[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 32.659791] random: sshd: uninitialized urandom read (32 bytes read) [ 33.007737] kauditd_printk_skb: 10 callbacks suppressed [ 33.007746] audit: type=1400 audit(1555966589.516:35): avc: denied { map } for pid=6849 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 33.066932] random: sshd: uninitialized urandom read (32 bytes read) [ 33.725421] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.0.90' (ECDSA) to the list of known hosts. [ 49.908203] random: sshd: uninitialized urandom read (32 bytes read) 2019/04/22 20:56:46 fuzzer started [ 50.099336] audit: type=1400 audit(1555966606.606:36): avc: denied { map } for pid=6860 comm="syz-fuzzer" path="/root/syz-fuzzer" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 51.826219] random: cc1: uninitialized urandom read (8 bytes read) 2019/04/22 20:56:49 dialing manager at 10.128.0.105:46537 2019/04/22 20:56:53 syscalls: 2434 2019/04/22 20:56:53 code coverage: enabled 2019/04/22 20:56:53 comparison tracing: ioctl(KCOV_TRACE_CMP) failed: invalid argument 2019/04/22 20:56:53 extra coverage: extra coverage is not supported by the kernel 2019/04/22 20:56:53 setuid sandbox: enabled 2019/04/22 20:56:53 namespace sandbox: enabled 2019/04/22 20:56:53 Android sandbox: /sys/fs/selinux/policy does not exist 2019/04/22 20:56:53 fault injection: enabled 2019/04/22 20:56:53 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/04/22 20:56:53 net packet injection: enabled 2019/04/22 20:56:53 net device setup: enabled [ 58.079798] random: crng init done 20:58:03 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000380)='net/mcfilter6\x00') preadv(r0, &(0x7f0000000480), 0x10000000000001e1, 0x4c000000) 20:58:03 executing program 5: r0 = syz_open_dev$sndmidi(&(0x7f0000653fee)='/dev/snd/midiC#D#\x00', 0x200, 0x201) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(r0, 0x40045730, &(0x7f0000000080)) 20:58:03 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@nat={'nat\x00', 0x19, 0x1, 0x138, [0x20000280, 0x0, 0x0, 0x20000358, 0x20000388], 0x0, 0x0, &(0x7f0000000280)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x15, 0x0, 0x0, 'bridge_s]ave_1\x00', 'erspan0\x00', 'veth0_to_bridge\x00', 'rose0\x00', @remote, [], @random="73a67b42c531", [], 0x70, 0x70, 0xa8}}, @arpreply={'arpreply\x00', 0x10, {{@remote, 0xfffffffc}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffefffffffff}]}, 0x1b0) 20:58:03 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000380)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000634000/0x4000)=nil, 0x4000}}) r0 = syz_open_dev$media(&(0x7f0000000100)='/dev/media#\x00', 0x0, 0x0) ioctl$EVIOCGKEY(r0, 0xc0487c04, &(0x7f0000000000)=""/226) 20:58:03 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000640)=@nat={'XatYt\x00\x00\x00\x00\x03\xe0\x01\x00', 0x19, 0x3, 0x3e0, [0x20001600, 0x0, 0x0, 0x200018d8, 0x20001908], 0x0, 0x0, &(0x7f0000001600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x1b, 0x0, 0x86dd, 'sit0\x00', 'erspan0\x00', 'b\x00', 'veth0_to_bond\x00', @remote, [], @broadcast, [], 0x128, 0x198, 0x1d0, [@statistic={'statistic\x00', 0x18}, @ip6={'ip6\x00', 0x50, {{@local, @dev}}}]}, [@snat={'snat\x00', 0x10, {{@dev}}}, @arpreply={'arpreply\x00', 0x10, {{@broadcast}}}]}, @arpreply={'arpreply\x00', 0x10}}, {{{0x3, 0x0, 0x0, 'vcan0\x00', 'nr0\x00', 'veth1_to_bridge\x00', 'ip6gretap0\x00', @remote, [], @remote, [], 0x70, 0xa8, 0xd8}, [@snat={'snat\x00', 0x10}]}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x3, 0x0, 0x0, 'ifb0\x00', 'dummy0\x00', 'ip_vti0\x00', 'ip6tnl0\x00', @broadcast, [], @link_local, [], 0x70, 0x70, 0xa8}}, @snat={'snat\x00', 0x10, {{@dev}}}}]}]}, 0x458) 20:58:03 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000340)='tls\x00', 0x4) getsockopt$inet6_tcp_buf(r0, 0x6, 0x1f, 0x0, &(0x7f0000000040)) [ 127.332440] audit: type=1400 audit(1555966683.846:37): avc: denied { map } for pid=6860 comm="syz-fuzzer" path="/root/syzkaller-shm665371683" dev="sda1" ino=1426 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:file_t:s0 tclass=file permissive=1 [ 127.371714] audit: type=1400 audit(1555966683.886:38): avc: denied { map } for pid=6876 comm="syz-executor.0" path="/sys/kernel/debug/kcov" dev="debugfs" ino=21 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1 [ 127.549964] IPVS: ftp: loaded support on port[0] = 21 [ 127.844081] chnl_net:caif_netlink_parms(): no params data found [ 127.854959] IPVS: ftp: loaded support on port[0] = 21 [ 127.883654] bridge0: port 1(bridge_slave_0) entered blocking state [ 127.890650] bridge0: port 1(bridge_slave_0) entered disabled state [ 127.897915] device bridge_slave_0 entered promiscuous mode [ 127.906481] bridge0: port 2(bridge_slave_1) entered blocking state [ 127.913003] bridge0: port 2(bridge_slave_1) entered disabled state [ 127.919999] device bridge_slave_1 entered promiscuous mode [ 127.941196] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 127.954443] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 127.976573] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 127.983879] team0: Port device team_slave_0 added [ 127.991661] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 127.998688] team0: Port device team_slave_1 added [ 128.006528] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 128.014065] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 128.071564] IPVS: ftp: loaded support on port[0] = 21 [ 128.092367] device hsr_slave_0 entered promiscuous mode [ 128.130402] device hsr_slave_1 entered promiscuous mode [ 128.170720] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 128.177720] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 128.243403] chnl_net:caif_netlink_parms(): no params data found [ 128.252702] bridge0: port 2(bridge_slave_1) entered blocking state [ 128.259147] bridge0: port 2(bridge_slave_1) entered forwarding state [ 128.266225] bridge0: port 1(bridge_slave_0) entered blocking state [ 128.272615] bridge0: port 1(bridge_slave_0) entered forwarding state [ 128.343748] IPVS: ftp: loaded support on port[0] = 21 [ 128.372572] chnl_net:caif_netlink_parms(): no params data found [ 128.389215] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 128.395827] 8021q: adding VLAN 0 to HW filter on device bond0 [ 128.426145] bridge0: port 1(bridge_slave_0) entered blocking state [ 128.432990] bridge0: port 1(bridge_slave_0) entered disabled state [ 128.440515] device bridge_slave_0 entered promiscuous mode [ 128.457690] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 128.464372] bridge0: port 2(bridge_slave_1) entered blocking state [ 128.471631] bridge0: port 2(bridge_slave_1) entered disabled state [ 128.478701] device bridge_slave_1 entered promiscuous mode [ 128.494936] IPVS: ftp: loaded support on port[0] = 21 [ 128.521489] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 128.537690] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 128.544842] 8021q: adding VLAN 0 to HW filter on device team0 [ 128.558886] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 128.566755] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 128.575103] bridge0: port 1(bridge_slave_0) entered disabled state [ 128.592695] bridge0: port 2(bridge_slave_1) entered disabled state [ 128.611327] bridge0: port 1(bridge_slave_0) entered blocking state [ 128.617734] bridge0: port 1(bridge_slave_0) entered disabled state [ 128.625222] device bridge_slave_0 entered promiscuous mode [ 128.632408] bridge0: port 2(bridge_slave_1) entered blocking state [ 128.638768] bridge0: port 2(bridge_slave_1) entered disabled state [ 128.645912] device bridge_slave_1 entered promiscuous mode [ 128.663079] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 128.670456] team0: Port device team_slave_0 added [ 128.677754] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 128.685858] team0: Port device team_slave_1 added [ 128.692897] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 128.706728] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 128.714408] bridge0: port 1(bridge_slave_0) entered blocking state [ 128.721094] bridge0: port 1(bridge_slave_0) entered forwarding state [ 128.755547] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 128.776563] IPVS: ftp: loaded support on port[0] = 21 [ 128.815106] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 128.823247] bridge0: port 2(bridge_slave_1) entered blocking state [ 128.829585] bridge0: port 2(bridge_slave_1) entered forwarding state [ 128.836943] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 128.845094] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 128.852831] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 128.859862] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 128.869247] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 128.894150] chnl_net:caif_netlink_parms(): no params data found [ 128.903664] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 128.952214] device hsr_slave_0 entered promiscuous mode [ 129.010381] device hsr_slave_1 entered promiscuous mode [ 129.051200] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 129.059110] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 129.068505] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 129.084138] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 129.091693] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 129.123991] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 129.131621] team0: Port device team_slave_0 added [ 129.142661] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 129.152283] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 129.159794] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 129.195900] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 129.203661] team0: Port device team_slave_1 added [ 129.217671] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 129.238652] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 