[info] Using makefile-style concurrent boot in runlevel 2. [ 43.073800][ T26] audit: type=1800 audit(1573592484.323:21): pid=7363 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="bootlogs" dev="sda1" ino=2452 res=0 [ 43.103126][ T26] audit: type=1800 audit(1573592484.323:22): pid=7363 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="motd" dev="sda1" ino=2480 res=0 [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.21' (ECDSA) to the list of known hosts. 2019/11/12 21:01:36 fuzzer started 2019/11/12 21:01:37 dialing manager at 10.128.0.105:45453 2019/11/12 21:01:38 syscalls: 2566 2019/11/12 21:01:38 code coverage: enabled 2019/11/12 21:01:38 comparison tracing: enabled 2019/11/12 21:01:38 extra coverage: extra coverage is not supported by the kernel 2019/11/12 21:01:38 setuid sandbox: enabled 2019/11/12 21:01:38 namespace sandbox: enabled 2019/11/12 21:01:38 Android sandbox: /sys/fs/selinux/policy does not exist 2019/11/12 21:01:38 fault injection: enabled 2019/11/12 21:01:38 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/11/12 21:01:38 net packet injection: enabled 2019/11/12 21:01:38 net device setup: enabled 2019/11/12 21:01:38 concurrency sanitizer: enabled 2019/11/12 21:01:38 devlink PCI setup: PCI device 0000:00:10.0 is not available syzkaller login: [ 67.223168][ T7532] KCSAN: could not find function: 'poll_schedule_timeout' 2019/11/12 21:01:52 adding functions to KCSAN blacklist: 'add_timer' 'generic_fillattr' 'ext4_nonda_switch' 'kernfs_refresh_inode' 'list_lru_count_one' 'ext4_es_lookup_extent' 'find_alive_thread' 'blk_mq_run_hw_queue' 'vti_tunnel_xmit' 'vfs_fsync_range' 'find_get_pages_range_tag' 'kauditd_thread' 'generic_write_end' '__filemap_fdatawrite_range' '__perf_event_overflow' 'ep_poll' 'vm_area_dup' 'blk_mq_free_request' 'tick_do_update_jiffies64' 'process_srcu' 'do_syslog' 'audit_log_start' 'mem_cgroup_select_victim_node' 'ktime_get_seconds' 'do_exit' '__d_lookup_done' 'timer_clear_idle' 'snd_seq_check_queue' '__mark_inode_dirty' 'inactive_list_is_low' 'snd_rawmidi_kernel_write1' 'tomoyo_supervisor' 'pipe_poll' '__ext4_new_inode' 'do_nanosleep' 'icmp_global_allow' 'p9_poll_workfn' 'futex_wait_queue_me' 'kvm_mmu_notifier_invalidate_range_end' 'ext4_mark_iloc_dirty' 'lruvec_lru_size' 'pipe_wait' 'mm_update_next_owner' 'n_tty_receive_buf_common' 'common_perm_cond' 'generic_file_read_iter' 'pid_update_inode' '__add_to_page_cache_locked' 'xas_find_marked' 'exit_signals' 'tcp_add_backlog' 'ksys_read' 'atime_needs_update' 'commit_echoes' 'blk_stat_add' 'run_timer_softirq' 'ext4_free_inode' '__wb_update_bandwidth' '__skb_try_recv_from_queue' 'ktime_get_real_seconds' 'dput' 'tick_sched_do_timer' 'ext4_has_free_clusters' 'p9_client_cb' 'virtqueue_disable_cb' 'dd_has_work' 'poll_schedule_timeout' 'do_signal_stop' 'sit_tunnel_xmit' 'clean_buffers' 'find_next_bit' 'taskstats_exit' 'xas_clear_mark' 'blk_mq_sched_dispatch_requests' 'tick_nohz_idle_stop_tick' 'rq_depth_scale_up' 'snd_seq_prioq_cell_out' '__hrtimer_run_queues' 'blk_mq_dispatch_rq_list' 'echo_char' 'wbt_issue' 'ext4_free_inodes_count' 'rcu_gp_fqs_check_wake' 'pcpu_alloc' 'smpboot_thread_fn' 'page_counter_try_charge' '__find_get_block' '__acct_update_integrals' 'mod_timer' 'blk_mq_get_request' 'copy_process' 'wbc_detach_inode' 'free_pid' '__delete_from_page_cache' 'ext4_writepages' 21:05:21 executing program 0: [ 280.580946][ T7536] IPVS: ftp: loaded support on port[0] = 21 21:05:21 executing program 1: [ 280.651125][ T7536] chnl_net:caif_netlink_parms(): no params data found [ 280.681827][ T7536] bridge0: port 1(bridge_slave_0) entered blocking state [ 280.689036][ T7536] bridge0: port 1(bridge_slave_0) entered disabled state [ 280.697522][ T7536] device bridge_slave_0 entered promiscuous mode [ 280.704723][ T7536] bridge0: port 2(bridge_slave_1) entered blocking state [ 280.712183][ T7536] bridge0: port 2(bridge_slave_1) entered disabled state [ 280.720679][ T7536] device bridge_slave_1 entered promiscuous mode [ 280.739052][ T7536] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 280.749672][ T7536] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 280.779276][ T7536] team0: Port device team_slave_0 added [ 280.797622][ T7536] team0: Port device team_slave_1 added 21:05:22 executing program 2: [ 280.868866][ T7536] device hsr_slave_0 entered promiscuous mode [ 280.907423][ T7536] device hsr_slave_1 entered promiscuous mode [ 280.974239][ T7539] IPVS: ftp: loaded support on port[0] = 21 [ 280.992221][ T7536] bridge0: port 2(bridge_slave_1) entered blocking state [ 280.999316][ T7536] bridge0: port 2(bridge_slave_1) entered forwarding state [ 281.006601][ T7536] bridge0: port 1(bridge_slave_0) entered blocking state [ 281.013656][ T7536] bridge0: port 1(bridge_slave_0) entered forwarding state [ 281.232753][ T7564] IPVS: ftp: loaded support on port[0] = 21 [ 281.361257][ T7536] 8021q: adding VLAN 0 to HW filter on device bond0 [ 281.397119][ T7539] chnl_net:caif_netlink_parms(): no params data found [ 281.438333][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 281.468233][ T12] bridge0: port 1(bridge_slave_0) entered disabled state 21:05:22 executing program 3: [ 281.497721][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 281.527872][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 281.598383][ T7536] 8021q: adding VLAN 0 to HW filter on device team0 [ 281.622138][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 281.648479][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 281.655570][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 281.788009][ T3007] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 281.806925][ T3007] bridge0: port 2(bridge_slave_1) entered blocking state [ 281.814135][ T3007] bridge0: port 2(bridge_slave_1) entered forwarding state [ 281.858025][ T3007] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 281.900249][ T7564] chnl_net:caif_netlink_parms(): no