Warning: Permanently added '10.128.0.57' (ECDSA) to the list of known hosts. 2018/12/20 21:02:46 fuzzer started 2018/12/20 21:02:51 dialing manager at 10.128.0.26:46613 2018/12/20 21:02:51 syscalls: 1 2018/12/20 21:02:51 code coverage: enabled 2018/12/20 21:02:51 comparison tracing: CONFIG_KCOV_ENABLE_COMPARISONS is not enabled 2018/12/20 21:02:51 setuid sandbox: enabled 2018/12/20 21:02:51 namespace sandbox: enabled 2018/12/20 21:02:51 Android sandbox: /sys/fs/selinux/policy does not exist 2018/12/20 21:02:51 fault injection: enabled 2018/12/20 21:02:51 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2018/12/20 21:02:51 net packet injection: enabled 2018/12/20 21:02:51 net device setup: enabled 21:05:09 executing program 0: openat$mixer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/mixer\x00', 0x0, 0x0) unshare(0x400) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$getflags(r0, 0x408) syzkaller login: [ 209.023936] IPVS: ftp: loaded support on port[0] = 21 [ 210.483049] bridge0: port 1(bridge_slave_0) entered blocking state [ 210.489607] bridge0: port 1(bridge_slave_0) entered disabled state [ 210.498090] device bridge_slave_0 entered promiscuous mode [ 210.590173] bridge0: port 2(bridge_slave_1) entered blocking state [ 210.596846] bridge0: port 2(bridge_slave_1) entered disabled state [ 210.605131] device bridge_slave_1 entered promiscuous mode [ 210.687552] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 210.767919] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 211.014880] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 211.099273] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 211.184022] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 211.190980] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 211.272995] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 211.279945] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 211.527661] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 211.536460] team0: Port device team_slave_0 added [ 211.617660] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 211.626309] team0: Port device team_slave_1 added [ 211.708739] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 211.797005] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 211.881414] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 211.889114] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 211.898443] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 211.983942] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 211.991489] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 212.000846] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready 21:05:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000010000/0x3000)=nil, 0x3000, 0x0, 0x100000000020012, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000500)={0x4, 0x0, &(0x7f0000000480)=[@enter_looper], 0x4, 0x0, &(0x7f00000004c0)='8)1z'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000000680)}) dup3(r1, r0, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) [ 213.020959] IPVS: ftp: loaded support on port[0] = 21 [ 213.222716] bridge0: port 2(bridge_slave_1) entered blocking state [ 213.229285] bridge0: port 2(bridge_slave_1) entered forwarding state [ 213.236558] bridge0: port 1(bridge_slave_0) entered blocking state [ 213.243185] bridge0: port 1(bridge_slave_0) entered forwarding state [ 213.252347] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 213.258849] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 215.502931] bridge0: port 1(bridge_slave_0) entered blocking state [ 215.509495] bridge0: port 1(bridge_slave_0) entered disabled state [ 215.517822] device bridge_slave_0 entered promiscuous mode [ 215.620854] bridge0: port 2(bridge_slave_1) entered blocking state [ 215.627479] bridge0: port 2(bridge_slave_1) entered disabled state [ 215.635986] device bridge_slave_1 entered promiscuous mode [ 215.818924] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 215.970492] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 216.415812] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 216.575115] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 216.832518] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 216.839581] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready 21:05:18 executing program 2: r0 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r0, 0x80000040045017, 0x0) [ 217.250126] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 217.258921] team0: Port device team_slave_0 added [ 217.441302] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 217.450121] team0: Port device team_slave_1 added [ 217.597650] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 217.701423] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 217.753769] IPVS: ftp: loaded support on port[0] = 21 [ 217.914295] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 217.922091] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 217.931349] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 218.111058] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 