129.257115] bridge0: port 1(bridge_slave_0) entered blocking state [ 129.263846] bridge0: port 1(bridge_slave_0) entered disabled state [ 129.271508] device bridge_slave_0 entered promiscuous mode [ 129.278390] bridge0: port 2(bridge_slave_1) entered blocking state [ 129.285069] bridge0: port 2(bridge_slave_1) entered disabled state [ 129.292467] device bridge_slave_1 entered promiscuous mode [ 129.307026] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 129.315605] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 129.321769] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 129.340745] chnl_net:caif_netlink_parms(): no params data found [ 129.413679] device hsr_slave_0 entered promiscuous mode [ 129.460447] device hsr_slave_1 entered promiscuous mode [ 129.505209] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 129.515547] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 129.529752] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 129.539072] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 129.586852] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 129.602669] bridge0: port 1(bridge_slave_0) entered blocking state [ 129.609098] bridge0: port 1(bridge_slave_0) entered disabled state [ 129.616432] device bridge_slave_0 entered promiscuous mode [ 129.628066] bridge0: port 2(bridge_slave_1) entered blocking state [ 129.636453] bridge0: port 2(bridge_slave_1) entered disabled state [ 129.643627] device bridge_slave_1 entered promiscuous mode [ 129.654234] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 129.661566] team0: Port device team_slave_0 added [ 129.680627] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 129.689478] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 129.698742] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 129.706432] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 129.714170] team0: Port device team_slave_1 added [ 129.719587] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 129.740815] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 129.750998] 8021q: adding VLAN 0 to HW filter on device bond0 [ 129.757288] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 129.801857] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 129.819282] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 129.828627] team0: Port device team_slave_0 added [ 129.839389] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 129.846666] team0: Port device team_slave_1 added [ 129.892335] device hsr_slave_0 entered promiscuous mode [ 129.930373] device hsr_slave_1 entered promiscuous mode [ 129.970844] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 129.993771] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 130.012512] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 130.019582] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 130.036962] 8021q: adding VLAN 0 to HW filter on device bond0 [ 130.045294] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 130.058180] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready 20:58:06 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@nat={'nat\x00', 0x19, 0x1, 0x138, [0x20000280, 0x0, 0x0, 0x20000358, 0x20000388], 0x0, 0x0, &(0x7f0000000280)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x15, 0x0, 0x0, 'bridge_s]ave_1\x00', 'erspan0\x00', 'veth0_to_bridge\x00', 'rose0\x00', @remote, [], @random="73a67b42c531", [], 0x70, 0x70, 0xa8}}, @arpreply={'arpreply\x00', 0x10, {{@remote, 0xfffffffc}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffefffffffff}]}, 0x1b0) [ 130.066230] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 130.074182] chnl_net:caif_netlink_parms(): no params data found [ 130.099024] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready 20:58:06 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@nat={'nat\x00', 0x19, 0x1, 0x138, [0x20000280, 0x0, 0x0, 0x20000358, 0x20000388], 0x0, 0x0, &(0x7f0000000280)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x15, 0x0, 0x0, 'bridge_s]ave_1\x00', 'erspan0\x00', 'veth0_to_bridge\x00', 'rose0\x00', @remote, [], @random="73a67b42c531", [], 0x70, 0x70, 0xa8}}, @arpreply={'arpreply\x00', 0x10, {{@remote, 0xfffffffc}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffefffffffff}]}, 0x1b0) [ 130.126456] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 130.136581] 8021q: adding VLAN 0 to HW filter on device team0 [ 130.144302] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 130.202531] device hsr_slave_0 entered promiscuous mode [ 130.240467] device hsr_slave_1 entered promiscuous mode 20:58:06 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@nat={'nat\x00', 0x19, 0x1, 0x138, [0x20000280, 0x0, 0x0, 0x20000358, 0x20000388], 0x0, 0x0, &(0x7f0000000280)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x15, 0x0, 0x0, 'bridge_s]ave_1\x00', 'erspan0\x00', 'veth0_to_bridge\x00', 'rose0\x00', @remote, [], @random="73a67b42c531", [], 0x70, 0x70, 0xa8}}, @arpreply={'arpreply\x00', 0x10, {{@remote, 0xfffffffc}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffefffffffff}]}, 0x1b0) [ 130.280793] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 130.287876] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 130.297260] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 130.309803] bridge0: port 1(bridge_slave_0) entered blocking state [ 130.318608] bridge0: port 1(bridge_slave_0) entered disabled state [ 130.327661] device bridge_slave_0 entered promiscuous mode [ 130.336607] bridge0: port 2(bridge_slave_1) entered blocking state [ 130.343386] bridge0: port 2(bridge_slave_1) entered disabled state [ 130.354247] device bridge_slave_1 entered promiscuous mode [ 130.368657] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready 20:58:06 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x10, 0x3, 0xc) sendmsg(r1, &(0x7f000001d000)={0x0, 0x0, &(0x7f0000024000)=[{&(0x7f0000000100)="24000000100007031dff22946fa2830020200a0009000300001d85687f0000000400ff7e28000000000a43ba5d806055b6fdd80b40000000140001000029ec2400020cd37e99d69cda45a95e", 0x4c}], 0x1}, 0x0) [ 130.375620] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 130.384046] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 130.401954] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 130.408543] 8021q: adding VLAN 0 to HW filter on device team0 [ 130.415922] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 130.462173] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 130.470139] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 130.477927] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 130.494519] bridge0: port 1(bridge_slave_0) entered blocking state [ 130.501086] bridge0: port 1(bridge_slave_0) entered forwarding state [ 130.508338] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 130.516558] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 130.524337] bridge0: port 1(bridge_slave_0) entered blocking state [ 130.530955] bridge0: port 1(bridge_slave_0) entered forwarding state [ 130.538084] audit: type=1400 audit(1555966687.046:39): avc: denied { create } for pid=6923 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 [ 130.563524] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 130.570717] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 130.574190] audit: type=1400 audit(1555966687.046:40): avc: denied { write } for pid=6923 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 [ 130.601805] 8021q: adding VLAN 0 to HW filter on device bond0 [ 130.608993] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 130.618289] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 130.627893] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 130.639713] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 130.647864] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 130.655731] bridge0: port 2(bridge_slave_1) entered blocking state [ 130.662131] bridge0: port 2(bridge_slave_1) entered forwarding state [ 130.670670] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 130.678421] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 130.686077] bridge0: port 2(bridge_slave_1) entered blocking state [ 130.693172] bridge0: port 2(bridge_slave_1) entered forwarding state [ 130.701551] bond0: Enslaving bond_slave_1 as an active interface with an up link 20:58:07 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x10, 0x3, 0xc) sendmsg(r1, &(0x7f000001d000)={0x0, 0x0, &(0x7f0000024000)=[{&(0x7f0000000100)="24000000100007031dff22946fa2830020200a0009000300001d85687f0000000400ff7e28000000000a43ba5d806055b6fdd80b40000000140001000029ec2400020cd37e99d69cda45a95e", 0x4c}], 0x1}, 0x0) [ 130.722100] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 130.729303] team0: Port device team_slave_0 added [ 130.736192] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 130.752452] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 130.764853] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 130.773408] team0: Port device team_slave_1 added [ 130.779561] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 130.788677] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 130.798130] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 130.810919] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 130.818590] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 130.826699] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 130.836882] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 130.844036] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 130.853412] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 130.862960] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready 20:58:07 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x10, 0x3, 0xc) sendmsg(r1, &(0x7f000001d000)={0x0, 0x0, &(0x7f0000024000)=[{&(0x7f0000000100)="24000000100007031dff22946fa2830020200a0009000300001d85687f0000000400ff7e28000000000a43ba5d806055b6fdd80b40000000140001000029ec2400020cd37e99d69cda45a95e", 