[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [ 57.033885] sshd (6062) used greatest stack depth: 53184 bytes left [....] Starting OpenBSD Secure Shell server: sshd[ 57.236518] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 61.777495] random: sshd: uninitialized urandom read (32 bytes read) [ 62.299973] random: sshd: uninitialized urandom read (32 bytes read) [ 64.363693] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.0.6' (ECDSA) to the list of known hosts. [ 70.091872] random: sshd: uninitialized urandom read (32 bytes read) 2018/10/03 22:23:55 fuzzer started [ 74.689138] random: cc1: uninitialized urandom read (8 bytes read) 2018/10/03 22:24:00 dialing manager at 10.128.0.26:36867 2018/10/03 22:24:00 syscalls: 1 2018/10/03 22:24:00 code coverage: enabled 2018/10/03 22:24:00 comparison tracing: CONFIG_KCOV_ENABLE_COMPARISONS is not enabled 2018/10/03 22:24:00 setuid sandbox: enabled 2018/10/03 22:24:00 namespace sandbox: enabled 2018/10/03 22:24:00 Android sandbox: /sys/fs/selinux/policy does not exist 2018/10/03 22:24:00 fault injection: enabled 2018/10/03 22:24:00 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2018/10/03 22:24:00 net packed injection: enabled 2018/10/03 22:24:00 net device setup: enabled [ 80.213948] random: crng init done 22:26:03 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f00000002c0)='/dev/vcsa#\x00', 0x0, 0x0) r1 = syz_open_dev$dspn(&(0x7f0000000340)='/dev/dsp#\x00', 0x2, 0x0) r2 = dup3(0xffffffffffffff9c, 0xffffffffffffffff, 0x80000) socket$inet6(0xa, 0x3, 0x0) add_key$keyring(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffff9) ioctl(r1, 0x3ff, &(0x7f00000000c0)="153f6234488dd25d766070") bind$alg(0xffffffffffffffff, &(0x7f0000000180)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280-generic\x00'}, 0x58) r3 = accept$alg(0xffffffffffffffff, 0x0, 0x0) recvmmsg(r3, &(0x7f00000011c0), 0x1, 0x0, &(0x7f0000001240)={0x0, 0x989680}) ioctl$BLKALIGNOFF(r2, 0x127a, &(0x7f0000000200)) ioctl$LOOP_SET_DIRECT_IO(r0, 0x4c08, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_WKALM_RD(0xffffffffffffffff, 0x80287010, &(0x7f0000000080)) r4 = perf_event_open(&(0x7f00004e7000)={0x2, 0x2a7, 0xdf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) accept4$packet(r0, &(0x7f0000000100), &(0x7f0000000040)=0xcbbd0edb, 0x80000) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x40082406, &(0x7f0000000400)="63707526307861000000010000019cd30e35a01d3d040a1c60666f8dcc6d5c76fd2e9e09626b31deea1b0d3b8184872d58b62cc5b4223726b5797482fb1d83f82e2d2000000028e9604401695c8d6c866c68a8fc80de2c4b74f423c55d593bc13676f9890906be2aaa26bd1678518ef3d61afdd00427799b7ce4b70845ed9780731957b75bf0253e4d4df598be5e3d7121a60f70013200bbbe9d5835af657010520b26afa8247f3756ed4c4a34cf0701d5540acac2865fc1ce8ded62538de97482f4317a7772e66f88e5e3e7476378c0914901000000010000004b9ee55ba00a0f04a6b07345298ad052c3c12c62201c2349527a36fe4a7edad75ffe1fe586b1787526fbf2bfe87f9193ab05003485866c8d000000000000000000000000000000") openat$vcs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vcs\x00', 0xe900, 0x0) fcntl$setlease(r4, 0x400, 0x2) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000300)={0xe42c, 0x4, 0x8e1a, 0x80000000, 0x8, 0x119, 0x79, 0x0, 0x4, 0x8, 0x7ff, 0x10000}) [ 201.462825] IPVS: ftp: loaded support on port[0] = 21 [ 203.820968] bridge0: port 1(bridge_slave_0) entered blocking state [ 203.828062] bridge0: port 1(bridge_slave_0) entered disabled state [ 203.836881] device bridge_slave_0 entered promiscuous mode [ 203.993594] bridge0: port 2(bridge_slave_1) entered blocking state [ 204.000079] bridge0: port 2(bridge_slave_1) entered disabled state [ 204.008739] device bridge_slave_1 entered promiscuous mode [ 204.149679] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 204.289238] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready 22:26:07 executing program 1: clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@nat={"6e61748800", 0x19, 0x1, 0x178, [0x200001c0, 0x0, 0x0, 0x200001f0, 0x20000220], 0x0, &(0x7f00000000c0), &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000b0000000b0000000e800000073746174697374696300000000000000ffffffffffffffff0000000000000000180000000000000000000100a4b2000005000000010000807f00000000000000736e617400000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000"]}, 0x1f0) [ 204.720530] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 204.941479] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 205.256698] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 205.263987] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 205.559546] IPVS: ftp: loaded support on port[0] = 21 [ 206.082034] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 206.090319] team0: Port device team_slave_0 added [ 206.396541] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 206.404785] team0: Port device team_slave_1 added [ 206.688861] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 206.696416] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 206.705611] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 206.986992] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 206.994533] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 207.003767] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 207.250542] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 207.259223] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 207.268532] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 207.454004] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 207.461844] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 207.471678] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 209.077268] bridge0: port 1(bridge_slave_0) entered blocking state [ 209.084083] bridge0: port 1(bridge_slave_0) entered disabled state [ 209.092748] device bridge_slave_0 entered promiscuous mode [ 209.255358] bridge0: port 2(bridge_slave_1) entered blocking state [ 209.262820] bridge0: port 2(bridge_slave_1) entered disabled state [ 209.271625] device bridge_slave_1 entered promiscuous mode [ 209.539651] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 209.710212] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 209.936005] bridge0: port 2(bridge_slave_1) entered blocking state [ 209.943019] bridge0: port 2(bridge_slave_1) entered forwarding state [ 209.950303] bridge0: port 1(bridge_slave_0) entered blocking state [ 209.957021] bridge0: port 1(bridge_slave_0) entered forwarding state [ 209.966206] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 210.313076] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 210.358679] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 210.506510] bond0: Enslaving bond_slave_1 as an active interface with an up link 22:26:13 executing program 2: semget(0x3, 0x6, 0x0) [ 