[ 48.459608][ T26] audit: type=1800 audit(1575921371.169:21): pid=7346 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="bootlogs" dev="sda1" ino=2452 res=0 [ 48.492432][ T26] audit: type=1800 audit(1575921371.179:22): pid=7346 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="motd" dev="sda1" ino=2480 res=0 [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [ 49.275346][ T7419] sshd (7419) used greatest stack depth: 10032 bytes left [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.34' (ECDSA) to the list of known hosts. 2019/12/09 19:56:23 fuzzer started 2019/12/09 19:56:24 dialing manager at 10.128.0.105:38603 2019/12/09 19:56:24 syscalls: 2689 2019/12/09 19:56:24 code coverage: enabled 2019/12/09 19:56:24 comparison tracing: enabled 2019/12/09 19:56:24 extra coverage: extra coverage is not supported by the kernel 2019/12/09 19:56:24 setuid sandbox: enabled 2019/12/09 19:56:24 namespace sandbox: enabled 2019/12/09 19:56:24 Android sandbox: /sys/fs/selinux/policy does not exist 2019/12/09 19:56:24 fault injection: enabled 2019/12/09 19:56:24 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/12/09 19:56:24 net packet injection: enabled 2019/12/09 19:56:24 net device setup: enabled 2019/12/09 19:56:24 concurrency sanitizer: enabled 2019/12/09 19:56:24 devlink PCI setup: PCI device 0000:00:10.0 is not available syzkaller login: [ 65.783355][ T7513] KCSAN: could not find function: 'poll_schedule_timeout' [ 67.233210][ T7513] KCSAN: could not find function: 'may_open' 2019/12/09 19:56:35 adding functions to KCSAN blacklist: 'tcp_add_backlog' 'skb_dequeue' 'vm_area_dup' 'dd_has_work' 'ext4_free_inode' 'ext4_free_inodes_count' '__hrtimer_run_queues' 'mod_timer' 'pid_update_inode' 'tick_sched_do_timer' 'blk_mq_get_request' 'pipe_wait' 'run_timer_softirq' 'aio_read_events' '__mark_inode_dirty' 'xas_clear_mark' 'add_timer' 'sbitmap_queue_clear' 'ext4_has_free_clusters' 'tomoyo_supervisor' 'poll_schedule_timeout' 'process_srcu' 'ktime_get_real_seconds' 'kauditd_thread' 'generic_write_end' '__ext4_new_inode' 'padata_find_next' 'common_perm_cond' 'watchdog' 'do_syslog' 'audit_log_start' 'ext4_mark_iloc_dirty' 'pipe_poll' 'may_open' 'sit_tunnel_xmit' 'copy_process' 'page_counter_try_charge' 'xas_find_marked' 'blk_mq_run_hw_queue' 'lruvec_lru_size' 'do_exit' 'taskstats_exit' '__snd_rawmidi_transmit_ack' 'find_get_pages_range_tag' 'iput' 'wbt_issue' 'blk_mq_sched_dispatch_requests' 'timer_clear_idle' 'atime_needs_update' 'find_next_bit' 'ipip_tunnel_xmit' '__skb_try_recv_from_queue' 'inactive_list_is_low' 'futex_wait_queue_me' 'ep_poll' 'generic_fillattr' 'ext4_nonda_switch' 'rcu_gp_fqs_check_wake' 'tick_do_update_jiffies64' 'do_nanosleep' 'echo_char' 'tick_nohz_idle_stop_tick' 'pcpu_alloc' '__d_lookup_done' 'blk_mq_dispatch_rq_list' 'rcu_gp_fqs_loop' '__dev_queue_xmit' 19:59:42 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000004fc8)={0x0, 0x0, &(0x7f000000b000)={&(0x7f000002c000)=@mpls_newroute={0x24, 0x18, 0x21, 0x0, 0x0, {0x1c, 0x14, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x1}, [@RTA_DST={0x8, 0x1e}]}, 0x24}}, 0x0) 19:59:42 executing program 1: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDGKBENT(r0, 0x560e, &(0x7f00000001c0)={0x7e}) [ 260.107125][ T7516] IPVS: ftp: loaded support on port[0] = 21 [ 260.198295][ T7516] chnl_net:caif_netlink_parms(): no params data found [ 260.264011][ T7516] bridge0: port 1(bridge_slave_0) entered blocking state [ 260.271131][ T7516] bridge0: port 1(bridge_slave_0) entered disabled state [ 260.279175][ T7516] device bridge_slave_0 entered promiscuous mode [ 260.303475][ T7516] bridge0: port 2(bridge_slave_1) entered blocking state [ 260.310593][ T7516] bridge0: port 2(bridge_slave_1) entered disabled state [ 260.318520][ T7516] device bridge_slave_1 entered promiscuous mode [ 260.343280][ T7516] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 260.353691][ T7516] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link 19:59:43 executing program 2: bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000000)) sysinfo(&(0x7f0000000000)=""/22) sendmsg(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0xffffff87, &(0x7f00000001c0)}, 0x0) r0 = socket$inet(0x10, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) ioctl$sock_ifreq(r0, 0x89f1, &(0x7f0000000180)={'ip6_vti0\x00\x14\xea:\x01\x00=\x00', @ifru_flags}) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) [ 260.373267][ T7516] team0: Port device team_slave_0 added [ 260.383256][ T7516] team0: Port device team_slave_1 added [ 260.394188][ T7519] IPVS: ftp: loaded support on port[0] = 21 [ 260.454034][ T7516] device hsr_slave_0 entered promiscuous mode [ 260.503091][ T7516] device hsr_slave_1 entered promiscuous mode 19:59:43 executing program 3: r0 = semget$private(0x0, 0xd, 0x0) semctl$SETALL(r0, 0x0, 0x11, &(0x7f0000000080)=[0x200]) semop(r0, &(0x7f0000000100), 0x2d) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) semctl$IPC_RMID(r0, 0x0, 0x0) [ 260.648155][ T7521] IPVS: ftp: loaded support on port[0] = 21 [ 260.695508][ T7516] bridge0: port 2(bridge_slave_1) entered blocking state [ 260.702694][ T7516] bridge0: port 2(bridge_slave_1) entered forwarding state [ 260.710015][ T7516] bridge0: port 1(bridge_slave_0) entered blocking state [ 260.717067][ T7516] bridge0: port 1(bridge_slave_0) entered forwarding state [ 261.062521][ T7519] chnl_net:caif_netlink_parms(): no params data found 19:59:43 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = socket$key(0xf, 0x3, 0x2) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) ptrace$peekuser(0x3, 0x0, 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000005c0)={0xffffffffffffffff, 0x0, 0x0}, 0x10) sendmsg$key(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[]}}, 0x0) mount(0x0, &(0x7f0000000400)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) syz_mount_image$ext4(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=ANY=[]) open$dir(0x0, 0x0, 0x0) mknodat(0xffffffffffffffff, 0x0, 0x2, 0xfdf) mknodat(0xffffffffffffffff, &(0x7f0000000440)='./file0\x00', 