[ 53.470512] audit: type=1800 audit(1545319182.491:26): pid=6430 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 54.891064] kauditd_printk_skb: 2 callbacks suppressed [ 54.891094] audit: type=1800 audit(1545319183.931:29): pid=6430 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 54.916285] audit: type=1800 audit(1545319183.941:30): pid=6430 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.10.32' (ECDSA) to the list of known hosts. 2018/12/20 15:19:57 fuzzer started 2018/12/20 15:20:01 dialing manager at 10.128.0.26:46613 2018/12/20 15:20:02 syscalls: 1 2018/12/20 15:20:02 code coverage: enabled 2018/12/20 15:20:02 comparison tracing: CONFIG_KCOV_ENABLE_COMPARISONS is not enabled 2018/12/20 15:20:02 setuid sandbox: enabled 2018/12/20 15:20:02 namespace sandbox: enabled 2018/12/20 15:20:02 Android sandbox: /sys/fs/selinux/policy does not exist 2018/12/20 15:20:02 fault injection: enabled 2018/12/20 15:20:02 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2018/12/20 15:20:02 net packet injection: enabled 2018/12/20 15:20:02 net device setup: enabled 15:20:44 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000000)={{}, {0x20000000304, @random="b61467b3bdc2"}, 0x14, {0x2, 0x0, @multicast1}, '\x00\x007\xfc\x00\x00\x00\x00\x00\x00\x00\xfe\x00'}) syzkaller login: [ 116.413913] IPVS: ftp: loaded support on port[0] = 21 [ 117.817749] bridge0: port 1(bridge_slave_0) entered blocking state [ 117.824475] bridge0: port 1(bridge_slave_0) entered disabled state [ 117.832933] device bridge_slave_0 entered promiscuous mode [ 117.915623] bridge0: port 2(bridge_slave_1) entered blocking state [ 117.922285] bridge0: port 2(bridge_slave_1) entered disabled state [ 117.930582] device bridge_slave_1 entered promiscuous mode [ 118.012849] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 118.095408] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 118.350378] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 118.438687] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 118.522506] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 118.529469] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 118.612925] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 118.619937] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 118.877836] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 118.886605] team0: Port device team_slave_0 added [ 118.968940] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 118.977602] team0: Port device team_slave_1 added [ 119.062691] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 119.152175] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 119.239177] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 119.246904] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 119.256583] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 119.341636] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 119.349327] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 119.358694] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 119.681791] ip (6671) used greatest stack depth: 53840 bytes left 15:20:48 executing program 1: r0 = socket$inet(0x2, 0x200000002, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000080)=@pppol2tpv3in6={0x18, 0x1, {0x0, r0, 0x3, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x32) getsockname(r1, &(0x7f00000000c0)=@ethernet={0x0, @dev}, &(0x7f0000000000)=0x80) [ 120.283259] IPVS: ftp: loaded support on port[0] = 21 [ 120.583621] bridge0: port 2(bridge_slave_1) entered blocking state [ 120.590193] bridge0: port 2(bridge_slave_1) entered forwarding state [ 120.597464] bridge0: port 1(bridge_slave_0) entered blocking state [ 120.604079] bridge0: port 1(bridge_slave_0) entered forwarding state [ 120.613322] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 120.619809] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 122.667140] bridge0: port 1(bridge_slave_0) entered blocking state [ 122.673873] bridge0: port 1(bridge_slave_0) entered disabled state [ 122.682035] device bridge_slave_0 entered promiscuous mode [ 122.840187] bridge0: port 2(bridge_slave_1) entered blocking state [ 122.846844] bridge0: port 2(bridge_slave_1) entered disabled state [ 122.855268] device bridge_slave_1 entered promiscuous mode [ 122.980347] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 123.073000] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 123.474766] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 123.650769] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 124.308382] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 124.317109] team0: Port device team_slave_0 added [ 124.467497] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 124.476225] team0: Port device team_slave_1 added [ 124.668124] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 124.823136] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready 15:20:53 executing program 2: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = syz_open_procfs(0x0, &(0x7f0000000240)='/exe\x00\x00\x00\x00\x00\x005\xab\xe1\xe8\r\x90>\rqz\xc1\x88\x9aE\xe5\x81\xc9\xe1J\\\x8f\x95\xf5\xd2\x96\x8a\xe8\xc7g\xe9\xd1\x8f\xd6\x9a') mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x800000000004, 0x20011, r1, 0x0) setsockopt$inet6_int(r0, 0x29, 0xd1, &(0x7f0000000180), 0x4) setsockopt$inet6_int(r0, 0x29, 0xd0, &(0x7f0000000000), 0x4) [ 124.930454] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 124.938231] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 124.947442] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 125.130335] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 125.138043] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 125.147313] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 125.429229] IPVS: ftp: loaded support on port[0] = 21 [ 126.473793] 8021q: adding VLAN 0 to HW filter on device bond0 [ 127.050841] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 127.073540] bridge0: port 2(bridge_slave_1) entered blocking state [ 127.080060] bridge0: port 2(bridge_slave_1) entered forwarding state [ 127.087280] bridge0: port 1(bridge_slave_0) entered blocking state [ 127.093884] bridge0: port 1(bridge_slave_0) entered forwarding state [ 127.103117] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 127.109804] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 