218.118739] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 218.127992] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 219.747504] 8021q: adding VLAN 0 to HW filter on device bond0 [ 220.012124] bridge0: port 2(bridge_slave_1) entered blocking state [ 220.018681] bridge0: port 2(bridge_slave_1) entered forwarding state [ 220.025884] bridge0: port 1(bridge_slave_0) entered blocking state [ 220.032474] bridge0: port 1(bridge_slave_0) entered forwarding state [ 220.042235] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 220.364505] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 220.472599] bridge0: port 1(bridge_slave_0) entered blocking state [ 220.479137] bridge0: port 1(bridge_slave_0) entered disabled state [ 220.487586] device bridge_slave_0 entered promiscuous mode [ 220.647948] bridge0: port 2(bridge_slave_1) entered blocking state [ 220.654709] bridge0: port 2(bridge_slave_1) entered disabled state [ 220.663632] device bridge_slave_1 entered promiscuous mode [ 220.741921] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 220.784654] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 220.964912] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 221.081712] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 221.088036] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 221.096266] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 221.457990] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 221.617159] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 221.681217] 8021q: adding VLAN 0 to HW filter on device team0 [ 221.820170] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 221.827232] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 222.002371] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 222.009354] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 222.387822] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 222.396701] team0: Port device team_slave_0 added [ 222.522274] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 222.530827] team0: Port device team_slave_1 added [ 222.717544] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 222.918959] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 222.926064] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 222.935063] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 223.028742] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 223.036696] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 223.045713] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 223.257391] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 223.265231] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 223.274515] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 225.188759] bridge0: port 2(bridge_slave_1) entered blocking state [ 225.195397] bridge0: port 2(bridge_slave_1) entered forwarding state [ 225.202616] bridge0: port 1(bridge_slave_0) entered blocking state [ 225.209195] bridge0: port 1(bridge_slave_0) entered forwarding state [ 225.218456] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 225.225047] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready 21:05:26 executing program 3: r0 = socket$inet(0x2, 0x3, 0x10000000002f) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='ip_vti0\x00', 0x10) sendmmsg$unix(r0, &(0x7f00000009c0)=[{&(0x7f0000000200)=@file={0x0, './file0\x00\x00\x00\x00\x00\x00\x00\x00\x05\xb4\x00'}, 0x6e, 0x0}], 0x1, 0x0) 21:05:26 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, &(0x7f0000000080), &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 21:05:26 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0xa102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket$inet6(0xa, 0x2, 0x0) ppoll(&(0x7f0000000000)=[{r1}], 0x1, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1a) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) 21:05:27 executing program 0: r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x208800, 0x0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000140)={0x64, 0x7, 0x8}) r1 = syz_open_procfs(0x0, &(0x7f0000000240)='net/ip_tables_matches\x00') mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x6, 0x2001d, r1, 0x0) [ 226.095393] IPVS: ftp: loaded support on port[0] = 21 21:05:27 executing program 0: r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x208800, 0x0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000140)={0x64, 0x7, 0x8}) r1 = syz_open_procfs(0x0, &(0x7f0000000240)='net/ip_tables_matches\x00') mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x6, 0x2001d, r1, 0x0) 21:05:27 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet(0x10, 0x3, 0xc) sendmsg(r1, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(r1, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000100)="24000000030307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e28000000110affff82aba0aa1c0009b356da5a80918b06b20cd37ed01cc000000000000000000000", 0x4c}], 0x1}, 0x0) ioctl$int_in(r0, 0x0, &(0x7f0000000080)=0x99a) [ 226.463646] netlink: 4 bytes leftover after parsing attributes in process `syz-executor0'. [ 226.504675] netlink: 20 bytes leftover after parsing attributes in process `syz-executor0'. [ 226.525759] netlink: 20 bytes leftover after parsing attributes in process `syz-executor0'. [ 226.564685] netlink: 20 bytes leftover after parsing attributes in process `syz-executor0'. 