210.796963] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 210.805444] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 211.095868] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 211.103393] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 211.719709] IPVS: ftp: loaded support on port[0] = 21 [ 211.974548] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 211.983108] team0: Port device team_slave_0 added [ 212.225615] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 212.233885] team0: Port device team_slave_1 added [ 212.580842] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 212.589617] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 212.598891] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 212.851803] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 212.859441] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 212.868748] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 213.225407] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 213.233292] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 213.243021] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 213.508028] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 213.516007] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 213.526419] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 216.158812] ip (6423) used greatest stack depth: 53056 bytes left [ 216.669240] bridge0: port 1(bridge_slave_0) entered blocking state [ 216.676055] bridge0: port 1(bridge_slave_0) entered disabled state [ 216.684815] device bridge_slave_0 entered promiscuous mode [ 216.932090] bridge0: port 2(bridge_slave_1) entered blocking state [ 216.938774] bridge0: port 2(bridge_slave_1) entered forwarding state [ 216.945894] bridge0: port 1(bridge_slave_0) entered blocking state [ 216.952539] bridge0: port 1(bridge_slave_0) entered forwarding state [ 216.961499] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 216.978423] bridge0: port 2(bridge_slave_1) entered blocking state [ 216.985180] bridge0: port 2(bridge_slave_1) entered disabled state [ 216.993786] device bridge_slave_1 entered promiscuous mode [ 217.223035] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 217.241640] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 217.508320] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 218.294857] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 218.569804] bond0: Enslaving bond_slave_1 as an active interface with an up link 22:26:21 executing program 3: sendmmsg(0xffffffffffffffff, &(0x7f0000007e00)=[{{&(0x7f00000004c0)=@in6={0xa, 0x4e22, 0x0, @mcast2}, 0x80, &(0x7f00000001c0), 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="126be24a1b0020003eeeab162eb45693"], 0x10}}], 0x1, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) sendmmsg(r0, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) [ 218.843757] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 218.851065] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 219.195398] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 219.202759] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 220.109418] IPVS: ftp: loaded support on port[0] = 21 [ 220.279194] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 220.287469] team0: Port device team_slave_0 added [ 220.677179] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 220.685461] team0: Port device team_slave_1 added [ 221.039155] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 221.048398] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 221.057433] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 221.391164] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 221.398399] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 221.407834] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 221.761212] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 221.769093] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 221.778275] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 222.119372] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 222.127355] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 222.136774] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 222.914207] 8021q: adding VLAN 0 to HW filter on device bond0 [ 224.268502] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 225.458862] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 225.465704] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 225.473830] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 225.934424] bridge0: port 1(bridge_slave_0) entered blocking state [ 225.940892] bridge0: port 1(bridge_slave_0) entered disabled state [ 225.949683] device bridge_slave_0 entered promiscuous mode [ 226.067963] bridge0: port 2(bridge_slave_1) entered blocking state [ 226.074531] bridge0: port 2(bridge_slave_1) entered forwarding state [ 226.081410] bridge0: port 1(bridge_slave_0) entered blocking state [ 226.088009] bridge0: port 1(bridge_slave_0) entered forwarding state [ 226.097081] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 226.263083] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 226.351061] bridge0: port 2(bridge_slave_1) entered blocking state [ 226.357630] bridge0: port 2(bridge_slave_1) entered disabled state [ 226.366116] device bridge_slave_1 entered promiscuous mode [ 226.733776] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 226.811602] 8021q: adding VLAN 0 to HW filter on device team0 [ 227.049207] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready 22:26:31 executing program 4: clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r0 = socket$inet_udplite(0x2, 0x2, 0x88) io_setup(0x0, &(0x7f0000000080)) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000400)=@nat={'nat\x00', 0x19, 0x1, 0x178, [0x20000180, 0x0, 0x0, 0x200001b0, 0x200001e0], 0x90, &(0x7f00000000c0), &(0x7f0000000180)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000900000000000000000064756d6d7930000000000000000000007465616d5f736c6176655f300000000073797a6b616c6c657230000000000000726f7365300000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000b0000000b0000000e800000071756f74610000000000000000000000000000000000000000000000000000001800000000000000000000000000000000000000000000000000000000000000736e6174000000000000000000000000000000000000000000000000000000f50f000000000000000000000000000000fdffffff00000000"]}, 0x1f0) [ 228.189674] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 228.617587] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 229.068358] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 229.075537] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 229.509491] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 229.517530] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 229.673236] IPVS: ftp: loaded