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000040)='/dev/media#\x00', 0x40, 0xa51df1e2e637bf91) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, 0x0, &(0x7f0000000180)) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r1, 0x84, 0x66, &(0x7f00000001c0)={0x0, 0x1}, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)='bpf\x00', 0x61, &(0x7f0000000780)={[{@mode={'mode'}}, {@mode={'mode'}}, {@mode={'mode'}}]}) [ 261.155928][ T7516] 8021q: adding VLAN 0 to HW filter on device bond0 [ 261.183731][ T7548] IPVS: ftp: loaded support on port[0] = 21 [ 261.193032][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 261.242751][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 261.273161][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 261.328072][ T7516] 8021q: adding VLAN 0 to HW filter on device team0 [ 261.423715][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 261.442459][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 261.500209][ T7519] bridge0: port 1(bridge_slave_0) entered blocking state [ 261.507516][ T7519] bridge0: port 1(bridge_slave_0) entered disabled state [ 261.525261][ T7519] device bridge_slave_0 entered promiscuous mode [ 261.574324][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 261.596248][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 261.632139][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 261.639209][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 261.676841][ T7521] chnl_net:caif_netlink_parms(): no params data found [ 261.694040][ T7519] bridge0: port 2(bridge_slave_1) entered blocking state [ 261.701133][ T7519] bridge0: port 2(bridge_slave_1) entered disabled state [ 261.733471][ T7519] device bridge_slave_1 entered promiscuous mode [ 261.775466][ T7554] IPVS: ftp: loaded support on port[0] = 21 [ 261.806120][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 261.822249][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 261.862129][ T17] bridge0: port 2(bridge_slave_1) entered blocking state [ 261.869205][ T17] bridge0: port 2(bridge_slave_1) entered forwarding state [ 261.913863][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 261.976540][ T7519] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 262.002418][ T7552] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready 19:59:44 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0xc008ae88, &(0x7f0000000080)={0x3d, 0x0, [0x20c0000102]}) [ 262.034536][ T7552] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 262.054525][ T7552] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 262.074998][ T7552] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 262.114149][ T7552] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 262.134380][ T7552] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 262.149755][ T7552] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 262.170788][ T7552] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 262.182652][ T7552] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 262.198289][ T7521] bridge0: port 1(bridge_slave_0) entered blocking state [ 262.209633][ T7521] bridge0: port 1(bridge_slave_0) entered disabled state [ 262.217716][ T7521] device bridge_slave_0 entered promiscuous mode [ 262.233191][ T7516] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 262.246902][ T7519] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 262.268822][ T7519] team0: Port device team_slave_0 added [ 262.275411][ T7552] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 262.288513][ T7521] bridge0: port 2(bridge_slave_1) entered blocking state [ 262.295766][ T7521] bridge0: port 2(bridge_slave_1) entered disabled state [ 262.304841][ T7521] device bridge_slave_1 entered promiscuous mode [ 262.323063][ T7521] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 262.337179][ T7519] team0: Port device team_slave_1 added [ 262.357441][ T7521] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 262.375700][ T7565] IPVS: ftp: loaded support on port[0] = 21 [ 262.376435][ T7521] team0: Port device team_slave_0 added [ 262.443750][ T7519] device hsr_slave_0 entered promiscuous mode [ 262.482081][ T7519] device hsr_slave_1 entered promiscuous mode [ 262.541877][ T7519] debugfs: Directory 'hsr0' with parent '/' already present! [ 262.550180][ T7521] team0: Port device team_slave_1 added [ 262.614116][ T7521] device hsr_slave_0 entered promiscuous mode [ 262.682075][ T7521] device hsr_slave_1 entered promiscuous mode [ 262.741876][ T7521] debugfs: Directory 'hsr0' with parent '/' already present! [ 262.778123][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 262.785777][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 262.811022][ T7516] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 262.827741][ T7548] chnl_net:caif_netlink_parms(): no params data found [ 263.045315][ T7554] chnl_net:caif_netlink_parms(): no params data found [ 263.156600][ T7548] bridge0: port 1(bridge_slave_0) entered blocking state [ 263.165015][ T7548] bridge0: port 1(bridge_slave_0) entered disabled state [ 263.211960][ T7548] device bridge_slave_0 entered promiscuous mode [ 263.278667][ T7521] 8021q: adding VLAN 0 to HW filter on device bond0 [ 263.320785][ T7550] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 263.417400][ T7548] bridge0: port 2(bridge_slave_1) entered blocking state [ 263.431889][ T7548] bridge0: port 2(bridge_slave_1) entered disabled state [ 263.484378][ T7548] device bridge_slave_1 entered promiscuous mode [ 263.517997][ T7521] 8021q: adding VLAN 0 to HW filter on device team0 [ 263.540348][ T7519] 8021q: adding VLAN 0 to HW filter on device bond0 [ 263.598854][ T7565] chnl_net:caif_netlink_parms(): no params data found [ 263.685097][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 263.699433][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 263.776873][ T7519] 8021q: adding VLAN 0 to HW filter on device team0 [ 263.805691][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 