21:05:27 executing program 0: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = shmget$private(0x0, 0x4000, 0x0, &(0x7f0000ffc000/0x4000)=nil) shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0x4000) mlock(&(0x7f0000ffe000/0x2000)=nil, 0x2000) shmat(r1, &(0x7f0000ffc000/0x2000)=nil, 0x7000) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x8c02, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) 21:05:28 executing program 0: ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000000)=0x0) syz_open_dev$amidi(&(0x7f00000000c0)='/dev/amidi#\x00', 0x20, 0x242800) r1 = syz_open_procfs(r0, &(0x7f0000000080)='ns\x00') ioctl$FS_IOC_ENABLE_VERITY(r1, 0x6685) mknodat(r1, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) 21:05:28 executing program 0: r0 = syz_open_dev$sndseq(&(0x7f0000000200)='/dev/snd/seq\x00', 0x0, 0x0) r1 = syz_open_dev$dspn(&(0x7f0000000240)='/dev/dsp#\x00', 0x0, 0x400) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r1, 0x800442d3, &(0x7f0000000280)={0x0, 0x3, 0xffffffff, @broadcast, 'ip_vti0\x00'}) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, '\nL\xea\xa0]\x9a\x00\x00\x00\x00\x00\x00\x00\x03\x9b?\xd4\xce\xc3\a\xe8\xef=\x13\xeby\x0e\xc9\xc6Z\xba\xf9\r\"\x9d\xb6\x92T.[x\xf8\xb2\x9e\n\'\x80\x0f\x00\x00\x00\x00\x00\x00\x00\t\xfbB\xf3vX\x97\x01\xa4', 0x0, 0x10800a}) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x80000, 0x0) write$FUSE_INIT(r2, &(0x7f0000000100)={0x50, 0xfffffffffffffffe, 0x7, {0x7, 0x1c, 0x20, 0x4, 0x1c, 0x200, 0x0, 0x2d0}}, 0x50) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r0, 0x40a85321, &(0x7f0000000080)) ioctl$VIDIOC_TRY_EXT_CTRLS(r2, 0xc0205649, &(0x7f00000001c0)={0xf9e0000, 0x72b, 0xffffffffffffff1d, [], &(0x7f0000000180)={0x990a7c, 0x0, [], @p_u16=&(0x7f0000000040)=0x1}}) getsockopt$inet_dccp_buf(r2, 0x21, 0xe, &(0x7f00000002c0)=""/42, &(0x7f0000000300)=0x2a) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, 0x0) 21:05:28 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f00001f0ff8)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000000)=0x0) ptrace$getregs(0xc, r2, 0x3, &(0x7f0000000140)=""/211) connect$unix(r0, &(0x7f00000000c0)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0xc0) sendto$unix(r1, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x414201, 0x0) readlinkat(r3, &(0x7f0000000080)='./file0\x00', &(0x7f0000000240)=""/19, 0x13) close(r0) [ 227.352414] 8021q: adding VLAN 0 to HW filter on device bond0 [ 228.031357] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 228.475680] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 228.482033] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 228.489813] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 229.049232] 8021q: adding VLAN 0 to HW filter on device team0 [ 229.274587] bridge0: port 1(bridge_slave_0) entered blocking state [ 229.281122] bridge0: port 1(bridge_slave_0) entered disabled state [ 229.289348] device bridge_slave_0 entered promiscuous mode [ 229.467658] bridge0: port 2(bridge_slave_1) entered blocking state [ 229.474459] bridge0: port 2(bridge_slave_1) entered disabled state [ 229.482803] device bridge_slave_1 entered promiscuous mode [ 229.607154] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 229.765272] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 230.315830] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 230.480548] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 230.653957] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 230.660935] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 230.779293] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 230.786491] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 231.120962] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 231.129631] team0: Port device team_slave_0 added [ 231.310669] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 231.319388] team0: Port device team_slave_1 added [ 231.421091] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 231.428232] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 231.437077] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 231.583864] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 231.590907] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 231.599883] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 231.756106] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 231.763841] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 231.773257] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 231.953996] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 231.961561] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 231.970683] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 232.892564] 8021q: adding VLAN 0 to HW filter on device bond0 [ 233.138618] binder: 7435 RLIMIT_NICE not set [ 