params data found [ 281.903964][ T7570] IPVS: ftp: loaded support on port[0] = 21 [ 281.921740][ T7536] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 281.956590][ T7536] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 281.988815][ T7539] bridge0: port 1(bridge_slave_0) entered blocking state [ 281.996028][ T7539] bridge0: port 1(bridge_slave_0) entered disabled state [ 282.027455][ T7539] device bridge_slave_0 entered promiscuous mode [ 282.057835][ T3007] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 282.066096][ T3007] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 282.098228][ T3007] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 282.127591][ T3007] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 282.157076][ T3007] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 282.177376][ T3007] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 282.207887][ T3007] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready 21:05:23 executing program 4: [ 282.277329][ T7539] bridge0: port 2(bridge_slave_1) entered blocking state [ 282.284393][ T7539] bridge0: port 2(bridge_slave_1) entered disabled state [ 282.308780][ T7539] device bridge_slave_1 entered promiscuous mode [ 282.348056][ T3007] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 282.403037][ T7539] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 282.448207][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 282.455624][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 282.478738][ T7536] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 282.492594][ T7539] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 282.518755][ T7564] bridge0: port 1(bridge_slave_0) entered blocking state [ 282.525883][ T7564] bridge0: port 1(bridge_slave_0) entered disabled state [ 282.543142][ T7564] device bridge_slave_0 entered promiscuous mode [ 282.552142][ T7564] bridge0: port 2(bridge_slave_1) entered blocking state [ 282.559329][ T7564] bridge0: port 2(bridge_slave_1) entered disabled state [ 282.567187][ T7564] device bridge_slave_1 entered promiscuous mode [ 282.589481][ T7539] team0: Port device team_slave_0 added [ 282.604326][ T7564] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 282.638943][ T7539] team0: Port device team_slave_1 added [ 282.645627][ T7564] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 282.682016][ T7582] IPVS: ftp: loaded support on port[0] = 21 [ 282.700053][ T7564] team0: Port device team_slave_0 added 21:05:24 executing program 0: [ 282.768791][ T7539] device hsr_slave_0 entered promiscuous mode [ 282.806954][ T7539] device hsr_slave_1 entered promiscuous mode 21:05:24 executing program 5: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x40, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000040)={0xb, 'syz1\x00', 'syz1\x00', 'syz1\x00', 0xd8, 0x2, 0x2, 0x2, 0xffffffc1, 0x2, "beb312e11a3434f01f4cf575b32260e33fa5369772dd0651992d3364bc53f5f41b066149c804a568209fe9639a12974bbd35a48c4229b2ca78462669969d24a6dde8116a2ee2491a15d3159b16939266124e75b62382ea1959566174fed7193138af145c5af0865795c08b35904d2fabe258d226b33918833135053c2f22698a6f2c300a57773459f8f592c5211b115d461cc973f9631d5301d983b24646d816cca00b26456f55cbc1e8f5875acec58254dbe0fe6ae771cbe2efcdf1532ff7c51de3dfd4024699b971198ddb62322e15e4e2036c0274b8ff"}, 0x1f0) r1 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) read(r1, &(0x7f0000000280)=""/22, 0x16) ioctl$VIDIOC_DBG_G_CHIP_INFO(r0, 0xc0c85666, &(0x7f00000002c0)={{0x0, @name="922a29d8931d751ad52d8b8a921f223bc4c2c0c3be83c592c9981c25d3c814bf"}, "1a769eaab62628571c5f4e2a7d649b565a52af98b9ffc954622a6174cb0863c5", 0x2}) r2 = syz_open_dev$adsp(&(0x7f00000003c0)='/dev/adsp#\x00', 0x9, 0x600000) ioctl$VIDIOC_G_DV_TIMINGS(r2, 0xc0845658, &(0x7f0000000400)={0x0, @reserved}) r3 = socket$bt_rfcomm(0x1f, 0x3, 0x3) pwrite64(r3, &(0x7f00000004c0)="d2e54939186dd5834c1d9218460c07d863b5f7add6bef73bdce4cc22d8f3f417b7d860c41504c033380f81816acb52c53c55518f62afa1fe6620065862a8d96af23b6ecebc0604bf47dd6075ae0cd6ba80a7546f010ee1174acd08b18612159903ad9827877719353fa1016e5d5a6c6ccb6c7b711ec126606fcbe1a11405019f6a8cf1ef8e1787a19290efc557ff5fe272e1dab296b7e50f13483332b6dcded0767ee66be1d64382d030e1dc2b29c81ba1cdba056f9aaf496721dc589aa32980e02c92", 0xc3, 0x80000001) seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0) r4 = socket(0x1, 0x3, 0xfe) ioctl$IMCTRLREQ(r4, 0x80044945, &(0x7f00000005c0)={0x103, 0x5, 0x5, 0x3f}) bind$rxrpc(r4, &(0x7f0000000600)=@in6={0x21, 0x2, 0x2, 0x1c, {0xa, 0x4e23, 0x5, @remote, 0xc5b}}, 0x24) r5 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000640)='/proc/sys/net/ipv4/vs/sync_sock_size\x00', 0x2, 0x0) write$UHID_DESTROY(r5, &(0x7f0000000680), 0x4) setsockopt$inet_dccp_buf(0xffffffffffffffff, 0x21, 0x2, &(0x7f00000006c0)="6fee16812996547f676958cfbb64ded866c58051395faec31cd8410c6ca67ed1635eb0cd35f635", 0x27) syz_genetlink_get_family_id$ipvs(&(0x7f0000000700)='IPVS\x00') r6 = syz_open_dev$sndpcmc(&(0x7f0000000900)='/dev/snd/pcmC#D#c\x00', 0x7, 0x20000) setsockopt$RXRPC_MIN_SECURITY_LEVEL(r6, 0x110, 0x4, &(0x7f0000000940), 0x4) r7 = syz_init_net_socket$bt_l2cap(0x1f, 0x4, 0x0) ioctl$FS_IOC_RESVSP(r7, 0x40305828, &(0x7f0000000980)={0x0, 0x7, 0xb13, 0x1ff}) r8 = syz_open_dev$dmmidi(&(0x7f00000009c0)='/dev/dmmidi#\x00', 0x9, 0x20000) getsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r8, 0x84, 0x7, &(0x7f0000000a00), &(0x7f0000000a40)=0x4) r9 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000a80)='/dev/vcs\x00', 0x4902, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000d00)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000cc0)={0xffffffffffffffff}, 0x111, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r9, &(0x7f0000000d40)={0x5, 0x10, 0xfa00, {&(0x7f0000000ac0), r10, 0xb8482705be8940fd}}, 0x18) r11 = syz_open_dev$mice(&(0x7f0000000d80)='/dev/input/mice\x00', 0x0, 0x100) getsockopt$IP_VS_SO_GET_DESTS(r11, 0x0, 