127.748108] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 127.754507] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 127.762680] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 128.213839] 8021q: adding VLAN 0 to HW filter on device team0 [ 128.234010] bridge0: port 1(bridge_slave_0) entered blocking state [ 128.240528] bridge0: port 1(bridge_slave_0) entered disabled state [ 128.249370] device bridge_slave_0 entered promiscuous mode [ 128.377748] bridge0: port 2(bridge_slave_1) entered blocking state [ 128.384448] bridge0: port 2(bridge_slave_1) entered disabled state [ 128.392830] device bridge_slave_1 entered promiscuous mode [ 128.476003] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 128.615930] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 129.158860] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 129.263490] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 129.425649] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 129.432848] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 129.618578] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 129.625812] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 130.142812] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 130.151550] team0: Port device team_slave_0 added [ 130.376003] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 130.384620] team0: Port device team_slave_1 added [ 130.528140] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 130.535175] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 130.544348] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 130.660907] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 130.668158] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 130.677147] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 130.799970] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 130.807669] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 130.816909] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 131.022849] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 131.030470] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 131.040324] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready 15:21:01 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000000)={{}, {0x20000000304, @random="b61467b3bdc2"}, 0x14, {0x2, 0x0, @multicast1}, '\x00\x007\xfc\x00\x00\x00\x00\x00\x00\x00\xfe\x00'}) 15:21:01 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000000)={{}, {0x20000000304, @random="b61467b3bdc2"}, 0x14, {0x2, 0x0, @multicast1}, '\x00\x007\xfc\x00\x00\x00\x00\x00\x00\x00\xfe\x00'}) 15:21:01 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000000)={{}, {0x20000000304, @random="b61467b3bdc2"}, 0x14, {0x2, 0x0, @multicast1}, '\x00\x007\xfc\x00\x00\x00\x00\x00\x00\x00\xfe\x00'}) [ 132.809787] bridge0: port 2(bridge_slave_1) entered blocking state [ 132.816430] bridge0: port 2(bridge_slave_1) entered forwarding state [ 132.823655] bridge0: port 1(bridge_slave_0) entered blocking state [ 132.830200] bridge0: port 1(bridge_slave_0) entered forwarding state [ 132.839440] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 132.846007] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready 15:21:02 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='veth1_to_bridge\x00', 0x172) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x814, 0x0, 0x0) 15:21:02 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='veth1_to_bridge\x00', 0x172) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x814, 0x0, 0x0) 15:21:02 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='veth1_to_bridge\x00', 0x172) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x814, 0x0, 0x0) 15:21:02 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) setsockopt$inet6_IPV6_PKTINFO(r1, 0x29, 0x32, 0x0, 0x0) 15:21:02 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='veth1_to_bridge\x00', 0x172) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x814, 0x0, 0x0) 15:21:02 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r0, 0x0, 0x13, 0xfffffffffffffffe, 0x3) 15:21:03 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r0, 0x0, 0x13, 0xfffffffffffffffe, 0x3) [ 134.056639] IPVS: ftp: loaded support on port[0] = 21 [ 134.484762] 8021q: adding VLAN 0 to HW filter on device bond0 [ 135.005425] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 135.660042] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 135.666415] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 135.674565] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 136.177674] 8021q: adding VLAN 0 to HW filter on device team0 [ 136.881493] bridge0: port 1(bridge_slave_0) entered blocking state [ 136.888115] bridge0: port 1(bridge_slave_0) entered disabled state [ 136.896388] device bridge_slave_0 entered promiscuous mode [ 137.021738] bridge0: port 2(bridge_slave_1) entered blocking state [ 137.028418] bridge0: port 2(bridge_slave_1) entered disabled state [ 137.036766] device bridge_slave_1 entered promiscuous mode [ 137.141081] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 137.293470] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 137.813845] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 137.943910] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 138.132044] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 138.140841] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 138.282295] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 138.289307] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 138.852295] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 138.860921] team0: Port device team_slave_0 added [ 139.051873] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 139.060668] team0: Port device team_slave_1 added [ 139.255912] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 139.263043] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 139.272010] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 139.416442] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 139.423777] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 139.432996] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 139.601400] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 139.609124] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 139.618122] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 