233.200660] binder: release 7433:7436 transaction 2 out, still active [ 233.207412] binder: undelivered TRANSACTION_COMPLETE [ 233.213567] binder: send failed reply for transaction 2, target dead [ 233.233668] binder_alloc: binder_alloc_mmap_handler: 7433 20010000-20013000 already mapped failed -16 [ 233.253795] binder: 7436 RLIMIT_NICE not set [ 233.272139] binder: BINDER_SET_CONTEXT_MGR already set [ 233.277555] binder: 7433:7435 ioctl 40046207 0 returned -16 [ 233.302401] binder_alloc: 7433: binder_alloc_buf, no vma [ 233.307947] binder: 7433:7436 transaction failed 29189/-3, size 0-0 line 2973 [ 233.327947] binder: undelivered TRANSACTION_ERROR: 29189 21:05:34 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000010000/0x3000)=nil, 0x3000, 0x0, 0x100000000020012, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000500)={0x4, 0x0, &(0x7f0000000480)=[@enter_looper], 0x4, 0x0, &(0x7f00000004c0)='8)1z'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000000680)}) dup3(r1, r0, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) [ 233.545984] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 233.555229] binder: 7450 RLIMIT_NICE not set [ 233.602969] binder: release 7449:7453 transaction 5 out, still active [ 233.609602] binder: undelivered TRANSACTION_COMPLETE [ 233.615232] binder: send failed reply for transaction 5, target dead [ 233.791588] bridge0: port 2(bridge_slave_1) entered blocking state [ 233.798188] bridge0: port 2(bridge_slave_1) entered forwarding state [ 233.805409] bridge0: port 1(bridge_slave_0) entered blocking state [ 233.811993] bridge0: port 1(bridge_slave_0) entered forwarding state [ 233.821319] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 233.828434] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 233.934898] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 233.941173] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 233.949144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 234.503705] 8021q: adding VLAN 0 to HW filter on device team0 21:05:39 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x1, 0x2) getsockopt$inet6_udp_int(r1, 0x11, 0x6f, &(0x7f0000000080), &(0x7f00000000c0)=0x4) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r3, 0xc008ae88, &(0x7f0000000000)=ANY=[@ANYBLOB="0100000000000400014d564b"]) [ 238.185907] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/l1tf.html for details. [ 238.757485] 8021q: adding VLAN 0 to HW filter on device bond0 [ 239.067248] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 239.379409] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 239.385818] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 239.393708] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 239.627007] 8021q: adding VLAN 0 to HW filter on device team0 21:05:41 executing program 3: r0 = syz_open_dev$vbi(&(0x7f0000000240)='/dev/vbi#\x00', 0xffffffffffffffff, 0x2) ioctl$VIDIOC_G_SLICED_VBI_CAP(r0, 0xc0745645, &(0x7f00000000c0)={0x0, [], 0x7}) 21:05:41 executing program 2: r0 = socket$packet(0x11, 0xffffffffffffffff, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x6}, 0x4) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-control\x00', 0x202082, 0x0) r2 = syz_open_dev$usbmon(&(0x7f0000000200)='/dev/usbmon#\x00', 0xfd, 0x10201) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000280)) sendmsg$can_raw(r1, &(0x7f0000000180)={&(0x7f00000000c0), 0x10, &(0x7f0000000140)={&(0x7f0000000100)=@can={{0x0, 0x81, 0x1, 0x3}, 0x5, 0x2, 0x0, 0x0, "3215f95e62671545"}, 0x10}, 0x1, 0x0, 0x0, 0x48080}, 0x40000) ioctl$KVM_GET_XCRS(r1, 0x8188aea6, &(0x7f00000002c0)={0x8, 0x7094, [{0x40, 0x0, 0x8}, {0x2, 0x0, 0x8}, {0x10001, 0x0, 0x9e4}, {0x9, 0x0, 0xff}, {0xab5, 0x0, 0x2}, {0x9, 0x0, 0xffffffff00000000}, {0x8001, 0x0, 0x1}, {0x282, 0x0, 0x800}]}) setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f0000000040)={0x200000000000008b, &(0x7f0000000080)}, 0x10) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r1, 0x40045542, &(0x7f0000000240)) lseek(r2, 0x0, 0x2) 21:05:41 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000010000/0x3000)=nil, 0x3000, 0x0, 0x100000000020012, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000500)={0x4, 0x0, &(0x7f0000000480)=[@enter_looper], 0x4, 0x0, &(0x7f00000004c0)='8)1z'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000000680)}) dup3(r1, r0, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 21:05:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000010000/0x3000)=nil, 0x3000, 0x0, 0x100000000020012, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000500)={0x4, 0x0, &(0x7f0000000480)=[@enter_looper], 0x4, 0x0, &(0x7f00000004c0)='8)1z'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000000680)}) dup3(r1, r0, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 21:05:41 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) clock_getres(0x0, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=@newlink={0x3c, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0xc, 0x2, [@IFLA_BOND_UPDELAY={0x8, 0x11, 0x14101}]}}}]}, 0x3c}}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mmap(&(0x7f00005a1000/0x200000)=nil, 