[ 50.118170] audit: type=1800 audit(1545314498.148:26): pid=6336 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 51.571650] kauditd_printk_skb: 2 callbacks suppressed [ 51.571678] audit: type=1800 audit(1545314499.618:29): pid=6336 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 51.596479] audit: type=1800 audit(1545314499.628:30): pid=6336 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.39' (ECDSA) to the list of known hosts. 2018/12/20 14:01:51 fuzzer started 2018/12/20 14:01:56 dialing manager at 10.128.0.26:46613 2018/12/20 14:01:56 syscalls: 1 2018/12/20 14:01:56 code coverage: enabled 2018/12/20 14:01:56 comparison tracing: CONFIG_KCOV_ENABLE_COMPARISONS is not enabled 2018/12/20 14:01:56 setuid sandbox: enabled 2018/12/20 14:01:56 namespace sandbox: enabled 2018/12/20 14:01:56 Android sandbox: /sys/fs/selinux/policy does not exist 2018/12/20 14:01:56 fault injection: enabled 2018/12/20 14:01:56 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2018/12/20 14:01:56 net packet injection: enabled 2018/12/20 14:01:56 net device setup: enabled 14:02:12 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000018000)={0x0, 0x0, &(0x7f0000013ff1)={&(0x7f0000000140)={0x30, 0x18, 0xfffffffffffffffd, 0x0, 0x0, {0x1}, [@typed={0xc, 0x3, @u64}, @nested={0x10, 0x6, [@typed={0xc, 0x0, @u64}]}]}, 0x30}}, 0x0) syzkaller login: [ 84.736224] IPVS: ftp: loaded support on port[0] = 21 [ 86.101468] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.108160] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.116556] device bridge_slave_0 entered promiscuous mode [ 86.197473] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.204104] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.212465] device bridge_slave_1 entered promiscuous mode [ 86.293202] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 86.371405] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 86.620317] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 86.705369] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 86.792892] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 86.799937] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 86.889132] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 86.896245] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 87.153307] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 87.161796] team0: Port device team_slave_0 added [ 87.244396] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 87.253095] team0: Port device team_slave_1 added [ 87.336291] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 87.429182] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 87.519088] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 87.526843] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 87.536437] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 87.713857] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 87.721584] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 87.731326] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready 14:02:16 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x4000000004002) io_setup(0x4, &(0x7f0000000080)=0x0) r2 = dup2(r0, r0) io_submit(r1, 0x1, &(0x7f0000001700)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, r2, 0x0}]) [ 88.678581] IPVS: ftp: loaded support on port[0] = 21 [ 88.951493] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.958115] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.965358] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.971952] bridge0: port 1(bridge_slave_0) entered forwarding state [ 88.981278] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 88.987803] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 90.855944] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.862644] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.870939] device bridge_slave_0 entered promiscuous mode [ 90.956658] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.963283] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.971563] device bridge_slave_1 entered promiscuous mode [ 91.051360] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 91.149036] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 91.483728] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 91.610769] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 91.752535] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 91.759565] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 91.888271] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 91.895375] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 92.318997] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 92.327648] team0: Port device team_slave_0 added [ 92.443764] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 92.452513] team0: Port device team_slave_1 added [ 92.577878] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 92.585495] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 92.594505] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 92.719443] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 