139.757886] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 139.765625] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 139.774999] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready 15:21:09 executing program 1: r0 = socket$inet(0x2, 0x200000002, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000080)=@pppol2tpv3in6={0x18, 0x1, {0x0, r0, 0x3, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x32) getsockname(r1, &(0x7f00000000c0)=@ethernet={0x0, @dev}, &(0x7f0000000000)=0x80) [ 140.487267] 8021q: adding VLAN 0 to HW filter on device bond0 [ 140.927502] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 141.482989] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 141.489344] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 141.497344] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 141.854437] bridge0: port 2(bridge_slave_1) entered blocking state [ 141.861010] bridge0: port 2(bridge_slave_1) entered forwarding state [ 141.868245] bridge0: port 1(bridge_slave_0) entered blocking state [ 141.874858] bridge0: port 1(bridge_slave_0) entered forwarding state [ 141.885308] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 142.059081] 8021q: adding VLAN 0 to HW filter on device team0 [ 142.493301] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready 15:21:14 executing program 2: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = syz_open_procfs(0x0, &(0x7f0000000240)='/exe\x00\x00\x00\x00\x00\x005\xab\xe1\xe8\r\x90>\rqz\xc1\x88\x9aE\xe5\x81\xc9\xe1J\\\x8f\x95\xf5\xd2\x96\x8a\xe8\xc7g\xe9\xd1\x8f\xd6\x9a') mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x800000000004, 0x20011, r1, 0x0) setsockopt$inet6_int(r0, 0x29, 0xd1, &(0x7f0000000180), 0x4) setsockopt$inet6_int(r0, 0x29, 0xd0, &(0x7f0000000000), 0x4) 15:21:14 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r0, 0x0, 0x13, 0xfffffffffffffffe, 0x3) 15:21:14 executing program 1: r0 = socket$inet(0x2, 0x200000002, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000080)=@pppol2tpv3in6={0x18, 0x1, {0x0, r0, 0x3, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x32) getsockname(r1, &(0x7f00000000c0)=@ethernet={0x0, @dev}, &(0x7f0000000000)=0x80) 15:21:14 executing program 4: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/connector\x00') bind$rds(r0, &(0x7f0000000040)={0x2, 0x4e20, @multicast1}, 0x10) ioctl$UI_SET_FFBIT(r0, 0x4004556b, 0x58) bind$rds(r0, &(0x7f0000000080)={0x2, 0x4e21, @loopback}, 0x10) ioctl$UI_SET_FFBIT(r0, 0x4004556b, 0x53) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f00000000c0)=0x0) ioctl$SNDRV_TIMER_IOCTL_STATUS(r0, 0x80605414, &(0x7f0000000100)=""/38) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000140)={0x4, 0x4, 0x0, r0}) ioctl$KVM_GET_XSAVE(r0, 0x9000aea4, &(0x7f0000000180)) ioctl$KVM_GET_XSAVE(r0, 0x9000aea4, &(0x7f0000000580)) timerfd_create(0x7, 0x80800) r3 = syz_open_procfs(r1, &(0x7f0000000980)='net/ip_vs_stats_percpu\x00') ioctl$UI_SET_FFBIT(r0, 0x4004556b, 0x4e) write$P9_RFLUSH(r3, &(0x7f00000009c0)={0x7, 0x6d, 0x1}, 0x7) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r3, 0xc4c85512, &(0x7f0000000a00)={{0x0, 0x6, 0x7, 0x4, '\x00', 0x100000000}, 0x0, [0x6, 0x1f2, 0x1, 0x5, 0x100000000, 0x80, 0x2, 0x1, 0xc2, 0x9, 0x1, 0x730d, 0x7fffffff, 0x8e, 0x8, 0x7ff, 0x10000, 0x0, 0xffffffff, 0x0, 0x5, 0x4a0, 0x2, 0x7, 0x0, 0x0, 0x9, 0x1, 0xffffffffffffff01, 0x5, 0x3, 0x2, 0xff, 0x0, 0x58, 0x20, 0x4, 0x0, 0x3, 0x3f, 0x4, 0xbac, 0x5, 0xffffffff7fffffff, 0x1f, 0x0, 0x1, 0x10000, 0x3f, 0x615e, 0x6c, 0x2, 0x1, 0x401, 0x2e88, 0x0, 0xfffffffffffffffe, 0x8, 0x562ce85, 0x0, 0x2, 0x7fffffff, 0x3, 0x398b19, 0x8001, 0x2, 0x5, 0x2, 0xdb, 0x200, 0x5305, 0x10001, 0x6, 0xfff, 0x5, 0xff, 0x8, 0x2, 0x4, 0xcf40, 0x60, 0x9d, 0x9, 0x3f, 0x8, 0x10001, 0x100000001, 0xa2, 0x81, 0x7, 0x0, 0x4, 0x20, 0x1, 0x7f, 0x7, 0x6, 0x401, 0x3, 0xfffffffffffff800, 0x6, 0xc13a, 0x8000, 0x3, 0x9, 0x72, 0x2, 0xffffffffffffffc0, 0x200, 0xb930, 0x500, 0x100000000, 0x37, 0x7f, 0x9, 0x3, 0x100000001, 0xa91, 0x3ff, 0xf8d, 0x6, 0x6539, 0xff, 0xc14, 0x3, 0x101, 0xdc, 0x3], {0x77359400}}) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000f00)={{{@in6=@remote, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in6=@mcast2}}, &(0x7f0000001000)=0xe8) bind$packet(r3, &(0x7f0000001040)={0x11, 0x10, r4, 0x1, 0x6, 0x6, @broadcast}, 0x14) ioctl$TUNGETIFF(r3, 0x800454d2, &(0x7f0000001080)) sysfs$3(0x3) r5 = timerfd_create(0x6, 0x800) rmdir(&(0x7f00000010c0)='./file0\x00') getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000001100), &(0x7f0000001140)=0x30) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f00000011c0)='TIPCv2\x00') sendmsg$TIPC_NL_MON_PEER_GET(r3, &(0x7f00000013c0)={&(0x7f0000001180)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000001380)={&(0x7f0000001200)={0x174, r6, 0x1, 0x70bd2c, 0x25dfdbfd, {}, [@TIPC_NLA_NODE={0x40, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xbc07}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x5}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x2}]}, @TIPC_NLA_BEARER={0x4}, @TIPC_NLA_MEDIA={0xa0, 0x5, [@TIPC_NLA_MEDIA_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}]}, @TIPC_NLA_MEDIA_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x100000000000000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7fffffff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_MTU={0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_SOCK={0x48, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xb287}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xffffffff}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7fff}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x40}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x9}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_MON={0x34, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xda3}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x400}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x47f}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x9}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x80}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xdca}]}]}, 0x174}, 0x1, 0x0, 0x0, 0x85}, 0x4000) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000001440)={0x0, 0x1c, &(0x7f0000001400)=[@in6={0xa, 0x4e21, 0xff, @mcast2, 