support on port[0] = 21 [ 230.648283] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 230.656457] team0: Port device team_slave_0 added [ 231.078956] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 231.087230] team0: Port device team_slave_1 added [ 231.497695] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 231.504986] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 231.514127] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 231.930716] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 231.937987] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 231.946918] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 232.381222] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 232.389010] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 232.398115] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 232.797480] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 232.805300] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 232.814410] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 232.951816] 8021q: adding VLAN 0 to HW filter on device bond0 [ 234.605698] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 236.122885] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 236.129334] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 236.137807] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 236.524562] hrtimer: interrupt took 50516 ns [ 236.764993] bridge0: port 1(bridge_slave_0) entered blocking state [ 236.771480] bridge0: port 1(bridge_slave_0) entered disabled state [ 236.780094] device bridge_slave_0 entered promiscuous mode 22:26:40 executing program 0: semctl$GETVAL(0x0, 0x84, 0xc, &(0x7f0000000000)=""/31) [ 237.206700] bridge0: port 2(bridge_slave_1) entered blocking state [ 237.213441] bridge0: port 2(bridge_slave_1) entered disabled state [ 237.221970] device bridge_slave_1 entered promiscuous mode 22:26:40 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x80000000005, 0x40000000001) r1 = request_key(&(0x7f00000000c0)='asymmetric\x00', &(0x7f0000000100)={'syz', 0x1}, &(0x7f0000000140)='\x00', 0xfffffffffffffffc) r2 = request_key(&(0x7f0000000200)='blacklist\x00', &(0x7f0000000240)={'syz', 0x2}, &(0x7f0000000280)='/dev/bus/usb/00#/00#\x00', 0xfffffffffffffffd) keyctl$search(0xa, r1, &(0x7f0000000180)='trusted\x00', &(0x7f00000001c0)={'syz', 0x3}, r2) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0105512, &(0x7f0000000040)={0x0, 0x80805513, 0x0, 0x80000001}) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f00000002c0)={0x400000000004, 0x2, 0xffff, 0x7, 0x10008}) [ 237.684190] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 237.693748] bridge0: port 2(bridge_slave_1) entered blocking state [ 237.700201] bridge0: port 2(bridge_slave_1) entered forwarding state [ 237.707232] bridge0: port 1(bridge_slave_0) entered blocking state [ 237.713836] bridge0: port 1(bridge_slave_0) entered forwarding state [ 237.722848] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready 22:26:40 executing program 0: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) write$evdev(r0, &(0x7f00006f7fe8)=[{{0x0, 0x2710}, 0x1, 0x40000000000004c, 0x400000002}], 0x18) ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000000000)) write$binfmt_elf32(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="7f454c46000000000000000000000000000000000000000000fe0bfbcf00000038000000000036b2763ea7a6073720000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000"], 0x58) [ 238.033791] 8021q: adding VLAN 0 to HW filter on device team0 [ 238.127865] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 238.583269] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready 22:26:41 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x200000, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000040)={&(0x7f0000ffb000/0x4000)=nil, 0x4000}, &(0x7f0000000080)=0x10) writev(r0, &(0x7f00000a8000)=[{&(0x7f0000aef000)="580000001400192300bb4b80040d8c562806f0ffffff04106a9643c218fe59a2e04a03ca8164243e890000000a215a0004fbf50dfff90003a5000004001ce1ed5e0000000000221f100001000700f8ffff0000ec6b0f536e", 0x58}], 0x1) 22:26:42 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000140)={0xffffffffffffffff}, 0x106, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r2, &(0x7f00000001c0)={0x15, 0x110, 0xfa00, {r3, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, [], 0x21}, 0xfffffffffffffff8}, @ib={0x1b, 0xeaf5, 0xf, {"1b6c41017a770a18768e1ce08a45fa81"}, 0xff, 0x4, 0x10001}}}, 0x118) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000380)={r1, 0x50, &(0x7f0000000300)}, 0x10) bind$alg(r0, &(0x7f00000004c0)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_hmac_sha1\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000), 0x0) getsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f0000000000), &(0x7f00000003c0)=0x8) r4 = accept$alg(r0, 0x0, 0x0) recvmmsg(r4, &(0x7f0000001280)=[{{&(0x7f0000000ec0)=@nl=@proc, 0x167, &(0x7f0000001180)=[{&(0x7f0000001080)=""/251, 0xfb}], 0x3ed, &(0x7f00000011c0)=""/157, 0x9d}}], 0x1500, 0x0, &(0x7f0000001380)={0x77359400}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x8040, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x40000000400200) [ 239.398180] bond0: Enslaving bond_slave_0 as an active interface with an up link 22:26:42 executing program 5: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x404001, 0x0) sendmmsg(r0, &(0x7f0000000600)=[{{&(0x7f0000000040)=@alg={0x26, 'hash\x00', 0x0, 0x0, 'crc32c-generic\x00'}, 0x80, &(0x7f0000000380)=[{&(0x7f00000000c0)="5ce61160f7cd984e40cef376b5e67ee43300620491a7edb03132dfd8bdcb65b4632f2e0eb11815d2fa48f5255f33d679642abf5f6fbb0ccbe102cecf76b8718b8cea4314b7715e14b01a32f1cb6006853b07320480bc95e2d79feb722e35001c134d9738254ddf6b4df38cbbe3cec33bd05f933ec7cf14e1bf9c9d5e17c3617b80f25a01364507febfb7b80ef03f14539ea0", 0x92}, {&(0x7f0000000180)="e9caa5faa814135110cb533395be8de219c117659a392926d2e06ee12524657e309f6f33cb3ed547d34ec39ef2a1a444442e81d6fbf2a4755eed5437843994a63b2e12095fb5df9a19c4ba5969abe389f11b904919c88d810aebdc1bd38293c72db69a4d5ce2f06cddfb26b612f79ca766ff647a9fa1e8eade28c7ee1c66a88689865e5834f76b302fdcdee6db6323f3a28ded0680586fec238b2b9fc715ffb9c141fa640fd79ed807137abc885efa873b7c6d59d91b2f98169725b298782ce079df61afc33ce9fa03e5d19fbc5498", 0xcf}, {&(0x7f0000000280)="f148218c673259790de18dc60d0ef76cd05f4eaf097bfb7864be2a7cdf50818217b1765adc2a403e3f8bc12ae7be38bffd1331727117277cc15c604acb48487c30876802b475ff740b8d8053e6532c453240ae4d5663beab5a7015e74d4d1609fb989e313fd883460933c2e96442364473d38a5bad1fcf275af62eea7b1bb134f2d54d2b4dd18801ed3a46d281c9269fb003a2eb0dc74fd7caf78a33d4b8ebecf7d9335cb8741fa930fff02a197162b5b4d542f4696a2d32372e84a427312217683bfc446a668b1d5d644afcde93c0388bacaa9b2355fd15c93583b88dc59771daae8b6e6a31dd8b5705154477dc7c0b359349c1945443a9f30bc4f8", 