Warning: Permanently added '10.128.10.40' (ECDSA) to the list of known hosts.
2019/10/11 02:48:40 fuzzer started
2019/10/11 02:48:42 dialing manager at 10.128.0.105:37331
2019/10/11 02:48:42 syscalls: 2523
2019/10/11 02:48:42 code coverage: enabled
2019/10/11 02:48:42 comparison tracing: enabled
2019/10/11 02:48:42 extra coverage: extra coverage is not supported by the kernel
2019/10/11 02:48:42 setuid sandbox: enabled
2019/10/11 02:48:42 namespace sandbox: enabled
2019/10/11 02:48:42 Android sandbox: /sys/fs/selinux/policy does not exist
2019/10/11 02:48:42 fault injection: enabled
2019/10/11 02:48:42 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled
2019/10/11 02:48:42 net packet injection: enabled
2019/10/11 02:48:42 net device setup: enabled
2019/10/11 02:48:42 concurrency sanitizer: enabled
02:48:46 executing program 0:
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x8003, &(0x7f0000000300)=0x75f, 0x9)
fcntl$getownex(0xffffffffffffffff, 0x10, 0x0)
r0 = syz_open_dev$vbi(&(0x7f00000001c0)='/dev/vbi#\x00', 0x1, 0x2)
r1 = memfd_create(&(0x7f0000000200)='-vboxnet0\x00]\xea\xb0\xe2N\xc6c\x05\x8d\xb5\xc0\n\xad\x0f#+\x17\xd6A\xf4\xdf\x1b\xf9~\x8e\"\r\xff\xbb\xb0\xc3\x86\x97\xaf\xf8\x7f*\xfc\xfd\xe7\xcc\xbc\xddI.\xc3\x9aQ\xc8\x8e8U\xdaX\x06\x92\x1d\xbd\x10\xf9\xe8q\x00\xddr>\xd7\x9f\xf8r\xeeE\xa83K\xf60 \x7f\xcd\xac\x86\x9eT*\xf7\a^L,\x98\xa2(2,\x8c*\xff\x8aA\xa1\x15<g8\xddGdF(\xeaN\xbcSoz\xe5.c\xdf\x8b\xd2m}\xc7D\x98\xd4p.e\x050,c9:\x95z\xe2\xa9\xcf\xd2\x90*\xaa\xc0W.\xcb|.F_\xf8(\xa4\x91\xc8\v\x9b>3\x15\b\xcb\xf7\xefw\xa6\xc7c@\xb5\x9b\xdc$`3]\xf9.\xcf\x00'/203, 0x0)
ftruncate(r1, 0x1000000)
sendfile(r0, r1, &(0x7f00000000c0)=0xf18001, 0xeefffdef)

syzkaller login: [   49.170630][ T7268] IPVS: ftp: loaded support on port[0] = 21
02:48:46 executing program 1:
socket$alg(0x26, 0x5, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
r1 = socket(0x1, 0x5, 0x0)
getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000001c0)={0x0, <r2=>0x0}, &(0x7f0000000200)=0x5)
setreuid(0x0, r2)
r3 = add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff)
add_key$keyring(&(0x7f0000000100)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, r3)

[   49.257997][ T7268] chnl_net:caif_netlink_parms(): no params data found
[   49.303244][ T7268] bridge0: port 1(bridge_slave_0) entered blocking state
[   49.310917][ T7268] bridge0: port 1(bridge_slave_0) entered disabled state
[   49.320280][ T7268] device bridge_slave_0 entered promiscuous mode
[   49.328252][ T7268] bridge0: port 2(bridge_slave_1) entered blocking state
[   49.336464][ T7268] bridge0: port 2(bridge_slave_1) entered disabled state
[   49.344886][ T7268] device bridge_slave_1 entered promiscuous mode
[   49.387150][ T7268] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   49.406255][ T7268] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   49.457406][ T7268] team0: Port device team_slave_0 added
[   49.464249][ T7268] team0: Port device team_slave_1 added
02:48:46 executing program 2:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x1)
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0x1)

[   49.557514][ T7268] device hsr_slave_0 entered promiscuous mode
[   49.624916][ T7268] device hsr_slave_1 entered promiscuous mode
[   49.672788][ T7268] bridge0: port 2(bridge_slave_1) entered blocking state
[   49.680031][ T7268] bridge0: port 2(bridge_slave_1) entered forwarding state
[   49.687384][ T7268] bridge0: port 1(bridge_slave_0) entered blocking state
[   49.694483][ T7268] bridge0: port 1(bridge_slave_0) entered forwarding state
[   49.757221][ T7271] IPVS: ftp: loaded support on port[0] = 21
[   49.850149][ T7268] 8021q: adding VLAN 0 to HW filter on device bond0
[   49.878372][ T7273] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
02:48:46 executing program 3:
r0 = open(&(0x7f0000000300)='./bus\x00', 0x141042, 0x0)
close(r0)
r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(r1, 0x4, 0x42000)
r2 = io_uring_setup(0xf2a, &(0x7f0000002740)={0x0, 0x0, 0x1})
io_uring_enter(r2, 0x0, 0x3, 0x1, 0x0, 0x0)
syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x100000000, 0x0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60)
ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
open_by_handle_at(r4, &(0x7f00000000c0)={0x7b, 0x80000001, "ebe83475bb318d95af1103c0fe07daf1211b64dc4ee5fdb29256a2e4cd63502c2e306f7ec1a253bad7c625c89a2a46552aceb306a69c0daaff4495650c446c7fe7e08f6d6289ecbc5271e9e5c780dacb7fc3ae3b0d5dbb7911600f1fcf9ef14ab0edc435cea47fa76246f7418be158c1f28075"}, 0x2400)