92.726521] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 92.735610] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 92.920135] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 92.927819] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 92.936811] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 93.110844] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 93.118540] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 93.127709] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready 14:02:21 executing program 2: unshare(0x20400) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet6_int(r0, 0x29, 0xb, &(0x7f0000000000), &(0x7f0000000040)=0x4) [ 93.879153] IPVS: ftp: loaded support on port[0] = 21 [ 94.618736] 8021q: adding VLAN 0 to HW filter on device bond0 [ 94.986735] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.993354] bridge0: port 2(bridge_slave_1) entered forwarding state [ 95.000421] bridge0: port 1(bridge_slave_0) entered blocking state [ 95.007023] bridge0: port 1(bridge_slave_0) entered forwarding state [ 95.015979] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 95.022478] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 95.103054] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 95.756154] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 95.762626] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 95.770541] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 96.495151] 8021q: adding VLAN 0 to HW filter on device team0 [ 96.790281] bridge0: port 1(bridge_slave_0) entered blocking state [ 96.796905] bridge0: port 1(bridge_slave_0) entered disabled state [ 96.805150] device bridge_slave_0 entered promiscuous mode [ 96.912030] bridge0: port 2(bridge_slave_1) entered blocking state [ 96.918674] bridge0: port 2(bridge_slave_1) entered disabled state [ 96.927082] device bridge_slave_1 entered promiscuous mode [ 97.107143] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 97.221356] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 97.676810] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 97.863190] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 98.189945] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 98.197022] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 98.561452] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 98.569898] team0: Port device team_slave_0 added [ 98.754427] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 98.763139] team0: Port device team_slave_1 added [ 98.938144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 99.050508] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 99.144012] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 99.151631] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 99.160847] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 99.255582] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 99.263319] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 99.272137] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 100.575154] netlink: 'syz-executor0': attribute type 3 has an invalid length. [ 100.582722] netlink: 'syz-executor0': attribute type 6 has an invalid length. 14:02:28 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000018000)={0x0, 0x0, &(0x7f0000013ff1)={&(0x7f0000000140)={0x30, 0x18, 0xfffffffffffffffd, 0x0, 0x0, {0x1}, [@typed={0xc, 0x3, @u64}, @nested={0x10, 0x6, [@typed={0xc, 0x0, @u64}]}]}, 0x30}}, 0x0) 14:02:28 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCPKT(r0, 0x5420, &(0x7f00000001c0)=0xffffffff) read(r0, &(0x7f0000000280)=""/11, 0xfe17) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000140)) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r0, &(0x7f0000000040)={0x14}) r3 = syz_open_pts(r0, 0x0) dup3(r3, r0, 0x0) ioctl$TCXONC(r0, 0x540a, 0x0) [ 100.784000] netlink: 'syz-executor0': attribute type 3 has an invalid length. [ 100.791381] netlink: 'syz-executor0': attribute type 6 has an invalid length. 14:02:28 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000018000)={0x0, 0x0, &(0x7f0000013ff1)={&(0x7f0000000140)={0x30, 0x18, 0xfffffffffffffffd, 0x0, 0x0, {0x1}, [@typed={0xc, 0x3, @u64}, @nested={0x10, 0x6, [@typed={0xc, 0x0, @u64}]}]}, 0x30}}, 0x0) [ 101.043062] netlink: 'syz-executor0': attribute type 3 has an invalid length. [ 101.050393] netlink: 'syz-executor0': attribute type 6 has an invalid length. 14:02:29 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000018000)={0x0, 0x0, &(0x7f0000013ff1)={&(0x7f0000000140)={0x30, 0x18, 0xfffffffffffffffd, 0x0, 0x0, {0x1}, [@typed={0xc, 0x3, @u64}, @nested={0x10, 0x6, [@typed={0xc, 0x0, @u64}]}]}, 0x30}}, 0x0) [ 101.189298] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.195989] bridge0: port 2(bridge_slave_1) entered forwarding state [ 101.203083] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.209612] bridge0: port 1(bridge_slave_0) entered forwarding state [ 101.218483] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 101.225287] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 101.389117] IPVS: ftp: loaded support on port[0] = 21 [ 101.401135] netlink: 'syz-executor0': attribute type 3 has an invalid length. [ 101.408620] netlink: 'syz-executor0': attribute type 6 has an invalid length. 