0xfc}], 0x3, &(0x7f00000003c0)=[{0xe8, 0x11f, 0x4, "02c1e63f02d72d2327fa4933980edc3c0f9b772624ca661855740e3d5175dc8e7e89ec9a5c4c64197f45d0949bcccb2acfd5e2591d4d6f1745233dd11dadb8c98f64ca87dd2b53d073da31e9751c885824b8783433979326cc6a312427fa7cba0453ae1d61f7c99735fd49023afec7fb8dc420aa4a34032b8c984bec3322c5fb7c4db964e5572f9aea617d5d9ddc3582f9d4b59a8a3d054b3dcb11e0a8bdb9f01bf0b105575b20c21808a38cc2e24823a1956f5da0e38cafc8e669c7578269bb68184a62603521c7f1dcde842b4577c70f"}, {0x40, 0x11, 0x9, "41da309cb7167fbb7c32be37907cdb472d03416afcb2ecdddce085d53432ac737c0a9810726c7ff980d82154270f"}, {0xe0, 0x0, 0x4000000000000000, "efdeae7c96e66cbfc3aea4520f5539681e2e76eff34d1651cc3165ed78102817c9a63d35aedee62bc07f63a2fbb65c397efd33542e1d41b7ef4c741d2779f283cf73755cdb0d8b6282fd161e32c770a003f6e1d5d5e52c9c8bb9a637e3a32fa079a93ff211278a41798a8826758258694748349dfdb07369f57f2545489502e016de979d9ed67dd2a86ab5d6df27e1e0bd7db498942ed08c032ecfd7693ec70e53f3bef457e126d2cc150a0d06d7a5a114b7160b750638eeb17897a6e433fc97520b6ff33fad66851880be9a90"}], 0x208, 0x44000}, 0x1ff}], 0x1, 0x880) uselib(&(0x7f0000000640)='./file0\x00') getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000680)={0x0, 0x3f}, &(0x7f00000006c0)=0x8) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000700)={r1, @in6={{0xa, 0x4e24, 0x0, @remote, 0x2}}, 0x4, 0x6}, &(0x7f00000007c0)=0x90) sendmsg$nl_generic(r0, &(0x7f0000000a00)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x4100000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000840)={0x154, 0x1e, 0x100, 0x70bd27, 0x25dfdbfd, {0xd}, [@generic="46ff9729d0c04e3503677bcab1f29a6fa60ea5993fbf0cb29658eb3a071c4b56e31337a1791a372f237eff7c04922985c2a6c3570ca35a5e08cfa0a5d95f8d58dbcfcd2121be0e8a10cf732d34e75172ce884c995b018f6e4f135b7873e34a1ec9b856cb08bd322286879fbfd8", @generic="3d591b259ac8a3ce2db022daa53f44af5761395bb4adf5e55f481953c6edf5d0709c4a43ba9b79924f2b82e974aa91f0a263a829bffcedac819126c7c83524fa36d5b3dd3982a4c70373c4331f407eaf3266f45c0f6fa134fffcfed732b005f97716a03bb6d2cb4676e367c643fe11c066ce2ebeb325b048dc9a511e697a5e37c0a1522ee312cef89642316db9219122ac3d802b282f3eb0db0d760946add6afd867aceef7c5f674ea8c356ba85f6f315613cd6948e4111b07d0c10a", @generic="3fa3f96403d3df07b0404c95", @typed={0x8, 0x57, @ipv4=@rand_addr=0x4}]}, 0x154}, 0x1, 0x0, 0x0, 0x800}, 0x40000) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000a40)={r1}, &(0x7f0000000a80)=0x8) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r0, 0x54a3) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r0, 0x0, 0x61, &(0x7f0000000ac0)={'filter\x00', 0x4}, 0x68) ioctl$sock_inet6_tcp_SIOCATMARK(r0, 0x8905, &(0x7f0000000b40)) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, &(0x7f0000000b80)=r0) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000bc0)={r3, 0x9}, &(0x7f0000000c00)=0x8) ioctl$SG_GET_LOW_DMA(r0, 0x227a, &(0x7f0000000c40)) fsetxattr$security_evm(r0, &(0x7f0000000c80)='security.evm\x00', &(0x7f0000000cc0)=@sha1={0x1, "7b622930325d8a93a7ed6ff3ad707259ba300c3f"}, 0x15, 0x3) setxattr$security_ima(&(0x7f0000000d00)='./file0\x00', &(0x7f0000000d40)='security.ima\x00', &(0x7f0000000d80)=@v1={0x2, "f3448fab9fa915d8ea354cf3b6"}, 0xe, 0x2) ioctl$KVM_GET_DEVICE_ATTR(r0, 0x4018aee2, &(0x7f0000000e00)={0x0, 0x6, 0xffffffffffff6d5d, &(0x7f0000000dc0)=0x3f}) ioctl$PIO_UNISCRNMAP(r0, 0x4b6a, &(0x7f0000000e40)="f53d184842c42b5b0da728ba92b13115a7e41ce5d5c22382eb30bf86e3346544e3d74e7d1e5f1d63466824cfa7b6aa10b60a2d604d8e0830a90f1e3a9555627a40f1f0f47b03d724626664cd9b0dd51a896c05cd7fe225134192db8539f0501acc5a4c458961cd437af9bb0d4558") getsockopt$inet_sctp_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000ec0)={r2, 0xffffffffffffffe0, 0x5, 0x6, 0x4, 0x100000000}, &(0x7f0000000f00)=0x14) ioctl$KDGKBMETA(r0, 0x4b62, &(0x7f0000000f40)) r4 = accept$unix(r0, &(0x7f0000000f80), &(0x7f0000001000)=0x6e) recvfrom$unix(r4, &(0x7f0000001040)=""/176, 0xb0, 0x40000002, &(0x7f0000001100)=@file={0x1, './file0\x00'}, 0x6e) r5 = request_key(&(0x7f0000001180)='asymmetric\x00', &(0x7f00000011c0)={'syz', 0x3}, &(0x7f0000001200)='filter\x00', 0xfffffffffffffffc) keyctl$restrict_keyring(0x1d, r5, &(0x7f0000001240)='rxrpc_s\x00', &(0x7f0000001280)='\x00') getsockopt$IP_VS_SO_GET_INFO(r4, 0x0, 0x481, &(0x7f00000012c0), &(0x7f0000001300)=0xc) sendto$inet(r0, &(0x7f0000001340)="8c75cf824f593ed77214e1f22157553407bb88c00cc872ac5832f668fb93377d1b76ce3f0f0afa4f55437ddc98cc33d6ddab58e118f402a2321e96b4e2f2a40778e3d44d54500f225dbd7ec50a5d8876572dee9526908c19f10fdd4cf9487a12c31d8c4113e57d355b2207b7fb7e20a31320af373b3903b736edd05cb1611f8ecaa767c24fcf0fa3f2536167fc3d1e7330b66dd3eb7664a56d70fd088f3b0ea0bf2b87db2c653887fb4e95983e6bae036c1f64298f566d736a0149b22cf6187f60965bf011cfff7c6ca8", 0xca, 0x14, &(0x7f0000001440)={0x2, 0x4e22, @local}, 0x10) r6 = shmget(0x2, 0x4000, 0x400, &(0x7f0000ffa000/0x4000)=nil) shmat(r6, &(0x7f0000ffa000/0x4000)=nil, 0x1000) setsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000001480)=@int=0x8, 0x4) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r0, 0x660c) writev(r0, &(0x7f0000001600)=[{&(0x7f00000014c0)="1a0150e5cec7c88ec1eb940074f0b5d277a5e61453210bd405bf6fb9ca9123cb30a0265c8c10c2827c556eba032a4e95e889eb5ab899ba8de1df679e37f2b266049b1a7ec6d2f5d39550415d41f91badb1e1b28789b76f4fdb65ce063e418bdd84dd9a682d94c888300684", 0x6b}, {&(0x7f0000001540)="eee7f673b39116a50366192485226c33560c1722081ea64ed47e5d17ba61f3a70eb48baa935ef1b54f92b01f03df04899bed601c30a51385387072ede40bb569ae06468782a37c11e4d9acdce451de127a7628b51af167164dabbce7d465676c2146ec76a53152c160cb18367edcefd4817705859a03537f8577333d44304d052ee1ffcf4f18c43ce62d97567068f458c8ae83705b0c0d89464914f66757ca068722860e891cd90aa58afbd79514232738c2b1ede4de7ddcd267b28f", 0xbc}], 0x2) [ 239.741980] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 240.109335] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 240.116638] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready 22:26:43 executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x805, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_SET_KEYBIT(r0, 0x40045565, 0x38) ioctl$UI_DEV_SETUP(r0, 0x5501, &(0x7f0000000300)={{}, 'syz0\x00'}) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 240.448239] input: syz1 as /devices/virtual/input/input5 [ 240.608276] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 240.615580] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 240.776221] input: syz1 as /devices/virtual/input/input6 22:26:44 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @local, 0x7fffffff}, 0x1c) [ 241.323064] IPVS: ftp: loaded support on port[0] = 21 [ 241.876240] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 241.884555] team0: Port device team_slave_0 added [ 242.190068] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 242.198457] team0: Port device team_slave_1 added [ 242.562652] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 242.569745] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 242.578866] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 242.946949] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 242.954277] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 242.963230] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 243.297992] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 243.305734] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 243.314992] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 243.493646] 8021q: adding VLAN 0 to HW filter on device bond0 [ 243.694102] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 243.701701] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 243.710801] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 244.941204] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 246.389191] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 246.395720] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 246.403925] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 247.113480] x_tables: eb_tables: snat target: only valid in nat table, not natˆ [ 247.194098] x_tables: eb_tables: snat target: only valid in nat table, not natˆ [ 247.304374] bridge0: port 1(bridge_slave_0) entered blocking state [ 247.310852] bridge0: port 1(bridge_slave_0) entered disabled state [ 247.319414] device bridge_slave_0 entered promiscuous mode 22:26:50 executing program 1: perf_event_open(&(0x7f0000000280)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$alg(0x26, 0x5, 0x0) readv(0xffffffffffffffff, &(0x7f00000001c0)=[{&(0x7f00000003c0)=""/146, 0x92}], 0x1) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) signalfd4(0xffffffffffffffff, &(0x7f0000000100), 0x8, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) [ 247.556356] bridge0: port 2(bridge_slave_1) entered blocking state [ 247.562940] bridge0: port 2(bridge_slave_1) entered forwarding state [ 247.569873] bridge0: port 1(bridge_slave_0) entered blocking state [ 247.576511] bridge0: port 1(bridge_slave_0) entered forwarding state [ 247.585086] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 247.675256] bridge0: port 2(bridge_slave_1) entered blocking state [ 247.681886] bridge0: port 2(bridge_slave_1) entered disabled state [ 247.690448] device bridge_slave_1 entered promiscuous mode [ 247.912840] 8021q: adding VLAN 0 to HW filter on device team0 [ 247.977890] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 248.295870] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 248.422796] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 249.133338] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 249.440418] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 249.741347] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 249.748660] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 250.105430] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 250.112777] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 251.048348] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 251.056635] team0: Port device team_slave_0 added [ 251.367916] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 251.376193] team0: Port device team_slave_1 added [ 251.717296] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 251.725123] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 251.734066] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 251.970366] 8021q: adding VLAN 0 to HW filter on device bond0 [ 252.060107] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 252.067334] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 252.076191] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 252.312882] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 252.320511] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 252.329934] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 252.636785] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 252.644540] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 252.653512] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 253.007597] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 254.022616] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 254.028986] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 254.036933] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 22:26:57 executing program 2: clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) setrlimit(0x7, &(0x7f0000a9cff8)) socket$packet(0x11, 0x2, 0x300) socket$inet6_tcp(0xa, 0x1, 0x0) [ 255.079253] 8021q: adding VLAN 0 to HW filter on device team0 [ 255.623058] bridge0: port 2(bridge_slave_1) entered blocking state [ 255.629549] bridge0: port 2(bridge_slave_1) entered forwarding state [ 255.636626] bridge0: port 1(bridge_slave_0) entered blocking state [ 255.643149] bridge0: port 1(bridge_slave_0) entered forwarding state [ 255.651435] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 255.658228] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 258.210698] 8021q: adding VLAN 0 to HW filter on device bond0 [ 259.057304] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 259.773652] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 259.780566] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 259.789563] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 22:27:03 executing program 3: [ 260.532809] 8021q: adding VLAN 0 to HW filter on device team0 [ 263.407697] 8021q: adding VLAN 0 to HW filter on device bond0 [ 263.898968] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready 22:27:07 executing program 4: 22:27:07 executing program 0: setrlimit(0x400000000000007, &(0x7f0000000580)={0x4, 0x80}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) 22:27:07 executing program 1: r0 = openat$random(0xffffffffffffff9c, &(0x7f0000000340)='/dev/urandom\x00', 0x0, 0x0) ioctl$RNDADDENTROPY(r0, 0x40085203, &(0x7f0000000380)={0x8}) 22:27:07 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(r1, 0x0, 0x63, &(0x7f0000000080)={'ah\x00'}, &(0x7f0000000140)=0x1e) 22:27:07 executing program 3: [ 264.032568] x_tables: eb_tables: snat.0 target: invalid size 16 (kernel) != (user) 15 [ 264.175740] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/l1tf.html for details. 