0x545}]}, &(0x7f0000001480)=0x10) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r3, 0x84, 0x1f, &(0x7f00000014c0)={r7, @in6={{0xa, 0x4e24, 0x52b, @mcast2, 0x94}}, 0x8, 0x9}, &(0x7f0000001580)=0x90) tee(r5, r3, 0x6, 0x8) ioctl$VHOST_SET_VRING_ENDIAN(r0, 0x4008af13, &(0x7f00000015c0)={0x3, 0x8001}) ioctl$RTC_AIE_ON(r2, 0x7001) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000001600)={0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x19, 0x1, "8893d7dd708504b9f586647a3686c89aa00c1bd5b4516cf64829e3b4a8014125f496f05ebfa4a24b61a7859ec104adfd6f74d1e664a4a55646b862e0dc87a65c", "2a0248dd22eec36e6ba5e2704d383ba77b441fc7491f208959f8e0e2bac058d6", [0x4, 0x8000]}) 15:21:14 executing program 1: r0 = socket$inet(0x2, 0x200000002, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000080)=@pppol2tpv3in6={0x18, 0x1, {0x0, r0, 0x3, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x32) getsockname(r1, &(0x7f00000000c0)=@ethernet={0x0, @dev}, &(0x7f0000000000)=0x80) 15:21:14 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r0, 0x0, 0x13, 0xfffffffffffffffe, 0x3) 15:21:14 executing program 2: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = syz_open_procfs(0x0, &(0x7f0000000240)='/exe\x00\x00\x00\x00\x00\x005\xab\xe1\xe8\r\x90>\rqz\xc1\x88\x9aE\xe5\x81\xc9\xe1J\\\x8f\x95\xf5\xd2\x96\x8a\xe8\xc7g\xe9\xd1\x8f\xd6\x9a') mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x800000000004, 0x20011, r1, 0x0) setsockopt$inet6_int(r0, 0x29, 0xd1, &(0x7f0000000180), 0x4) setsockopt$inet6_int(r0, 0x29, 0xd0, &(0x7f0000000000), 0x4) [ 146.048069] IPVS: ftp: loaded support on port[0] = 21 [ 147.439653] 8021q: adding VLAN 0 to HW filter on device bond0 [ 147.763506] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 147.828455] bridge0: port 1(bridge_slave_0) entered blocking state [ 147.835094] bridge0: port 1(bridge_slave_0) entered disabled state [ 147.843366] device bridge_slave_0 entered promiscuous mode [ 147.925769] bridge0: port 2(bridge_slave_1) entered blocking state [ 147.932403] bridge0: port 2(bridge_slave_1) entered disabled state [ 147.940666] device bridge_slave_1 entered promiscuous mode [ 148.022724] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 148.104897] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 148.120580] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 148.128692] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 148.136799] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 148.354331] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 148.448575] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 148.460128] 8021q: adding VLAN 0 to HW filter on device team0 [ 148.469440] ip (7680) used greatest stack depth: 53736 bytes left [ 148.531031] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 148.538311] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 148.620784] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 148.628138] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 148.878335] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 148.887008] team0: Port device team_slave_0 added [ 148.968864] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 148.977460] team0: Port device team_slave_1 added [ 149.067568] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 149.154164] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 149.236361] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 149.245203] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 149.254373] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 149.334756] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 149.342977] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 149.352206] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 150.317452] bridge0: port 2(bridge_slave_1) entered blocking state [ 150.324057] bridge0: port 2(bridge_slave_1) entered forwarding state [ 150.331159] bridge0: port 1(bridge_slave_0) entered blocking state [ 150.337766] bridge0: port 1(bridge_slave_0) entered forwarding state [ 150.347145] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 150.452387] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready 15:21:19 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) setsockopt$inet6_IPV6_PKTINFO(r1, 0x29, 0x32, 0x0, 0x0) 15:21:19 executing program 0: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = syz_open_procfs(0x0, &(0x7f0000000240)='/exe\x00\x00\x00\x00\x00\x005\xab\xe1\xe8\r\x90>\rqz\xc1\x88\x9aE\xe5\x81\xc9\xe1J\\\x8f\x95\xf5\xd2\x96\x8a\xe8\xc7g\xe9\xd1\x8f\xd6\x9a') mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x800000000004, 0x20011, r1, 0x0) setsockopt$inet6_int(r0, 0x29, 0xd1, &(0x7f0000000180), 0x4) setsockopt$inet6_int(r0, 0x29, 0xd0, &(0x7f0000000000), 0x4) 15:21:19 executing program 1: r0 = openat$audio(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/audio\x00', 0x0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ppoll(&(0x7f0000000200)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl(r1, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") ioctl$int_in(r0, 0x8000008004500b, 0x0) clock_nanosleep(0x7, 0x1, &(0x7f0000000000), &(0x7f0000000040)) 15:21:19 executing program 2: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = syz_open_procfs(0x0, &(0x7f0000000240)='/exe\x00\x00\x00\x00\x00\x005\xab\xe1\xe8\r\x90>\rqz\xc1\x88\x9aE\xe5\x81\xc9\xe1J\\\x8f\x95\xf5\xd2\x96\x8a\xe8\xc7g\xe9\xd1\x8f\xd6\x9a') mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x800000000004, 0x20011, r1, 0x0) setsockopt$inet6_int(r0, 0x29, 0xd1, &(0x7f0000000180), 0x4) setsockopt$inet6_int(r0, 0x29, 0xd0, &(0x7f0000000000), 0x4) 15:21:19 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='pids.events\x00', 0x0, 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000580)={{{@in6=@mcast2, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@local}}, &(0x7f0000000680)=0xe8) ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f00000006c0)={@loopback, @local, @dev={0xfe, 0x80, [], 0x16}, 0x6, 0x1, 0x101, 0x500, 0x4, 0x420900a0, r1}) r2 = syz_genetlink_get_family_id$fou(&(0x7f0000000780)='fou\x00') sendmsg$FOU_CMD_DEL(r0, &(0x7f0000000840)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x30, r2, 0x408, 0x70bd2a, 0x25dfdbfe, {}, [@FOU_ATTR_AF={0x8, 0x2, 0xa}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0xbf}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}]}, 