[   49.896087][ T7273] bridge0: port 1(bridge_slave_0) entered disabled state
[   49.915055][ T7273] bridge0: port 2(bridge_slave_1) entered disabled state
[   49.932419][ T7273] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
[   49.952865][ T7268] 8021q: adding VLAN 0 to HW filter on device team0
[   49.992873][    T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[   49.997613][ T7275] IPVS: ftp: loaded support on port[0] = 21
[   50.002906][    T5] bridge0: port 1(bridge_slave_0) entered blocking state
[   50.013919][    T5] bridge0: port 1(bridge_slave_0) entered forwarding state
[   50.068782][ T7273] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[   50.082692][ T7273] bridge0: port 2(bridge_slave_1) entered blocking state
[   50.089852][ T7273] bridge0: port 2(bridge_slave_1) entered forwarding state
[   50.167511][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[   50.186038][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[   50.227988][ T7273] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[   50.236658][ T7273] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[   50.264164][ T7268] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   50.277185][ T7278] IPVS: ftp: loaded support on port[0] = 21
[   50.290607][ T7268] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[   50.299117][ T7271] chnl_net:caif_netlink_parms(): no params data found
[   50.316444][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[   50.355014][ T7268] 8021q: adding VLAN 0 to HW filter on device batadv0
[   50.458011][ T7271] bridge0: port 1(bridge_slave_0) entered blocking state
[   50.466223][ T7271] bridge0: port 1(bridge_slave_0) entered disabled state
[   50.474236][ T7271] device bridge_slave_0 entered promiscuous mode
[   50.483994][ T7271] bridge0: port 2(bridge_slave_1) entered blocking state
[   50.491592][ T7271] bridge0: port 2(bridge_slave_1) entered disabled state
[   50.501499][ T7271] device bridge_slave_1 entered promiscuous mode
[   50.551760][ T7275] chnl_net:caif_netlink_parms(): no params data found
02:48:47 executing program 4:
syz_open_dev$sndseq(&(0x7f00000003c0)='/dev/snd/seq\x00', 0x0, 0x0)
r0 = syz_open_dev$sndseq(0x0, 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x404c534a, &(0x7f00000000c0)={0x0, 0x0, 0x20000006, {0x0, 0x989680}})

[   50.624298][ T7271] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   50.666328][ T7271] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   50.704829][    C0] hrtimer: interrupt took 33917 ns
[   50.726655][ T7275] bridge0: port 1(bridge_slave_0) entered blocking state
[   50.733734][ T7275] bridge0: port 1(bridge_slave_0) entered disabled state
[   50.755569][ T7275] device bridge_slave_0 entered promiscuous mode
[   50.775285][ T7275] bridge0: port 2(bridge_slave_1) entered blocking state
[   50.782384][ T7275] bridge0: port 2(bridge_slave_1) entered disabled state
[   50.805501][ T7275] device bridge_slave_1 entered promiscuous mode
[   50.823346][ T7271] team0: Port device team_slave_0 added
[   50.835704][ T7271] team0: Port device team_slave_1 added
[   50.897900][ T7275] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   50.997692][ T7271] device hsr_slave_0 entered promiscuous mode
[   51.044995][ T7271] device hsr_slave_1 entered promiscuous mode
[   51.086814][ T7271] debugfs: Directory 'hsr0' with parent '/' already present!
[   51.098896][ T7275] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   51.122437][ T7271] bridge0: port 2(bridge_slave_1) entered blocking state
[   51.123875][ T7291] IPVS: ftp: loaded support on port[0] = 21
02:48:48 executing program 5:
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071")
mmap(&(0x7f0000196000/0x4000)=nil, 0x4000, 0x0, 0x4032, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000194000/0x5000)=nil, 0x5000, 0xffffffffefffffff, 0x8032, 0xffffffffffffffff, 0x0)