22:27:07 executing program 2: [ 264.769089] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 264.775451] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 264.783410] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 265.076954] 8021q: adding VLAN 0 to HW filter on device team0 22:27:10 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000640)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r2 = syz_open_pts(r0, 0x0) ioctl$TCSETSF(r2, 0x5412, &(0x7f0000000040)={0xa}) 22:27:10 executing program 1: 22:27:10 executing program 3: 22:27:10 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) ioctl$TCSETAW(r0, 0x5407, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000}) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/191, 0xbf) ioctl$TCSETS(r0, 0x5402, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xc3, 0x0, 0x0, 0x101, 0x0, 0x0, 0x9f6a}) 22:27:10 executing program 0: setrlimit(0x400000000000007, &(0x7f0000000580)={0x4, 0x80}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) 22:27:10 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000640)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={"00ac730000000000ec973f820f7c4000", 0x102}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000000)={'ip6_vti0\x00', 0x400}) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000100)={0x1, &(0x7f0000000040)=[{0x6}]}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000140)={'bcsh0\x00', 0x600}) 22:27:10 executing program 0: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) wait4(0x0, &(0x7f00000001c0), 0x40000000, &(0x7f0000000200)) syz_open_procfs$namespace(0x0, &(0x7f0000000100)='ns/uts\x00') r0 = getpid() rt_sigqueueinfo(r0, 0xa, &(0x7f0000000180)) 22:27:10 executing program 1: socketpair(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0xb}, 0x2c) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8946, &(0x7f0000000040)="6c6f00966fd651b159a9c84a2c60d29800000020") 22:27:10 executing program 3: r0 = socket$inet6(0xa, 0x400000000001, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000008, &(0x7f0000000300)={0xa, 0x0, 0x0, @ipv4={[], [], @dev}}, 0x1c) 22:27:10 executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x805, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_SET_KEYBIT(r0, 0x40045565, 0x38) ioctl$UI_DEV_SETUP(r0, 0x5501, &(0x7f0000000300)={{}, 'syz0\x00'}) 22:27:10 executing program 5: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) wait4(0x0, &(0x7f00000001c0), 0x40000000, &(0x7f0000000200)) syz_open_procfs$namespace(0x0, &(0x7f0000000100)='ns/uts\x00') r0 = getpid() openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) rt_sigqueueinfo(r0, 0xa, &(0x7f0000000180)) 22:27:10 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x6}, 0x1c) sendto$inet6(r0, &(0x7f0000000300), 0xfdb8, 0x0, &(0x7f00000000c0)={0xa, 0x4e23, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) 22:27:10 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000640)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={"00ac730000000000ec973f820f7c4000", 0x102}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000000)={'ip6_vti0\x00', 0x400}) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000100)={0x1, &(0x7f0000000040)=[{0x6}]}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000140)={'bcsh0\x00', 0x600}) 22:27:10 executing program 5: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) wait4(0x0, &(0x7f00000001c0), 0x40000000, &(0x7f0000000200)) syz_open_procfs$namespace(0x0, &(0x7f0000000100)='ns/uts\x00') r0 = getpid() openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) rt_sigqueueinfo(r0, 0xa, &(0x7f0000000180)) 22:27:10 executing program 3: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r0, &(0x7f0000000480)=ANY=[@ANYBLOB="7f454c4673000200faff3c46dc000000006e0100000000a4e24000000000000000f4010000000000f336f1aa00030038000100ffff0000d9ba5ad20070010000004000000000000000050000000000000001800000000000000100000000000000060000ec05000000000000800000000005402fc8e76d86"], 0x78) sendfile(r0, r0, &(0x7f0000000080), 0x10001) sendfile(r0, r0, &(0x7f00000001c0), 0xa198) [ 267.727314] input: syz1 as /devices/virtual/input/input7 [ 267.786285] input: syz1 as /devices/virtual/input/input8 22:27:10 executing program 1: r0 = socket$inet(0x2, 0x10000000000002, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000eed000)={0x2, 0x1}, 0x10) syz_emit_ethernet(0x423, &(0x7f0000000300)={@link_local, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x415, 0x0, 0x0, 0x0, 0x200000000000011, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x1, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}, "b441d632cdbbcb211363807aec73d3883762a61dc02d349bfa3ac974b987aa7fb97eb324d594fbbb77bab759418aa8d451d921e8f5d2cf2b08292111701192e97cac366dd3eb2e0fb039e58314ef4709c5f3556db6a1ab6b4fb2bdd83cdc26e8395ec4984ec3faf71a611d1569545d654cded93be827a85188b803c19c1b56aab522862a718b81e512b49690994d3425e33bd93f0e744c66a083c1f9f1bd7bb8f9e123c08f3f041ed3fdc058136cf0071a47cc0e38720a12e11e842a7b5b26dff07f578fdb9a7b14662a625c1ee76c41ccb2b1fc6376aa718e1067b9e4af511ef5b360dbfad326108bb033db193dab27974eb8c462739eaee51d87f31c516e7e391073770da3202e02c41a7277c847df24bd5b0a7ab6e252f3c8ebf00688cc55311d887e8bfd95a7f4c6a126af3fe26714ddb869c66d18f870631bbd497e8a06881b754ecdcdd0dcffc51cd52a6b560f8d64b63a1674745edc5f53b18a8ffcc5c2fbc4d2bbcc2faf3c189d9b36c0655d1394f5c127ec86b8a764a87b546c2b6ac37d0a8ec3edd7cda6f930570763dbdc0640d219749bd57c7c89eaadfdae41d654a46b17be069a32a7d94d29b612fbe61b8bd11a2d10ba5d4ac7014fc0465c3f144598bd1f913343e7293711040eee0ae8df1e49f04ed1037d4b742aed0e932116060aaf6b985238d2e10fb5b11d19d7801befed4833287d96a85a7cdd9e211a672760335655576fc0fa0336621c2b2b1018ef71bb5077c67ee5fa8d479d6776013363e98b1f1213712be7e47549b6035459008c509f0f983130a451531381ee3c1ab9e1cbb8e558b56ca1a70939389addc5f9632b37ff3f634abb504bb0be0a51649683f6e29588c15cda40255e173328681884ffef6729e9058c5623e1401fdcc7b8cb5623a8fd725fbeea05fc417c44e46500619218dff7c70aa068994c58883cada505a2aa85b6620dfe9c45b707c9aa1222b86972eae564b28a05ddfa3545df231fde2707d4bf67dc6ba41daba91dee8081e5c7e2bcfbebebd42d5ab8a32d6e098fd57233e3b813dc0d772134775def451823b7fef2bc93da01722cd613b9a3db7e2d4c51fb7b56006ee9cea53b62343599a56167388d45247f9289fb1cab67a7cb0c3665ddf1e1411875b4de3428b32fc6603691a023d8e4cb93c667acb7b535fb5f77af9a49640cbe8ffe3a193cf4df1b556a67cb753c60bdf978b871aa513c07074c6602037ebc32199290e3c7ac6f103ad9358951ad4de0c8f1b34951b0e6a48295975cf08b2c3c95064855fc95317e386f1c18608d1d08699003c998b93332cd316f17a5139d350cbfa9dabc3f77c4197a0186e50913978e980a7a028e7ccdeee718af028200e94a6b3a0ec93ba14b0c64dfaf3967e230d8cf876f26287d436ebc9588b52b43f2380836bfe3"}}}}}, 0x0) 22:27:11 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x1) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback}, 0x1c) 22:27:11 executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x805, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_SET_KEYBIT(r0, 0x40045565, 0x38) ioctl$UI_DEV_SETUP(r0, 0x5501, &(0x7f0000000300)={{}, 'syz0\x00'}) 22:27:11 executing program 5: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) wait4(0x0, &(0x7f00000001c0), 0x40000000, &(0x7f0000000200)) syz_open_procfs$namespace(0x0, &(0x7f0000000100)='ns/uts\x00') r0 = getpid() openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) rt_sigqueueinfo(r0, 0xa, &(0x7f0000000180)) 22:27:11 executing program 2: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet(0x10, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='\x00\x00\x00\x00\x00') r1 = openat$cgroup_ro(r0, &(0x7f0000000000)="6d656d00017937737761532e63757289c942abe3fa72656e7400", 0x0, 0x0) preadv(r1, &(0x7f0000000180)=[{&(0x7f00000000c0)=""/81, 0x20000111}], 0x1, 0x2000107c) 22:27:11 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="153f6234d000d25d766070") mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0xbcda34450b800b7a, 0x40000000000a132, 0xffffffffffffffff, 0x0) msgctl$MSG_STAT(0x0, 0xb, &(0x7f0000000040)=""/200) [ 268.394739] input: syz1 as /devices/virtual/input/input9 22:27:11 executing program 3: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r0, &(0x7f0000000480)=ANY=[@ANYBLOB="7f454c4673000200faff3c46dc000000006e0100000000a4e24000000000000000f4010000000000f336f1aa00030038000100ffff0000d9ba5ad20070010000004000000000000000050000000000000001800000000000000100000000000000060000ec05000000000000800000000005402fc8e76d86"], 0x78) sendfile(r0, r0, &(0x7f0000000080), 0x10001) sendfile(r0, r0, &(0x7f00000001c0), 0xa198) 22:27:11 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_procfs(0x0, &(0x7f0000000240)='net/unix\x00') sendfile(r0, r1, &(0x7f0000000000), 0x800000bf) 22:27:11 executing program 5: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) wait4(0x0, &(0x7f00000001c0), 0x40000000, &(0x7f0000000200)) syz_open_procfs$namespace(0x0, &(0x7f0000000100)='ns/uts\x00') r0 = getpid() openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) rt_sigqueueinfo(r0, 0xa, &(0x7f0000000180)) 22:27:11 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000380)={0x1, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @remote}}}, 0x408) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000240)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) 22:27:12 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000040)={&(0x7f00000001c0), 0xc, &(0x7f0000000000)={&(0x7f0000000680)={0x14, 0x1d, 0xffffdffffffffffd, 0x0, 0x0, {0x1f}}, 0x14}}, 0x0) 22:27:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), &(0x7f0000000200)}}}], 0xfffffffffffffda5, 0x0, &(0x7f0000000300)}) [ 269.213477] binder: 7888:7889 transaction failed 29189/-22, size 0-0 line 2855 [ 269.228547] binder: 7888:7889 transaction failed 29189/-22, size 0-0 line 2855 [ 269.236870] binder: 7888:7890 transaction failed 29189/-22, size 0-0 line 2855 [ 269.248009] binder: undelivered TRANSACTION_ERROR: 29189 22:27:12 executing program 3: r0 = socket$netlink(0x10, 0x3, 0xf) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r0, 0x10e, 0x8, &(0x7f00000000c0)=0x7fffffff, 0x4) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/loop-control\x00', 0x0, 0x0) r2 = ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, r2) 22:27:12 executing program 0: add_key$keyring(&(0x7f00000001c0)='keyring\x00', &(0x7f0000000000)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffb) 22:27:12 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000280)={&(0x7f0000000000), 0xc, &(0x7f0000000240)={&(0x7f0000000480)=@acquire={0x128, 0x17, 0x1, 0x0, 0x0, {{@in=@multicast1}, @in6=@ipv4={[], [], @dev}, {@in=@loopback, @in6=@local}, {{@in=@rand_addr, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x2}}}}, 0x128}}, 0x0) 22:27:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), &(0x7f0000000200)}}}], 0xfffffffffffffda5, 0x0, &(0x7f0000000300)}) 22:27:12 executing program 2: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet(0x10, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='\x00\x00\x00\x00\x00') r1 = openat$cgroup_ro(r0, &(0x7f0000000000)="6d656d00017937737761532e63757289c942abe3fa72656e7400", 0x0, 0x0) preadv(r1, &(0x7f0000000180)=[{&(0x7f00000000c0)=""/81, 0x20000111}], 0x1, 0x2000107c) 22:27:12 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x6, 0x0, 0x0, 0x0, 0x9917, 0xffff}, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) r1 = ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800"}) ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f00000000c0)={'\x00', 0x400}) ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000040)={'veth0_to_bridge\x00', 0x602}) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000002c0)={0x0, @in={{0x2, 0x4e20, @broadcast}}}, &(0x7f00000001c0)=0x84) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000440)='IPVS\x00') sendmsg$IPVS_CMD_GET_INFO(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x21}, 0xc, &(0x7f00000004c0)={&(0x7f0000000740)=ANY=[@ANYBLOB="000228bd7000fb5adf250f8000001c000200080006000000000008000900060000000800030000000000080005000000000008000500be020000080005000800000008000600030000005800010008000b007369700008000b007369700014000300ffffffff0000000000000000000000000c0007001a00000000000000080008000200010114000300fe80000000000000550a830e000000bb08000500000000003000030008000700004e2073051e54425086a000000000000000000000000000bb000000000000000000"], 0x1}}, 0x40) ioctl$LOOP_CTL_ADD(r0, 0x4c80, r1) getsockopt$bt_BT_SNDMTU(0xffffffffffffffff, 0x112, 0xc, &(0x7f00000005c0)=0x3, &(0x7f0000000640)=0x2) socket(0x0, 0x802, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000000180)={0x0}, &(0x7f0000000900)=0x8) getsockopt$inet_sctp_SCTP_DELAYED_SACK(0xffffffffffffffff, 0x84, 0x10, &(0x7f0000000980)=@sack_info={r2, 0x800, 0xe86}, &(0x7f00000009c0)=0xc) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000480)='/dev/audio\x00', 0x100, 0x0) ioctl$TUNGETIFF(r3, 0x800454d2, &(0x7f0000000540)) ioctl$RNDCLEARPOOL(r0, 0x5206, &(0x7f0000000200)=0xffffffff) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f00000003c0)={'team0\x00'}) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcs\x00', 0x800, 0x0) ioctl$TUNGETIFF(r4, 0x800454d2, &(0x7f0000000240)) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000380)='/dev/vcs\x00', 0x0, 0x0) ioctl$LOOP_SET_STATUS(r5, 0x4c02, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, "4a6dcd57f7f10eae8aa69bdefc837a361ac7469a9ff94cca43026131708220c7fc2c5483bbfa815f2832c3c69eb014b64f25df2c6930c03d7661e3b2d4ed85a3", "8d2f63b66744cc6934c2d68586cdf29fdc2bff8469b8c21f4b8dbe6582ec91a8"}) 22:27:12 executing program 0: ioprio_set$pid(0x2, 0x0, 0x0) [ 269.668668] binder: 7902:7904 transaction failed 29189/-22, size 0-0 line 2855 22:27:13 executing program 5: r0 = add_key$keyring(&(0x7f00000001c0)='keyring\x00', &(0x7f0000000000)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffb) keyctl$set_timeout(0xf, r0, 0x0) 22:27:13 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000000)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @ipv4={[], [], @rand_addr}}}}, 0x108) 22:27:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), &(0x7f0000000200)}}}], 