0x30}, 0x1, 0x0, 0x0, 0x10}, 0x1) ioctl$EVIOCSABS0(r0, 0x401845c0, &(0x7f0000000880)={0xfffffffffffffff8, 0x3, 0x8, 0x93, 0x5, 0x200}) ioctl$RTC_PLL_GET(r0, 0x80207011, &(0x7f00000008c0)) ioctl$KVM_GET_NR_MMU_PAGES(r0, 0xae45, 0x2) setsockopt$inet_sctp_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000000900)={0x1ff}, 0x1) r3 = add_key(&(0x7f0000000a00)='.request_key_auth\x00', &(0x7f0000000a40)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) r4 = request_key(&(0x7f0000000940)='keyring\x00', &(0x7f0000000980)={'syz', 0x2}, &(0x7f00000009c0)='pids.events\x00', r3) keyctl$search(0xa, r3, &(0x7f0000000a80)='id_legacy\x00', &(0x7f0000000ac0)={'syz', 0x2}, r4) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000b40)='TIPCv2\x00') sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000cc0)={&(0x7f0000000b00)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000c80)={&(0x7f0000000b80)={0xc4, r5, 0x400, 0x70bd2d, 0x25dfdbfe, {}, [@TIPC_NLA_NET={0x40, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x4688}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x8001}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x8}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x957}]}, @TIPC_NLA_BEARER={0x70, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x15}}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x8d0, @loopback, 0x8}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x800}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x38}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x18}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz1\x00'}]}]}, 0xc4}, 0x1, 0x0, 0x0, 0x40}, 0x40) ioctl$VIDIOC_DECODER_CMD(r0, 0xc0485660, &(0x7f0000000d00)={0x64cd5fad2eed2cf, 0x2, @start={0x3}}) ioctl$EVIOCGBITSND(r0, 0x80404532, &(0x7f0000000d80)=""/159) bind$alg(r0, &(0x7f0000000e40)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-aes-aesni\x00'}, 0x58) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r0) readlinkat(r0, &(0x7f0000000ec0)='./file0\x00', &(0x7f0000000f00)=""/66, 0x42) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x1) ioctl$TIOCMGET(r0, 0x5415, &(0x7f0000000f80)) ioctl$EVIOCGLED(r0, 0x80404519, &(0x7f0000000fc0)=""/246) r6 = shmget$private(0x0, 0x3000, 0x540002a8, &(0x7f0000ffc000/0x3000)=nil) shmctl$IPC_STAT(r6, 0x2, &(0x7f00000010c0)=""/4096) bind$pptp(r0, &(0x7f00000020c0)={0x18, 0x2, {0x1, @multicast1}}, 0x1e) connect$bt_rfcomm(r0, &(0x7f0000002100)={0x1f, {0x0, 0x2, 0xfff, 0x7, 0x3, 0x100}, 0x6}, 0xa) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r0, 0x40106614, &(0x7f0000002140)={0x0, @speck128}) syz_execute_func(&(0x7f0000002180)="26450f1d68ff666566450f38db7300660f676d2b4513b2b1c61dbb26430f01d7c4e279303a460f922dcf42c4d3d9720a662636dfdbc4a149651f") ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, &(0x7f00000021c0)=0x4a3) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000002200)={{{@in6=@loopback, @in6=@ipv4={[], [], @multicast2}}}, {{@in=@multicast1}}}, &(0x7f0000002300)=0xe8) 15:21:19 executing program 0: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = syz_open_procfs(0x0, &(0x7f0000000240)='/exe\x00\x00\x00\x00\x00\x005\xab\xe1\xe8\r\x90>\rqz\xc1\x88\x9aE\xe5\x81\xc9\xe1J\\\x8f\x95\xf5\xd2\x96\x8a\xe8\xc7g\xe9\xd1\x8f\xd6\x9a') mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x800000000004, 0x20011, r1, 0x0) setsockopt$inet6_int(r0, 0x29, 0xd1, &(0x7f0000000180), 0x4) setsockopt$inet6_int(r0, 0x29, 0xd0, &(0x7f0000000000), 0x4) 15:21:19 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) setsockopt$inet6_IPV6_PKTINFO(r1, 0x29, 0x32, 0x0, 0x0) 15:21:19 executing program 2: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl(r0, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x40, 0x10, 0xe3b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xa000000}, [@IFLA_MASTER={0x8, 0xa, 0x6}, @IFLA_LINKINFO={0x18, 0x12, @vti={{0x8, 0x1, 'vti\x00'}, {0xc, 0x2, [@IFLA_VTI_LOCAL={0x8, 0xc005, @multicast2}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x3d}, 0x7fc) [ 151.358359] IPVS: ftp: loaded support on port[0] = 21 [ 152.765054] bridge0: port 1(bridge_slave_0) entered blocking state [ 152.771587] bridge0: port 1(bridge_slave_0) entered disabled state [ 152.779967] device bridge_slave_0 entered promiscuous mode [ 152.867100] bridge0: port 2(bridge_slave_1) entered blocking state [ 152.873706] bridge0: port 2(bridge_slave_1) entered disabled state [ 152.881947] device bridge_slave_1 entered promiscuous mode [ 152.960033] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 153.038775] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 153.285639] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 153.368767] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 153.452970] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 153.460017] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 153.547233] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 153.555839] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 153.807502] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 153.815472] team0: Port device team_slave_0 added [ 153.900706] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 153.909554] team0: Port device team_slave_1 added [ 153.992589] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 154.098618] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 154.181019] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 154.188893] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 154.197861] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 154.286948] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 154.294694] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 154.303744] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 154.395304] 8021q: adding VLAN 0 to HW filter on device bond0 [ 154.703559] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 155.007998] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 155.014423] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 155.022553] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 155.211220] bridge0: port 2(bridge_slave_1) entered blocking state [ 155.217848] bridge0: port 2(bridge_slave_1) entered forwarding state [ 155.224992] bridge0: port 1(bridge_slave_0) entered blocking state [ 155.231543] bridge0: port 1(bridge_slave_0) entered