0x484, &(0x7f0000000dc0)=""/29, &(0x7f0000000e00)=0x1d) r12 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000e40)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) r13 = accept4$ax25(r5, &(0x7f0000000e80)={{0x3, @netrom}, [@netrom, @netrom, @bcast, @rose, @netrom, @null, @bcast, @bcast]}, &(0x7f0000000f00)=0x48, 0x1c00) io_uring_register$IORING_REGISTER_FILES(r12, 0x2, &(0x7f0000000f40)=[r3, r8, r13], 0x3) 21:05:24 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$unix(0x1, 0x3, 0x0) bind$unix(r2, &(0x7f00000006c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r3 = socket$unix(0x1, 0x3, 0x0) connect(r1, &(0x7f0000000240)=@in6={0xa, 0x4e24, 0x8, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x1}, 0x80) connect$unix(r3, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(r3, &(0x7f0000002dc0), 0x49a, 0x4ffe0) dup2(r0, r2) [ 282.846576][ T7539] debugfs: Directory 'hsr0' with parent '/' already present! [ 282.854880][ T7564] team0: Port device team_slave_1 added [ 282.870474][ T7570] chnl_net:caif_netlink_parms(): no params data found [ 283.028870][ T7564] device hsr_slave_0 entered promiscuous mode [ 283.066956][ T7564] device hsr_slave_1 entered promiscuous mode [ 283.096667][ T7564] debugfs: Directory 'hsr0' with parent '/' already present! 21:05:24 executing program 0: setresuid(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4007, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$packet(0x11, 0x0, 0x300) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rfkill\x00', 0x0, 0x0) [ 283.294037][ T7570] bridge0: port 1(bridge_slave_0) entered blocking state [ 283.346652][ T7570] bridge0: port 1(bridge_slave_0) entered disabled state [ 283.417207][ T7570] device bridge_slave_0 entered promiscuous mode [ 283.449255][ T7570] bridge0: port 2(bridge_slave_1) entered blocking state [ 283.456410][ T7570] bridge0: port 2(bridge_slave_1) entered disabled state 21:05:24 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) socket$inet6(0xa, 0x2, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') r1 = socket(0x10, 0x0, 0x0) r2 = socket$inet(0x2, 0x80001, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000040)={0x2, 0x8, 0x2, 0x6, 0x7fffffff, 0x8, 0x5, 0x0, r3}, 0x20) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f0000000300)={r3, 0x2, 0x30}, 0xc) r4 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/capi/capi20\x00', 0x208100, 0x0) ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffffff, 0xc0106426, &(0x7f0000000040)={0x3, &(0x7f0000000000)=[{0x0}, {}, {}]}) ioctl$DRM_IOCTL_NEW_CTX(0xffffffffffffffff, 0x40086425, &(0x7f0000000080)={r5, 0x2}) ioctl$DRM_IOCTL_GET_SAREA_CTX(r4, 0xc010641d, &(0x7f00000002c0)={r5, &(0x7f0000000240)=""/53}) r6 = getpid() sched_setattr(r6, &(0x7f0000000040)={0x30, 0x2}, 0x0) r7 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r7, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r9, 0x407, 0x0) write(r9, &(0x7f0000000340), 0x41395527) vmsplice(r8, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3, 0x0, 0xfffffffffffffffb}, 0x0) r10 = creat(&(0x7f0000000280)='./file0\x00', 0x1) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0xa}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) close(r10) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) r11 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r11, &(0x7f0000000480), 0xfffffffffffffdce, 0x0, 0x0, 0x150) shutdown(0xffffffffffffffff, 0x400000000000001) r12 = dup(0xffffffffffffffff) sendmsg$unix(r12, &(0x7f00000001c0)={&(0x7f0000000100)=@abs={0x0, 0x0, 0x4e22}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x800}, 0x4020c10) [ 283.503060][ T7570] device bridge_slave_1 entered promiscuous mode [ 283.560211][ T7539] 8021q: adding VLAN 0 to HW filter on device bond0 [ 283.574544][ T7625] IPVS: ftp: loaded support on port[0] = 21 [ 283.639564][ T7582] chnl_net:caif_netlink_parms(): no params data found [ 283.687142][ T7570] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 283.709308][ T2878] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 283.727109][ T2878] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 283.738258][ T7564] 8021q: adding VLAN 0 to HW filter on device bond0 [ 283.746774][ T7539] 8021q: adding VLAN 0 to HW filter on device team0 [ 283.805150][ T7564] 8021q: adding VLAN 0 to HW filter on device team0 [ 283.831391][ C1] hrtimer: interrupt took 34925 ns [ 283.858399][ T7570] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 283.917521][ T3506] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 283.949557][ T3506] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 284.055410][ T7582] bridge0: port 1(bridge_slave_0) entered blocking state [ 284.075664][ T7582] bridge0: port 1(bridge_slave_0) entered disabled state [ 284.114176][ T7582] device bridge_slave_0 entered promiscuous mode [ 284.185926][ T3506] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 284.209062][ T3506] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 284.259755][ T3506] bridge0: port 1(bridge_slave_0) entered blocking state [ 284.266866][ T3506] bridge0: port 1(bridge_slave_0) entered forwarding state [ 284.345492][ T3506] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 284.395884][ T3506] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 284.438097][ T3506] bridge0: port 1(bridge_slave_0) entered blocking state [ 284.445234][ T3506] bridge0: port 1(bridge_slave_0) entered forwarding state [ 284.545429][ T3506] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready 21:05:25 executing program 0: mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x8031, 0xffffffffffffffff, 0x0) getrusage(0x0, 0x0) r0 = socket$inet6(0xa, 0x3, 0x100000001) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) [ 284.598876][ T3506] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 284.628261][ T3506] bridge0: port 2(bridge_slave_1) entered blocking state [ 284.635329][ T3506] bridge0: port 