14:02:29 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) r1 = openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x400000000032, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) write$FUSE_OPEN(r2, &(0x7f00000001c0)={0x20}, 0x20) 14:02:29 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) r1 = openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x400000000032, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) write$FUSE_OPEN(r2, &(0x7f00000001c0)={0x20}, 0x20) 14:02:30 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) r1 = openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x400000000032, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) write$FUSE_OPEN(r2, &(0x7f00000001c0)={0x20}, 0x20) 14:02:30 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) r1 = openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x400000000032, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) write$FUSE_OPEN(r2, &(0x7f00000001c0)={0x20}, 0x20) [ 102.319404] 8021q: adding VLAN 0 to HW filter on device bond0 14:02:30 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) r1 = openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x400000000032, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) write$FUSE_OPEN(r2, &(0x7f00000001c0)={0x20}, 0x20) 14:02:30 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) r1 = openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x400000000032, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) write$FUSE_OPEN(r2, &(0x7f00000001c0)={0x20}, 0x20) [ 103.181378] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 103.736526] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 103.742921] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 103.750673] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 104.376931] 8021q: adding VLAN 0 to HW filter on device team0 [ 104.450095] bridge0: port 1(bridge_slave_0) entered blocking state [ 104.456679] bridge0: port 1(bridge_slave_0) entered disabled state [ 104.464734] device bridge_slave_0 entered promiscuous mode [ 104.732972] bridge0: port 2(bridge_slave_1) entered blocking state [ 104.739448] bridge0: port 2(bridge_slave_1) entered disabled state [ 104.749031] device bridge_slave_1 entered promiscuous mode [ 104.909943] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 105.059939] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 105.615416] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 105.762050] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 105.923936] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 105.930960] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 106.129174] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 106.136293] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 106.665652] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 106.674416] team0: Port device team_slave_0 added [ 106.789611] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 106.798143] team0: Port device team_slave_1 added [ 106.928550] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 106.935606] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 106.944456] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 107.102754] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 107.109943] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 107.118661] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 107.245806] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 107.253540] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 107.262478] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 107.400301] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 107.407900] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 107.417172] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready 14:02:35 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x4000000004002) io_setup(0x4, &(0x7f0000000080)=0x0) r2 = dup2(r0, r0) io_submit(r1, 0x1, &(0x7f0000001700)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, r2, 0x0}]) [ 108.233272] 8021q: adding VLAN 0 to HW filter on device bond0 [ 108.710445] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 108.844878] bridge0: port 2(bridge_slave_1) entered blocking state [ 108.851422] bridge0: port 2(bridge_slave_1) entered forwarding state [ 108.858541] bridge0: port 1(bridge_slave_0) entered blocking state [ 108.865112] bridge0: port 1(bridge_slave_0) entered forwarding state [ 108.873892] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 108.880396] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 109.163995] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 109.170560] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 109.178736] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 109.634918] 8021q: adding