263.852491][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 263.860840][ T3017] bridge0: port 1(bridge_slave_0) entered blocking state [ 263.867916][ T3017] bridge0: port 1(bridge_slave_0) entered forwarding state 19:59:46 executing program 0: socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffb, 0x31, 0xffffffffffffffff, 0x0) write$binfmt_elf64(r0, &(0x7f0000000380)=ANY=[], 0x5ee3) write$binfmt_misc(r0, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r1, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xfffffe53) ioctl(0xffffffffffffffff, 0x1000008912, 0x0) mmap(&(0x7f00008b0000/0x200000)=nil, 0x200000, 0xc, 0x2031, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x0, 0x0) [ 263.978441][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 264.044158][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 264.061933][ T3017] bridge0: port 2(bridge_slave_1) entered blocking state [ 264.069054][ T3017] bridge0: port 2(bridge_slave_1) entered forwarding state [ 264.175092][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 264.218714][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 264.265588][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 264.313112][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 264.372622][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 264.412196][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 264.463062][ T7548] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 264.507409][ T7554] bridge0: port 1(bridge_slave_0) entered blocking state [ 264.515340][ T7554] bridge0: port 1(bridge_slave_0) entered disabled state [ 264.547233][ T7554] device bridge_slave_0 entered promiscuous mode [ 264.646954][ T7521] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 264.685246][ T7521] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 264.765644][ T7551] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 264.785882][ T7551] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 264.845564][ T7551] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 264.875743][ T7551] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 264.932826][ T7551] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 264.975635][ T7551] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 265.005978][ T7551] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 265.062329][ T7551] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 265.120778][ T7551] bridge0: port 1(bridge_slave_0) entered blocking state [ 265.127868][ T7551] bridge0: port 1(bridge_slave_0) entered forwarding state [ 265.203368][ T7551] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 265.265661][ T7551] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 265.316638][ T7551] bridge0: port 2(bridge_slave_1) entered blocking state [ 265.323728][ T7551] bridge0: port 2(bridge_slave_1) entered forwarding state 19:59:48 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) add_key$keyring(&(0x7f0000000300)='keyring\x00', 0x0, 0x0, 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000500)='/dev/loop#\x00', 0x0, 0x100082) memfd_create(&(0x7f0000000540)='\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00v\x8e\x05\xf7\xc1U\xad}\xc6\x94|W>Zi$Nv8,\n\xa6=W^\xa3Y\x7f\x8b\x17(\'~\xf7k0TM{\xa9-\xcf\x97\x8f\x1f\x81\xdc\x1b\x7f\x8f{4Q\xda\xda\x02\xec\xb4\xf1\xdd\xcc\x8bRA\xda\x89Efn\x00s\xc2Zb\x01\x00M\xbe\xa3z\xab\xd3\xeb\x98\x88\xc4\xc6)A\x9fP\x93zhH\xe0\xd2\x81\xdb\xeeV\x8cM\xe9\xa06\xc2o\x19\"\xf6Iq\xd4\xdf\x97\xfb\xab\x04\xe8\xceI8\xb3\x1d\xcf%\x9bK\xc6\t\x01\xe1\x86a\xfa\xb8\xfb)\x88\xcd+\xc2`\xc2\xf5r5>k\xb0\xa0\x02\xfc\x16MO\x18\x9b\x06\x80b\xd1\x01\x00\x00\x00\x00\x00\x00\x00@\f\fL\xa5{Tk\x940\x17.\xa56.\xe0\x14\x1b=\xf0j\xd25\xe8\x15\xd8\x9e\xea\xd3\xd9G4\t\xc0\x9c.\'\xa9R3z$\xf2\x01\x88\xc0\x13\x12<\xc01j3\xd8\xb4CE7s\xe4\xa0\x9e\xdd\x801\x12M\xee\x13\xce\x9cu(\x8f.\xc83\xc7\xe6j\xf5\xb1\x9a\x00\x00\x00\x00\x00\x00\x00', 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) ioctl$VIDIOC_SUBDEV_S_SELECTION(0xffffffffffffffff, 0xc040563e, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x20000, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket(0x40000000015, 0x5, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) sendmsg$xdp(r1, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) getpeername$packet(r1, 0x0, &(0x7f0000000180)) ioctl$KVM_GET_EMULATED_CPUID(0xffffffffffffffff, 0xc008ae09, &(0x7f00000000c0)=""/34) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000240)='/dev/null\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000280), 0x200, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r0, 0x0, 0x40fdf) [ 265.396744][ T7551] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 265.473463][ T7551] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 265.514366][ T7551] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 265.550374][ T7551] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 265.612232][ T7551] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 265.672553][ T7551] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 265.681172][ T7551] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready 19:59:48 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) add_key$keyring(&(0x7f0000000300)='keyring\x00', 0x0, 0x0, 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000500)='/dev/loop#\x00', 0x0, 0x100082) memfd_create(&(0x7f0000000540)='\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00v\x8e\x05\xf7\xc1U\xad}\xc6\x94|W>Zi$Nv8,\n\xa6=W^\xa3Y\x7f\x8b\x17(\'~\xf7k0TM{\xa9-\xcf\x97\x8f\x1f\x81\xdc\x1b\x7f\x8f{4Q\xda\xda\x02\xec\xb4\xf1\xdd\xcc\x8bRA\xda\x89Efn\x00s\xc2Zb\x01\x00M\xbe\xa3z\xab\xd3\xeb\x98\x88\xc4\xc6)A\x9fP\x93zhH\xe0\xd2\x81\xdb\xeeV\x8cM\xe9\xa06\xc2o\x19\"\xf6Iq\xd4\xdf\x97\xfb\xab\x04\xe8\xceI8\xb3\x1d\xcf%\x9bK\xc6\t\x01\xe1\x86a\xfa\xb8\xfb)\x88\xcd+\xc2`\xc2\xf5r5>k\xb0\xa0\x02\xfc\x16MO\x18\x9b\x06\x80b\xd1\x01\x00\x00\x00\x00\x00\x00\x00@\f\fL\xa5{Tk\x940\x17.\xa56.\xe0\x14\x1b=\xf0j\xd25\xe8\x15\xd8\x9e\xea\xd3\xd9G4\t\xc0\x9c.