0x4c}], 0x1}, 0x0) [ 130.869036] 8021q: adding VLAN 0 to HW filter on device team0 [ 130.876888] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 130.897809] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 130.908614] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 130.919891] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 130.929203] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 130.946629] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 130.955318] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 130.963336] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 130.971341] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 130.978859] bridge0: port 1(bridge_slave_0) entered blocking state [ 130.985240] bridge0: port 1(bridge_slave_0) entered forwarding state [ 130.999277] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 131.006747] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 131.052413] device hsr_slave_0 entered promiscuous mode [ 131.090377] device hsr_slave_1 entered promiscuous mode [ 131.131881] 8021q: adding VLAN 0 to HW filter on device bond0 [ 131.141531] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 131.148544] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 131.157349] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 131.166152] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 131.174174] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 131.182078] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 131.189802] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 131.197564] bridge0: port 2(bridge_slave_1) entered blocking state [ 131.203950] bridge0: port 2(bridge_slave_1) entered forwarding state [ 131.211229] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 131.220392] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 131.228161] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 131.237118] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 131.245376] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 131.252596] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 131.259898] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 131.267044] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 131.274725] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 131.282774] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 131.291521] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 131.299740] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 131.309255] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 131.319866] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 131.327700] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 131.335996] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 131.344789] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 131.355055] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 131.362457] 8021q: adding VLAN 0 to HW filter on device team0 [ 131.374845] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 131.382166] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 131.389639] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 131.400433] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 131.408075] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 131.417796] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 131.427493] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 131.437637] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 131.447872] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 131.459031] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 131.465300] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 131.472559] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 131.480133] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 131.487590] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 131.495426] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 131.503202] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 131.511413] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 131.519070] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 131.527026] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 131.534816] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 131.542925] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 131.550746] bridge0: port 1(bridge_slave_0) entered blocking state [ 131.557089] bridge0: port 1(bridge_slave_0) entered forwarding state [ 131.564146] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 131.571120] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 131.579005] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 131.597388] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 131.614000] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 131.624472] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 131.632268] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 131.639284] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 131.646884] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 131.654483] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 131.662602] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 131.670824] bridge0: port 2(bridge_slave_1) entered blocking state [ 131.677365] bridge0: port 2(bridge_slave_1) entered forwarding state [ 131.685184] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 131.703826] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 131.711559] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 131.719057] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 131.729064] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 131.739138] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 131.749501] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 131.756070] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 131.764277] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 131.774172] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 131.788685] 8021q: adding VLAN 0 to HW filter on device bond0 [ 131.795154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 131.803572] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 131.811482] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 131.819188] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 131.833295] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 131.844780] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 131.854829] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 131.861944] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 131.869677] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 131.878584] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 131.887865] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 131.899957] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 131.910706] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 131.919428] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 131.929622] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 131.936123] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 131.944269] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 131.952668] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 131.959626] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 131.968328] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 131.980714] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 131.986815] 8021q: adding VLAN 0 to HW filter on device team0 [ 131.996540] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 132.004881] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 132.015892] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 132.031421] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 132.039580] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 132.054061] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 132.060632] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 132.079118] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 132.087189] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 132.099065] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 132.109024] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 132.117315] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 132.125174] bridge0: port 1(bridge_slave_0) entered blocking state [ 132.131758] bridge0: port 1(bridge_slave_0) entered forwarding state [ 132.138903] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 132.148158] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 132.165898] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 132.173766] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 132.183912] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 132.192951] bridge0: port 2(bridge_slave_1) entered blocking state [ 132.199353] bridge0: port 2(bridge_slave_1) entered forwarding state [ 132.215470] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 132.242414] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 132.249362] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 132.275232] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 132.282789] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 132.294093] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 132.302123] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 132.315705] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 132.324006] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 132.337830] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 132.360232] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 132.368370] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 132.389883] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 132.402889] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 132.413318] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 132.415696] x_tables: eb_tables: snat target: only valid in nat table, not