[   51.129574][ T7271] bridge0: port 2(bridge_slave_1) entered forwarding state
[   51.129669][ T7271] bridge0: port 1(bridge_slave_0) entered blocking state
[   51.149794][ T7271] bridge0: port 1(bridge_slave_0) entered forwarding state
[   51.168453][ T7278] chnl_net:caif_netlink_parms(): no params data found
[   51.193956][ T7275] team0: Port device team_slave_0 added
[   51.209603][ T7275] team0: Port device team_slave_1 added
[   51.337930][ T7275] device hsr_slave_0 entered promiscuous mode
[   51.374912][ T7275] device hsr_slave_1 entered promiscuous mode
[   51.425520][ T7275] debugfs: Directory 'hsr0' with parent '/' already present!
[   51.445980][   T17] bridge0: port 1(bridge_slave_0) entered disabled state
[   51.464977][   T17] bridge0: port 2(bridge_slave_1) entered disabled state
02:48:48 executing program 0:
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x8003, &(0x7f0000000300)=0x75f, 0x9)
fcntl$getownex(0xffffffffffffffff, 0x10, 0x0)
r0 = syz_open_dev$vbi(&(0x7f00000001c0)='/dev/vbi#\x00', 0x1, 0x2)
r1 = memfd_create(&(0x7f0000000200)='-vboxnet0\x00]\xea\xb0\xe2N\xc6c\x05\x8d\xb5\xc0\n\xad\x0f#+\x17\xd6A\xf4\xdf\x1b\xf9~\x8e\"\r\xff\xbb\xb0\xc3\x86\x97\xaf\xf8\x7f*\xfc\xfd\xe7\xcc\xbc\xddI.\xc3\x9aQ\xc8\x8e8U\xdaX\x06\x92\x1d\xbd\x10\xf9\xe8q\x00\xddr>\xd7\x9f\xf8r\xeeE\xa83K\xf60 \x7f\xcd\xac\x86\x9eT*\xf7\a^L,\x98\xa2(2,\x8c*\xff\x8aA\xa1\x15<g8\xddGdF(\xeaN\xbcSoz\xe5.c\xdf\x8b\xd2m}\xc7D\x98\xd4p.e\x050,c9:\x95z\xe2\xa9\xcf\xd2\x90*\xaa\xc0W.\xcb|.F_\xf8(\xa4\x91\xc8\v\x9b>3\x15\b\xcb\xf7\xefw\xa6\xc7c@\xb5\x9b\xdc$`3]\xf9.\xcf\x00'/203, 0x0)
ftruncate(r1, 0x1000000)
sendfile(r0, r1, &(0x7f00000000c0)=0xf18001, 0xeefffdef)

[   51.499353][ T7293] IPVS: ftp: loaded support on port[0] = 21
[   51.518371][ T7278] bridge0: port 1(bridge_slave_0) entered blocking state
[   51.526239][ T7278] bridge0: port 1(bridge_slave_0) entered disabled state
[   51.534400][ T7278] device bridge_slave_0 entered promiscuous mode
[   51.623853][ T7278] bridge0: port 2(bridge_slave_1) entered blocking state
[   51.633450][ T7278] bridge0: port 2(bridge_slave_1) entered disabled state
[   51.642705][ T7278] device bridge_slave_1 entered promiscuous mode
[   51.690245][ T7278] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   51.702961][ T7291] chnl_net:caif_netlink_parms(): no params data found
[   51.723207][ T7271] 8021q: adding VLAN 0 to HW filter on device bond0
[   51.732132][ T7278] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   51.750986][ T7275] 8021q: adding VLAN 0 to HW filter on device bond0
[   51.770751][ T7271] 8021q: adding VLAN 0 to HW filter on device team0
[   51.801932][ T7278] team0: Port device team_slave_0 added
[   51.808735][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[   51.816948][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[   51.828655][ T7275] 8021q: adding VLAN 0 to HW filter on device team0
[   51.847209][ T7278] team0: Port device team_slave_1 added
[   51.853596][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[   51.861736][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[   51.896103][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[   51.906678][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[   51.915124][ T3023] bridge0: port 1(bridge_slave_0) entered blocking state
[   51.922171][ T3023] bridge0: port 1(bridge_slave_0) entered forwarding state
[   51.930535][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[   51.939313][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[   51.951828][ T3023] bridge0: port 2(bridge_slave_1) entered blocking state
[   51.959023][ T3023] bridge0: port 2(bridge_slave_1) entered forwarding state
[   51.966904][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[   51.975774][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[   51.984321][ T3023] bridge0: port 1(bridge_slave_0) entered blocking state
[   51.991392][ T3023] bridge0: port 1(bridge_slave_0) entered forwarding state
[   52.002911][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[   52.012076][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[   52.020832][ T3023] bridge0: port 2(bridge_slave_1) entered blocking state
[   52.027929][ T3023] bridge0: port 2(bridge_slave_1) entered forwarding state
[   52.035916][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[   52.045424][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[   52.055101][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[   52.063865][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[   52.110764][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[   52.119269][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[   52.127903][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[   52.137304][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[   52.147167][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[   52.160197][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[   52.169858][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[   52.178675][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[   52.187870][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[   52.196516][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[   52.205127][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[   52.213673][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[   52.233875][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[   52.248711][ T7291] bridge0: port 1(bridge_slave_0) entered blocking state
[   52.255862][ T7291] bridge0: port 1(bridge_slave_0) entered disabled state
[   52.263925][ T7291] device bridge_slave_0 entered promiscuous mode
[   52.326963][ T7278] device hsr_slave_0 entered promiscuous mode
[   52.365051][ T7278] device hsr_slave_1 entered promiscuous mode
02:48:49 executing program 0:
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x8003, &(0x7f0000000300)=0x75f, 0x9)
fcntl$getownex(0xffffffffffffffff, 0x10, 0x0)
r0 = syz_open_dev$vbi(&(0x7f00000001c0)='/dev/vbi#\x00', 0x1, 0x2)
r1 = memfd_create(&(0x7f0000000200)='-vboxnet0\x00]\xea\xb0\xe2N\xc6c\x05\x8d\xb5\xc0\n\xad\x0f#+\x17\xd6A\xf4\xdf\x1b\xf9~\x8e\"\r\xff\xbb\xb0\xc3\x86\x97\xaf\xf8\x7f*\xfc\xfd\xe7\xcc\xbc\xddI.\xc3\x9aQ\xc8\x8e8U\xdaX\x06\x92\x1d\xbd\x10\xf9\xe8q\x00\xddr>\xd7\x9f\xf8r\xeeE\xa83K\xf60 \x7f\xcd\xac\x86\x9eT*\xf7\a^L,\x98\xa2(2,\x8c*\xff\x8aA\xa1\x15<g8\xddGdF(\xeaN\xbcSoz\xe5.c\xdf\x8b\xd2m}\xc7D\x98\xd4p.e\x050,c9:\x95z\xe2\xa9\xcf\xd2\x90*\xaa\xc0W.\xcb|.F_\xf8(\xa4\x91\xc8\v\x9b>3\x15\b\xcb\xf7\xefw\xa6\xc7c@\xb5\x9b\xdc$`3]\xf9.\xcf\x00'/203, 0x0)
ftruncate(r1, 0x1000000)
sendfile(r0, r1, &(0x7f00000000c0)=0xf18001, 0xeefffdef)