VLAN 0 to HW filter on device team0 14:02:40 executing program 2: unshare(0x20400) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet6_int(r0, 0x29, 0xb, &(0x7f0000000000), &(0x7f0000000040)=0x4) 14:02:40 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) r1 = openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x400000000032, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) write$FUSE_OPEN(r2, &(0x7f00000001c0)={0x20}, 0x20) [ 113.718602] 8021q: adding VLAN 0 to HW filter on device bond0 [ 113.877225] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 114.034315] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 114.040481] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 114.048322] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 114.206739] 8021q: adding VLAN 0 to HW filter on device team0 14:02:43 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCPKT(r0, 0x5420, &(0x7f00000001c0)=0xffffffff) read(r0, &(0x7f0000000280)=""/11, 0xfe17) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000140)) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r0, &(0x7f0000000040)={0x14}) r3 = syz_open_pts(r0, 0x0) dup3(r3, r0, 0x0) ioctl$TCXONC(r0, 0x540a, 0x0) 14:02:43 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x4000000004002) io_setup(0x4, &(0x7f0000000080)=0x0) r2 = dup2(r0, r0) io_submit(r1, 0x1, &(0x7f0000001700)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, r2, 0x0}]) 14:02:43 executing program 4: syz_open_dev$mouse(&(0x7f0000000080)='/dev/input/mouse#\x00', 0x0, 0x0) syz_open_dev$sndseq(0x0, 0x0, 0x0) 14:02:43 executing program 2: unshare(0x20400) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet6_int(r0, 0x29, 0xb, &(0x7f0000000000), &(0x7f0000000040)=0x4) 14:02:43 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = getpgrp(0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) keyctl$read(0xb, 0xfffffffffffffffd, &(0x7f0000000040)=""/4, 0xfebc) fcntl$setownex(r0, 0xf, &(0x7f00000000c0)={0x0, r1}) ioctl$sock_SIOCSPGRP(r0, 0x8902, &(0x7f0000000080)=r1) 14:02:43 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x3, 0x800) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000040)={'HL\x00'}, &(0x7f0000000080)=0x1e) r1 = openat$ashmem(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ashmem\x00', 0x0, 0x0) getsockopt$inet6_dccp_int(r0, 0x21, 0x11, &(0x7f0000000100), &(0x7f0000000140)=0x4) recvfrom$unix(r0, &(0x7f0000000180)=""/107, 0x6b, 0x0, &(0x7f0000000200)=@abs={0x0, 0x0, 0x4e20}, 0x6e) getsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000280)={@mcast1, 0x0}, &(0x7f00000002c0)=0x14) sendmsg$can_raw(r0, &(0x7f00000003c0)={&(0x7f0000000300)={0x1d, r2}, 0x10, &(0x7f0000000380)={&(0x7f0000000340)=@can={{0x4, 0x1ff, 0x5, 0x5}, 0x1, 0x1, 0x0, 0x0, "c2be94fdd3c90d70"}, 0x10}, 0x1, 0x0, 0x0, 0x2000c014}, 0x0) bind$can_raw(r0, &(0x7f0000000400)={0x1d, r2}, 0x10) ioctl$VIDIOC_DV_TIMINGS_CAP(r0, 0xc0905664, &(0x7f0000000440)={0x0, 0x0, [], @raw_data=[0x3, 0x6, 0x1ff, 0x7f, 0x3f, 0x1cd, 0x1, 0x3bba, 0x10001, 0x6, 0x9, 0x7f, 0x6, 0x4a251db3, 0x62, 0x3, 0x9, 0xa3, 0xd4, 0x8, 0x6, 0x7fff, 0x1a0a, 0x8080000000, 0x2, 0x7f, 0x4c6e, 0x48c, 0x5, 0x4db9, 0xb6, 0x400]}) fcntl$setstatus(r1, 0x4, 0x44000) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000500)='/dev/sequencer2\x00', 0x40, 0x0) getresuid(&(0x7f0000000580), &(0x7f00000005c0), &(0x7f0000000600)=0x0) r5 = getgid() chown(&(0x7f0000000540)='./file0\x00', r4, r5) ioctl$TUNDETACHFILTER(r0, 0x401054d6, 0x0) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000680)='IPVS\x00') sendmsg$IPVS_CMD_GET_DEST(r0, &(0x7f0000000800)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x8001000}, 0xc, &(0x7f00000007c0)={&(0x7f00000006c0)={0xec, r6, 0x400, 0x70bd29, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xb6}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x10001}, @IPVS_CMD_ATTR_DAEMON={0x44, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @remote}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e22}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x3}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @remote}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @broadcast}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x800}]}, @IPVS_CMD_ATTR_DAEMON={0x14, 0x3, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x20}, @IPVS_CMD_ATTR_DAEMON={0x34, 0x3, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast2}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x17}}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}]}]}, 0xec}, 0x1, 0x0, 0x0, 0x800}, 0x40c1) r7 = dup3(r3, r3, 0x80000) bpf$BPF_MAP_GET_NEXT_ID(0xc, &(0x7f0000000840)=0x14c, 0x4) getresuid(&(0x7f0000000880), &(0x7f00000008c0), &(0x7f0000000900)) ioctl$UI_SET_PROPBIT(r3, 0x4004556e, 0x1f) fchmod(r0, 0x2) ioctl$VIDIOC_S_SELECTION(r7, 0xc040565f, &(0x7f0000000940)={0xf0b7f077707941d1, 0x2, 0x1, {0x6, 0x7, 0xb0, 0xd68}}) getuid() write$binfmt_elf64(r0, &(0x7f0000000980)={{0x7f, 0x45, 0x4c, 0x46, 0x800, 0x80000000, 0x2, 0x5, 0x0, 0x3, 0x3e, 0xfffffffffffffff8, 