XatYt [ 132.427849] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 132.452807] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 132.484447] hrtimer: interrupt took 35176 ns [ 132.515440] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 132.572683] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 132.578839] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 132.606754] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 132.618881] 8021q: adding VLAN 0 to HW filter on device batadv0 20:58:09 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000380)='net/mcfilter6\x00') preadv(r0, &(0x7f0000000480), 0x10000000000001e1, 0x4c000000) 20:58:09 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x10, 0x3, 0xc) sendmsg(r1, &(0x7f000001d000)={0x0, 0x0, &(0x7f0000024000)=[{&(0x7f0000000100)="24000000100007031dff22946fa2830020200a0009000300001d85687f0000000400ff7e28000000000a43ba5d806055b6fdd80b40000000140001000029ec2400020cd37e99d69cda45a95e", 0x4c}], 0x1}, 0x0) 20:58:09 executing program 5: r0 = syz_open_dev$sndmidi(&(0x7f0000653fee)='/dev/snd/midiC#D#\x00', 0x200, 0x201) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(r0, 0x40045730, &(0x7f0000000080)) 20:58:10 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000380)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000634000/0x4000)=nil, 0x4000}}) r0 = syz_open_dev$media(&(0x7f0000000100)='/dev/media#\x00', 0x0, 0x0) ioctl$EVIOCGKEY(r0, 0xc0487c04, &(0x7f0000000000)=""/226) 20:58:10 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000340)='tls\x00', 0x4) getsockopt$inet6_tcp_buf(r0, 0x6, 0x1f, 0x0, &(0x7f0000000040)) 20:58:10 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000640)=@nat={'XatYt\x00\x00\x00\x00\x03\xe0\x01\x00', 0x19, 0x3, 0x3e0, [0x20001600, 0x0, 0x0, 0x200018d8, 0x20001908], 0x0, 0x0, &(0x7f0000001600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x1b, 0x0, 0x86dd, 'sit0\x00', 'erspan0\x00', 'b\x00', 'veth0_to_bond\x00', @remote, [], @broadcast, [], 0x128, 0x198, 0x1d0, [@statistic={'statistic\x00', 0x18}, @ip6={'ip6\x00', 0x50, {{@local, @dev}}}]}, [@snat={'snat\x00', 0x10, {{@dev}}}, @arpreply={'arpreply\x00', 0x10, {{@broadcast}}}]}, @arpreply={'arpreply\x00', 0x10}}, {{{0x3, 0x0, 0x0, 'vcan0\x00', 'nr0\x00', 'veth1_to_bridge\x00', 'ip6gretap0\x00', @remote, [], @remote, [], 0x70, 0xa8, 0xd8}, [@snat={'snat\x00', 0x10}]}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x3, 0x0, 0x0, 'ifb0\x00', 'dummy0\x00', 'ip_vti0\x00', 'ip6tnl0\x00', @broadcast, [], @link_local, [], 0x70, 0x70, 0xa8}}, @snat={'snat\x00', 0x10, {{@dev}}}}]}]}, 0x458) 20:58:10 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f319bd070") r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet(0x2, 0x3, 0x19) connect$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) setsockopt(r2, 0x0, 0x15, &(0x7f0000000140)="f1", 0x1) 20:58:10 executing program 5: r0 = syz_open_dev$sndmidi(&(0x7f0000653fee)='/dev/snd/midiC#D#\x00', 0x200, 0x201) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(r0, 0x40045730, &(0x7f0000000080)) 20:58:10 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000380)='net/mcfilter6\x00') preadv(r0, &(0x7f0000000480), 0x10000000000001e1, 0x4c000000) 20:58:10 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000340)='tls\x00', 0x4) getsockopt$inet6_tcp_buf(r0, 0x6, 0x1f, 0x0, &(0x7f0000000040)) 20:58:10 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000640)=@nat={'XatYt\x00\x00\x00\x00\x03\xe0\x01\x00', 0x19, 0x3, 0x3e0, [0x20001600, 0x0, 0x0, 0x200018d8, 0x20001908], 0x0, 0x0, &(0x7f0000001600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x1b, 0x0, 0x86dd, 'sit0\x00', 'erspan0\x00', 'b\x00', 'veth0_to_bond\x00', @remote, [], @broadcast, [], 0x128, 0x198, 0x1d0, [@statistic={'statistic\x00', 0x18}, @ip6={'ip6\x00', 0x50, {{@local, @dev}}}]}, [@snat={'snat\x00', 0x10, {{@dev}}}, @arpreply={'arpreply\x00', 0x10, {{@broadcast}}}]}, @arpreply={'arpreply\x00', 0x10}}, {{{0x3, 0x0, 0x0, 'vcan0\x00', 'nr0\x00', 'veth1_to_bridge\x00', 'ip6gretap0\x00', @remote, [], @remote, [], 0x70, 0xa8, 0xd8}, [@snat={'snat\x00', 0x10}]}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x3, 0x0, 0x0, 'ifb0\x00', 'dummy0\x00', 'ip_vti0\x00', 'ip6tnl0\x00', @broadcast, [], @link_local, [], 0x70, 0x70, 0xa8}}, @snat={'snat\x00', 0x10, {{@dev}}}}]}]}, 0x458) [ 133.857038] x_tables: eb_tables: snat target: only valid in nat table, not XatYt 20:58:10 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000380)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000634000/0x4000)=nil, 0x4000}}) r0 = syz_open_dev$media(&(0x7f0000000100)='/dev/media#\x00', 0x0, 0x0) ioctl$EVIOCGKEY(r0, 0xc0487c04, &(0x7f0000000000)=""/226) 20:58:10 executing program 5: r0 = syz_open_dev$sndmidi(&(0x7f0000653fee)='/dev/snd/midiC#D#\x00', 0x200, 0x201) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(r0, 0x40045730, &(0x7f0000000080)) 20:58:10 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f319bd070") r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet(0x2, 0x3, 0x19) connect$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) setsockopt(r2, 0x0, 0x15, &(0x7f0000000140)="f1", 0x1) 20:58:10 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000340)='tls\x00', 0x4) getsockopt$inet6_tcp_buf(r0, 0x6, 0x1f, 0x0, &(0x7f0000000040)) 20:58:10 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000380)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000634000/0x4000)=nil, 0x4000}}) r0 = syz_open_dev$media(&(0x7f0000000100)='/dev/media#\x00', 0x0, 0x0) ioctl$EVIOCGKEY(r0, 0xc0487c04, &(0x7f0000000000)=""/226) 20:58:10 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f319bd070") r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet(0x2, 0x3, 0x19) connect$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) setsockopt(r2, 0x0, 0x15, &(0x7f0000000140)="f1", 0x1) [ 134.019395] x_tables: eb_tables: snat target: only valid in nat table, not XatYt 20:58:10 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000380)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000634000/0x4000)=nil, 0x4000}}) r0 = syz_open_dev$media(&(0x7f0000000100)='/dev/media#\x00', 0x0, 0x0) ioctl$EVIOCGKEY(r0, 0xc0487c04, &(0x7f0000000000)=""/226) 20:58:10 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000640)=@nat={'XatYt\x00\x00\x00\x00\x03\xe0\x01\x00', 0x19, 0x3, 0x3e0, [0x20001600, 0x0, 0x0, 0x200018d8, 0x20001908], 0x0, 0x0, &(0x7f0000001600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x1b, 0x0, 0x86dd, 'sit0\x00', 'erspan0\x00', 'b\x00', 'veth0_to_bond\x00', @remote, [], @broadcast, [], 0x128, 0x198, 0x1d0, [@statistic={'statistic\x00', 0x18}, @ip6={'ip6\x00', 0x50, {{@local, @dev}}}]}, [@snat={'snat\x00', 0x10, {{@dev}}}, @arpreply={'arpreply\x00', 0x10, {{@broadcast}}}]}, @arpreply={'arpreply\x00', 0x10}}, {{{0x3, 0x0, 0x0, 'vcan0\x00', 'nr0\x00', 'veth1_to_bridge\x00', 'ip6gretap0\x00', @remote, [], @remote, [], 0x70, 0xa8, 0xd8}, [@snat={'snat\x00', 0x10}]}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x3, 0x0, 0x0, 'ifb0\x00', 'dummy0\x00', 'ip_vti0\x00', 'ip6tnl0\x00', @broadcast, [], @link_local, [], 0x70, 0x70, 0xa8}}, @snat={'snat\x00', 0x10, {{@dev}}}}]}]}, 0x458) 20:58:10 executing program 4: mknod$loop(&(0x7f00000000c0)='./file0\x00', 0x6008, 0x0) r0 = creat(&(0x7f0000000000)='./file0\x00', 0x0) ioctl$BLKBSZGET(r0, 0x80081270, &(0x7f0000000040)) [ 134.202855] x_tables: eb_tables: snat target: only valid in nat table, not XatYt 20:58:10 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000380)='net/mcfilter6\x00') preadv(r0, &(0x7f0000000480), 0x10000000000001e1, 0x4c000000) 20:58:10 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") socket(0x0, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$X25_QBITINCL(0xffffffffffffffff, 0x106, 0x1, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) setsockopt$bt_hci_HCI_DATA_DIR(0xffffffffffffffff, 0x0, 0x1, 0x0, 0x0) recvfrom$inet6(r2, &(0x7f00000001c0)=""/31, 0xfffffffffffffe3c, 0x100, &(0x7f0000001880), 0x17c) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, 0x0, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='scalable\x00\xa6\xfbS\xf4\xa9\n\x82-\x7fps\x17I\xbb\x80\xfax\xb2K//\x19\xc0\xfe+k\x0f:\xde-\x98X\xa2\x96A\x15/G\xf2(\x92\xa2\xe2:w', 0x123) shutdown(r2, 0x1) r3 = accept4(r0, 0x0, 0x0, 0x0) sendto$inet6(r3, &(0x7f00000000c0), 0xfffffdda, 0x0, 0x0, 0x1a) 20:58:10 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f319bd070") r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet(0x2, 0x3, 0x19) connect$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) setsockopt(r2, 0x0, 0x15, &(0x7f0000000140)="f1", 0x1) 20:58:10 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000380)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000634000/0x4000)=nil, 0x4000}}) r0 = syz_open_dev$media(&(0x7f0000000100)='/dev/media#\x00', 0x0, 0x0) ioctl$EVIOCGKEY(r0, 0xc0487c04, &(0x7f0000000000)=""/226) 20:58:10 executing program 3: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x7ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_open_dev$usbmon(0x0, 0xef, 0x0) openat$ion(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/ion\x00', 0xc800, 0x0) ioctl$EVIOCSKEYCODE_V2(0xffffffffffffffff, 0x40284504, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x1ffffffffff, 0x3) socket$inet6(0xa, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'sit0\x00'}) socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000081, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup\x00', 0x200002, 0x0) mkdirat$cgroup(r0, 0x0, 0x1ff) fchdir(r0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, 0x0) umount2(&(0x7f0000000280)='./file0\x00', 0x0) 20:58:10 executing program 4: mknod$loop(&(0x7f00000000c0)='./file0\x00', 0x6008, 0x0) r0 = creat(&(0x7f0000000000)='./file0\x00', 0x0) ioctl$BLKBSZGET(r0, 0x80081270, &(0x7f0000000040)) 20:58:10 executing program 4: mknod$loop(&(0x7f00000000c0)='./file0\x00', 