2(bridge_slave_1) entered forwarding state [ 284.709954][ T3506] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 284.777083][ T3506] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 284.812025][ T3506] bridge0: port 2(bridge_slave_1) entered blocking state [ 284.819138][ T3506] bridge0: port 2(bridge_slave_1) entered forwarding state [ 284.877141][ T3506] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 284.917379][ T3506] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 284.959540][ T3506] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 285.010627][ T3506] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 285.052055][ T3506] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 285.111794][ T3506] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 285.158943][ T3506] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 285.210495][ T3506] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 285.269413][ T3506] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 285.300434][ T3506] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 285.358250][ T3506] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 285.400860][ T3506] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 285.449971][ T3506] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 285.484787][ T3506] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 285.520873][ T3506] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 285.572275][ T3506] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 285.592266][ T3506] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 285.614014][ T3506] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 285.644850][ T3506] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 285.689930][ T3506] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 285.717947][ T7570] team0: Port device team_slave_0 added [ 285.728931][ T7582] bridge0: port 2(bridge_slave_1) entered blocking state [ 285.736002][ T7582] bridge0: port 2(bridge_slave_1) entered disabled state [ 285.773589][ T7582] device bridge_slave_1 entered promiscuous mode [ 285.799998][ T7564] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 285.809238][ T7539] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 285.822438][ T3506] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 285.833228][ T3506] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 285.844325][ T3506] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 285.853336][ T3506] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 285.866488][ T7570] team0: Port device team_slave_1 added [ 285.919653][ T7564] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 285.943381][ T7582] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 285.963958][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 285.976014][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 286.003486][ T7539] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 286.088699][ T7570] device hsr_slave_0 entered promiscuous mode 21:05:27 executing program 0: r0 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet_int(r0, 0x0, 0xb, 0x0, 0x0) [ 286.166885][ T7570] device hsr_slave_1 entered promiscuous mode [ 286.196683][ T7570] debugfs: Directory 'hsr0' with parent '/' already present! 21:05:27 executing program 0: r0 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x1, 0x2) ioctl$VIDIOC_ENUMSTD(r0, 0xc0485619, &(0x7f0000000400)={0x0, 0x0, "3f58d819320c9e4b9d4f47a5992a0f777fe04502f5d148f0"}) [ 286.209367][ T7582] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 286.225822][ T7652] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 286.233408][ T7652] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 286.248521][ T7625] chnl_net:caif_netlink_parms(): no params data found [ 286.277713][ T7582] team0: Port device team_slave_0 added [ 286.343097][ T7582] team0: Port device team_slave_1 added [ 286.522107][ T7582] device hsr_slave_0 entered promiscuous mode [ 286.580491][ T7582] device hsr_slave_1 entered promiscuous mode [ 286.606929][ T7582] debugfs: Directory 'hsr0' with parent '/' already present! 21:05:27 executing program 1: perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x7ff}, 0x0, 0xfffffffffffffffd, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = syz_open_procfs(0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.swap.current\x00', 0x275a, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0xffffffffffffffb9, 0x0, 0x0, 0x1022d) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) bind$packet(r2, &(0x7f0000000140)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @remote}, 0x14) sendmmsg(r2, &(0x7f0000008a80), 0x400000000000328, 0x0) openat$null(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x4008000) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x401, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) sendmsg$IPVS_CMD_GET_DAEMON(0xffffffffffffffff, 0x0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x0) add_key(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff) fchmod(r1, 0x0) setsockopt$inet6_MRT6_ADD_MFC(r1, 0x29, 0xcc, 0x0, 0x0) ioctl$KVM_ASSIGN_PCI_DEVICE(r1, 0x8040ae69, &(0x7f00000000c0)={0x401, 0x5, 0xfffffffa, 0x0, 0x4}) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x6, 0x30, r0, 0x8c951000) syz_open_procfs(0xffffffffffffffff, 0x0) fchmod(0xffffffffffffffff, 0x0) setsockopt$inet6_MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0xcc, 0x0, 0x0) 21:05:27 executing program 0: ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) ioctl$TUNSETTXFILTER(0xffffffffffffffff, 0x400454d1, &(0x7f0000000000)={0x0, 0x7, [@dev, @link_local, @dev={[], 0x3}, @dev={[], 0x18}, @remote, @random="a2dc7be9d8e5", @remote]}) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) r0 = request_key(&(0x7f00000001c0)='blacklist\x00', 0x0, &(0x7f0000000240)='\x00', 0xffffffffffffffff) add_key$user(0x0, 