forwarding state [ 155.240797] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 155.333528] 8021q: adding VLAN 0 to HW filter on device team0 [ 155.403922] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready 15:21:26 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000140)={'bridge0\x00\x00\x00\x00{\x00', &(0x7f0000000100)=@ethtool_cmd={0xf}}) 15:21:26 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) setsockopt$inet6_IPV6_PKTINFO(r1, 0x29, 0x32, 0x0, 0x0) 15:21:26 executing program 2: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl(r0, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x40, 0x10, 0xe3b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xa000000}, [@IFLA_MASTER={0x8, 0xa, 0x6}, @IFLA_LINKINFO={0x18, 0x12, @vti={{0x8, 0x1, 'vti\x00'}, {0xc, 0x2, [@IFLA_VTI_LOCAL={0x8, 0xc005, @multicast2}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x3d}, 0x7fc) 15:21:26 executing program 0: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = syz_open_procfs(0x0, &(0x7f0000000240)='/exe\x00\x00\x00\x00\x00\x005\xab\xe1\xe8\r\x90>\rqz\xc1\x88\x9aE\xe5\x81\xc9\xe1J\\\x8f\x95\xf5\xd2\x96\x8a\xe8\xc7g\xe9\xd1\x8f\xd6\x9a') mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x800000000004, 0x20011, r1, 0x0) setsockopt$inet6_int(r0, 0x29, 0xd1, &(0x7f0000000180), 0x4) setsockopt$inet6_int(r0, 0x29, 0xd0, &(0x7f0000000000), 0x4) 15:21:26 executing program 1: socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000024c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) io_setup(0x8, &(0x7f0000000140)=0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000006c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000002c0)={'syzkaller0\x00', 0xa112}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) io_submit(r2, 0x1400, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x7, 0x0, r1, &(0x7f0000000140), 0x7}]) 15:21:26 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={&(0x7f00000000c0), 0xc, &(0x7f0000000000)={&(0x7f00000001c0)=@delneigh={0x24, 0x1d, 0xb, 0x0, 0x0, {0xa}, [@NDA_DST_IPV4={0x8}]}, 0xfde4}}, 0x0) [ 157.532035] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 157.538889] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 15:21:26 executing program 0: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESTART(r0, 0x1260, 0x0) 15:21:26 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000140)={'bridge0\x00\x00\x00\x00{\x00', &(0x7f0000000100)=@ethtool_cmd={0xf}}) [ 157.838456] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 157.985928] syz-executor1 (8129) used greatest stack depth: 53720 bytes left [ 158.621663] 8021q: adding VLAN 0 to HW filter on device bond0 [ 158.792374] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 158.971349] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 158.977666] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 158.985536] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 159.153995] 8021q: adding VLAN 0 to HW filter on device team0 15:21:29 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f0000000040)) r2 = syz_open_pts(r1, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000000)=0x3) ioctl$TCFLSH(r2, 0x541b, 0x710000) 15:21:29 executing program 2: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl(r0, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x40, 0x10, 0xe3b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xa000000}, [@IFLA_MASTER={0x8, 0xa, 0x6}, @IFLA_LINKINFO={0x18, 0x12, @vti={{0x8, 0x1, 'vti\x00'}, {0xc, 0x2, [@IFLA_VTI_LOCAL={0x8, 0xc005, @multicast2}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x3d}, 0x7fc) 15:21:29 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={&(0x7f00000000c0), 0xc, &(0x7f0000000000)={&(0x7f00000001c0)=@delneigh={0x24, 0x1d, 0xb, 0x0, 0x0, {0xa}, [@NDA_DST_IPV4={0x8}]}, 0xfde4}}, 0x0) 15:21:29 executing program 0: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESTART(r0, 0x1260, 0x0) 15:21:29 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000140)={'bridge0\x00\x00\x00\x00{\x00', &(0x7f0000000100)=@ethtool_cmd={0xf}}) 15:21:29 executing program 1: socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000024c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) io_setup(0x8, &(0x7f0000000140)=0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000006c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000002c0)={'syzkaller0\x00', 0xa112}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) io_submit(r2, 0x1400, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x7, 0x0, r1, &(0x7f0000000140), 0x7}]) 15:21:29 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000140)={'bridge0\x00\x00\x00\x00{\x00', &(0x7f0000000100)=@ethtool_cmd={0xf}}) 15:21:29 executing program 0: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESTART(r0, 0x1260, 0x0) [ 160.395121] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 15:21:29 executing program 2: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl(r0, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x40, 0x10, 0xe3b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xa000000}, [@IFLA_MASTER={0x8, 0xa, 0x6}, @IFLA_LINKINFO={0x18, 0x12, @vti={{0x8, 0x1, 'vti\x00'}, {0xc, 0x2, [@IFLA_VTI_LOCAL={0x8, 0xc005, @multicast2}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x3d}, 0x7fc) 15:21:29 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={&(0x7f00000000c0), 0xc, &(0x7f0000000000)={&(0x7f00000001c0)=@delneigh={0x24, 0x1d, 0xb, 0x0, 0x0, {0xa}, [@NDA_DST_IPV4={0x8}]}, 0xfde4}}, 0x0) 15:21:29 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f0000000040)) r2 = syz_open_pts(r1, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000000)=0x3) ioctl$TCFLSH(r2, 0x541b, 0x710000) 15:21:29 executing program 0: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESTART(r0, 0x1260, 0x0) 15:21:29 executing program 4: r0 = socket$can_raw(0x1d, 0x3, 0x1) unshare(0x2000400) setsockopt(r0, 0x65, 0x0, &(0x7f0000000080), 0x0) 15:21:29 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={&(0x7f00000000c0), 0xc, &(0x7f0000000000)={&(0x7f00000001c0)=@delneigh={0x24, 0x1d, 0xb, 0x0, 0x0, {0xa}, [@NDA_DST_IPV4={0x8}]}, 0xfde4}}, 0x0) 15:21:30 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f0000000040)) r2 = syz_open_pts(r1, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000000)=0x3) ioctl$TCFLSH(r2, 