[   52.404576][ T7278] debugfs: Directory 'hsr0' with parent '/' already present!
[   52.426099][ T7291] bridge0: port 2(bridge_slave_1) entered blocking state
[   52.433243][ T7291] bridge0: port 2(bridge_slave_1) entered disabled state
[   52.446290][ T7291] device bridge_slave_1 entered promiscuous mode
[   52.466139][   T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[   52.480069][   T43] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[   52.509962][   T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[   52.518740][   T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[   52.532478][ T7271] 8021q: adding VLAN 0 to HW filter on device batadv0
[   52.556727][ T7275] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   52.569158][ T7275] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[   52.584014][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[   52.592807][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[   52.618793][ T7275] 8021q: adding VLAN 0 to HW filter on device batadv0
[   52.641715][ T7291] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   52.656200][ T7291] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   52.666764][ T7293] chnl_net:caif_netlink_parms(): no params data found
[   52.800932][ T7293] bridge0: port 1(bridge_slave_0) entered blocking state
[   52.837110][ T7293] bridge0: port 1(bridge_slave_0) entered disabled state
02:48:49 executing program 1:
socket$alg(0x26, 0x5, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
r1 = socket(0x1, 0x5, 0x0)
getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000001c0)={0x0, <r2=>0x0}, &(0x7f0000000200)=0x5)
setreuid(0x0, r2)
r3 = add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff)
add_key$keyring(&(0x7f0000000100)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, r3)

[   52.853231][ T7293] device bridge_slave_0 entered promiscuous mode
[   52.876306][ T7278] 8021q: adding VLAN 0 to HW filter on device bond0
[   52.905820][ T7291] team0: Port device team_slave_0 added
[   52.928039][ T7291] team0: Port device team_slave_1 added
[   52.935747][ T7293] bridge0: port 2(bridge_slave_1) entered blocking state
[   52.942869][ T7293] bridge0: port 2(bridge_slave_1) entered disabled state
[   52.951114][ T7293] device bridge_slave_1 entered promiscuous mode
[   52.964299][ T7278] 8021q: adding VLAN 0 to HW filter on device team0
[   53.018974][   T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[   53.036964][   T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
02:48:50 executing program 1:
socket$alg(0x26, 0x5, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
r1 = socket(0x1, 0x5, 0x0)
getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000001c0)={0x0, <r2=>0x0}, &(0x7f0000000200)=0x5)
setreuid(0x0, r2)
r3 = add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff)
add_key$keyring(&(0x7f0000000100)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, r3)