0x6008, 0x0) r0 = creat(&(0x7f0000000000)='./file0\x00', 0x0) ioctl$BLKBSZGET(r0, 0x80081270, &(0x7f0000000040)) 20:58:10 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000600)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(camellia)\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000100)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) sendmsg$nl_route_sched(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=@newtaction={0x30, 0x30, 0x0, 0x0, 0x0, {}, [{0x1c, 0x1, @m_bpf={0x18, 0x0, {{0x8, 0x1, 'bpf\x00'}, {0x4}, {0x4}}}}]}, 0x30}}, 0x0) recvmsg$kcm(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000480)=""/143, 0x8f}], 0x1}, 0x0) 20:58:10 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000380)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000634000/0x4000)=nil, 0x4000}}) r0 = syz_open_dev$media(&(0x7f0000000100)='/dev/media#\x00', 0x0, 0x0) ioctl$EVIOCGKEY(r0, 0xc0487c04, &(0x7f0000000000)=""/226) [ 134.432838] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 20:58:11 executing program 5: r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_G_CROP(r0, 0xc014563b, &(0x7f0000000080)={0x900}) 20:58:11 executing program 4: mknod$loop(&(0x7f00000000c0)='./file0\x00', 0x6008, 0x0) r0 = creat(&(0x7f0000000000)='./file0\x00', 0x0) ioctl$BLKBSZGET(r0, 0x80081270, &(0x7f0000000040)) 20:58:11 executing program 5: r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_G_CROP(r0, 0xc014563b, &(0x7f0000000080)={0x900}) 20:58:11 executing program 5: r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_G_CROP(r0, 0xc014563b, &(0x7f0000000080)={0x900}) 20:58:11 executing program 4: r0 = socket$inet(0x10, 0x2, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000004000)=[{&(0x7f0000000100)="2f0000001d0003fd6d0000360000000002dd0700810000001f5f080108000100020273730beeffff005867855e7fa5", 0x2f}], 0x1}, 0x0) 20:58:11 executing program 1: recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000000000)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000180)='projid_map\x00') r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000080)="0adc1f123c123f319bd070") preadv(r0, &(0x7f00000017c0), 0x331, 0x0) 20:58:11 executing program 3: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x7ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_open_dev$usbmon(0x0, 0xef, 0x0) openat$ion(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/ion\x00', 0xc800, 0x0) ioctl$EVIOCSKEYCODE_V2(0xffffffffffffffff, 0x40284504, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x1ffffffffff, 0x3) socket$inet6(0xa, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'sit0\x00'}) socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000081, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup\x00', 0x200002, 0x0) mkdirat$cgroup(r0, 0x0, 0x1ff) fchdir(r0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, 0x0) umount2(&(0x7f0000000280)='./file0\x00', 0x0) 20:58:11 executing program 0: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x7ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_open_dev$usbmon(0x0, 0xef, 0x0) openat$ion(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/ion\x00', 0xc800, 0x0) ioctl$EVIOCSKEYCODE_V2(0xffffffffffffffff, 0x40284504, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x1ffffffffff, 0x3) socket$inet6(0xa, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'sit0\x00'}) socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000081, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup\x00', 0x200002, 0x0) mkdirat$cgroup(r0, 0x0, 0x1ff) fchdir(r0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, 0x0) umount2(&(0x7f0000000280)='./file0\x00', 0x0) 20:58:11 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") socket(0x0, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$X25_QBITINCL(0xffffffffffffffff, 0x106, 0x1, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) setsockopt$bt_hci_HCI_DATA_DIR(0xffffffffffffffff, 0x0, 0x1, 0x0, 0x0) recvfrom$inet6(r2, &(0x7f00000001c0)=""/31, 0xfffffffffffffe3c, 0x100, &(0x7f0000001880), 0x17c) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, 0x0, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='scalable\x00\xa6\xfbS\xf4\xa9\n\x82-\x7fps\x17I\xbb\x80\xfax\xb2K//\x19\xc0\xfe+k\x0f:\xde-\x98X\xa2\x96A\x15/G\xf2(\x92\xa2\xe2:w', 0x123) shutdown(r2, 0x1) r3 = accept4(r0, 0x0, 0x0, 0x0) sendto$inet6(r3, &(0x7f00000000c0), 0xfffffdda, 0x0, 0x0, 0x1a) 20:58:11 executing program 5: r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_G_CROP(r0, 0xc014563b, &(0x7f0000000080)={0x900}) 20:58:11 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") socket(0x0, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$X25_QBITINCL(0xffffffffffffffff, 0x106, 0x1, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) setsockopt$bt_hci_HCI_DATA_DIR(0xffffffffffffffff, 0x0, 0x1, 0x0, 0x0) recvfrom$inet6(r2, &(0x7f00000001c0)=""/31, 0xfffffffffffffe3c, 0x100, &(0x7f0000001880), 0x17c) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, 0x0, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='scalable\x00\xa6\xfbS\xf4\xa9\n\x82-\x7fps\x17I\xbb\x80\xfax\xb2K//\x19\xc0\xfe+k\x0f:\xde-\x98X\xa2\x96A\x15/G\xf2(\x92\xa2\xe2:w', 0x123) shutdown(r2, 0x1) r3 = accept4(r0, 0x0, 0x0, 0x0) sendto$inet6(r3, &(0x7f00000000c0), 0xfffffdda, 0x0, 0x0, 0x1a) 20:58:11 executing program 4: r0 = socket$inet(0x10, 0x2, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000004000)=[{&(0x7f0000000100)="2f0000001d0003fd6d0000360000000002dd0700810000001f5f080108000100020273730beeffff005867855e7fa5", 0x2f}], 0x1}, 0x0) 20:58:11 executing program 1: recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000000000)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000180)='projid_map\x00') r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000080)="0adc1f123c123f319bd070") preadv(r0, &(0x7f00000017c0), 0x331, 0x0) [ 135.231981] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 20:58:11 executing program 4: r0 = socket$inet(0x10, 0x2, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000004000)=[{&(0x7f0000000100)="2f0000001d0003fd6d0000360000000002dd0700810000001f5f080108000100020273730beeffff005867855e7fa5", 0x2f}], 0x1}, 0x0) [ 135.342878] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 20:58:11 executing program 0: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x7ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_open_dev$usbmon(0x0, 0xef, 0x0) openat$ion(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/ion\x00', 0xc800, 0x0) ioctl$EVIOCSKEYCODE_V2(0xffffffffffffffff, 0x40284504, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x1ffffffffff, 0x3) socket$inet6(0xa, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'sit0\x00'}) socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000081, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup\x00', 0x200002, 0x0) mkdirat$cgroup(r0, 0x0, 0x1ff) fchdir(r0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, 0x0) umount2(&(0x7f0000000280)='./file0\x00', 0x0) 20:58:11 executing program 3: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x7ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_open_dev$usbmon(0x0, 0xef, 0x0) openat$ion(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/ion\x00', 0xc800, 0x0) ioctl$EVIOCSKEYCODE_V2(0xffffffffffffffff, 0x40284504, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x1ffffffffff, 0x3) socket$inet6(0xa, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'sit0\x00'}) socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000081, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup\x00', 0x200002, 0x0) mkdirat$cgroup(r0, 0x0, 0x1ff) fchdir(r0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, 0x0) umount2(&(0x7f0000000280)='./file0\x00', 0x0) 20:58:12 executing program 4: r0 = socket$inet(0x10, 0x2, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000004000)=[{&(0x7f0000000100)="2f0000001d0003fd6d0000360000000002dd0700810000001f5f080108000100020273730beeffff005867855e7fa5", 0x2f}], 0x1}, 0x0) 20:58:12 executing program 1: recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000000000)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000180)='projid_map\x00') r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000080)="0adc1f123c123f319bd070") preadv(r0, &(0x7f00000017c0), 0x331, 0x0) 20:58:12 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xc, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x4c00000000000000, 0x0, 0x0, 0x1e, 0x25}}, &(0x7f0000003ff6)='GPL\x00', 0x20000000001, 0xc3, &(0x7f0000000100)=""/195}, 0x48) 20:58:12 executing program 3: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x7ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_open_dev$usbmon(0x0, 0xef, 0x0) openat$ion(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/ion\x00', 0xc800, 0x0) ioctl$EVIOCSKEYCODE_V2(0xffffffffffffffff, 0x40284504, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x1ffffffffff, 0x3) socket$inet6(0xa, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'sit0\x00'}) socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000081, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup\x00', 0x200002, 0x0) mkdirat$cgroup(r0, 0x0, 0x1ff) fchdir(r0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, 0x0) umount2(&(0x7f0000000280)='./file0\x00', 0x0) 20:58:12 executing program 0: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x7ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_open_dev$usbmon(0x0, 0xef, 0x0) openat$ion(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/ion\x00', 0xc800, 0x0) ioctl$EVIOCSKEYCODE_V2(0xffffffffffffffff, 0x40284504, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x1ffffffffff, 0x3) socket$inet6(0xa, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'sit0\x00'}) socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000081, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup\x00', 