0xfffffffffffffda5, 0x0, &(0x7f0000000300)}) [ 270.211545] binder: 7923:7924 transaction failed 29189/-22, size 0-0 line 2855 22:27:13 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f0000000280)=@file={0x1, './file0\x00'}, 0x6e) r3 = syz_open_procfs(0x0, &(0x7f0000000240)='net/unix\x00') sendfile(r2, r3, &(0x7f0000000000), 0x800000bf) 22:27:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, &(0x7f0000002000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), &(0x7f0000000200)}}}], 0xfffffffffffffda5, 0x0, &(0x7f0000000300)}) 22:27:13 executing program 0: prctl$seccomp(0x16, 0x2, &(0x7f0000000140)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0xfffffffffffffff9}]}) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'ghash-generic\x00'}, 0x58) accept4(r0, 0x0, &(0x7f0000000140), 0x0) 22:27:13 executing program 5: socketpair$unix(0x1, 0x8000000000000002, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000000)=[@textreal={0x8, &(0x7f00000005c0)="82780000260f017731f3d87e0b0f20e06635000020000f22e066b9800000c00f326635002000000f30640f02d766b8008000000f23d80f21f86635400000f00f23f8db13b85f078ee82e0f01cf"}], 0xaaaaaaaaaaaac60, 0x0, &(0x7f0000000100), 0x330) ioctl$KVM_NMI(r3, 0xae9a) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4008ae89, &(0x7f0000000040)={0x2, 0x0, [0x4b564d02, 0x1]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) [ 270.740229] kauditd_printk_skb: 3 callbacks suppressed [ 270.740263] audit: type=1326 audit(1538605633.784:31): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=7935 comm="syz-executor0" exe="/root/syz-executor0" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45a3da code=0xffff0000 [ 270.766061] binder: 7936:7940 transaction failed 29189/-22, size 0-0 line 2855 [ 270.822125] ================================================================== [ 270.829566] BUG: KMSAN: uninit-value in __vmx_flush_tlb+0x755/0x790 [ 270.835996] CPU: 1 PID: 7942 Comm: syz-executor5 Not tainted 4.19.0-rc4+ #63 [ 270.843202] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 270.852568] Call Trace: [ 270.855187] dump_stack+0x306/0x460 [ 270.858840] ? __vmx_flush_tlb+0x755/0x790 [ 270.863126] kmsan_report+0x1a3/0x2d0 [ 270.866976] __msan_warning+0x7c/0xe0 [ 270.870814] __vmx_flush_tlb+0x755/0x790 [ 270.874923] vmx_flush_tlb+0x94/0xb0 [ 270.878679] ? vmx_set_rflags+0x740/0x740 [ 270.882863] kvm_mmu_load+0x1656/0x3460 [ 270.886885] ? vmx_set_cr0+0x3510/0x3510 [ 270.890998] kvm_arch_vcpu_ioctl_run+0x879e/0x10a20 [ 270.896202] ? task_kmsan_context_state+0x6b/0x120 [ 270.901168] ? __msan_get_context_state+0x9/0x30 [ 270.905977] ? INIT_INT+0xc/0x30 [ 270.909384] ? task_kmsan_context_state+0x6b/0x120 [ 270.914358] ? __msan_metadata_ptr_for_store_1+0x13/0x20 [ 270.919849] ? kmsan_set_origin_inline+0x6b/0x120 [ 270.924735] ? __msan_poison_alloca+0x17a/0x210 [ 270.929451] ? put_pid+0x71/0x410 [ 270.932945] ? kvm_vcpu_ioctl+0x20a4/0x20b0 [ 270.937311] ? put_pid+0x1a9/0x410 [ 270.940878] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 270.946275] ? get_task_pid+0x17b/0x270 [ 270.950291] kvm_vcpu_ioctl+0x11a7/0x20b0 [ 270.954484] ? do_vfs_ioctl+0x18a/0x2810 [ 270.958582] ? __se_sys_ioctl+0x1da/0x270 [ 270.962762] ? kvm_vm_release+0x90/0x90 [ 270.966764] do_vfs_ioctl+0xcf3/0x2810 [ 270.970702] ? security_file_ioctl+0x92/0x200 [ 270.975246] __se_sys_ioctl+0x1da/0x270 [ 270.979271] __x64_sys_ioctl+0x4a/0x70 [ 270.983194] do_syscall_64+0xbe/0x100 [ 270.987040] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 270.992255] RIP: 0033:0x457579 [ 270.995475] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 271.014399] RSP: 002b:00007fa7086c9c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 271.022142] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457579 [ 271.029430] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000007 [ 271.036727] RBP: 000000000072bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 271.044032] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fa7086ca6d4 [ 271.051339] R13: 00000000004c003b R14: 00000000004d0108 R15: 00000000ffffffff [ 271.058646] [ 271.060296] Local variable description: ----error.i.i.i@__vmx_flush_tlb [ 271.067063] Variable was created at: [ 271.070814] __vmx_flush_tlb+0x103/0x790 [ 271.074898] vmx_flush_tlb+0x94/0xb0 [ 271.078625] ================================================================== [ 271.085995] Disabling lock debugging due to kernel taint [ 271.091468] Kernel panic - not syncing: panic_on_warn set ... [ 271.091468] [ 271.098866] CPU: 1 PID: 7942 Comm: syz-executor5 Tainted: G B 4.19.0-rc4+ #63 [ 271.107457] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 271.116844] Call Trace: [ 271.119461] dump_stack+0x306/0x460 [ 271.123131] panic+0x54c/0xafa [ 271.126391] ? __msan_metadata_ptr_for_store_1+0x13/0x20 [ 271.131869] kmsan_report+0x2cd/0x2d0 [ 271.135710] __msan_warning+0x7c/0xe0 [ 271.139544] __vmx_flush_tlb+0x755/0x790 [ 271.143650] vmx_flush_tlb+0x94/0xb0 [ 271.147387] ? vmx_set_rflags+0x740/0x740 [ 271.151563] kvm_mmu_load+0x1656/0x3460 [ 271.155597] ? vmx_set_cr0+0x3510/0x3510 [ 271.159697] kvm_arch_vcpu_ioctl_run+0x879e/0x10a20 [ 271.164865] ? task_kmsan_context_state+0x6b/0x120 [ 271.169845] ? __msan_get_context_state+0x9/0x30 [ 271.174621] ? INIT_INT+0xc/0x30 [ 271.178018] ? task_kmsan_context_state+0x6b/0x120 [ 271.182973] ? __msan_metadata_ptr_for_store_1+0x13/0x20 [ 271.188455] ? kmsan_set_origin_inline+0x6b/0x120 [ 271.193319] ? __msan_poison_alloca+0x17a/0x210 [ 271.198026] ? put_pid+0x71/0x410 [ 271.201497] ? kvm_vcpu_ioctl+0x20a4/0x20b0 [ 271.205850] ? put_pid+0x1a9/0x410 [ 271.209408] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 271.214795] ? get_task_pid+0x17b/0x270 [ 271.218810] kvm_vcpu_ioctl+0x11a7/0x20b0 [ 271.222997] ? do_vfs_ioctl+0x18a/0x2810 [ 271.227091] ? __se_sys_ioctl+0x1da/0x270 [ 271.231265] ? kvm_vm_release+0x90/0x90 [ 271.235260] do_vfs_ioctl+0xcf3/0x2810 [ 271.239184] ? security_file_ioctl+0x92/0x200 [ 271.243712] __se_sys_ioctl+0x1da/0x270 [ 271.247722] __x64_sys_ioctl+0x4a/0x70 [ 271.251628] do_syscall_64+0xbe/0x100 [ 271.255451] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 271.260657] RIP: 0033:0x457579 [ 271.263864] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 271.282791] RSP: 002b:00007fa7086c9c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 271.290525] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457579 [ 271.297813] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000007 [ 271.305097] RBP: 000000000072bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 271.312377] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fa7086ca6d4 [ 271.319660] R13: 00000000004c003b R14: 00000000004d0108 R15: 00000000ffffffff [ 271.327902] Kernel Offset: disabled [ 271.331543] Rebooting in 86400 seconds..