[   53.117457][ T7291] device hsr_slave_0 entered promiscuous mode
[   53.164964][ T7291] device hsr_slave_1 entered promiscuous mode
[   53.194616][ T7291] debugfs: Directory 'hsr0' with parent '/' already present!
[   53.202273][    T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[   53.236476][    T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[   53.282161][    T5] bridge0: port 1(bridge_slave_0) entered blocking state
[   53.290020][    T5] bridge0: port 1(bridge_slave_0) entered forwarding state
02:48:50 executing program 0:
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
set_mempolicy(0x8003, &(0x7f0000000300)=0x75f, 0x9)
fcntl$getownex(0xffffffffffffffff, 0x10, 0x0)
r0 = syz_open_dev$vbi(&(0x7f00000001c0)='/dev/vbi#\x00', 0x1, 0x2)
r1 = memfd_create(&(0x7f0000000200)='-vboxnet0\x00]\xea\xb0\xe2N\xc6c\x05\x8d\xb5\xc0\n\xad\x0f#+\x17\xd6A\xf4\xdf\x1b\xf9~\x8e\"\r\xff\xbb\xb0\xc3\x86\x97\xaf\xf8\x7f*\xfc\xfd\xe7\xcc\xbc\xddI.\xc3\x9aQ\xc8\x8e8U\xdaX\x06\x92\x1d\xbd\x10\xf9\xe8q\x00\xddr>\xd7\x9f\xf8r\xeeE\xa83K\xf60 \x7f\xcd\xac\x86\x9eT*\xf7\a^L,\x98\xa2(2,\x8c*\xff\x8aA\xa1\x15<g8\xddGdF(\xeaN\xbcSoz\xe5.c\xdf\x8b\xd2m}\xc7D\x98\xd4p.e\x050,c9:\x95z\xe2\xa9\xcf\xd2\x90*\xaa\xc0W.\xcb|.F_\xf8(\xa4\x91\xc8\v\x9b>3\x15\b\xcb\xf7\xefw\xa6\xc7c@\xb5\x9b\xdc$`3]\xf9.\xcf\x00'/203, 0x0)
ftruncate(r1, 0x1000000)
sendfile(r0, r1, &(0x7f00000000c0)=0xf18001, 0xeefffdef)

[   53.400327][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[   53.426856][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[   53.470970][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[   53.511774][ T3023] bridge0: port 2(bridge_slave_1) entered blocking state
[   53.518944][ T3023] bridge0: port 2(bridge_slave_1) entered forwarding state
02:48:50 executing program 1:
socket$alg(0x26, 0x5, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
r1 = socket(0x1, 0x5, 0x0)
getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000001c0)={0x0, <r2=>0x0}, &(0x7f0000000200)=0x5)
setreuid(0x0, r2)
r3 = add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff)
add_key$keyring(&(0x7f0000000100)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, r3)

[   53.603409][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[   53.669708][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[   53.721644][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[   53.752850][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[   53.778582][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[   53.817862][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[   53.856171][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[   53.896745][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[   53.931958][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[   53.977427][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[   54.000692][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[   54.028880][ T7293] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   54.070654][ T7278] 8021q: adding VLAN 0 to HW filter on device batadv0
[   54.117730][ T7293] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
02:48:51 executing program 1:
socket$alg(0x26, 0x5, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
r1 = socket(0x1, 0x5, 0x0)
getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000001c0)={0x0, <r2=>0x0}, &(0x7f0000000200)=0x5)
setreuid(0x0, r2)
r3 = add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff)
add_key$keyring(&(0x7f0000000100)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, r3)

[   54.273654][ T7291] 8021q: adding VLAN 0 to HW filter on device bond0
[   54.345896][ T7293] team0: Port device team_slave_0 added
[   54.376866][   T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[   54.409501][   T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[   54.476422][ T7293] team0: Port device team_slave_1 added
[   54.483082][ T7291] 8021q: adding VLAN 0 to HW filter on device team0
[   54.677286][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[   54.697483][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[   54.740082][ T3023] bridge0: port 1(bridge_slave_0) entered blocking state
[   54.747226][ T3023] bridge0: port 1(bridge_slave_0) entered forwarding state
[   54.835389][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[   54.895328][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[   54.925086][ T3023] bridge0: port 2(bridge_slave_1) entered blocking state
[   54.932206][ T3023] bridge0: port 2(bridge_slave_1) entered forwarding state
02:48:52 executing program 1:
socket$alg(0x26, 0x5, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
r1 = socket(0x1, 0x5, 0x0)
getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000001c0)={0x0, <r2=>0x0}, &(0x7f0000000200)=0x5)
setreuid(0x0, r2)
r3 = add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff)
add_key$keyring(&(0x7f0000000100)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, r3)

02:48:52 executing program 2:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x1)
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0x1)