0x200002, 0x0) mkdirat$cgroup(r0, 0x0, 0x1ff) fchdir(r0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, 0x0) umount2(&(0x7f0000000280)='./file0\x00', 0x0) 20:58:12 executing program 1: recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000000000)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000180)='projid_map\x00') r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000080)="0adc1f123c123f319bd070") preadv(r0, &(0x7f00000017c0), 0x331, 0x0) 20:58:12 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") socket(0x0, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$X25_QBITINCL(0xffffffffffffffff, 0x106, 0x1, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) setsockopt$bt_hci_HCI_DATA_DIR(0xffffffffffffffff, 0x0, 0x1, 0x0, 0x0) recvfrom$inet6(r2, &(0x7f00000001c0)=""/31, 0xfffffffffffffe3c, 0x100, &(0x7f0000001880), 0x17c) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, 0x0, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='scalable\x00\xa6\xfbS\xf4\xa9\n\x82-\x7fps\x17I\xbb\x80\xfax\xb2K//\x19\xc0\xfe+k\x0f:\xde-\x98X\xa2\x96A\x15/G\xf2(\x92\xa2\xe2:w', 0x123) shutdown(r2, 0x1) r3 = accept4(r0, 0x0, 0x0, 0x0) sendto$inet6(r3, &(0x7f00000000c0), 0xfffffdda, 0x0, 0x0, 0x1a) 20:58:12 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xc, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x4c00000000000000, 0x0, 0x0, 0x1e, 0x25}}, &(0x7f0000003ff6)='GPL\x00', 0x20000000001, 0xc3, &(0x7f0000000100)=""/195}, 0x48) 20:58:12 executing program 3: futex(&(0x7f0000000ffc), 0xc, 0x0, &(0x7f0000000000)={0xffff, 0x4}, &(0x7f0000000ffc), 0x0) 20:58:12 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") socket(0x0, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$X25_QBITINCL(0xffffffffffffffff, 0x106, 0x1, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) setsockopt$bt_hci_HCI_DATA_DIR(0xffffffffffffffff, 0x0, 0x1, 0x0, 0x0) recvfrom$inet6(r2, &(0x7f00000001c0)=""/31, 0xfffffffffffffe3c, 0x100, &(0x7f0000001880), 0x17c) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, 0x0, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='scalable\x00\xa6\xfbS\xf4\xa9\n\x82-\x7fps\x17I\xbb\x80\xfax\xb2K//\x19\xc0\xfe+k\x0f:\xde-\x98X\xa2\x96A\x15/G\xf2(\x92\xa2\xe2:w', 0x123) shutdown(r2, 0x1) r3 = accept4(r0, 0x0, 0x0, 0x0) sendto$inet6(r3, &(0x7f00000000c0), 0xfffffdda, 0x0, 0x0, 0x1a) 20:58:12 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f00000003c0)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) r1 = syz_open_procfs(0x0, &(0x7f00004c6f8b)='mounts\x00') read$eventfd(r1, &(0x7f0000000080), 0xff97) 20:58:12 executing program 0: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x0) ioctl$TIOCGSID(r0, 0x5429, 0x0) 20:58:12 executing program 3: futex(&(0x7f0000000ffc), 0xc, 0x0, &(0x7f0000000000)={0xffff, 0x4}, &(0x7f0000000ffc), 0x0) 20:58:12 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xc, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x4c00000000000000, 0x0, 0x0, 0x1e, 0x25}}, &(0x7f0000003ff6)='GPL\x00', 0x20000000001, 0xc3, &(0x7f0000000100)=""/195}, 0x48) 20:58:12 executing program 0: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x0) ioctl$TIOCGSID(r0, 0x5429, 0x0) 20:58:12 executing program 3: futex(&(0x7f0000000ffc), 0xc, 0x0, &(0x7f0000000000)={0xffff, 0x4}, &(0x7f0000000ffc), 0x0) [ 136.159425] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 136.198410] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 20:58:12 executing program 0: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x0) ioctl$TIOCGSID(r0, 0x5429, 0x0) 20:58:12 executing program 3: futex(&(0x7f0000000ffc), 0xc, 0x0, &(0x7f0000000000)={0xffff, 0x4}, &(0x7f0000000ffc), 0x0) 20:58:13 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") socket(0x0, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$X25_QBITINCL(0xffffffffffffffff, 0x106, 0x1, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) setsockopt$bt_hci_HCI_DATA_DIR(0xffffffffffffffff, 0x0, 0x1, 0x0, 0x0) recvfrom$inet6(r2, &(0x7f00000001c0)=""/31, 0xfffffffffffffe3c, 0x100, &(0x7f0000001880), 0x17c) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, 0x0, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='scalable\x00\xa6\xfbS\xf4\xa9\n\x82-\x7fps\x17I\xbb\x80\xfax\xb2K//\x19\xc0\xfe+k\x0f:\xde-\x98X\xa2\x96A\x15/G\xf2(\x92\xa2\xe2:w', 0x123) shutdown(r2, 0x1) r3 = accept4(r0, 0x0, 0x0, 0x0) sendto$inet6(r3, &(0x7f00000000c0), 0xfffffdda, 0x0, 0x0, 0x1a) 20:58:13 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xc, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x4c00000000000000, 0x0, 0x0, 0x1e, 0x25}}, &(0x7f0000003ff6)='GPL\x00', 0x20000000001, 0xc3, &(0x7f0000000100)=""/195}, 0x48) 20:58:13 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f00000003c0)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) r1 = syz_open_procfs(0x0, &(0x7f00004c6f8b)='mounts\x00') read$eventfd(r1, &(0x7f0000000080), 0xff97) 20:58:13 executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f00000003c0)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) r1 = syz_open_procfs(0x0, &(0x7f00004c6f8b)='mounts\x00') read$eventfd(r1, &(0x7f0000000080), 0xff97) 20:58:13 executing program 0: syz_open_dev$dri(&(0x7f0000000180)='/dev/dri/card#\x00', 0x0, 0x0) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x0) ioctl$TIOCGSID(r0, 0x5429, 0x0) 20:58:13 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") socket(0x0, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$X25_QBITINCL(0xffffffffffffffff, 0x106, 0x1, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) setsockopt$bt_hci_HCI_DATA_DIR(0xffffffffffffffff, 0x0, 0x1, 0x0, 0x0) recvfrom$inet6(r2, &(0x7f00000001c0)=""/31, 0xfffffffffffffe3c, 0x100, &(0x7f0000001880), 0x17c) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, 0x0, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='scalable\x00\xa6\xfbS\xf4\xa9\n\x82-\x7fps\x17I\xbb\x80\xfax\xb2K//\x19\xc0\xfe+k\x0f:\xde-\x98X\xa2\x96A\x15/G\xf2(\x92\xa2\xe2:w', 0x123) shutdown(r2, 0x1) r3 = accept4(r0, 0x0, 0x0, 0x0) sendto$inet6(r3, &(0x7f00000000c0), 0xfffffdda, 0x0, 0x0, 0x1a) 20:58:13 executing program 4: r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc) close(r0) syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = fanotify_init(0x0, 0x0) mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) 20:58:13 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f00000003c0)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) r1 = syz_open_procfs(0x0, &(0x7f00004c6f8b)='mounts\x00') read$eventfd(r1, &(0x7f0000000080), 0xff97) 20:58:13 executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f00000003c0)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) r1 = syz_open_procfs(0x0, &(0x7f00004c6f8b)='mounts\x00') read$eventfd(r1, &(0x7f0000000080), 0xff97) 20:58:13 executing program 0: creat(&(0x7f0000000300)='./file0\x00', 0x0) clone(0x104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='devpts\x00', 0x0, &(0x7f0000000340)='wlan0[\x00') ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40000000000002d) wait4(0x0, 0x0, 0x0, 0x0) [ 137.066209] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 137.069178] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 20:58:13 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f00000003c0)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) r1 = syz_open_procfs(0x0, &(0x7f00004c6f8b)='mounts\x00') read$eventfd(r1, &(0x7f0000000080), 0xff97) [ 137.141221] devpts: called with bogus options 20:58:13 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x131f64) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, 0x0, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x27) setsockopt$sock_int(r1, 0x1, 0x7, &(0x7f0000000140), 0x4) [ 137.182480] devpts: called with bogus options 20:58:14 executing program 0: creat(&(0x7f0000000300)='./file0\x00', 0x0) clone(0x104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='devpts\x00', 0x0, &(0x7f0000000340)='wlan0[\x00') ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40000000000002d) wait4(0x0, 0x0, 0x0, 0x0) 20:58:14 executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f00000003c0)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) r1 = syz_open_procfs(0x0, &(0x7f00004c6f8b)='mounts\x00') read$eventfd(r1, &(0x7f0000000080), 0xff97) 20:58:14 executing program 1: creat(&(0x7f0000000300)='./file0\x00', 0x0) clone(0x104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='devpts\x00', 0x0, &(0x7f0000000340)='wlan0[\x00') ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40000000000002d) wait4(0x0, 0x0, 0x0, 0x0) 20:58:14 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @local, 0x4}, 0x1c) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f000014f000)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000780)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@mcast1, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x48, &(0x7f0000000200)={@remote}, 0x20) 20:58:14 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bc070") r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/mls\x00', 0x0, 0x0) read$eventfd(r1, &(0x7f0000000080), 0x8) [ 137.845170] devpts: called with bogus options 20:58:14 executing program 0: creat(&(0x7f0000000300)='./file0\x00', 0x0) clone(0x104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='devpts\x00', 0x0, &(0x7f0000000340)='wlan0[\x00') ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40000000000002d) wait4(0x0, 0x0, 0x0, 0x0) 20:58:14 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @local, 0x4}, 0x1c) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f000014f000)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000780)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@mcast1, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x48, &(0x7f0000000200)={@remote}, 0x20) 20:58:14 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='illinois\x00', 