T9992] __kasan_report.cold+0xe/0x32 [ 281.645607][ T9992] ? snd_timer_resolution+0xf1/0x110 [ 281.650966][ T9992] kasan_report+0x12/0x20 [ 281.655314][ T9992] __asan_report_load8_noabort+0x14/0x20 [ 281.660951][ T9992] snd_timer_resolution+0xf1/0x110 [ 281.666078][ T9992] snd_seq_info_timer_read+0x95/0x2f1 [ 281.671475][ T9992] snd_info_seq_show+0xcb/0x120 [ 281.676440][ T9992] seq_read+0x4ca/0x1170 [ 281.680694][ T9992] ? seq_open_private+0x50/0x50 [ 281.685553][ T9992] proc_reg_read+0x1f8/0x2b0 [ 281.690134][ T9992] ? proc_reg_unlocked_ioctl+0x2a0/0x2a0 [ 281.695769][ T9992] do_iter_read+0x4a4/0x660 [ 281.700273][ T9992] ? dup_iter+0x260/0x260 [ 281.704596][ T9992] vfs_readv+0xf0/0x160 [ 281.708757][ T9992] ? compat_rw_copy_check_uvector+0x4c0/0x4c0 [ 281.714828][ T9992] ? __kasan_check_read+0x11/0x20 [ 281.719868][ T9992] ? do_dup2+0x4f0/0x4f0 [ 281.724121][ T9992] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 281.730375][ T9992] ? debug_smp_processor_id+0x33/0x18a [ 281.735844][ T9992] ? __fget_light+0x1ad/0x270 [ 281.740519][ T9992] do_preadv+0x1c4/0x280 [ 281.744770][ T9992] ? do_readv+0x330/0x330 [ 281.749287][ T9992] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 281.754782][ T9992] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 281.760760][ T9992] ? do_syscall_64+0x26/0x790 [ 281.765551][ T9992] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 281.771707][ T9992] ? do_syscall_64+0x26/0x790 [ 281.776391][ T9992] __x64_sys_preadv+0x9a/0xf0 [ 281.781064][ T9992] do_syscall_64+0xfa/0x790 [ 281.785580][ T9992] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 281.791478][ T9992] RIP: 0033:0x45b349 [ 281.795386][ T9992] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 281.814989][ T9992] RSP: 002b:00007f1582537c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 281.823405][ T9992] RAX: ffffffffffffffda RBX: 00007f15825386d4 RCX: 000000000045b349 [ 281.831381][ T9992] RDX: 000000000000019e RSI: 00000000200017c0 RDI: 0000000000000004 [ 281.839362][ T9992] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 281.847373][ T9992] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 281.855363][ T9992] R13: 000000000000084f R14: 00000000004c9c13 R15: 000000000075bf2c [ 281.864163][ T9992] Kernel Offset: disabled [ 281.868508][ T9992] Rebooting in 86400 seconds..