0x236, 0x40, 0x3e6, 0x0, 0x38, 0x38, 0x1, 0xffffffffffffffff, 0x20, 0x7}, [{0x3, 0x342a, 0x7, 0x0, 0x8, 0x40, 0x6, 0x8}, {0x70000000, 0x9, 0xe3, 0x1, 0x100, 0x59d, 0xc0, 0x7fff}], "e573e457df6931dfb2d706d565ed81999c66d69df75e6ebe12e3e7d7e67076c341e96345e80c50ea89bb4a4e22747e11c4fed9284f4a9e53617b8ba59567544a0ae318692e4108ad9bb6e6a14c15a21d6f5ee48537c197a69216ab8816b5caff801db2450c86a5d80e25588db31561faba278107b4d2ada121e4e548f3153b8ac774f0ae27fc1d37c8e1e02086bc9048377ee8dc", [[], [], [], [], [], [], [], []]}, 0x944) syz_open_dev$swradio(&(0x7f0000001300)='/dev/swradio#\x00', 0x0, 0x2) ioctl$SNDRV_CTL_IOCTL_HWDEP_NEXT_DEVICE(r7, 0xc0045520, &(0x7f0000001340)) ioctl$VIDIOC_TRY_EXT_CTRLS(r7, 0xc0205649, &(0x7f00000013c0)={0x9d0000, 0x9, 0x1000, [], &(0x7f0000001380)={0x990b6f, 0x1000, [], @value64=0x80}}) setsockopt$inet_tcp_TCP_CONGESTION(r7, 0x6, 0xd, &(0x7f0000001400)='hybla\x00', 0x6) getsockopt$TIPC_NODE_RECVQ_DEPTH(r7, 0x10f, 0x83, &(0x7f0000001440), &(0x7f0000001480)=0x4) 14:02:43 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCPKT(r0, 0x5420, &(0x7f00000001c0)=0xffffffff) read(r0, &(0x7f0000000280)=""/11, 0xfe17) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000140)) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r0, &(0x7f0000000040)={0x14}) r3 = syz_open_pts(r0, 0x0) dup3(r3, r0, 0x0) ioctl$TCXONC(r0, 0x540a, 0x0) 14:02:43 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x4000000004002) io_setup(0x4, &(0x7f0000000080)=0x0) r2 = dup2(r0, r0) io_submit(r1, 0x1, &(0x7f0000001700)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, r2, 0x0}]) 14:02:43 executing program 2: unshare(0x20400) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet6_int(r0, 0x29, 0xb, &(0x7f0000000000), &(0x7f0000000040)=0x4) 14:02:44 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCPKT(r0, 0x5420, &(0x7f00000001c0)=0xffffffff) read(r0, &(0x7f0000000280)=""/11, 0xfe17) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000140)) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r0, &(0x7f0000000040)={0x14}) r3 = syz_open_pts(r0, 0x0) dup3(r3, r0, 0x0) ioctl$TCXONC(r0, 0x540a, 0x0) 14:02:44 executing program 2: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, &(0x7f00000002c0)) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)=""/193, &(0x7f0000000500)=""/97, &(0x7f0000000300)=""/127}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f00000000c0)={0x1, 0x0, &(0x7f0000000040)=""/83, &(0x7f0000000380)=""/181, &(0x7f0000000440)=""/141}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000001900)=ANY=[]) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000006c0)=0x1) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000000)) 14:02:44 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCPKT(r0, 0x5420, &(0x7f00000001c0)=0xffffffff) read(r0, &(0x7f0000000280)=""/11, 0xfe17) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000140)) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r0, &(0x7f0000000040)={0x14}) r3 = syz_open_pts(r0, 0x0) dup3(r3, r0, 0x0) ioctl$TCXONC(r0, 0x540a, 0x0) 14:02:44 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCPKT(r0, 0x5420, &(0x7f00000001c0)=0xffffffff) read(r0, &(0x7f0000000280)=""/11, 0xfe17) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000140)) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r0, &(0x7f0000000040)={0x14}) r3 = syz_open_pts(r0, 0x0) dup3(r3, r0, 0x0) ioctl$TCXONC(r0, 0x540a, 0x0) 14:02:44 executing program 2: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, &(0x7f00000002c0)) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)=""/193, &(0x7f0000000500)=""/97, &(0x7f0000000300)=""/127}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f00000000c0)={0x1, 0x0, &(0x7f0000000040)=""/83, &(0x7f0000000380)=""/181, &(0x7f0000000440)=""/141}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000001900)=ANY=[]) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000006c0)=0x1) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000000)) [ 116.322100] IPVS: ftp: loaded support on port[0] = 21 [ 116.542213] IPVS: ftp: loaded support on port[0] = 21 [ 117.779727] bridge0: port 1(bridge_slave_0) entered blocking state [ 117.786303] bridge0: port 1(bridge_slave_0) entered disabled state [ 117.794270] device bridge_slave_0 entered promiscuous mode [ 117.869707] bridge0: port 2(bridge_slave_1) entered blocking state [ 117.876282] bridge0: port 2(bridge_slave_1) entered disabled state [ 117.884316] device bridge_slave_1 entered promiscuous mode [ 117.901148] bridge0: port 1(bridge_slave_0) entered blocking state [ 117.907878] bridge0: port 1(bridge_slave_0) entered disabled state [ 117.915916] device bridge_slave_0 entered promiscuous mode [ 117.956963] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 117.990671] bridge0: port 2(bridge_slave_1) entered blocking state [ 117.997337] bridge0: port 2(bridge_slave_1) entered disabled state [ 118.005451] device bridge_slave_1 entered promiscuous mode [ 118.032381] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 