0x0, &(0x7f0000000300)="06f5d98715bbf52657da91142c10e96f7deca434013c598b9f4ce469c67ef41d8ea902b2feaa473a5c697666efb1c30e5df60becc1cc13c5f73c4574148fce55724ce09f44066e824478ee394853df7e2d5db28df44712237f58eede49eae22459399472ec587dddbc6ffdb2e821d2ea09b1343a9af47375", 0x78, r0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='./file0\x00') add_key(0x0, 0x0, &(0x7f0000000240), 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KDSKBMETA(0xffffffffffffffff, 0x4b63, &(0x7f0000000280)=0xc6d) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}, @IFLA_PROTO_DOWN={0x8, 0x4}]}, 0x30}}, 0x0) readahead(0xffffffffffffffff, 0x0, 0x8141) [ 286.637016][ T7625] bridge0: port 1(bridge_slave_0) entered blocking state [ 286.644249][ T7625] bridge0: port 1(bridge_slave_0) entered disabled state [ 286.720159][ T7625] device bridge_slave_0 entered promiscuous mode [ 286.743161][ T7570] 8021q: adding VLAN 0 to HW filter on device bond0 [ 286.789095][ T7625] bridge0: port 2(bridge_slave_1) entered blocking state [ 286.796170][ T7625] bridge0: port 2(bridge_slave_1) entered disabled state [ 286.824757][ T7625] device bridge_slave_1 entered promiscuous mode [ 287.084494][ T7570] 8021q: adding VLAN 0 to HW filter on device team0 [ 287.148883][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 287.169382][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 287.276880][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 287.285437][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 287.336911][ T17] bridge0: port 1(bridge_slave_0) entered blocking state [ 287.343977][ T17] bridge0: port 1(bridge_slave_0) entered forwarding state [ 287.421916][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 287.477189][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 287.485616][ T17] bridge0: port 2(bridge_slave_1) entered blocking state [ 287.492701][ T17] bridge0: port 2(bridge_slave_1) entered forwarding state [ 287.608438][ T7625] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 287.658407][ T7652] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 287.689847][ T7652] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 287.730215][ T7652] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 287.797772][ T7652] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 287.847101][ T7652] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 287.855779][ T7652] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 287.947709][ T7652] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 287.957517][ T7625] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 287.995899][ T7570] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 288.076564][ T7570] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 288.426393][ T3506] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 288.447559][ T3506] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 288.487056][ T3506] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 288.527349][ T3506] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 288.566989][ T3506] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 288.607422][ T3506] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 288.655567][ T7570] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 288.713103][ T7625] team0: Port device team_slave_0 added [ 288.747082][ T7652] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 288.754613][ T7652] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 288.836054][ T7625] team0: Port device team_slave_1 added [ 289.144189][ T7625] device hsr_slave_0 entered promiscuous mode [ 289.186960][ T7625] device hsr_slave_1 entered promiscuous mode [ 289.246619][ T7625] debugfs: Directory 'hsr0' with parent '/' already present! [ 289.262651][ T7582] 8021q: adding VLAN 0 to HW filter on device bond0 [ 289.330330][ T7582] 8021q: adding VLAN 0 to HW filter on device team0 [ 289.362318][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 289.387783][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 289.570133][ T7652] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 289.600348][ T7652] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready 21:05:30 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") r1 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mISDNtimer\x00', 0x0, 0x0) ioctl$IMADDTIMER(r1, 0x80044940, &(0x7f0000000080)=0x14) readv(r1, &(0x7f0000000580)=[{&(0x7f0000000000)=""/4, 0x4}], 0x1) [ 289.621307][ T7652] bridge0: port 1(bridge_slave_0) entered blocking state [ 289.628427][ T7652] bridge0: port 1(bridge_slave_0) entered forwarding state [ 289.679979][ T7652] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 289.708090][ T7652] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 289.746823][ T7652] bridge0: port 2(bridge_slave_1) entered blocking state [ 289.753898][ T7652] bridge0: port 2(bridge_slave_1) entered forwarding state [ 289.800428][ T7652] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 289.827860][ T7652] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 289.847482][ T7652] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 289.867516][ T7652] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 289.896664][ T7652] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 289.904724][ T7652] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 290.019775][ T3506] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 290.037344][ T3506] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 290.046166][ T3506] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 290.087091][ T3506] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 290.098271][ T7582] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 290.131225][ T7582] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 290.251843][ T7652] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 290.267575][ T7652] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 290.310267][ T3007] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 