\'\xa9R3z$\xf2\x01\x88\xc0\x13\x12<\xc01j3\xd8\xb4CE7s\xe4\xa0\x9e\xdd\x801\x12M\xee\x13\xce\x9cu(\x8f.\xc83\xc7\xe6j\xf5\xb1\x9a\x00\x00\x00\x00\x00\x00\x00', 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) ioctl$VIDIOC_SUBDEV_S_SELECTION(0xffffffffffffffff, 0xc040563e, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x20000, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket(0x40000000015, 0x5, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) sendmsg$xdp(r1, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) getpeername$packet(r1, 0x0, &(0x7f0000000180)) ioctl$KVM_GET_EMULATED_CPUID(0xffffffffffffffff, 0xc008ae09, &(0x7f00000000c0)=""/34) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000240)='/dev/null\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000280), 0x200, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r0, 0x0, 0x40fdf) [ 265.752544][ T7551] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 265.794216][ T7548] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 265.817874][ T7554] bridge0: port 2(bridge_slave_1) entered blocking state [ 265.827142][ T7554] bridge0: port 2(bridge_slave_1) entered disabled state [ 265.888819][ T7554] device bridge_slave_1 entered promiscuous mode [ 265.917027][ T7519] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network 19:59:48 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) add_key$keyring(&(0x7f0000000300)='keyring\x00', 0x0, 0x0, 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000500)='/dev/loop#\x00', 0x0, 0x100082) memfd_create(&(0x7f0000000540)='\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00v\x8e\x05\xf7\xc1U\xad}\xc6\x94|W>Zi$Nv8,\n\xa6=W^\xa3Y\x7f\x8b\x17(\'~\xf7k0TM{\xa9-\xcf\x97\x8f\x1f\x81\xdc\x1b\x7f\x8f{4Q\xda\xda\x02\xec\xb4\xf1\xdd\xcc\x8bRA\xda\x89Efn\x00s\xc2Zb\x01\x00M\xbe\xa3z\xab\xd3\xeb\x98\x88\xc4\xc6)A\x9fP\x93zhH\xe0\xd2\x81\xdb\xeeV\x8cM\xe9\xa06\xc2o\x19\"\xf6Iq\xd4\xdf\x97\xfb\xab\x04\xe8\xceI8\xb3\x1d\xcf%\x9bK\xc6\t\x01\xe1\x86a\xfa\xb8\xfb)\x88\xcd+\xc2`\xc2\xf5r5>k\xb0\xa0\x02\xfc\x16MO\x18\x9b\x06\x80b\xd1\x01\x00\x00\x00\x00\x00\x00\x00@\f\fL\xa5{Tk\x940\x17.\xa56.\xe0\x14\x1b=\xf0j\xd25\xe8\x15\xd8\x9e\xea\xd3\xd9G4\t\xc0\x9c.\'\xa9R3z$\xf2\x01\x88\xc0\x13\x12<\xc01j3\xd8\xb4CE7s\xe4\xa0\x9e\xdd\x801\x12M\xee\x13\xce\x9cu(\x8f.\xc83\xc7\xe6j\xf5\xb1\x9a\x00\x00\x00\x00\x00\x00\x00', 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) ioctl$VIDIOC_SUBDEV_S_SELECTION(0xffffffffffffffff, 0xc040563e, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x20000, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket(0x40000000015, 0x5, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) sendmsg$xdp(r1, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) getpeername$packet(r1, 0x0, &(0x7f0000000180)) ioctl$KVM_GET_EMULATED_CPUID(0xffffffffffffffff, 0xc008ae09, &(0x7f00000000c0)=""/34) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000240)='/dev/null\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000280), 0x200, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r0, 0x0, 0x40fdf) [ 265.950425][ T7519] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 265.983633][ T7565] bridge0: port 1(bridge_slave_0) entered blocking state [ 265.990778][ T7565] bridge0: port 1(bridge_slave_0) entered disabled state [ 265.998743][ T7565] device bridge_slave_0 entered promiscuous mode [ 266.019939][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 266.027862][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready 19:59:48 executing program 0: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) add_key$keyring(&(0x7f0000000300)='keyring\x00', 0x0, 0x0, 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000500)='/dev/loop#\x00', 0x0, 0x100082) memfd_create(&(0x7f0000000540)='\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00v\x8e\x05\xf7\xc1U\xad}\xc6\x94|W>Zi$Nv8,\n\xa6=W^\xa3Y\x7f\x8b\x17(\'~\xf7k0TM{\xa9-\xcf\x97\x8f\x1f\x81\xdc\x1b\x7f\x8f{4Q\xda\xda\x02\xec\xb4\xf1\xdd\xcc\x8bRA\xda\x89Efn\x00s\xc2Zb\x01\x00M\xbe\xa3z\xab\xd3\xeb\x98\x88\xc4\xc6)A\x9fP\x93zhH\xe0\xd2\x81\xdb\xeeV\x8cM\xe9\xa06\xc2o\x19\"\xf6Iq\xd4\xdf\x97\xfb\xab\x04\xe8\xceI8\xb3\x1d\xcf%\x9bK\xc6\t\x01\xe1\x86a\xfa\xb8\xfb)\x88\xcd+\xc2`\xc2\xf5r5>k\xb0\xa0\x02\xfc\x16MO\x18\x9b\x06\x80b\xd1\x01\x00\x00\x00\x00\x00\x00\x00@\f\fL\xa5{Tk\x940\x17.\xa56.\xe0\x14\x1b=\xf0j\xd25\xe8\x15\xd8\x9e\xea\xd3\xd9G4\t\xc0\x9c.\'\xa9R3z$\xf2\x01\x88\xc0\x13\x12<\xc01j3\xd8\xb4CE7s\xe4\xa0\x9e\xdd\x801\x12M\xee\x13\xce\x9cu(\x8f.\xc83\xc7\xe6j\xf5\xb1\x9a\x00\x00\x00\x00\x00\x00\x00', 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) ioctl$VIDIOC_SUBDEV_S_SELECTION(0xffffffffffffffff, 0xc040563e, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x61, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x20000, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket(0x40000000015, 0x5, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) sendmsg$xdp(r1, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) getpeername$packet(r1, 0x0, &(0x7f0000000180)) ioctl$KVM_GET_EMULATED_CPUID(0xffffffffffffffff, 0xc008ae09, &(0x7f00000000c0)=""/34) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000240)='/dev/null\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000280), 0x200, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r0, 0x0, 0x40fdf) [ 266.048015][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 266.059955][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 266.070813][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 266.083609][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready 19:59:48 executing program 0: r0 = memfd_create(&(0x7f0000000100)='\x00', 0x0) mmap(&(0x7f0000000000/0xe000)=nil, 0xe000, 0x0, 0x22012, r0, 0x0) get_mempolicy(0x0, &(0x7f0000001400), 0x7f, &(0x7f0000006000/0x1000)=nil, 0x2) [ 266.104926][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 266.137458][ T7565] bridge0: port 2(bridge_slave_1) entered blocking state [ 266.147626][ T7565] bridge0: port 2(bridge_slave_1) entered disabled state [ 