[   54.966321][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[   55.031149][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[   55.067458][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[   55.096973][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[   55.129075][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[   55.158596][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[   55.189301][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[   55.216233][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[   55.246214][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[   55.272488][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[   55.347320][ T7291] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   55.431482][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[   55.475360][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[   55.577529][ T7293] device hsr_slave_0 entered promiscuous mode
[   55.618521][ T7293] device hsr_slave_1 entered promiscuous mode
[   55.704961][ T7293] debugfs: Directory 'hsr0' with parent '/' already present!
[   55.770598][ T7291] 8021q: adding VLAN 0 to HW filter on device batadv0
[   56.020062][ T7293] 8021q: adding VLAN 0 to HW filter on device bond0
[   56.132082][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[   56.150337][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[   56.236207][ T7293] 8021q: adding VLAN 0 to HW filter on device team0
[   56.304889][ T7273] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[   56.314179][ T7273] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[   56.402858][ T7273] bridge0: port 1(bridge_slave_0) entered blocking state
[   56.410534][ T7273] bridge0: port 1(bridge_slave_0) entered forwarding state
[   56.529162][ T7273] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[   56.605349][ T7273] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[   56.614326][ T7273] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[   56.729753][ T7273] bridge0: port 2(bridge_slave_1) entered blocking state
[   56.737062][ T7273] bridge0: port 2(bridge_slave_1) entered forwarding state
02:48:53 executing program 3:
r0 = open(&(0x7f0000000300)='./bus\x00', 0x141042, 0x0)
close(r0)
r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(r1, 0x4, 0x42000)
r2 = io_uring_setup(0xf2a, &(0x7f0000002740)={0x0, 0x0, 0x1})
io_uring_enter(r2, 0x0, 0x3, 0x1, 0x0, 0x0)
syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x100000000, 0x0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60)
ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
open_by_handle_at(r4, &(0x7f00000000c0)={0x7b, 0x80000001, "ebe83475bb318d95af1103c0fe07daf1211b64dc4ee5fdb29256a2e4cd63502c2e306f7ec1a253bad7c625c89a2a46552aceb306a69c0daaff4495650c446c7fe7e08f6d6289ecbc5271e9e5c780dacb7fc3ae3b0d5dbb7911600f1fcf9ef14ab0edc435cea47fa76246f7418be158c1f28075"}, 0x2400)

[   56.825952][ T7273] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[   56.879348][ T7273] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
02:48:53 executing program 4:
syz_open_dev$sndseq(&(0x7f00000003c0)='/dev/snd/seq\x00', 0x0, 0x0)
r0 = syz_open_dev$sndseq(0x0, 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x404c534a, &(0x7f00000000c0)={0x0, 0x0, 0x20000006, {0x0, 0x989680}})

[   56.948249][ T7273] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[   57.055252][ T7273] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[   57.101125][ T7273] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[   57.165559][ T7273] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[   57.166764][ T7427] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details.
[   57.253056][ T7273] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[   57.314900][ T7273] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[   57.341541][ T7273] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[   57.379216][ T7273] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[   57.476906][ T7293] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[   57.510040][ T3023] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[   57.607126][ T7293] 8021q: adding VLAN 0 to HW filter on device batadv0
02:48:55 executing program 5:
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071")
mmap(&(0x7f0000196000/0x4000)=nil, 0x4000, 0x0, 0x4032, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000194000/0x5000)=nil, 0x5000, 0xffffffffefffffff, 0x8032, 0xffffffffffffffff, 0x0)

02:48:55 executing program 1:
socket$alg(0x26, 0x5, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
r1 = socket(0x1, 0x5, 0x0)
getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000001c0)={0x0, <r2=>0x0}, &(0x7f0000000200)=0x5)
setreuid(0x0, r2)
r3 = add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff)
add_key$keyring(&(0x7f0000000100)='keyring\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, r3)

02:48:55 executing program 2:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x1)
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0x1)

02:48:55 executing program 4:
syz_open_dev$sndseq(&(0x7f00000003c0)='/dev/snd/seq\x00', 0x0, 0x0)
r0 = syz_open_dev$sndseq(0x0, 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x404c534a, &(0x7f00000000c0)={0x0, 0x0, 0x20000006, {0x0, 0x989680}})

02:48:55 executing program 3:
r0 = open(&(0x7f0000000300)='./bus\x00', 0x141042, 0x0)
close(r0)
r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(r1, 0x4, 0x42000)
r2 = io_uring_setup(0xf2a, &(0x7f0000002740)={0x0, 0x0, 0x1})
io_uring_enter(r2, 0x0, 0x3, 0x1, 0x0, 0x0)
syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x100000000, 0x0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60)
ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
open_by_handle_at(r4, &(0x7f00000000c0)={0x7b, 0x80000001, "ebe83475bb318d95af1103c0fe07daf1211b64dc4ee5fdb29256a2e4cd63502c2e306f7ec1a253bad7c625c89a2a46552aceb306a69c0daaff4495650c446c7fe7e08f6d6289ecbc5271e9e5c780dacb7fc3ae3b0d5dbb7911600f1fcf9ef14ab0edc435cea47fa76246f7418be158c1f28075"}, 0x2400)

02:48:56 executing program 2:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x1)
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0x1)

02:48:56 executing program 5:
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071")
mmap(&(0x7f0000196000/0x4000)=nil, 0x4000, 0x0, 0x4032, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000194000/0x5000)=nil, 0x5000, 0xffffffffefffffff, 0x8032, 0xffffffffffffffff, 0x0)