290.336701][ T3007] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 290.422916][ T7582] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 290.456453][ T7625] 8021q: adding VLAN 0 to HW filter on device bond0 [ 290.563786][ T7625] 8021q: adding VLAN 0 to HW filter on device team0 [ 290.597219][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 290.604983][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 290.757900][ T3007] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 290.767069][ T3007] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 290.775363][ T3007] bridge0: port 1(bridge_slave_0) entered blocking state [ 290.782441][ T3007] bridge0: port 1(bridge_slave_0) entered forwarding state [ 290.828896][ T3007] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 290.838543][ T3007] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 290.847988][ T3007] bridge0: port 2(bridge_slave_1) entered blocking state [ 290.855133][ T3007] bridge0: port 2(bridge_slave_1) entered forwarding state [ 290.863385][ T3007] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 290.872729][ T3007] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 290.881647][ T3007] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 290.893225][ T3007] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 290.902036][ T3007] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 290.910743][ T3007] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 290.919512][ T3007] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 290.927938][ T3007] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 290.939025][ T7625] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network 21:05:32 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = timerfd_create(0x0, 0x0) readv(r2, &(0x7f00000001c0)=[{&(0x7f0000000000)=""/14, 0x34c}], 0x1) timerfd_settime(r2, 0x0, &(0x7f0000000040)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) 21:05:32 executing program 2: mount(0x0, 0x0, 0x0, 0x0, 0x0) creat(&(0x7f00000001c0)='./file0/file0\x00', 0x0) r0 = open$dir(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x3810c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x4030582a, &(0x7f0000000000)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r2, &(0x7f00000004c0)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4cc74502f987c2cec6504df6eabb4ed8a60ab563e9c38b4b2a3d27a7082dbb78abd55fba3da80b856445ab100621570b45a48bdaf968a500f2cd89e9b08e3f5972fe9ca162b123e19268c89c9dd81c796f27f537cc5a3fb54aff8eaff4f6b5ffa7a7f69c41705b96a6711d4679079d00000000000000000013007f22e58751c7eb6743f8562c2eee7d9a75f763bee90a1851aadd01c1f18ed1121149c35ec301aac5ec491f1743"], 0x15) r3 = dup(r2) write$FUSE_BMAP(r3, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r3, &(0x7f00000000c0)={0x14c}, 0x137) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000580)={{{@in=@multicast2, @in6=@dev}}, {{@in=@initdev}, 0x0, @in6=@dev}}, &(0x7f00000001c0)=0xe8) chown(0x0, 0x0, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f0000000880)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@cache_fscache='cache=fscache'}, {@dfltgid={'dfltgid'}}, {@afid={'afid', 0x3d, 0x200}}, {@afid={'afid'}}]}}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) fsetxattr$trusted_overlay_opaque(0xffffffffffffffff, &(0x7f0000000340)='trusted.overlay.opaque\x00', 0x0, 0x0, 0x3) setxattr$trusted_overlay_upper(&(0x7f0000000080)='./file0\x00', &(0x7f0000000180)='trusted.overlay.upper\x00', &(0x7f0000000740)={0x0, 0xfb, 0x3c, 0x0, 0x0, "3535612161354c0fb81a15fda9d281b4", "a4d60b5094548af077bcabee2adf4e35466eba17e1aaac20f41178deca0e6663f5edc458c3cbe8"}, 0x3c, 0x2) socket$caif_stream(0x25, 0x1, 0x0) socket(0x10, 0x3, 0x0) mknodat(r0, &(0x7f0000000040)='./file1\x00', 0x0, 0x0) [ 290.974291][ T7625] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 291.029446][ T3007] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 291.038342][ T3007] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 291.055624][ T3007] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 291.064118][ T3007] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 291.087328][ T7] device bridge_slave_1 left promiscuous mode [ 291.094221][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 291.105814][ T7817] 9pnet: bogus RWRITE count (2 > 1) [ 291.137487][ T7] device bridge_slave_0 left promiscuous mode [ 291.143828][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 291.152745][ T7822] 9pnet: bogus RWRITE count (2 > 1) [ 291.856849][ T7] device hsr_slave_0 left promiscuous mode [ 291.916703][ T7] device hsr_slave_1 left promiscuous mode [ 291.972183][ T7] team0 (unregistering): Port device team_slave_1 removed [ 291.981834][ T7] team0 (unregistering): Port device team_slave_0 removed [ 291.991790][ T7] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 292.029592][ T7] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 292.105725][ T7] bond0 (unregistering): Released all slaves [ 292.199345][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 292.206788][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 292.215525][ T7625] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 292.379810][ T26] kauditd_printk_skb: 8 callbacks suppressed [ 292.379827][ T26] audit: type=1326 audit(1573592733.633:31): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=7831 comm="syz-executor.5" exe="/root/syz-executor.5" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45d05a code=0x0 [ 293.248935][ T26] audit: type=1326 audit(1573592734.503:32): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=7831 comm="syz-executor.5" exe="/root/syz-executor.5" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45d05a code=0x0 21:05:34 executing program 5: 21:05:34 executing program 3: r0 = memfd_create(&(0x7f0000000100)='\vem1\xc1\xf8\xa6\x8dN\xc0\xa3w\xe2\xcb\xa2\xba\xe5\xf4\x97\xac#*\xff', 0x0) write(r0, &(0x7f0000000040)="0600", 