266.156683][ T7565] device bridge_slave_1 entered promiscuous mode [ 266.173478][ T7550] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 266.192631][ T7550] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 19:59:48 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x1}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) syz_genetlink_get_family_id$ipvs(0x0) ioctl$FICLONERANGE(0xffffffffffffffff, 0x4020940d, 0x0) pipe2(0x0, 0x0) openat$vsock(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vsock\x00', 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) ioctl$DRM_IOCTL_AGP_ENABLE(0xffffffffffffffff, 0x40086432, &(0x7f0000000380)=0xffff) write(0xffffffffffffffff, &(0x7f00000000c0), 0x0) write$char_usb(0xffffffffffffffff, &(0x7f0000000180)="269da7925c513e2b5f63b2255c0816b52aefc76c25f7e95a49bc9d77be564bddb046b4865ee22ab18a4d3a086c4d45390505a632d48a2246bac759901e42bfb089765d91409030e37749aae88f65c966e40eb36c6985481397e969dbba52062c0bce5abf7cbab6accdafd51df0298f146fdc52e3e43da8abb9a37372807105955d0bfc024a0c89ea41efc8ef3fdc97aa927422029028061d58dacd5effef57dd2d8311a0112bc8e8f460387685cad687", 0xb0) syz_open_dev$swradio(0x0, 0x0, 0x2) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) clone(0x800007fd, 0x0, 0xfffffffffffffffe, 0xfffffffffffffffe, 0xffffffffffffffff) mount(&(0x7f0000000240)=ANY=[@ANYBLOB="5c2e5c3a5d2c303a3a303a00b4e81599b0fe9a74954f6f29f20860e7561bfae8ba05ee4243f33e48a274c62a903ddb5b2e98337986c26932659c853806c9888681d70de5f437c6a7e8866fec67e4"], &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='ceph\x00', 0x0, 0x0) close(0xffffffffffffffff) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80001d00c0d0) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) [ 266.200126][ T7550] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 266.211723][ T7550] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 266.219674][ T7550] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 266.240414][ T7521] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 266.251785][ C1] hrtimer: interrupt took 27245 ns [ 266.261753][ T7554] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 266.282066][ T7519] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 266.289947][ T7548] team0: Port device team_slave_0 added [ 266.297390][ T7548] team0: Port device team_slave_1 added [ 266.343492][ T7554] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 266.371941][ T7565] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 266.381546][ T7675] libceph: resolve '\.\' (ret=-3): failed [ 266.401100][ T7675] libceph: parse_ips bad ip '\.\:],0::0' [ 266.414251][ T7548] device hsr_slave_0 entered promiscuous mode [ 266.472288][ T7548] device hsr_slave_1 entered promiscuous mode [ 266.501982][ T7548] debugfs: Directory 'hsr0' with parent '/' already present! [ 266.517012][ T7565] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 266.536077][ T7554] team0: Port device team_slave_0 added [ 266.583128][ T7554] team0: Port device team_slave_1 added [ 266.667157][ T7554] device hsr_slave_0 entered promiscuous mode [ 266.732153][ T7554] device hsr_slave_1 entered promiscuous mode [ 266.775064][ T7554] debugfs: Directory 'hsr0' with parent '/' already present! [ 266.796522][ T7565] team0: Port device team_slave_0 added [ 266.840397][ T7565] team0: Port device team_slave_1 added 19:59:49 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003b9fdc)) r2 = syz_open_pts(r1, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) ioctl$TCXONC(r3, 0x540a, 0x1) [ 267.104464][ T7565] device hsr_slave_0 entered promiscuous mode [ 267.142287][ T7565] device hsr_slave_1 entered promiscuous mode 19:59:49 executing program 2: timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) futex(&(0x7f0000000100)=0x1, 0x800000000006, 0x0, &(0x7f0000000040)={0x0, 0x989680}, 0x0, 0x0) r0 = gettid() timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x10006, 0x80011, 0xffffffffffffffff, 0x0) tkill(r0, 0x1000000000016) socketpair$unix(0x1, 0x5, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) semget$private(0x0, 0x0, 0x0) r1 = syz_open_dev$vcsa(&(0x7f00000000c0)='/dev/vcsa#\x00', 0x7, 0x6e49c0) ioctl$KDGKBSENT(r1, 0x4b48, &(0x7f0000000240)={0x6, "263a6a21f8cd32b478974a22697555e5f5aa1d1878abfb86aae3f5c901e98d99fd82e1521da579437a0715bd0e47a03c5d011ac6649c0ae9e914c6322afa28fd01a349641aac15b950a412cf6611508eae72aa4430b68d938afcf258ba42d7589dd37f58b40fb4493603d9f48c2b4cb4efec86a037a8ada9c88c5c4f47f26d7d62135655fac75caf1bb94bc01ad014d45d7c65d904817af5a4cc1749408be41362992d11613f8426559a520cdb28410654c69bf976a50364a71d9c442b047add2407f6684b60ed77c608715f6d30e7849a46edf27e3f29e6d6b237222720576819ee66a0f6005326e3dc762d213dc5626da50071317fa305c1f2f4adf7067ced09d1b84bd401d6e13e4fc666abf26501f273135b986581f047ea663ac2e9e8ff26163683aaf155e63a556e9911d29acb1d10aa15bcba3821cfa8d36ce8197da2abb21b744867b4e1f7396105530bc86d58a6c4217ce1776c28919f80632108fbfa84199d6224e090939b6e5d57c95f842f6f0e6273bc20fafb8f6b84ebc4f260916ee6810ba7770ce90a9b614385ce3a54115afc8d3a3ca62f69ea4aeac4626754e91c827d83723f1afe7fcf1f5ae0e535ae3341f8ae0a6266574f5c1f493620478c267f49e75ce7d1660ad7f5a4d23505cf25f30acc577e7020782bc2627ea3d6897570b15f121c45c3d90770360d8db305f7c04addade2f0bddba9ea3204bf"}) mknod(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f00000004c0)={0x0, 0x3ff, 0x4000, {0x401, 0x6}, {0xfff9, 0x5}, @period={0x5a, 0x32, 0x33, 0x6, 0x40, {0xff00, 0x2, 0xad9, 0x101}, 0x6, &(0x7f0000000480)=[0x20, 0x1, 0x3d3, 0x37, 0xfffe, 0x1b9]}}) syz_open_dev$rtc(&(0x7f00000001c0)='/dev/rtc#\x00', 0x5, 0x20000) lseek(0xffffffffffffffff, 0x1f, 0x0) clone(0x180000105, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f000000a000)={0x4, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0x2}, 0x8000000200000402, 0x800007f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000fb5ffc)='nfs\x00', 0x0, &(0x7f000000a000)) r2 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) write$P9_RATTACH(r2, &(0x7f0000000080)={0x14, 0x69, 0x0, {0x0, 0x1, 0x2}}, 0xffffff70) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 