0x200000, 0x1fffffe, 0x8031, 0xffffffffffffffff, 0x0) r4 = geteuid() ioctl$VIDIOC_CREATE_BUFS(r1, 0xc100565c, &(0x7f00000001c0)={0x80000001, 0x89, 0x3, {0x5, @vbi={0xff, 0x5, 0xffffffff, 0x73737f5f, [0x3, 0x5], [0x2, 0x3]}}}) ioctl$TUNSETOWNER(r1, 0x400454cc, r4) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x4c832, 0xffffffffffffffff, 0x0) 21:05:41 executing program 5: r0 = fanotify_init(0x20, 0x80800) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x800, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'bond_slave_1\x00', 0x0}) connect$can_bcm(r1, &(0x7f0000000140)={0x1d, r2}, 0x10) setxattr$security_smack_entry(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='security.SMACK64EXEC\x00', &(0x7f0000000200)='nodev-\x00', 0x7, 0x2) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000280)='nbd\x00') sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x2c, r3, 0x900, 0x70bd27, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x800) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000380)={0xffffffff, 0x9, 0xffffffffffff084c, 0x17, 0x7, 0x81, 0xfff, 0x3, 0x0, 0x80000000, 0xff}, 0xb) ioctl$PIO_UNIMAPCLR(r1, 0x4b68, &(0x7f00000003c0)={0x10000, 0x3d, 0x9}) fdatasync(r0) sendmsg$can_bcm(r1, &(0x7f0000000500)={&(0x7f0000000400)={0x1d, r2}, 0x10, &(0x7f00000004c0)={&(0x7f0000000440)={0x1, 0x50, 0x100000001, {}, {}, {0x2, 0x200, 0x9, 0x7}, 0x1, @canfd={{0x1, 0x5, 0x55, 0x2}, 0x3b, 0x2, 0x0, 0x0, "a694d97d9d5fb982734894874e7d10a5432cbd6880fe355b686bfe9a128c8bc93457be026416b595dd13a3162b90e13793dbfa40b7704d66210cefceda28d40a"}}, 0x80}, 0x1, 0x0, 0x0, 0x1}, 0x880) connect$netlink(r1, &(0x7f0000000540)=@proc={0x10, 0x0, 0x25dfdbff, 0x10}, 0xc) ioctl$sock_inet_SIOCSIFNETMASK(r1, 0x891c, &(0x7f0000000580)={'bond_slave_1\x00', {0x2, 0x4e22, @loopback}}) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r0, 0x400c6615, &(0x7f00000005c0)) linkat(r1, &(0x7f0000000600)='./file0\x00', r1, &(0x7f0000000640)='./file0\x00', 0x1000) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000680)='/dev/audio\x00', 0x80, 0x0) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(r4, 0x6, 0x21, &(0x7f00000006c0)="913ba83a22d381b53af3ba16338d0816", 0x10) timer_create(0x7, &(0x7f00000007c0)={0x0, 0x27, 0x1, @thr={&(0x7f0000000700)="0b552247995c41cbb7915db850b49940380b43d231c7d889b3fa170636b7c67fb0df1daed47527e569420b36efc5fb5eccecf17d8fe030ae236a00c23c7c31b2541b7a771c67aa47c397de877a240968db288caa80ef7d3887472fbdcb8301fc54813e85b727670c1e6bebfafcdca1910182686aafa50bdfb476", &(0x7f0000000780)="74547f335cc2e19c97f47d8b9adffbbc51"}}, &(0x7f0000000800)) r5 = syz_open_dev$audion(&(0x7f0000000840)='/dev/audio#\x00', 0x5, 0xc4800) r6 = semget(0x0, 0x3, 0x10) semctl$SEM_INFO(r6, 0x0, 0x13, &(0x7f0000000880)=""/150) r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000980)='IPVS\x00') sendmsg$IPVS_CMD_GET_SERVICE(r4, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x44, r7, 0x20, 0x70bd25, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x1}]}, @IPVS_CMD_ATTR_DAEMON={0x24, 0x3, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x10001}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000080}, 0x4) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r5, 0x84, 0x6c, &(0x7f0000000ac0)={0x0, 0x47, "2b90a5bdbfe64f5221a5dfcbdf759aa797de5aa1b60923ce651bb2e5407485c709001b2c03b841e51657efa6e317df75edd1d29332af196f94d5378fba8c612de9216c79b1d06e"}, &(0x7f0000000b40)=0x4f) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r4, 0x84, 0x66, &(0x7f0000000b80)={r8, 0x9}, &(0x7f0000000bc0)=0x8) bind$inet6(r1, &(0x7f0000000c00)={0xa, 0x4e23, 0x80000000, @remote, 0xfff}, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r4, 0x4040534e, &(0x7f0000000c40)={0x2, @tick=0x3f, 0x4, {0x90000, 0xffff}, 0x9, 0x1, 0x2a8b}) fsetxattr$security_smack_entry(r4, &(0x7f0000000cc0)='security.SMACK64IPIN\x00', &(0x7f0000000d00)='\x00', 0x1, 0x1) ioctl$sock_kcm_SIOCKCMATTACH(r4, 0x89e0, &(0x7f0000000d40)={r4, r5}) connect$can_bcm(r5, &(0x7f0000000d80)={0x1d, r2}, 0x10) [ 240.692365] raw_sendmsg: syz-executor3 forgot to set AF_INET. Fix it! [ 240.769153] netlink: 'syz-executor0': attribute type 17 has an invalid length. [ 240.826951] binder: 7702 RLIMIT_NICE not set 21:05:41 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_udp_int(r1, 0x11, 0xa, 0x0, &(0x7f0000012000)) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) close(r0) [ 240.877282] binder: send failed reply for transaction 7 to 7700:7705 [ 240.883988] binder: undelivered TRANSACTION_COMPLETE [ 240.889129] binder: undelivered TRANSACTION_ERROR: 29189 21:05:42 executing program 3: r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f0000000000)="2400000052001f0014f9f407002c04000a00071008000100ffffffff0800000000000000", 0x24) 21:05:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000010000/0x3000)=nil, 0x3000, 0x0, 0x100000000020012, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000500)={0x4, 0x0, &(0x7f0000000480)=[@enter_looper], 0x4, 0x0, &(0x7f00000004c0)='8)1z'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000000680)}) dup3(r1, r0, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 