0x2) write$FUSE_NOTIFY_STORE(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="34e7fffeffff340000007f12b5f0fb0000010000000000b1cd06eaffff000093750500000000070000b7d0e2121788445389cf1f3406000000f706807490073cbc1192c91de591e36c4aacd4bf5b070000005e6b6020635eb90b59f3224e9c339c5ee041bb"], 0xe) sendfile(r0, r0, &(0x7f0000001000), 0xffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x80000000004, 0x11, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f000001a000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f000002eff0)={0x32b, &(0x7f0000000000)=[{}]}, 0x10) 21:05:34 executing program 1: perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x7ff}, 0x0, 0xfffffffffffffffd, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = syz_open_procfs(0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.swap.current\x00', 0x275a, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0xffffffffffffffb9, 0x0, 0x0, 0x1022d) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) bind$packet(r2, &(0x7f0000000140)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @remote}, 0x14) sendmmsg(r2, &(0x7f0000008a80), 0x400000000000328, 0x0) openat$null(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x4008000) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x401, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) sendmsg$IPVS_CMD_GET_DAEMON(0xffffffffffffffff, 0x0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x0) add_key(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff) fchmod(r1, 0x0) setsockopt$inet6_MRT6_ADD_MFC(r1, 0x29, 0xcc, 0x0, 0x0) ioctl$KVM_ASSIGN_PCI_DEVICE(r1, 0x8040ae69, &(0x7f00000000c0)={0x401, 0x5, 0xfffffffa, 0x0, 0x4}) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x6, 0x30, r0, 0x8c951000) syz_open_procfs(0xffffffffffffffff, 0x0) fchmod(0xffffffffffffffff, 0x0) setsockopt$inet6_MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0xcc, 0x0, 0x0) 21:05:34 executing program 0: ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) ioctl$TUNSETTXFILTER(0xffffffffffffffff, 0x400454d1, &(0x7f0000000000)={0x0, 0x7, [@dev, @link_local, @dev={[], 0x3}, @dev={[], 0x18}, @remote, @random="a2dc7be9d8e5", @remote]}) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) r0 = request_key(&(0x7f00000001c0)='blacklist\x00', 0x0, &(0x7f0000000240)='\x00', 0xffffffffffffffff) add_key$user(0x0, 0x0, &(0x7f0000000300)="06f5d98715bbf52657da91142c10e96f7deca434013c598b9f4ce469c67ef41d8ea902b2feaa473a5c697666efb1c30e5df60becc1cc13c5f73c4574148fce55724ce09f44066e824478ee394853df7e2d5db28df44712237f58eede49eae22459399472ec587dddbc6ffdb2e821d2ea09b1343a9af47375", 0x78, r0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='./file0\x00') add_key(0x0, 0x0, &(0x7f0000000240), 0x0, 0xfffffffffffffffc) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KDSKBMETA(0xffffffffffffffff, 0x4b63, &(0x7f0000000280)=0xc6d) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}, @IFLA_PROTO_DOWN={0x8, 0x4}]}, 0x30}}, 0x0) readahead(0xffffffffffffffff, 0x0, 0x8141) 21:05:34 executing program 4: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmmsg$inet6(r0, &(0x7f0000000000)=[{{&(0x7f0000000540)={0xa, 0x4e24, 0x0, @dev}, 0x1c, 0x0, 0x0, &(0x7f0000000640)=[@hoplimit_2292={{0x14}}], 0x18}}], 0x1, 0x0) 21:05:34 executing program 2: mount(0x0, 0x0, 0x0, 0x0, 0x0) creat(&(0x7f00000001c0)='./file0/file0\x00', 0x0) r0 = open$dir(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x3810c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x4030582a, &(0x7f0000000000)) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r2, &(0x7f00000004c0)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4cc74502f987c2cec6504df6eabb4ed8a60ab563e9c38b4b2a3d27a7082dbb78abd55fba3da80b856445ab100621570b45a48bdaf968a500f2cd89e9b08e3f5972fe9ca162b123e19268c89c9dd81c796f27f537cc5a3fb54aff8eaff4f6b5ffa7a7f69c41705b96a6711d4679079d00000000000000000013007f22e58751c7eb6743f8562c2eee7d9a75f763bee90a1851aadd01c1f18ed1121149c35ec301aac5ec491f1743"], 0x15) r3 = dup(r2) write$FUSE_BMAP(r3, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r3, &(0x7f00000000c0)={0x14c}, 0x137) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000580)={{{@in=@multicast2, @in6=@dev}}, {{@in=@initdev}, 0x0, @in6=@dev}}, &(0x7f00000001c0)=0xe8) chown(0x0, 0x0, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f0000000880)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@cache_fscache='cache=fscache'}, {@dfltgid={'dfltgid'}}, {@afid={'afid', 0x3d, 0x200}}, {@afid={'afid'}}]}}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) fsetxattr$trusted_overlay_opaque(0xffffffffffffffff, &(0x7f0000000340)='trusted.overlay.opaque\x00', 0x0, 0x0, 0x3) setxattr$trusted_overlay_upper(&(0x7f0000000080)='./file0\x00', &(0x7f0000000180)='trusted.overlay.upper\x00', &(0x7f0000000740)={0x0, 0xfb, 0x3c, 0x0, 0x0, "3535612161354c0fb81a15fda9d281b4", "a4d60b5094548af077bcabee2adf4e35466eba17e1aaac20f41178deca0e6663f5edc458c3cbe8"}, 0x3c, 0x2) socket$caif_stream(0x25, 0x1, 0x0) socket(0x10, 0x3, 0x0) mknodat(r0, &(0x7f0000000040)='./file1\x00', 0x0, 0x0) 21:05:34 executing program 4: [ 293.445266][ T7839] 9pnet: bogus RWRITE count (2 > 1) 21:05:34 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff}) dup2(r2, r0) pipe(&(0x7f00000003c0)={0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) splice(r3, 0x0, r4, 0x0, 0x1420000a77, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000700)=[@release], 0xffffffffffffff18, 0x0, 0x0}) 21:05:34 executing program 2: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x4c, 0x0, &(0x7f00000002c0)=[@reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 21:05:34 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f00000004c0)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4cc74502f987c2cec6504df6eabb4ed8a60ab563e9c38b4b2a3d27a7082dbb78abd55fba3da80b856445ab100621570b45a48bdaf968a500f2cd89e9b08e3f5972fe9ca162b123e19268c89c9dd81c796f27f537cc5a3fb54aff8eaff4f6b5ffa7a7f69c41705b96a6711d4679079d00000000000000000013007f22e58751c7eb6743f8562c2eee7d9a75f763bee90a1851aadd01c1f18ed1121149c35ec301aac5ec491f1743"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f0000000880)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) setxattr$trusted_overlay_upper(&(0x7f0000000080)='./file0\x00', &(0x7f0000000180)='trusted.overlay.upper\x00', &(0x7f0000000740)=ANY=[@ANYBLOB="00fb4c00003535612161354c0fb81a15fda9d2818af077bcabee2adf4e35466eba17e1aaac20f41100deca0e6663f5edc458c3cbe8b58dd2d47817d51c61f4bdc7d839a191"], 0x4c, 0x2) [ 293.655210][ T7853] debugfs: File '7852' in directory 'proc' already present! [ 293.747330][ T7856] binder: 7852:7856 ioctl c0306201 20000080 returned -14 [ 293.782281][ T7859] debugfs: File '7858' in directory 'proc' already present! 