267.182962][ T7565] debugfs: Directory 'hsr0' with parent '/' already present! [ 267.245306][ T7548] 8021q: adding VLAN 0 to HW filter on device bond0 [ 267.369718][ T7548] 8021q: adding VLAN 0 to HW filter on device team0 [ 267.435362][ T7555] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 267.462188][ T7555] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 267.469964][ T7555] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 267.668246][ T7555] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 267.778814][ T7555] bridge0: port 1(bridge_slave_0) entered blocking state [ 267.785935][ T7555] bridge0: port 1(bridge_slave_0) entered forwarding state [ 267.909496][ T7554] 8021q: adding VLAN 0 to HW filter on device bond0 [ 267.983532][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 267.991498][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 268.065600][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 268.152333][ T17] bridge0: port 2(bridge_slave_1) entered blocking state [ 268.159408][ T17] bridge0: port 2(bridge_slave_1) entered forwarding state [ 268.255331][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 268.322795][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 268.402088][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 268.410994][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 268.492696][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 268.501406][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 268.625051][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 268.737890][ T7554] 8021q: adding VLAN 0 to HW filter on device team0 [ 268.771442][ T7548] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 268.864580][ T7548] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 268.957437][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 268.972384][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 268.980109][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 269.102416][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 269.111404][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 269.202438][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 269.216931][ T7565] 8021q: adding VLAN 0 to HW filter on device bond0 [ 269.275566][ T7548] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 269.335088][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 269.372357][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 269.381703][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 269.482093][ T17] bridge0: port 1(bridge_slave_0) entered blocking state [ 269.489173][ T17] bridge0: port 1(bridge_slave_0) entered forwarding state [ 269.562457][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 269.571062][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 269.692211][ T17] bridge0: port 2(bridge_slave_1) entered blocking state [ 269.699289][ T17] bridge0: port 2(bridge_slave_1) entered forwarding state [ 269.782492][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 269.789944][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 269.896596][ T7565] 8021q: adding VLAN 0 to HW filter on device team0 [ 269.942634][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 269.951555][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 270.024455][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 270.075304][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 270.145712][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 270.205381][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 270.245285][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 270.305725][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 270.342383][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 270.350776][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 270.402477][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 270.410863][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 270.469131][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 270.509331][ T7554] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 270.558772][ T7552] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 270.577713][ T7552] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 270.615410][ T7552] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 270.624581][ T7552] bridge0: port 1(bridge_slave_0) entered blocking state [ 270.631612][ T7552] bridge0: port 1(bridge_slave_0) entered forwarding state [ 270.682758][ T7552] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 270.710546][ T7552] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 270.739827][ T7552] bridge0: port 2(bridge_slave_1) entered blocking state [ 270.746986][ T7552] bridge0: port 2(bridge_slave_1) entered forwarding state [ 270.790882][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 270.799121][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 270.810178][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 270.819446][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 270.828437][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 270.837201][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 270.845888][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 270.854621][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 270.865617][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 270.874083][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 270.895694][ T7554] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 270.930721][ T7565] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 270.948022][ T7565] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 270.960816][ T7550] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 270.969214][ T7550] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 270.978188][ T7550] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 270.986686][ T7550] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 270.995114][ T7550] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 271.015371][ T7552] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 271.022873][ T7552] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 271.037393][ T7565] 8021q: adding VLAN 0 to HW filter on device batadv0 19:59:53 executing program 0: sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) mremap(&(0x7f00003fb000/0x400000)=nil, 0x400000, 0x400000, 0x3, &(0x7f0000bff000/0x400000)=nil) syz_genetlink_get_family_id$fou(&(0x7f0000000040)='fou\x00') openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0xb6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dri(&(0x7f00000001c0)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(0x0, 0x0, 0x0) r2 = fcntl$dupfd(r0, 0x0, r1) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r2, 0x402c5342, &(0x7f00000000c0)={0x0, 0xb861}) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$EVIOCSFF(r2, 0x40304580, &(0x7f0000000000)={0x55, 0x750b, 0xb4, {0xffff, 0x6}, {0x0, 0x2}, @rumble={0x0, 0xfff}}) mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) ioctl$USBDEVFS_REAPURBNDELAY(0xffffffffffffffff, 0x4008550d, &(0x7f00000002c0)) clone(0x180000105, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8000000200000000, 0x800007f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000fb5ffc)='nfs\x00', 0x0, &(0x7f000000a000)) r3 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) write$P9_RATTACH(r3, &(0x7f0000000080)={0x14}, 0xfffffff4) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) [ 271.213333][ T7829] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 271.369428][ T7820] syz-executor.0 (7820) used greatest stack depth: 9960 bytes left 19:59:54 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = socket$key(0xf, 0x3, 0x2) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) ptrace$peekuser(0x3, 0x0, 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000005c0)={0xffffffffffffffff, 0x0, 0x0}, 0x10) sendmsg$key(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[]}}, 0x0) mount(0x0, &(0x7f0000000400)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) syz_mount_image$ext4(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=ANY=[]) open$dir(0x0, 0x0, 0x0) mknodat(0xffffffffffffffff, 0x0, 0x2, 0xfdf) mknodat(0xffffffffffffffff, &(0x7f0000000440)='./file0\x00', 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000040)='/dev/media#\x00', 0x40, 0xa51df1e2e637bf91) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, 0x0, &(0x7f0000000180)) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r1, 0x84, 0x66, &(0x7f00000001c0)={0x0, 0x1}, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)='bpf\x00', 0x61, &(0x7f0000000780)={[{@mode={'mode'}}, {@mode={'mode'}}, {@mode={'mode'}}]}) 19:59:54 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = socket$key(0xf, 0x3, 0x2) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) ptrace$peekuser(0x3, 0x0, 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000005c0)={0xffffffffffffffff, 0x0, 0x0}, 0x10) sendmsg$key(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[]}}, 0x0) mount(0x0, &(0x7f0000000400)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) syz_mount_image$ext4(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=ANY=[]) open$dir(0x0, 0x0, 0x0) mknodat(0xffffffffffffffff, 0x0, 0x2, 0xfdf) mknodat(0xffffffffffffffff, &(0x7f0000000440)='./file0\x00', 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000040)='/dev/media#\x00', 0x40, 0xa51df1e2e637bf91) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, 0x0, &(0x7f0000000180)) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r1, 0x84, 0x66, &(0x7f00000001c0)={0x0, 0x1}, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)='bpf\x00', 0x61, &(0x7f0000000780)={[{@mode={'mode'}}, {@mode={'mode'}}, {@mode={'mode'}}]}) 19:59:54 executing program 3: r0 = semget$private(0x0, 0xd, 0x0) semctl$SETALL(r0, 0x0, 0x11, &(0x7f0000000080)=[0x200]) semop(r0, &(0x7f0000000100), 0x2d) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) semctl$IPC_RMID(r0, 0x0, 0x0) 19:59:54 executing program 2: syz_mount_image$btrfs(&(0x7f0000000000)='btrfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000140)="8da4363ac0ed0200000007002301004d010000000000000000007a0000000000fff6f2a2299748aeb81e1b00920efd9a000001000000000001fffffff60000005f42485266535f4d", 0x48, 0x10000}], 0x0, 0x0) 19:59:54 executing program 1: capset(&(0x7f0000be6ff8)={0x19980330}, &(0x7f000032e000)) creat(&(0x7f0000891ff8)='./file0\x00', 0x0) lsetxattr(&(0x7f0000712ff8)='./file0\x00', &(0x7f0000faffe7)=@known='security.capability\x00', &(0x7f0000d9ffec)='\x00\x00\x00\x02\x01\x00\x00\x00\x00\x00\x00\x01\x04\x00\x00\x00\x00\x00\x00\x00', 0x14, 0x0) 19:59:54 executing program 0: sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) mremap(&(0x7f00003fb000/0x400000)=nil, 0x400000, 0x400000, 0x3, &(0x7f0000bff000/0x400000)=nil) syz_genetlink_get_family_id$fou(&(0x7f0000000040)='fou\x00') openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0xb6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dri(&(0x7f00000001c0)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(0x0, 0x0, 0x0) r2 = fcntl$dupfd(r0, 0x0, r1) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r2, 0x402c5342, &(0x7f00000000c0)={0x0, 0xb861}) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$EVIOCSFF(r2, 0x40304580, &(0x7f0000000000)={0x55, 0x750b, 0xb4, {0xffff, 0x6}, {0x0, 0x2}, @rumble={0x0, 0xfff}}) mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) ioctl$USBDEVFS_REAPURBNDELAY(0xffffffffffffffff, 0x4008550d, &(0x7f00000002c0)) clone(0x180000105, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8000000200000000, 0x800007f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000fb5ffc)='nfs\x00', 0x0, &(0x7f000000a000)) r3 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) write$P9_RATTACH(r3, &(0x7f0000000080)={0x14}, 0xfffffff4) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) 19:59:54 executing program 3: r0 = semget$private(0x0, 0xd, 0x0) semctl$SETALL(r0, 0x0, 0x11, &(0x7f0000000080)=[0x200]) semop(r0, &(0x7f0000000100), 