21:05:42 executing program 2: r0 = socket$inet6(0xa, 0x800000001, 0x8010000000000084) setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000000), 0x4) [ 241.274514] binder: 7717 RLIMIT_NICE not set 21:05:42 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-control\x00', 0x0, 0x0) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000340)=""/12, 0xc}, {&(0x7f0000000380)=""/67, 0x43}], 0x2) 21:05:42 executing program 2: openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000000), &(0x7f0000000100)={0x2}, &(0x7f0000000140)={0x8}, &(0x7f0000000200), &(0x7f0000000300)={&(0x7f00000002c0), 0x8}) [ 241.352465] binder: release 7715:7720 transaction 9 out, still active [ 241.359145] binder: undelivered TRANSACTION_COMPLETE [ 241.365757] binder: send failed reply for transaction 9, target dead [ 241.458449] dlm: non-version read from control device 67 21:05:42 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000140)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r3}, [@IFA_CACHEINFO={0x14, 0x9, {0xf000}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 241.544173] IPVS: ftp: loaded support on port[0] = 21 21:05:42 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000000)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0xffffff9c}, [@ldst={0x7, 0x731, 0x0, 0x91}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0x265, &(0x7f000000cf3d)=""/195}, 0x48) [ 241.816974] IPVS: ftp: loaded support on port[0] = 21 [ 243.152606] bridge0: port 1(bridge_slave_0) entered blocking state [ 243.159239] bridge0: port 1(bridge_slave_0) entered disabled state [ 243.167425] device bridge_slave_0 entered promiscuous mode [ 243.246653] bridge0: port 2(bridge_slave_1) entered blocking state [ 243.253306] bridge0: port 2(bridge_slave_1) entered disabled state [ 243.261499] device bridge_slave_1 entered promiscuous mode [ 243.274853] bridge0: port 1(bridge_slave_0) entered blocking state [ 243.281370] bridge0: port 1(bridge_slave_0) entered disabled state [ 243.289685] device bridge_slave_0 entered promiscuous mode [ 243.338117] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 243.370637] bridge0: port 2(bridge_slave_1) entered blocking state [ 243.377235] bridge0: port 2(bridge_slave_1) entered disabled state [ 243.386059] device bridge_slave_1 entered promiscuous mode [ 243.413475] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 243.465364] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 243.542805] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 243.655106] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 243.740671] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 243.782805] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 243.832710] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 243.839698] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 243.864559] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 243.920780] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 243.927943] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 243.943705] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 243.950682] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 244.031050] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 244.038163] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 244.167325] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 244.175977] team0: Port device team_slave_0 added [ 244.253670] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 244.263717] team0: Port device team_slave_1 added [ 244.281251] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 244.289928] team0: Port device team_slave_0 added [ 244.343423] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 244.371275] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 244.379872] team0: Port device team_slave_1 added [ 244.440960] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 244.470014] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 244.499703] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 244.507408] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 244.517424] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 244.553401] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 244.598787] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 244.606436] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 244.615533] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 244.635256] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 244.642973] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 244.652515] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 244.717664] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 244.726987] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 244.736494] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 245.583200] bridge0: port 2(bridge_slave_1) entered blocking state [ 245.589782] bridge0: port 2(bridge_slave_1) entered forwarding state [ 245.596945] bridge0: port 1(bridge_slave_0) entered blocking state [ 245.603438] bridge0: port 