21:05:35 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000000380)={{0x80}, 'port1\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00'}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write(0xffffffffffffffff, &(0x7f0000000200)="200000001a00010000000066835f7f081c000000000000000000000004", 0x1d) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r0, 0x40505330, &(0x7f0000000440)={{}, {0x40000000000080}}) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000019c0)='/dev/sequencer\x00', 0x1, 0x0) write$sndseq(r3, &(0x7f00000001c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @raw8={"8681ac61fdc1a4dd0d8b2392"}}], 0x156) [ 293.816957][ T7859] debugfs: File '7858' in directory 'proc' already present! [ 293.827709][ T7860] 9pnet: bogus RWRITE count (2 > 1) 21:05:35 executing program 2: [ 293.913639][ T7863] 9pnet: bogus RWRITE count (2 > 1) 21:05:35 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f00000004c0)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4cc74502f987c2cec6504df6eabb4ed8a60ab563e9c38b4b2a3d27a7082dbb78abd55fba3da80b856445ab100621570b45a48bdaf968a500f2cd89e9b08e3f5972fe9ca162b123e19268c89c9dd81c796f27f537cc5a3fb54aff8eaff4f6b5ffa7a7f69c41705b96a6711d4679079d00000000000000000013007f22e58751c7eb6743f8562c2eee7d9a75f763bee90a1851aadd01c1f18ed1121149c35ec301aac5ec491f1743"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f0000000880)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) setxattr$trusted_overlay_upper(&(0x7f0000000080)='./file0\x00', &(0x7f0000000180)='trusted.overlay.upper\x00', &(0x7f0000000740)=ANY=[@ANYBLOB="00fb4c00003535612161354c0fb81a15fda9d2818af077bcabee2adf4e35466eba17e1aaac20f41100deca0e6663f5edc458c3cbe8b58dd2d47817d51c61f4bdc7d839a191"], 0x4c, 0x2) 21:05:35 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000000380)={{0x80}, 'port1\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00'}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write(0xffffffffffffffff, &(0x7f0000000200)="200000001a00010000000066835f7f081c000000000000000000000004", 0x1d) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r0, 0x40505330, &(0x7f0000000440)={{}, {0x40000000000080}}) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000019c0)='/dev/sequencer\x00', 0x1, 0x0) write$sndseq(r3, &(0x7f00000001c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @raw8={"8681ac61fdc1a4dd0d8b2392"}}], 0x156) [ 294.162104][ T7844] ================================================================== [ 294.170284][ T7844] BUG: KCSAN: data-race in ksys_write / ksys_write [ 294.176785][ T7844] [ 294.179110][ T7844] write to 0xffff888126f1ca68 of 8 bytes by task 7847 on cpu 0: [ 294.186732][ T7844] ksys_write+0x101/0x1b0 [ 294.191049][ T7844] __x64_sys_write+0x4c/0x60 [ 294.195631][ T7844] do_syscall_64+0xcc/0x370 [ 294.200126][ T7844] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 294.206016][ T7844] [ 294.208349][ T7844] read to 0xffff888126f1ca68 of 8 bytes by task 7844 on cpu 1: [ 294.215884][ T7844] ksys_write+0xa9/0x1b0 [ 294.220113][ T7844] __x64_sys_write+0x4c/0x60 [ 294.224697][ T7844] do_syscall_64+0xcc/0x370 [ 294.229199][ T7844] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 294.235080][ T7844] [ 294.237392][ T7844] Reported by Kernel Concurrency Sanitizer on: [ 294.243533][ T7844] CPU: 1 PID: 7844 Comm: syz-executor.3 Not tainted 5.4.0-rc7+ #0 [ 294.251316][ T7844] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 294.261354][ T7844] ================================================================== [ 294.269400][ T7844] Kernel panic - not syncing: panic_on_warn set ... [ 294.275976][ T7844] CPU: 1 PID: 7844 Comm: syz-executor.3 Not tainted 5.4.0-rc7+ #0 [ 294.283758][ T7844] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 294.293799][ T7844] Call Trace: [ 294.297077][ T7844] dump_stack+0x11d/0x181 [ 294.301393][ T7844] panic+0x210/0x640 [ 294.305288][ T7844] ? vprintk_func+0x8d/0x140 [ 294.309871][ T7844] kcsan_report.cold+0xc/0x1a [ 294.314542][ T7844] kcsan_setup_watchpoint+0x3fe/0x460 [ 294.319917][ T7844] __tsan_read8+0xc6/0x100 [ 294.324321][ T7844] ksys_write+0xa9/0x1b0 [ 294.328556][ T7844] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 294.334798][ T7844] __x64_sys_write+0x4c/0x60 [ 294.339390][ T7844] do_syscall_64+0xcc/0x370 [ 294.343887][ T7844] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 294.349772][ T7844] RIP: 0033:0x45a219 [ 294.353661][ T7844] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 294.373252][ T7844] RSP: 002b:00007f1e1e8f1c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 294.381660][ T7844] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045a219 [ 294.389617][ T7844] RDX: 0000000000000002 RSI: 0000000020000040 RDI: 0000000000000003 [ 294.397576][ T7844] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 294.405534][ T7844] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f1e1e8f26d4 [ 294.413491][ T7844] R13: 00000000004c6cf5 R14: 00000000004e2238 R15: 00000000ffffffff [ 294.422822][ T7844] Kernel Offset: disabled [ 294.427154][ T7844] Rebooting in 86400 seconds..