0x9) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000140)=0x78, 0x4) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r0, &(0x7f0000a88f88), 0x0, 0x20000000, 0x0, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0x2000000000001a, &(0x7f0000000080), &(0x7f0000000180)=0xff4b) 20:58:14 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bc070") r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/mls\x00', 0x0, 0x0) read$eventfd(r1, &(0x7f0000000080), 0x8) 20:58:14 executing program 0: creat(&(0x7f0000000300)='./file0\x00', 0x0) clone(0x104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='devpts\x00', 0x0, &(0x7f0000000340)='wlan0[\x00') ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40000000000002d) wait4(0x0, 0x0, 0x0, 0x0) 20:58:14 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bc070") r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/mls\x00', 0x0, 0x0) read$eventfd(r1, &(0x7f0000000080), 0x8) [ 138.029155] devpts: called with bogus options 20:58:16 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x131f64) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, 0x0, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x27) setsockopt$sock_int(r1, 0x1, 0x7, &(0x7f0000000140), 0x4) 20:58:16 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @local, 0x4}, 0x1c) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f000014f000)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000780)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@mcast1, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x48, &(0x7f0000000200)={@remote}, 0x20) 20:58:16 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='illinois\x00', 0x9) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000140)=0x78, 0x4) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r0, &(0x7f0000a88f88), 0x0, 0x20000000, 0x0, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0x2000000000001a, &(0x7f0000000080), &(0x7f0000000180)=0xff4b) 20:58:17 executing program 1: creat(&(0x7f0000000300)='./file0\x00', 0x0) clone(0x104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='devpts\x00', 0x0, &(0x7f0000000340)='wlan0[\x00') ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40000000000002d) wait4(0x0, 0x0, 0x0, 0x0) 20:58:17 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bc070") r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/mls\x00', 0x0, 0x0) read$eventfd(r1, &(0x7f0000000080), 0x8) 20:58:17 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @local, 0x4}, 0x1c) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f000014f000)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000780)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@mcast1, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x48, &(0x7f0000000200)={@remote}, 0x20) 20:58:17 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='illinois\x00', 0x9) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000140)=0x78, 0x4) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r0, &(0x7f0000a88f88), 0x0, 0x20000000, 0x0, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0x2000000000001a, &(0x7f0000000080), &(0x7f0000000180)=0xff4b) 20:58:17 executing program 5: capset(&(0x7f00000fc000)={0x19980330}, &(0x7f000047efe8)={0x0, 0xff, 0xffffffffffffffff}) prctl$PR_CAP_AMBIENT(0x2f, 0x2, 0x0) 20:58:17 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='illinois\x00', 0x9) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000140)=0x78, 0x4) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r0, &(0x7f0000a88f88), 0x0, 0x20000000, 0x0, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0x2000000000001a, &(0x7f0000000080), &(0x7f0000000180)=0xff4b) 20:58:17 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f319bd070") clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$EBT_SO_SET_COUNTERS(r0, 0x0, 0x81, &(0x7f0000000140)={'brou\x00', 0x0, 0x0, 0x0, [], 0x1, 0x0, 0x0, [{}]}, 0x88) [ 140.884202] devpts: called with bogus options [ 140.897015] capability: warning: `syz-executor.5' uses 32-bit capabilities (legacy support in use) 20:58:17 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f319bd070") clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$EBT_SO_SET_COUNTERS(r0, 0x0, 0x81, &(0x7f0000000140)={'brou\x00', 0x0, 0x0, 0x0, [], 0x1, 0x0, 0x0, [{}]}, 0x88) 20:58:17 executing program 5: capset(&(0x7f00000fc000)={0x19980330}, &(0x7f000047efe8)={0x0, 0xff, 0xffffffffffffffff}) prctl$PR_CAP_AMBIENT(0x2f, 0x2, 0x0) 20:58:19 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x131f64) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, 0x0, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x27) setsockopt$sock_int(r1, 0x1, 0x7, &(0x7f0000000140), 0x4) 20:58:19 executing program 3: r0 = epoll_create1(0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r2 = epoll_create1(0x0) close(r0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000780)) poll(&(0x7f0000000080)=[{r0}], 0x1, 0x3) 20:58:19 executing program 0: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) setxattr$system_posix_acl(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000100)='system.posix_acl_default\x00', &(0x7f0000000140), 0x24, 0x0) 20:58:20 executing program 1: creat(&(0x7f0000000300)='./file0\x00', 0x0) clone(0x104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='devpts\x00', 0x0, &(0x7f0000000340)='wlan0[\x00') ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40000000000002d) wait4(0x0, 0x0, 0x0, 0x0) 20:58:20 executing program 5: capset(&(0x7f00000fc000)={0x19980330}, &(0x7f000047efe8)={0x0, 0xff, 0xffffffffffffffff}) prctl$PR_CAP_AMBIENT(0x2f, 0x2, 0x0) 20:58:20 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f319bd070") clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$EBT_SO_SET_COUNTERS(r0, 0x0, 0x81, &(0x7f0000000140)={'brou\x00', 0x0, 0x0, 0x0, [], 0x1, 0x0, 0x0, [{}]}, 0x88) 20:58:20 executing program 0: open(&(0x7f0000000280)='./file0\x00', 0x41, 0x0) r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0) write$binfmt_elf64(r0, &(0x7f0000000080)=ANY=[], 0xfffffef6) rename(&(0x7f0000008500)='./file0\x00', &(0x7f00000001c0)='./file1\x00') link(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000100)='./file0\x00') 20:58:20 executing program 3: r0 = epoll_create1(0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r2 = epoll_create1(0x0) close(r0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000780)) poll(&(0x7f0000000080)=[{r0}], 0x1, 0x3) 20:58:20 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x131f64) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, 0x0, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x27) setsockopt$sock_int(r1, 0x1, 0x7, &(0x7f0000000140), 0x4) 20:58:20 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f319bd070") clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$EBT_SO_SET_COUNTERS(r0, 0x0, 0x81, &(0x7f0000000140)={'brou\x00', 0x0, 0x0, 0x0, [], 0x1, 0x0, 0x0, [{}]}, 0x88) 20:58:20 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='ip6gre0\x00', 0x10) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f0000000100)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev}, 0x1c) sendmmsg(r2, &(0x7f0000005fc0)=[{{&(0x7f0000005680)=@sco, 0x80, &(0x7f0000005b00)}}, {{&(0x7f0000005b80)=@l2, 0x80, &(0x7f0000005c40), 0x1f4, &(0x7f0000005c80), 0x3a00}}], 0x3e8, 0x0) 20:58:20 executing program 3: r0 = epoll_create1(0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r2 = epoll_create1(0x0) close(r0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000780)) poll(&(0x7f0000000080)=[{r0}], 0x1, 0x3) [ 143.915055] devpts: called with bogus options 20:58:20 executing program 5: capset(&(0x7f00000fc000)={0x19980330}, &(0x7f000047efe8)={0x0, 0xff, 0xffffffffffffffff}) prctl$PR_CAP_AMBIENT(0x2f, 0x2, 0x0) 20:58:20 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setfsgid(0x0) r0 = socket(0x1e, 0x1, 0x0) sendmsg(r0, &(0x7f00003bbfc8)={&(0x7f0000fdbf80)=@generic={0x10000000001e, "02ff0100000001000000000000000ae77f5bf86c48020002000000f1ffffff009a480075e6a50000de010300000000e4ff064b3f013a000000080000008f00000000ac50d5fe32c4000000007fffffff6a008356edb9a6341c1fd45624281e00070ecddd0206c39750c40000fd00000900000000000b0000db000004da36"}, 0x80, 0x0}, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000280)}}, 0x152610) close(0xffffffffffffffff) 20:58:20 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setfsgid(0x0) r0 = socket(0x1e, 0x1, 0x0) sendmsg(r0, &(0x7f00003bbfc8)={&(0x7f0000fdbf80)=@generic={0x10000000001e, "02ff0100000001000000000000000ae77f5bf86c48020002000000f1ffffff009a480075e6a50000de010300000000e4ff064b3f013a000000080000008f00000000ac50d5fe32c4000000007fffffff6a008356edb9a6341c1fd45624281e00070ecddd0206c39750c40000fd00000900000000000b0000db000004da36"}, 0x80, 0x0}, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000280)}}, 0x152610) close(0xffffffffffffffff) 20:58:23 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='ip6gre0\x00', 0x10) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f0000000100)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev}, 0x1c) sendmmsg(r2, &(0x7f0000005fc0)=[{{&(0x7f0000005680)=@sco, 0x80, &(0x7f0000005b00)}}, {{&(0x7f0000005b80)=@l2, 0x80, &(0x7f0000005c40), 0x1f4, &(0x7f0000005c80), 0x3a00}}], 0x3e8, 0x0) 20:58:23 executing program 3: r0 = epoll_create1(0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r2 = epoll_create1(0x0) close(r0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000780)) poll(&(0x7f0000000080)=[{r0}], 0x1, 0x3) 20:58:23 executing program 4: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setfsgid(0x0) r0 = socket(0x1e, 0x1, 0x0) sendmsg(r0, &(0x7f00003bbfc8)={&(0x7f0000fdbf80)=@generic={0x10000000001e, "02ff0100000001000000000000000ae77f5bf86c48020002000000f1ffffff009a480075e6a50000de010300000000e4ff064b3f013a000000080000008f00000000ac50d5fe32c4000000007fffffff6a008356edb9a6341c1fd45624281e00070ecddd0206c39750c40000fd00000900000000000b0000db000004da36"}, 