0x541b, 0x710000) 15:21:30 executing program 4: r0 = socket$can_raw(0x1d, 0x3, 0x1) unshare(0x2000400) setsockopt(r0, 0x65, 0x0, &(0x7f0000000080), 0x0) 15:21:30 executing program 1: socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000024c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) io_setup(0x8, &(0x7f0000000140)=0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000006c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000002c0)={'syzkaller0\x00', 0xa112}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) io_submit(r2, 0x1400, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x7, 0x0, r1, &(0x7f0000000140), 0x7}]) 15:21:30 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) msgctl$MSG_STAT(0x0, 0xb, &(0x7f0000000180)=""/125) 15:21:30 executing program 3: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000440)=@migrate={0xac, 0x21, 0x301, 0x0, 0x0, {{@in=@multicast1, @in6=@remote}}, [@migrate={0x5c, 0x11, [{}, {@in, @in6=@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa]}}]}]}, 0xac}}, 0x0) 15:21:30 executing program 0: mkdir(&(0x7f0000001b40)='./file0\x00', 0x0) mount(&(0x7f0000000080), &(0x7f0000026ff8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) chdir(&(0x7f0000000000)='./file0\x00') r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) ftruncate(r0, 0x8200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x1) getresuid(&(0x7f00000004c0), &(0x7f0000003280), &(0x7f00000032c0)) 15:21:30 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) msgctl$MSG_STAT(0x0, 0xb, &(0x7f0000000180)=""/125) [ 161.405043] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 15:21:30 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f0000000040)) r2 = syz_open_pts(r1, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000000)=0x3) ioctl$TCFLSH(r2, 0x541b, 0x710000) 15:21:30 executing program 3: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000440)=@migrate={0xac, 0x21, 0x301, 0x0, 0x0, {{@in=@multicast1, @in6=@remote}}, [@migrate={0x5c, 0x11, [{}, {@in, @in6=@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa]}}]}]}, 0xac}}, 0x0) 15:21:30 executing program 4: r0 = socket$can_raw(0x1d, 0x3, 0x1) unshare(0x2000400) setsockopt(r0, 0x65, 0x0, &(0x7f0000000080), 0x0) 15:21:30 executing program 0: mkdir(&(0x7f0000001b40)='./file0\x00', 0x0) mount(&(0x7f0000000080), &(0x7f0000026ff8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) chdir(&(0x7f0000000000)='./file0\x00') r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) ftruncate(r0, 0x8200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x1) getresuid(&(0x7f00000004c0), &(0x7f0000003280), &(0x7f00000032c0)) 15:21:30 executing program 3: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000440)=@migrate={0xac, 0x21, 0x301, 0x0, 0x0, {{@in=@multicast1, @in6=@remote}}, [@migrate={0x5c, 0x11, [{}, {@in, @in6=@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa]}}]}]}, 0xac}}, 0x0) 15:21:30 executing program 5: r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000600)='/dev/qat_adf_ctl\x00', 0x0, 0x0) ioctl$sock_inet_SIOCRTMSG(r0, 0x40046103, &(0x7f0000000540)={0x0, {0x2, 0x0, @broadcast}, {}, {0x2, 0x0, @broadcast}, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)='gre0\x00'}) 15:21:30 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) msgctl$MSG_STAT(0x0, 0xb, &(0x7f0000000180)=""/125) 15:21:30 executing program 1: socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000024c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) io_setup(0x8, &(0x7f0000000140)=0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000006c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000002c0)={'syzkaller0\x00', 0xa112}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) io_submit(r2, 0x1400, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x7, 0x0, r1, &(0x7f0000000140), 0x7}]) 15:21:30 executing program 4: r0 = socket$can_raw(0x1d, 0x3, 0x1) unshare(0x2000400) setsockopt(r0, 0x65, 0x0, &(0x7f0000000080), 0x0) 15:21:31 executing program 0: mkdir(&(0x7f0000001b40)='./file0\x00', 0x0) mount(&(0x7f0000000080), &(0x7f0000026ff8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) chdir(&(0x7f0000000000)='./file0\x00') r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) ftruncate(r0, 0x8200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x1) getresuid(&(0x7f00000004c0), &(0x7f0000003280), &(0x7f00000032c0)) 15:21:31 executing program 5: r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000600)='/dev/qat_adf_ctl\x00', 0x0, 0x0) ioctl$sock_inet_SIOCRTMSG(r0, 0x40046103, &(0x7f0000000540)={0x0, {0x2, 0x0, @broadcast}, {}, {0x2, 0x0, @broadcast}, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)='gre0\x00'}) 15:21:31 executing program 3: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000440)=@migrate={0xac, 0x21, 0x301, 0x0, 0x0, {{@in=@multicast1, @in6=@remote}}, [@migrate={0x5c, 0x11, [{}, {@in, @in6=@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa]}}]}]}, 0xac}}, 0x0) [ 162.137133] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 15:21:31 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) msgctl$MSG_STAT(0x0, 0xb, &(0x7f0000000180)=""/125) 15:21:31 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000000000)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000180)={0xbd}) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r0, 0xc0a85352, &(0x7f0000000300)={{0x0, 0x10001}, 'port0\x00'}) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r0, 0xc0bc5351, &(0x7f00000003c0)={0x0, 0x0, 'client0\x00', 0x0, "d564acebb8dd6770", "1215cf237d9304c0cee68aca75242d0cb7afd94c0dc36a72169399b225829d16"}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) clock_gettime(0x0, &(0x7f00000000c0)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, r2+10000000}, {0x0, 0x9}}, &(0x7f0000000480)) tkill(r1, 0x1000000000015) 15:21:31 executing program 5: r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000600)='/dev/qat_adf_ctl\x00', 0x0, 0x0) ioctl$sock_inet_SIOCRTMSG(r0, 0x40046103, &(0x7f0000000540)={0x0, {0x2, 0x0, @broadcast}, {}, {0x2, 0x0, @broadcast}, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)='gre0\x00'}) 15:21:31 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = add_key$keyring(&(0x7f00000001c0)='keyring\x00', &(0x7f0000000400)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) keyctl$search(0xa, r1, &(0x7f0000000a40)='keyring\x00', &(0x7f0000000a80)={'syz'}, 