02:48:56 executing program 3:
r0 = open(&(0x7f0000000300)='./bus\x00', 0x141042, 0x0)
close(r0)
r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(r1, 0x4, 0x42000)
r2 = io_uring_setup(0xf2a, &(0x7f0000002740)={0x0, 0x0, 0x1})
io_uring_enter(r2, 0x0, 0x3, 0x1, 0x0, 0x0)
syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x100000000, 0x0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60)
ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
open_by_handle_at(r4, &(0x7f00000000c0)={0x7b, 0x80000001, "ebe83475bb318d95af1103c0fe07daf1211b64dc4ee5fdb29256a2e4cd63502c2e306f7ec1a253bad7c625c89a2a46552aceb306a69c0daaff4495650c446c7fe7e08f6d6289ecbc5271e9e5c780dacb7fc3ae3b0d5dbb7911600f1fcf9ef14ab0edc435cea47fa76246f7418be158c1f28075"}, 0x2400)

02:48:56 executing program 4:
syz_open_dev$sndseq(&(0x7f00000003c0)='/dev/snd/seq\x00', 0x0, 0x0)
r0 = syz_open_dev$sndseq(0x0, 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x404c534a, &(0x7f00000000c0)={0x0, 0x0, 0x20000006, {0x0, 0x989680}})

02:48:56 executing program 1:
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071")
mmap(&(0x7f0000196000/0x4000)=nil, 0x4000, 0x0, 0x4032, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000194000/0x5000)=nil, 0x5000, 0xffffffffefffffff, 0x8032, 0xffffffffffffffff, 0x0)

02:48:57 executing program 0:
syz_open_dev$sndseq(&(0x7f00000003c0)='/dev/snd/seq\x00', 0x0, 0x0)
r0 = syz_open_dev$sndseq(0x0, 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x404c534a, &(0x7f00000000c0)={0x0, 0x0, 0x20000006, {0x0, 0x989680}})

02:48:57 executing program 4:
syz_open_dev$sndseq(&(0x7f00000003c0)='/dev/snd/seq\x00', 0x0, 0x0)
r0 = syz_open_dev$sndseq(0x0, 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x404c534a, &(0x7f00000000c0)={0x0, 0x0, 0x20000006, {0x0, 0x989680}})

02:48:57 executing program 1:
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071")
mmap(&(0x7f0000196000/0x4000)=nil, 0x4000, 0x0, 0x4032, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000194000/0x5000)=nil, 0x5000, 0xffffffffefffffff, 0x8032, 0xffffffffffffffff, 0x0)

02:48:57 executing program 0:
syz_open_dev$sndseq(&(0x7f00000003c0)='/dev/snd/seq\x00', 0x0, 0x0)
r0 = syz_open_dev$sndseq(0x0, 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x404c534a, &(0x7f00000000c0)={0x0, 0x0, 0x20000006, {0x0, 0x989680}})

02:48:57 executing program 5:
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071")
mmap(&(0x7f0000196000/0x4000)=nil, 0x4000, 0x0, 0x4032, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000194000/0x5000)=nil, 0x5000, 0xffffffffefffffff, 0x8032, 0xffffffffffffffff, 0x0)

02:48:57 executing program 2:
r0 = open(&(0x7f0000000300)='./bus\x00', 0x141042, 0x0)
close(r0)
r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(r1, 0x4, 0x42000)
r2 = io_uring_setup(0xf2a, &(0x7f0000002740)={0x0, 0x0, 0x1})
io_uring_enter(r2, 0x0, 0x3, 0x1, 0x0, 0x0)
syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x100000000, 0x0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60)
ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
open_by_handle_at(r4, &(0x7f00000000c0)={0x7b, 0x80000001, "ebe83475bb318d95af1103c0fe07daf1211b64dc4ee5fdb29256a2e4cd63502c2e306f7ec1a253bad7c625c89a2a46552aceb306a69c0daaff4495650c446c7fe7e08f6d6289ecbc5271e9e5c780dacb7fc3ae3b0d5dbb7911600f1fcf9ef14ab0edc435cea47fa76246f7418be158c1f28075"}, 0x2400)