0x80, 0x0}, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000280)}}, 0x152610) close(0xffffffffffffffff) 20:58:23 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setfsgid(0x0) r0 = socket(0x1e, 0x1, 0x0) sendmsg(r0, &(0x7f00003bbfc8)={&(0x7f0000fdbf80)=@generic={0x10000000001e, "02ff0100000001000000000000000ae77f5bf86c48020002000000f1ffffff009a480075e6a50000de010300000000e4ff064b3f013a000000080000008f00000000ac50d5fe32c4000000007fffffff6a008356edb9a6341c1fd45624281e00070ecddd0206c39750c40000fd00000900000000000b0000db000004da36"}, 0x80, 0x0}, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000280)}}, 0x152610) close(0xffffffffffffffff) 20:58:23 executing program 0: open(&(0x7f0000000280)='./file0\x00', 0x41, 0x0) r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0) write$binfmt_elf64(r0, &(0x7f0000000080)=ANY=[], 0xfffffef6) rename(&(0x7f0000008500)='./file0\x00', &(0x7f00000001c0)='./file1\x00') link(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000100)='./file0\x00') 20:58:23 executing program 1: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setfsgid(0x0) r0 = socket(0x1e, 0x1, 0x0) sendmsg(r0, &(0x7f00003bbfc8)={&(0x7f0000fdbf80)=@generic={0x10000000001e, "02ff0100000001000000000000000ae77f5bf86c48020002000000f1ffffff009a480075e6a50000de010300000000e4ff064b3f013a000000080000008f00000000ac50d5fe32c4000000007fffffff6a008356edb9a6341c1fd45624281e00070ecddd0206c39750c40000fd00000900000000000b0000db000004da36"}, 0x80, 0x0}, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000280)}}, 0x152610) close(0xffffffffffffffff) 20:58:23 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r1, &(0x7f0000000000), 0x1c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = dup2(r1, r2) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000000), 0x10e755) clone(0x300, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$inet6_tcp_int(r1, 0x6, 0x8, &(0x7f0000000080), 0x108) getsockopt$inet6_tcp_buf(r1, 0x6, 0x1c, 0x0, &(0x7f0000000140)) 20:58:23 executing program 4: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setfsgid(0x0) r0 = socket(0x1e, 0x1, 0x0) sendmsg(r0, &(0x7f00003bbfc8)={&(0x7f0000fdbf80)=@generic={0x10000000001e, "02ff0100000001000000000000000ae77f5bf86c48020002000000f1ffffff009a480075e6a50000de010300000000e4ff064b3f013a000000080000008f00000000ac50d5fe32c4000000007fffffff6a008356edb9a6341c1fd45624281e00070ecddd0206c39750c40000fd00000900000000000b0000db000004da36"}, 0x80, 0x0}, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000280)}}, 0x152610) close(0xffffffffffffffff) 20:58:23 executing program 1: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setfsgid(0x0) r0 = socket(0x1e, 0x1, 0x0) sendmsg(r0, &(0x7f00003bbfc8)={&(0x7f0000fdbf80)=@generic={0x10000000001e, "02ff0100000001000000000000000ae77f5bf86c48020002000000f1ffffff009a480075e6a50000de010300000000e4ff064b3f013a000000080000008f00000000ac50d5fe32c4000000007fffffff6a008356edb9a6341c1fd45624281e00070ecddd0206c39750c40000fd00000900000000000b0000db000004da36"}, 0x80, 0x0}, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000280)}}, 0x152610) close(0xffffffffffffffff) 20:58:23 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setfsgid(0x0) r0 = socket(0x1e, 0x1, 0x0) sendmsg(r0, &(0x7f00003bbfc8)={&(0x7f0000fdbf80)=@generic={0x10000000001e, "02ff0100000001000000000000000ae77f5bf86c48020002000000f1ffffff009a480075e6a50000de010300000000e4ff064b3f013a000000080000008f00000000ac50d5fe32c4000000007fffffff6a008356edb9a6341c1fd45624281e00070ecddd0206c39750c40000fd00000900000000000b0000db000004da36"}, 0x80, 0x0}, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000280)}}, 0x152610) close(0xffffffffffffffff) [ 147.238666] ================================================================== [ 147.246252] BUG: KASAN: use-after-free in refcount_inc_not_zero+0xd3/0xe0 [ 147.253183] Read of size 4 at addr ffff8880a92d4f00 by task kworker/u4:5/6942 [ 147.260458] [ 147.262089] CPU: 1 PID: 6942 Comm: kworker/u4:5 Not tainted 4.14.113 #3 [ 147.268934] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 147.278305] Workqueue: tipc_rcv tipc_recv_work [ 147.282977] Call Trace: [ 147.285568] dump_stack+0x138/0x19c [ 147.289203] ? refcount_inc_not_zero+0xd3/0xe0 [ 147.293797] print_address_description.cold+0x7c/0x1dc [ 147.299108] ? refcount_inc_not_zero+0xd3/0xe0 [ 147.303696] kasan_report.cold+0xaf/0x2b5 [ 147.307844] __asan_report_load4_noabort+0x14/0x20 [ 147.312774] refcount_inc_not_zero+0xd3/0xe0 [ 147.317189] refcount_inc+0x16/0x40 [ 147.320841] tipc_subscrb_rcv_cb+0x61d/0xa80 [ 147.325256] tipc_receive_from_sock+0x28a/0x4e0 [ 147.329950] ? trace_hardirqs_on+0x10/0x10 [ 147.334181] ? tipc_send_work+0x5a0/0x5a0 20:58:23 executing program 4: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setfsgid(0x0) r0 = socket(0x1e, 0x1, 0x0) sendmsg(r0, &(0x7f00003bbfc8)={&(0x7f0000fdbf80)=@generic={0x10000000001e, "02ff0100000001000000000000000ae77f5bf86c48020002000000f1ffffff009a480075e6a50000de010300000000e4ff064b3f013a000000080000008f00000000ac50d5fe32c4000000007fffffff6a008356edb9a6341c1fd45624281e00070ecddd0206c39750c40000fd00000900000000000b0000db000004da36"}, 0x80, 0x0}, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000280)}}, 0x152610) close(0xffffffffffffffff) [ 147.334207] ? process_one_work+0x787/0x1610 [ 147.334222] ? __lock_is_held+0xb6/0x140 [ 147.334231] ? check_preemption_disabled+0x3c/0x250 [ 147.334239] tipc_recv_work+0x8b/0xf0 [ 147.334248] process_one_work+0x868/0x1610 [ 147.334259] ? pwq_dec_nr_in_flight+0x2e0/0x2e0 [ 147.334270] worker_thread+0x5d9/0x1050 [ 147.334285] kthread+0x31c/0x430 [ 147.334291] ? process_one_work+0x1610/0x1610 [ 147.342960] ? kthread_create_on_node+0xd0/0xd0 [ 147.342972] ret_from_fork+0x3a/0x50 [ 147.342987] [ 147.342992] Allocated by task 2765: [ 147.343003] save_stack_trace+0x16/0x20 [ 147.343010] save_stack+0x45/0xd0 [ 147.343016] kasan_kmalloc+0xce/0xf0 [ 147.343023] kmem_cache_alloc_trace+0x152/0x790 [ 147.343034] tipc_subscrb_connect_cb+0x46/0x160 [ 147.343040] tipc_accept_from_sock+0x280/0x470 [ 147.343045] tipc_recv_work+0x8b/0xf0 [ 147.343052] process_one_work+0x868/0x1610 [ 147.343059] worker_thread+0x5d9/0x1050 [ 147.428263] kthread+0x31c/0x430 [ 147.431634] ret_from_fork+0x3a/0x50 [ 147.435440] 20:58:23 executing program 4: clone(0x2000000c00ffff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x200008001fffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000000)=0x2, 0x0, 0x40000000002, 0x0, 0x0, 0x0) tkill(r0, 0x39) [ 147.437070] Freed by task 2765: [ 147.440443] save_stack_trace+0x16/0x20 [ 147.444407] save_stack+0x45/0xd0 [ 147.444414] kasan_slab_free+0x75/0xc0 [ 147.444418] kfree+0xcc/0x270 [ 147.444427] tipc_subscrb_put+0x27/0x30 [ 147.444433] tipc_subscrb_release_cb+0x20/0x30 [ 147.444440] tipc_close_conn+0x179/0x210 [ 147.444445] tipc_send_work+0x470/0x5a0 [ 147.444451] process_one_work+0x868/0x1610 [ 147.444457] worker_thread+0x5d9/0x1050 [ 147.444464] kthread+0x31c/0x430 [ 147.448601] kobject: 'loop4' (ffff8880a4ad0960): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 147.451778] ret_from_fork+0x3a/0x50 [ 147.451781] [ 147.451787] The buggy address belongs to the object at ffff8880a92d4f00 [ 147.451787] which belongs to the cache kmalloc-96 of size 96 [ 147.451794] The buggy address is located 0 bytes inside of [ 147.451794] 96-byte region [ffff8880a92d4f00, ffff8880a92d4f60) [ 147.451797] The buggy address belongs to the page: [ 147.451804] page:ffffea0002a4b500 count:1 mapcount:0 mapping:ffff8880a92d4000 index:0x0 [ 147.451812] flags: 0x1fffc0000000100(slab) [ 147.451824] raw: 01fffc0000000100 ffff8880a92d4000 0000000000000000 0000000100000020 [ 147.451832] raw: ffffea0002a5d060 ffffea0002939ce0 ffff8880aa8004c0 0000000000000000 [ 147.451836] page dumped because: kasan: bad access detected [ 147.451838] [ 147.451841] Memory state around the buggy address: [ 147.451847] ffff8880a92d4e00: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 147.451852] ffff8880a92d4e80: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 147.451863] >ffff8880a92d4f00: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 147.451866] ^ [ 147.451872] ffff8880a92d4f80: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc [ 147.451876] ffff8880a92d5000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 147.451879] ================================================================== [ 147.451882] Disabling lock debugging due to kernel taint [ 147.451910] Kernel panic - not syncing: panic_on_warn set ... [ 147.451910] [ 147.631080] CPU: 1 PID: 6942 Comm: kworker/u4:5 Tainted: G B 4.14.113 #3 [ 147.639023] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 147.648799] Workqueue: tipc_rcv tipc_recv_work [ 147.653364] Call Trace: [ 147.655935] dump_stack+0x138/0x19c [ 147.659548] ? refcount_inc_not_zero+0xd3/0xe0 [ 147.664114] panic+0x1f2/0x438 [ 147.667291] ? add_taint.cold+0x16/0x16 [ 147.671516] kasan_end_report+0x47/0x4f [ 147.675476] kasan_report.cold+0x136/0x2b5 [ 147.679686] __asan_report_load4_noabort+0x14/0x20 [ 147.684595] refcount_inc_not_zero+0xd3/0xe0 [ 147.689007] refcount_inc+0x16/0x40 [ 147.692618] tipc_subscrb_rcv_cb+0x61d/0xa80 [ 147.697008] tipc_receive_from_sock+0x28a/0x4e0 [ 147.701665] ? trace_hardirqs_on+0x10/0x10 [ 147.705898] ? tipc_send_work+0x5a0/0x5a0 [ 147.710040] ? process_one_work+0x787/0x1610 [ 147.714536] ? __lock_is_held+0xb6/0x140 [ 147.718636] ? check_preemption_disabled+0x3c/0x250 [ 147.723809] tipc_recv_work+0x8b/0xf0 [ 147.727600] process_one_work+0x868/0x1610 [ 147.731823] ? pwq_dec_nr_in_flight+0x2e0/0x2e0 [ 147.736470] worker_thread+0x5d9/0x1050 [ 147.740424] kthread+0x31c/0x430 [ 147.743778] ? process_one_work+0x1610/0x1610 [ 147.748250] ? kthread_create_on_node+0xd0/0xd0 [ 147.752910] ret_from_fork+0x3a/0x50 [ 147.757123] Kernel Offset: disabled [ 147.760859] Rebooting in 86400 seconds..