118.081028] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 118.157336] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 118.273814] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 118.353213] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 118.392333] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 118.435319] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 118.442238] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 118.471982] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 118.514901] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 118.521876] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 118.548194] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 118.555278] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 118.630327] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 118.637314] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 118.747578] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 118.756340] team0: Port device team_slave_0 added [ 118.832238] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 118.840866] team0: Port device team_slave_1 added [ 118.868552] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 118.877285] team0: Port device team_slave_0 added [ 118.914961] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 118.953450] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 118.961916] team0: Port device team_slave_1 added [ 119.006481] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 119.039228] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 119.071433] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 119.079056] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 119.088150] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 119.116206] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 119.165612] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 119.173333] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 119.182234] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 119.197809] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 119.205463] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 119.215316] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 119.293006] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 119.301271] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 119.311151] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 120.043753] bridge0: port 2(bridge_slave_1) entered blocking state [ 120.050322] bridge0: port 2(bridge_slave_1) entered forwarding state [ 120.057489] bridge0: port 1(bridge_slave_0) entered blocking state [ 120.063971] bridge0: port 1(bridge_slave_0) entered forwarding state [ 120.072038] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 120.225923] bridge0: port 2(bridge_slave_1) entered blocking state [ 120.232520] bridge0: port 2(bridge_slave_1) entered forwarding state [ 120.239554] bridge0: port 1(bridge_slave_0) entered blocking state [ 120.246106] bridge0: port 1(bridge_slave_0) entered forwarding state [ 120.255041] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 120.442581] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 120.450645] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 123.169040] 8021q: adding VLAN 0 to HW filter on device bond0 [ 123.333116] 8021q: adding VLAN 0 to HW filter on device bond0 [ 123.452857] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 123.609712] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 123.733967] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 123.740310] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 123.748322] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 123.902253] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 123.908580] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 123.916557] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 124.028413] 8021q: adding VLAN 0 to HW filter on device team0 [ 124.205711] 8021q: adding VLAN 0 to HW filter on device team0 14:02:54 executing program 4: syz_open_dev$mouse(&(0x7f0000000080)='/dev/input/mouse#\x00', 0x0, 0x0) syz_open_dev$sndseq(0x0, 0x0, 0x0) 14:02:54 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCPKT(r0, 0x5420, &(0x7f00000001c0)=0xffffffff) read(r0, &(0x7f0000000280)=""/11, 0xfe17) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000140)) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r0, &(0x7f0000000040)={0x14}) r3 = syz_open_pts(r0, 0x0) dup3(r3, r0, 0x0) ioctl$TCXONC(r0, 0x540a, 0x0) 14:02:54 executing program 2: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, &(0x7f00000002c0)) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)=""/193, &(0x7f0000000500)=""/97, &(0x7f0000000300)=""/127}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f00000000c0)={0x1, 0x0, &(0x7f0000000040)=""/83, &(0x7f0000000380)=""/181, &(0x7f0000000440)=""/141}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000001900)=ANY=[]) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000006c0)=0x1) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000000)) 