[   60.650891][ T3905] ==================================================================
[   60.659022][ T3905] BUG: KCSAN: data-race in tomoyo_supervisor / tomoyo_supervisor
[   60.666726][ T3905] 
[   60.669054][ T3905] write to 0xffffffff860bff28 of 8 bytes by task 7235 on cpu 1:
[   60.676706][ T3905]  tomoyo_supervisor+0x1ec/0xd20
[   60.681642][ T3905]  tomoyo_path_permission+0x121/0x160
[   60.687012][ T3905]  tomoyo_check_open_permission+0x2b9/0x320
[   60.692895][ T3905]  tomoyo_file_open+0x75/0x90
[   60.697569][ T3905]  security_file_open+0x69/0x210
[   60.702500][ T3905]  do_dentry_open+0x20a/0x900
[   60.707169][ T3905]  vfs_open+0x62/0x80
[   60.711142][ T3905]  path_openat+0xf75/0x3530
[   60.715640][ T3905]  do_filp_open+0x11e/0x1b0
[   60.720144][ T3905]  do_sys_open+0x3b3/0x4f0
[   60.724557][ T3905]  __x64_sys_open+0x55/0x70
[   60.729049][ T3905]  do_syscall_64+0xcf/0x2f0
[   60.733547][ T3905]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[   60.739423][ T3905] 
[   60.741761][ T3905] write to 0xffffffff860bff28 of 8 bytes by task 3905 on cpu 0:
[   60.749401][ T3905]  tomoyo_supervisor+0x1ec/0xd20
[   60.754333][ T3905]  tomoyo_path_permission+0x121/0x160
[   60.759695][ T3905]  tomoyo_path_perm+0x23e/0x390
[   60.764543][ T3905]  tomoyo_inode_getattr+0x26/0x40
[   60.769566][ T3905]  security_inode_getattr+0x9b/0xd0
[   60.774761][ T3905]  vfs_getattr+0x2e/0x70
[   60.778998][ T3905]  vfs_statx+0x102/0x190
[   60.783234][ T3905]  __do_sys_newstat+0x51/0xb0
[   60.787902][ T3905]  __x64_sys_newstat+0x3a/0x50
[   60.792668][ T3905]  do_syscall_64+0xcf/0x2f0
[   60.798482][ T3905]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[   60.804355][ T3905] 
[   60.806666][ T3905] Reported by Kernel Concurrency Sanitizer on:
[   60.812816][ T3905] CPU: 0 PID: 3905 Comm: udevd Not tainted 5.3.0+ #0
[   60.819477][ T3905] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   60.829524][ T3905] ==================================================================
[   60.838019][ T3905] Kernel panic - not syncing: panic_on_warn set ...
[   60.844599][ T3905] CPU: 0 PID: 3905 Comm: udevd Not tainted 5.3.0+ #0
[   60.851275][ T3905] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   60.862970][ T3905] Call Trace:
[   60.866264][ T3905]  dump_stack+0xf5/0x159
[   60.870535][ T3905]  panic+0x209/0x639
[   60.874429][ T3905]  ? __x64_sys_newstat+0x3a/0x50
[   60.879377][ T3905]  ? vprintk_func+0x8d/0x140
[   60.883964][ T3905]  kcsan_report.cold+0xc/0x1b
[   60.888643][ T3905]  __kcsan_setup_watchpoint+0x3ee/0x510
[   60.894191][ T3905]  __tsan_write8+0x32/0x40
[   60.898602][ T3905]  tomoyo_supervisor+0x1ec/0xd20
[   60.903540][ T3905]  ? __kcsan_setup_watchpoint+0x96/0x510
[   60.909176][ T3905]  ? __kcsan_setup_watchpoint+0x96/0x510
[   60.914800][ T3905]  ? __tsan_write1+0x32/0x40
[   60.919385][ T3905]  ? tomoyo_compare_name_union+0xa0/0xa0
[   60.925104][ T3905]  tomoyo_path_permission+0x121/0x160
[   60.930472][ T3905]  tomoyo_path_perm+0x23e/0x390
[   60.935333][ T3905]  tomoyo_inode_getattr+0x26/0x40
[   60.940353][ T3905]  security_inode_getattr+0x9b/0xd0
[   60.945552][ T3905]  vfs_getattr+0x2e/0x70
[   60.949788][ T3905]  vfs_statx+0x102/0x190
[   60.954026][ T3905]  __do_sys_newstat+0x51/0xb0
[   60.958691][ T3905]  ? __kcsan_setup_watchpoint+0x96/0x510
[   60.964319][ T3905]  ? path_put+0x3d/0x40
[   60.968470][ T3905]  ? __kcsan_setup_watchpoint+0x96/0x510
[   60.974107][ T3905]  ? __kcsan_setup_watchpoint+0x96/0x510
[   60.979759][ T3905]  ? __tsan_read8+0x2c/0x30
[   60.984265][ T3905]  __x64_sys_newstat+0x3a/0x50
[   60.989030][ T3905]  do_syscall_64+0xcf/0x2f0
[   60.993537][ T3905]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[   60.999533][ T3905] RIP: 0033:0x7f2645396c65
[   61.004120][ T3905] Code: 00 00 00 e8 5d 01 00 00 48 83 c4 18 c3 90 90 90 90 90 90 90 90 83 ff 01 48 89 f0 77 18 48 89 c7 48 89 d6 b8 04 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 17 f3 c3 90 48 8b 05 a1 51 2b 00 64 c7 00 16
[   61.023722][ T3905] RSP: 002b:00007ffee34a2678 EFLAGS: 00000246 ORIG_RAX: 0000000000000004
[   61.032134][ T3905] RAX: ffffffffffffffda RBX: 0000000001308250 RCX: 00007f2645396c65
[   61.042358][ T3905] RDX: 00007ffee34a2690 RSI: 00007ffee34a2690 RDI: 00007ffee34a2b20
[   61.050324][ T3905] RBP: 00007ffee34a2f80 R08: 000000000041f4f1 R09: 00007f26453ed7d0
[   61.058292][ T3905] R10: 7269762f73656369 R11: 0000000000000246 R12: 0000000000000004
[   61.066253][ T3905] R13: 00007ffee34a2f87 R14: 000000000130c600 R15: 0000000001308250
[   61.075605][ T3905] Kernel Offset: disabled
[   61.079986][ T3905] Rebooting in 86400 seconds..