1(bridge_slave_0) entered forwarding state [ 245.611502] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 245.694449] bridge0: port 2(bridge_slave_1) entered blocking state [ 245.701023] bridge0: port 2(bridge_slave_1) entered forwarding state [ 245.708273] bridge0: port 1(bridge_slave_0) entered blocking state [ 245.714895] bridge0: port 1(bridge_slave_0) entered forwarding state [ 245.724078] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 245.806043] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 245.814018] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 248.895178] 8021q: adding VLAN 0 to HW filter on device bond0 [ 249.023291] 8021q: adding VLAN 0 to HW filter on device bond0 [ 249.220781] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 249.323106] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 249.522106] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 249.528435] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 249.536408] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 249.629647] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 249.636030] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 249.644017] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 249.846885] 8021q: adding VLAN 0 to HW filter on device team0 [ 249.947882] 8021q: adding VLAN 0 to HW filter on device team0 [ 251.820472] binder: 8254 RLIMIT_NICE not set [ 251.868555] binder: release 8252:8260 transaction 11 out, still active [ 251.875432] binder: undelivered TRANSACTION_COMPLETE [ 251.880680] binder: send failed reply for transaction 11, target dead 21:05:52 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000010000/0x3000)=nil, 0x3000, 0x0, 0x100000000020012, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000500)={0x4, 0x0, &(0x7f0000000480)=[@enter_looper], 0x4, 0x0, &(0x7f00000004c0)='8)1z'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000000680)}) dup3(r1, r0, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 21:05:52 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="1400000001ffff7fc819542faebaa579e5008fba"], 0x14}}, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) 21:05:52 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000200)='net/ip_tables_names\x00') pread64(r0, &(0x7f0000000240)=""/186, 0xba, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f00000000c0)=""/169, 0xa9}], 0x1, 0x8) 21:05:52 executing program 0: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='/exe\x00\x00\x00\x00\x00\x04\t\x00K\xdd\xd9\xde\x91\xbe\x10\xee\xbf\x00\x0e\xe9\xa9\x0fy\x80XC\x9e\xd5T\xfa\aBJ\xb9\xb3\xf8h>\xcf\x89\xde\xe9\x01\xd2\xdau\xc0\x1f\x02\x00\xf5\x8d&\xd7\xa0q\xfb53\x1c\xe3\x9cZ\xee\xffP\x83\xcf\a\xddFE\\\x91MJ\xff\x1e|\xf7\xedW\xc0\xc2\x05o\\\xa9\xfc\xf0<\xbf\x82\xbd\x13SG73\x92E\xd3\xc7\x06A\xbeb\x81\xd7\xe1\xb4\xb7\t\x91\x14\xc5q\x87\"\x98\xdd\x7f! \xe2\xb6\xfa*.*,\x9cn\x004u\vya\xfa,\x15\x84\xc0\xb5\xa5\x00\xae\n\xc3\x9b\xc7jx\xd9\x15\x82fu\x9fvj>\x8c\x84\xc0\x9c\xf3\xad\x88\x82\x94\x7f\xfa\x1f\xb4\xc0Pr{\xeb\x12\xc5~\x06\xffY\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x89$W\x8a\xd4\x9e\xa1\x14LtH\xd6@\xaa\x88\xa6jq\xb7}s\xa9$\xff\x02\x7f\xdc\xb5P\x16\x16S\xd4\xcbW\b\x83\x85$\x82\x86\xf5\xbe\x9d\x87f\xc7\f)\xe6\xf5\x06=\xfet\xa1\xb0\xb5 y\x15\x90H!\vM\'\x1a\xc9L\x88\x9b\x06<\xa3J\tW\x9a\xf061\xf1(\xe6\xdd,\x96m\xae\xcd|o~\x0fN\xbc\xaf\x80%\f\xfa\xb0q\x84\x83\x80x\xc7\x1d\x80\x9d\x06\xdc\v\xacu\xdb\x81E%\xd1\xd1\xac\xafL\xb6\xf4\x89\x0f9s\x82\xaecf\x97\xf6\x88\tN8\xdb\\\"w\x0fS\alc\r\xf9\xbbL\x14\x91\x89\xff\xa9u\xf5 \x871\x1c[\xaa\xfc\x11\xc9\v\xdc%\xfc\x80;q\x15=\xdc9\x95\xb2\xdfI\xcd\xd7\x84\xbc[\xea@\x86\x10p\xda\xdb9^\x85\xc9<\xdf\xa0\x8e') mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0xfffffffffffffffc, 0x12, r0, 0x0) r1 = socket$inet_dccp(0x2, 0x6, 0x0) getsockopt$inet_int(r1, 0x10d, 0x0, &(0x7f0000000000), &(0x7f0000000040)=0x4) 21:05:52 executing program 1: r0 = syz_open_dev$sndctrl(&(0x7f0000006000)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r0, 0xc1105517, &(0x7f0000000040)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x3, 0x0, 0x4, 0x0, 0x1, 0x0, 'syz1\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1d\np\xb4\xd6)\xf5\x1a\x00', &(0x7f00000004c0)=['syz'], 0x258, [], [0x2, 0x1, 0x0, 0x3ff]}) 21:05:52 executing program 5: rt_sigprocmask(0x0, &(0x7f0000000140)={0xfffffffffffffffc}, 0x0, 0x8) r0 = gettid() timer_create(0xb, &(0x7f0000000200)={0x0, 0x12, 0x4, @tid=r0}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) rt_sigtimedwait(&(0x7f00000000c0)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) [ 252.065502] binder: 8279 RLIMIT_NICE not set 21:05:53 executing program 2: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x80200000006, 0x0) ioctl$VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000080)={0x2, 0xa, 0x0, "1760550f2b5c01ecff00"}) 21:05:53 executing program 1: unshare(0x20400) r0 = openat$apparmor_task_exec(0xffffffffffffff9c, &(0x7f0000000300)='/proc/self/attr/exec\x00', 0x2, 0x0) fcntl$getownex(r0, 0x11, &(0x7f0000000200)) 21:05:53 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4008ae89, &(0x7f0000000340)={0x79, 