0x0) 15:21:31 executing program 0: mkdir(&(0x7f0000001b40)='./file0\x00', 0x0) mount(&(0x7f0000000080), &(0x7f0000026ff8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) chdir(&(0x7f0000000000)='./file0\x00') r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) ftruncate(r0, 0x8200) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x1) getresuid(&(0x7f00000004c0), &(0x7f0000003280), &(0x7f00000032c0)) 15:21:31 executing program 2: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/userio\x00', 0x0, 0x0) poll(&(0x7f0000000180)=[{r0}], 0x1, 0x0) 15:21:31 executing program 5: r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000600)='/dev/qat_adf_ctl\x00', 0x0, 0x0) ioctl$sock_inet_SIOCRTMSG(r0, 0x40046103, &(0x7f0000000540)={0x0, {0x2, 0x0, @broadcast}, {}, {0x2, 0x0, @broadcast}, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)='gre0\x00'}) 15:21:31 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = add_key$keyring(&(0x7f00000001c0)='keyring\x00', &(0x7f0000000400)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) keyctl$search(0xa, r1, &(0x7f0000000a40)='keyring\x00', &(0x7f0000000a80)={'syz'}, 0x0) 15:21:31 executing program 2: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/userio\x00', 0x0, 0x0) poll(&(0x7f0000000180)=[{r0}], 0x1, 0x0) 15:21:31 executing program 0: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000040)={0x0, {{0xa, 0x0, 0x0, @mcast1}}, 0x81}, 0x90) 15:21:31 executing program 5: mount$fuse(0xf6ffffff, &(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) 15:21:31 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x6}, 0x1c) setsockopt$inet_mreqsrc(r0, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@remote}, 0x6) socket$inet6(0xa, 0x0, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 162.893906] ================================================================== [ 162.901421] BUG: KMSAN: uninit-value in __siphash_aligned+0x512/0xae0 [ 162.908032] CPU: 0 PID: 8398 Comm: syz-executor1 Not tainted 4.20.0-rc7+ #8 [ 162.915148] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 162.924517] Call Trace: [ 162.927146] dump_stack+0x173/0x1d0 [ 162.930818] kmsan_report+0x120/0x290 [ 162.934665] kmsan_internal_check_memory+0x9a7/0xa20 [ 162.939836] __msan_instrument_asm_load+0x8a/0x90 [ 162.944714] __siphash_aligned+0x512/0xae0 [ 162.949013] secure_ipv6_port_ephemeral+0x110/0x220 [ 162.954081] inet6_hash_connect+0x11f/0x1a0 [ 162.958460] tcp_v6_connect+0x20ba/0x2890 [ 162.962674] ? __msan_poison_alloca+0x1e0/0x270 [ 162.967410] ? tcp_v6_pre_connect+0x130/0x130 [ 162.971950] __inet_stream_connect+0x2f9/0x1340 [ 162.976708] inet_stream_connect+0x101/0x180 [ 162.981165] __sys_connect+0x664/0x820 [ 162.985097] ? __inet_stream_connect+0x1340/0x1340 [ 162.990065] ? prepare_exit_to_usermode+0x114/0x420 [ 162.995115] ? syscall_return_slowpath+0x50/0x650 [ 163.000009] __se_sys_connect+0x8d/0xb0 [ 163.004036] __x64_sys_connect+0x4a/0x70 [ 163.008136] do_syscall_64+0xbc/0xf0 [ 163.011897] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 163.017118] RIP: 0033:0x457669 [ 163.020349] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 163.039304] RSP: 002b:00007f7cd7250c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 163.047050] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457669 [ 163.054348] RDX: 000000000000001c RSI: 0000000020000080 RDI: 0000000000000003 [ 163.061639] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 163.068935] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f7cd72516d4 [ 163.076229] R13: 00000000004bdc27 R14: 00000000004cd678 R15: 00000000ffffffff [ 163.083536] [ 163.085185] Local variable description: ----combined@secure_ipv6_port_ephemeral 15:21:32 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = add_key$keyring(&(0x7f00000001c0)='keyring\x00', &(0x7f0000000400)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) keyctl$search(0xa, r1, &(0x7f0000000a40)='keyring\x00', &(0x7f0000000a80)={'syz'}, 0x0) [ 163.092641] Variable was created at: [ 163.096385] secure_ipv6_port_ephemeral+0x6a/0x220 [ 163.101344] inet6_hash_connect+0x11f/0x1a0 [ 163.105674] [ 163.107344] Bytes 2-7 of 8 are uninitialized [ 163.111775] Memory access of size 8 starts at ffff88814fadf9f0 [ 163.117761] ================================================================== [ 163.125133] Disabling lock debugging due to kernel taint [ 163.130596] Kernel panic - not syncing: panic_on_warn set ... [ 163.136505] CPU: 0 PID: 8398 Comm: syz-executor1 Tainted: G B 4.20.0-rc7+ #8 [ 163.145013] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 163.154385] Call Trace: [ 163.157008] dump_stack+0x173/0x1d0 [ 163.160688] panic+0x3ce/0x961 [ 163.163968] kmsan_report+0x285/0x290 [ 163.167826] kmsan_internal_check_memory+0x9a7/0xa20 [ 163.172999] __msan_instrument_asm_load+0x8a/0x90 [ 163.177883] __siphash_aligned+0x512/0xae0 [ 163.182182] secure_ipv6_port_ephemeral+0x110/0x220 [ 163.187256] inet6_hash_connect+0x11f/0x1a0 [ 163.191654] tcp_v6_connect+0x20ba/0x2890 [ 163.195864] ? __msan_poison_alloca+0x1e0/0x270 [ 163.200592] ? tcp_v6_pre_connect+0x130/0x130 [ 163.205134] __inet_stream_connect+0x2f9/0x1340 [ 163.209885] inet_stream_connect+0x101/0x180 [ 163.214359] __sys_connect+0x664/0x820 [ 163.218320] ? __inet_stream_connect+0x1340/0x1340 [ 163.223320] ? prepare_exit_to_usermode+0x114/0x420 [ 163.228374] ? syscall_return_slowpath+0x50/0x650 [ 163.233270] __se_sys_connect+0x8d/0xb0 [ 163.237345] __x64_sys_connect+0x4a/0x70 [ 163.241454] do_syscall_64+0xbc/0xf0 [ 163.245211] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 163.250428] RIP: 0033:0x457669 [ 163.253648] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 163.272564] RSP: 002b:00007f7cd7250c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 163.280269] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457669 [ 163.287561] RDX: 000000000000001c RSI: 0000000020000080 RDI: 0000000000000003 [ 163.294826] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 163.302104] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f7cd72516d4 [ 163.309428] R13: 00000000004bdc27 R14: 00000000004cd678 R15: 00000000ffffffff [ 163.317807] Kernel Offset: disabled [ 163.321444] Rebooting in 86400 seconds..