14:02:54 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCPKT(r0, 0x5420, &(0x7f00000001c0)=0xffffffff) read(r0, &(0x7f0000000280)=""/11, 0xfe17) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000140)) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r0, &(0x7f0000000040)={0x14}) r3 = syz_open_pts(r0, 0x0) dup3(r3, r0, 0x0) ioctl$TCXONC(r0, 0x540a, 0x0) 14:02:54 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCPKT(r0, 0x5420, &(0x7f00000001c0)=0xffffffff) read(r0, &(0x7f0000000280)=""/11, 0xfe17) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000140)) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r0, &(0x7f0000000040)={0x14}) r3 = syz_open_pts(r0, 0x0) dup3(r3, r0, 0x0) ioctl$TCXONC(r0, 0x540a, 0x0) 14:02:54 executing program 5: syz_emit_ethernet(0x2e, &(0x7f00006a4000)={@link_local, @dev, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x2f, 0x0, @rand_addr, @multicast1}, @igmp={0xffffca88, 0x0, 0x0, @empty, '\x00\x00\x00\b'}}}}}, &(0x7f0000000000)) 14:02:54 executing program 5: syz_emit_ethernet(0x2e, &(0x7f00006a4000)={@link_local, @dev, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x2f, 0x0, @rand_addr, @multicast1}, @igmp={0xffffca88, 0x0, 0x0, @empty, '\x00\x00\x00\b'}}}}}, &(0x7f0000000000)) 14:02:54 executing program 2: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, &(0x7f00000002c0)) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)=""/193, &(0x7f0000000500)=""/97, &(0x7f0000000300)=""/127}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f00000000c0)={0x1, 0x0, &(0x7f0000000040)=""/83, &(0x7f0000000380)=""/181, &(0x7f0000000440)=""/141}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000001900)=ANY=[]) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000006c0)=0x1) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000000)) 14:02:54 executing program 5: syz_emit_ethernet(0x2e, &(0x7f00006a4000)={@link_local, @dev, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x2f, 0x0, @rand_addr, @multicast1}, @igmp={0xffffca88, 0x0, 0x0, @empty, '\x00\x00\x00\b'}}}}}, &(0x7f0000000000)) 14:02:54 executing program 4: syz_open_dev$mouse(&(0x7f0000000080)='/dev/input/mouse#\x00', 0x0, 0x0) syz_open_dev$sndseq(0x0, 0x0, 0x0) 14:02:54 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCPKT(r0, 0x5420, &(0x7f00000001c0)=0xffffffff) read(r0, &(0x7f0000000280)=""/11, 0xfe17) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000140)) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r0, &(0x7f0000000040)={0x14}) r3 = syz_open_pts(r0, 0x0) dup3(r3, r0, 0x0) ioctl$TCXONC(r0, 0x540a, 0x0) 14:02:54 executing program 0: unshare(0x24020400) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x1, 0x4031, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f0000000100), &(0x7f0000000080)=0x4) 14:02:54 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) listen(r3, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x4e22}, 0x1c) r4 = accept4(r3, 0x0, 0x0, 0x0) sendto(r2, &(0x7f0000000040), 0xfffffffffffffd6a, 0x0, 0x0, 0xfffffe29) splice(r4, 0x0, r1, 0x0, 0x80000000, 0x0) 14:02:54 executing program 3: move_pages(0x0, 0x2000, &(0x7f0000000000)=[&(0x7f0000cb8000/0x3000)=nil], &(0x7f0000003b80), &(0x7f0000000040), 0x0) mount(&(0x7f00000001c0), &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='\xf6\xf0\x0f\t\xd6', 0x0, &(0x7f0000000180)) 14:02:54 executing program 5: syz_emit_ethernet(0x2e, &(0x7f00006a4000)={@link_local, @dev, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x2f, 0x0, @rand_addr, @multicast1}, @igmp={0xffffca88, 0x0, 0x0, @empty, '\x00\x00\x00\b'}}}}}, &(0x7f0000000000)) [ 126.754378] ================================================================== [ 126.761811] BUG: KMSAN: uninit-value in __siphash_aligned+0x512/0xae0 [ 126.768403] CPU: 0 PID: 8219 Comm: syz-executor2 Not tainted 4.20.0-rc7+ #8 [ 126.775504] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 126.784878] Call Trace: [ 126.787483] dump_stack+0x173/0x1d0 [ 126.791148] kmsan_report+0x120/0x290 [ 126.795027] kmsan_internal_check_memory+0x9a7/0xa20 14:02:54 executing program 4: syz_open_dev$mouse(&(0x7f0000000080)='/dev/input/mouse#\x00', 0x0, 0x0) syz_open_dev$sndseq(0x0, 0x0, 0x0) [ 126.800175] __msan_instrument_asm_load+0x8a/0x90 [ 126.805070] __siphash_aligned+0x512/0xae0 [ 126.809352] secure_ipv6_port_ephemeral+0x110/0x220 [ 126.814404] inet6_hash_connect+0x11f/0x1a0 [ 126.818804] tcp_v6_connect+0x20ba/0x2890 [ 126.823001] ? __msan_poison_alloca+0x1e0/0x270 [ 126.827716] ? tcp_v6_pre_connect+0x130/0x130 [ 126.832230] __inet_stream_connect+0x2f9/0x1340 [ 126.836951] ? kmem_cache_alloc_trace+0x55a/0xb90 [ 126.841836] ? tcp_sendmsg_locked+0x6394/0x6be0 [ 126.846569] tcp_sendmsg_locked+0x65d5/0x6be0 [ 126.851094] ? aa_label_sk_perm+0xda/0x940 [ 126.855391] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 126.860800] ? aa_label_sk_perm+0x6d6/0x940 [ 126.865150] ? __msan_metadata_ptr_for_store_8+0x13/0x20 [ 126.870709] ? __msan_metadata_ptr_for_load_1+0x10/0x20 [ 126.876119] tcp_sendmsg+0xb2/0x100 [ 126.879816] ? tcp_sendmsg_locked+0x6be0/0x6be0 [ 126.884502] inet_sendmsg+0x54a/0x720 [ 126.888340] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 126.893751] ? security_socket_sendmsg+0x1bd/0x200 [ 126.898718] ? inet_getname+0x490/0x490 14:02:54 executing program 3: move_pages(0x0, 0x2000, &(0x7f0000000000)=[&(0x7f0000cb8000/0x3000)=nil], &(0x7f0000003b80), &(0x7f0000000040), 0x0) mount(&(0x7f00000001c0), &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='\xf6\xf0\x0f\t\xd6', 0x0, &(0x7f0000000180)) [ 126.902721] __sys_sendto+0x8c4/0xac0 [ 126.906623] ? __msan_metadata_ptr_for_store_4+0x13/0x20 [ 126.912083] ? prepare_exit_to_usermode+0x114/0x420 [ 126.917117] ? syscall_return_slowpath+0x50/0x650 [ 126.921980] __se_sys_sendto+0x107/0x130 [ 126.926073] __x64_sys_sendto+0x6e/0x90 [ 126.930081] do_syscall_64+0xbc/0xf0 [ 126.933823] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 126.939047] RIP: 0033:0x457669 [ 126.942293] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 126.961202] RSP: 002b:00007f6c7f9b9c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 126.968917] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000000457669 [ 126.976213] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000007 [ 126.983550] RBP: 000000000072bf00 R08: 0000000020b63fe4 R09: 000000000000001c [ 126.990833] R10: 0000000020000004 R11: 0000000000000246 R12: 00007f6c7f9ba6d4 [ 126.998112] R13: 00000000004c4539 R14: 00000000004d75a8 R15: 00000000ffffffff [ 127.005406] [ 127.007045] Local variable description: ----combined@secure_ipv6_port_ephemeral [ 127.014493] Variable was created at: [ 127.018247] secure_ipv6_port_ephemeral+0x6a/0x220 [ 127.023206] inet6_hash_connect+0x11f/0x1a0 [ 127.027533] [ 127.029165] Bytes 2-7 of 8 are uninitialized [ 127.033610] Memory access of size 8 starts at ffff888157dff5f0 [ 127.039624] ================================================================== [ 127.046982] Disabling lock debugging due to kernel taint 14:02:55 executing program 3: move_pages(0x0, 0x2000, &(0x7f0000000000)=[&(0x7f0000cb8000/0x3000)=nil], &(0x7f0000003b80), &(0x7f0000000040), 0x0) mount(&(0x7f00000001c0), &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='\xf6\xf0\x0f\t\xd6', 0x0, &(0x7f0000000180)) [ 127.052435] Kernel panic - not syncing: panic_on_warn set ... [ 127.058333] CPU: 0 PID: 8219 Comm: syz-executor2 Tainted: G B 4.20.0-rc7+ #8 [ 127.066823] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 127.076180] Call Trace: [ 127.078790] dump_stack+0x173/0x1d0 [ 127.082448] panic+0x3ce/0x961 [ 127.085718] kmsan_report+0x285/0x290 [ 127.089579] kmsan_internal_check_memory+0x9a7/0xa20 [ 127.094730] __msan_instrument_asm_load+0x8a/0x90 [ 127.099598] __siphash_aligned+0x512/0xae0 [ 127.103931] secure_ipv6_port_ephemeral+0x110/0x220 [ 127.108984] inet6_hash_connect+0x11f/0x1a0 [ 127.113336] tcp_v6_connect+0x20ba/0x2890 [ 127.117542] ? __msan_poison_alloca+0x1e0/0x270 [ 127.122242] ? tcp_v6_pre_connect+0x130/0x130 [ 127.126762] __inet_stream_connect+0x2f9/0x1340 [ 127.131462] ? kmem_cache_alloc_trace+0x55a/0xb90 [ 127.136343] ? tcp_sendmsg_locked+0x6394/0x6be0 [ 127.141040] tcp_sendmsg_locked+0x65d5/0x6be0 [ 127.145561] ? aa_label_sk_perm+0xda/0x940 [ 127.149837] ? __msan_metadata_ptr_for_load_8+0x10/0x20 14:02:55 executing program 3: move_pages(0x0, 0x2000, &(0x7f0000000000)=[&(0x7f0000cb8000/0x3000)=nil], &(0x7f0000003b80), &(0x7f0000000040), 0x0) mount(&(0x7f00000001c0), &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='\xf6\xf0\x0f\t\xd6', 0x0, &(0x7f0000000180)) [ 127.155233] ? aa_label_sk_perm+0x6d6/0x940 [ 127.159600] ? __msan_metadata_ptr_for_store_8+0x13/0x20 [ 127.165098] ? __msan_metadata_ptr_for_load_1+0x10/0x20 [ 127.170498] tcp_sendmsg+0xb2/0x100 [ 127.174145] ? tcp_sendmsg_locked+0x6be0/0x6be0 [ 127.178819] inet_sendmsg+0x54a/0x720 [ 127.182630] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 127.188061] ? security_socket_sendmsg+0x1bd/0x200 [ 127.193015] ? inet_getname+0x490/0x490 [ 127.197018] __sys_sendto+0x8c4/0xac0 [ 127.200902] ? __msan_metadata_ptr_for_store_4+0x13/0x20 [ 127.206402] ? prepare_exit_to_usermode+0x114/0x420 [ 127.211433] ? syscall_return_slowpath+0x50/0x650 [ 127.216349] __se_sys_sendto+0x107/0x130 [ 127.220443] __x64_sys_sendto+0x6e/0x90 [ 127.224441] do_syscall_64+0xbc/0xf0 [ 127.228180] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 127.233404] RIP: 0033:0x457669 [ 127.236610] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 127.255540] RSP: 002b:00007f6c7f9b9c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 127.263294] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000000457669 [ 127.270589] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000007 [ 127.277867] RBP: 000000000072bf00 R08: 0000000020b63fe4 R09: 000000000000001c [ 127.285396] R10: 0000000020000004 R11: 0000000000000246 R12: 00007f6c7f9ba6d4 [ 127.292688] R13: 00000000004c4539 R14: 00000000004d75a8 R15: 00000000ffffffff [ 127.300933] Kernel Offset: disabled [ 127.304565] Rebooting in 86400 seconds..