0x600000000000000, [0x40000073, 0x0, 0x1b], [0xc2]}) 21:05:53 executing program 5: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket(0x400000000000010, 0x802, 0x0) write(r1, &(0x7f0000000040)="240000001a0099f0003be90000ed190e020808160000000031ba0080080001007f196be0", 0x24) [ 252.112804] binder: release 8275:8284 transaction 13 out, still active [ 252.119632] binder: undelivered TRANSACTION_COMPLETE [ 252.126290] binder: send failed reply for transaction 13, target dead 21:05:53 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ustat(0xe, &(0x7f0000000040)) 21:05:53 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000000)='tls\x00', 0xca) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) getsockopt$inet6_tcp_buf(r0, 0x11a, 0x1, &(0x7f0000000680)=""/4096, &(0x7f0000000180)=0x3) [ 252.362390] kvm [8292]: vcpu0, guest rIP: 0xfff0 disabled perfctr wrmsr: 0xc2 data 0x0 [ 252.390478] ================================================================== [ 252.397887] BUG: KMSAN: uninit-value in __siphash_aligned+0x512/0xae0 [ 252.404481] CPU: 1 PID: 8306 Comm: syz-executor0 Not tainted 4.20.0-rc7+ #8 [ 252.411581] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 252.420941] Call Trace: [ 252.423570] dump_stack+0x173/0x1d0 [ 252.427222] kmsan_report+0x120/0x290 [ 252.431049] kmsan_internal_check_memory+0x9a7/0xa20 [ 252.436213] __msan_instrument_asm_load+0x8a/0x90 [ 252.441074] __siphash_aligned+0x512/0xae0 [ 252.445351] secure_ipv6_port_ephemeral+0x110/0x220 [ 252.450413] inet6_hash_connect+0x11f/0x1a0 [ 252.454769] tcp_v6_connect+0x20ba/0x2890 [ 252.458952] ? __msan_poison_alloca+0x1e0/0x270 [ 252.463655] ? tcp_v6_pre_connect+0x130/0x130 [ 252.468185] __inet_stream_connect+0x2f9/0x1340 [ 252.472904] inet_stream_connect+0x101/0x180 [ 252.477338] __sys_connect+0x664/0x820 [ 252.481251] ? __inet_stream_connect+0x1340/0x1340 [ 252.486204] ? prepare_exit_to_usermode+0x114/0x420 [ 252.491253] ? syscall_return_slowpath+0x50/0x650 [ 252.496145] __se_sys_connect+0x8d/0xb0 [ 252.500149] __x64_sys_connect+0x4a/0x70 [ 252.504229] do_syscall_64+0xbc/0xf0 [ 252.507992] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 252.513202] RIP: 0033:0x457669 [ 252.516417] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 252.535324] RSP: 002b:00007f74b0ff7c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 252.543040] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457669 [ 252.550312] RDX: 000000000000001c RSI: 0000000020000080 RDI: 0000000000000003 [ 252.557605] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 252.564886] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f74b0ff86d4 [ 252.572175] R13: 00000000004bdc27 R14: 00000000004cd678 R15: 00000000ffffffff [ 252.579478] [ 252.581101] Local variable description: ----combined@secure_ipv6_port_ephemeral [ 252.588546] Variable was created at: [ 252.592284] secure_ipv6_port_ephemeral+0x6a/0x220 [ 252.597223] inet6_hash_connect+0x11f/0x1a0 [ 252.601547] [ 252.603173] Bytes 2-7 of 8 are uninitialized [ 252.607584] Memory access of size 8 starts at ffff888188e9f9f0 [ 252.613556] ================================================================== [ 252.620913] Disabling lock debugging due to kernel taint [ 252.626362] Kernel panic - not syncing: panic_on_warn set ... [ 252.632736] CPU: 1 PID: 8306 Comm: syz-executor0 Tainted: G B 4.20.0-rc7+ #8 [ 252.641231] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 252.650705] Call Trace: [ 252.653307] dump_stack+0x173/0x1d0 [ 252.656973] panic+0x3ce/0x961 [ 252.660225] kmsan_report+0x285/0x290 [ 252.664055] kmsan_internal_check_memory+0x9a7/0xa20 [ 252.669204] __msan_instrument_asm_load+0x8a/0x90 [ 252.674083] __siphash_aligned+0x512/0xae0 [ 252.678378] secure_ipv6_port_ephemeral+0x110/0x220 [ 252.683428] inet6_hash_connect+0x11f/0x1a0 [ 252.687773] tcp_v6_connect+0x20ba/0x2890 [ 252.691960] ? __msan_poison_alloca+0x1e0/0x270 [ 252.696667] ? tcp_v6_pre_connect+0x130/0x130 [ 252.701179] __inet_stream_connect+0x2f9/0x1340 [ 252.705914] inet_stream_connect+0x101/0x180 [ 252.710367] __sys_connect+0x664/0x820 [ 252.714290] ? __inet_stream_connect+0x1340/0x1340 [ 252.719243] ? prepare_exit_to_usermode+0x114/0x420 [ 252.724270] ? syscall_return_slowpath+0x50/0x650 [ 252.729146] __se_sys_connect+0x8d/0xb0 [ 252.733151] __x64_sys_connect+0x4a/0x70 [ 252.737230] do_syscall_64+0xbc/0xf0 [ 252.740964] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 252.746163] RIP: 0033:0x457669 [ 252.749362] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 252.768268] RSP: 002b:00007f74b0ff7c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 252.775992] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457669 [ 252.783713] RDX: 000000000000001c RSI: 0000000020000080 RDI: 0000000000000003 [ 252.791019] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 252.798292] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f74b0ff86d4 [ 252.805568] R13: 00000000004bdc27 R14: 00000000004cd678 R15: 00000000ffffffff [ 252.813753] Kernel Offset: disabled [ 252.817380] Rebooting in 86400 seconds..