0x2d) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) semctl$IPC_RMID(r0, 0x0, 0x0) [ 271.517015][ T7854] capability: warning: `syz-executor.1' uses 32-bit capabilities (legacy support in use) [ 271.550183][ T7851] BTRFS: device fsid fff6f2a2-2997-48ae-b81e-1b00920efd9a devid 0 transid 0 /dev/loop2 19:59:54 executing program 0: sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) mremap(&(0x7f00003fb000/0x400000)=nil, 0x400000, 0x400000, 0x3, &(0x7f0000bff000/0x400000)=nil) syz_genetlink_get_family_id$fou(&(0x7f0000000040)='fou\x00') openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0xb6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dri(&(0x7f00000001c0)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(0x0, 0x0, 0x0) r2 = fcntl$dupfd(r0, 0x0, r1) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r2, 0x402c5342, &(0x7f00000000c0)={0x0, 0xb861}) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$EVIOCSFF(r2, 0x40304580, &(0x7f0000000000)={0x55, 0x750b, 0xb4, {0xffff, 0x6}, {0x0, 0x2}, @rumble={0x0, 0xfff}}) mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) ioctl$USBDEVFS_REAPURBNDELAY(0xffffffffffffffff, 0x4008550d, &(0x7f00000002c0)) clone(0x180000105, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8000000200000000, 0x800007f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000fb5ffc)='nfs\x00', 0x0, &(0x7f000000a000)) r3 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) write$P9_RATTACH(r3, &(0x7f0000000080)={0x14}, 0xfffffff4) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) 19:59:54 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = socket$key(0xf, 0x3, 0x2) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) ptrace$peekuser(0x3, 0x0, 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000005c0)={0xffffffffffffffff, 0x0, 0x0}, 0x10) sendmsg$key(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[]}}, 0x0) mount(0x0, &(0x7f0000000400)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) syz_mount_image$ext4(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=ANY=[]) open$dir(0x0, 0x0, 0x0) mknodat(0xffffffffffffffff, 0x0, 0x2, 0xfdf) mknodat(0xffffffffffffffff, &(0x7f0000000440)='./file0\x00', 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000040)='/dev/media#\x00', 0x40, 0xa51df1e2e637bf91) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, 0x0, &(0x7f0000000180)) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r1, 0x84, 0x66, &(0x7f00000001c0)={0x0, 0x1}, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)='bpf\x00', 0x61, &(0x7f0000000780)={[{@mode={'mode'}}, {@mode={'mode'}}, {@mode={'mode'}}]}) 19:59:54 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = socket$key(0xf, 0x3, 0x2) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) ptrace$peekuser(0x3, 0x0, 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000005c0)={0xffffffffffffffff, 0x0, 0x0}, 0x10) sendmsg$key(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[]}}, 0x0) mount(0x0, &(0x7f0000000400)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) syz_mount_image$ext4(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=ANY=[]) open$dir(0x0, 0x0, 0x0) mknodat(0xffffffffffffffff, 0x0, 0x2, 0xfdf) mknodat(0xffffffffffffffff, &(0x7f0000000440)='./file0\x00', 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000040)='/dev/media#\x00', 0x40, 0xa51df1e2e637bf91) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, 0x0, &(0x7f0000000180)) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r1, 0x84, 0x66, &(0x7f00000001c0)={0x0, 0x1}, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)='bpf\x00', 0x61, &(0x7f0000000780)={[{@mode={'mode'}}, {@mode={'mode'}}, {@mode={'mode'}}]}) 19:59:54 executing program 3: r0 = semget$private(0x0, 0xd, 0x0) semctl$SETALL(r0, 0x0, 0x11, &(0x7f0000000080)=[0x200]) semop(r0, &(0x7f0000000100), 0x2d) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) semctl$IPC_RMID(r0, 0x0, 0x0) 19:59:54 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = socket$key(0xf, 0x3, 0x2) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) ptrace$peekuser(0x3, 0x0, 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000005c0)={0xffffffffffffffff, 0x0, 0x0}, 0x10) sendmsg$key(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[]}}, 0x0) mount(0x0, &(0x7f0000000400)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) syz_mount_image$ext4(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=ANY=[]) open$dir(0x0, 0x0, 0x0) mknodat(0xffffffffffffffff, 0x0, 0x2, 0xfdf) mknodat(0xffffffffffffffff, &(0x7f0000000440)='./file0\x00', 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000040)='/dev/media#\x00', 0x40, 0xa51df1e2e637bf91) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, 0x0, &(0x7f0000000180)) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r1, 0x84, 0x66, &(0x7f00000001c0)={0x0, 0x1}, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)='bpf\x00', 0x61, &(0x7f0000000780)={[{@mode={'mode'}}, {@mode={'mode'}}, {@mode={'mode'}}]}) 19:59:54 executing program 2: syz_mount_image$btrfs(&(0x7f0000000000)='btrfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000140)="8da4363ac0ed0200000007002301004d010000000000000000007a0000000000fff6f2a2299748aeb81e1b00920efd9a000001000000000001fffffff60000005f42485266535f4d", 0x48, 0x10000}], 0x0, 0x0) 19:59:54 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = socket$key(0xf, 0x3, 0x2) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) ptrace$peekuser(0x3, 0x0, 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000005c0)={0xffffffffffffffff, 0x0, 0x0}, 0x10) sendmsg$key(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[]}}, 0x0) mount(0x0, &(0x7f0000000400)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) syz_mount_image$ext4(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=ANY=[]) open$dir(0x0, 0x0, 0x0) mknodat(0xffffffffffffffff, 0x0, 0x2, 0xfdf) mknodat(0xffffffffffffffff, &(0x7f0000000440)='./file0\x00', 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000040)='/dev/media#\x00', 0x40, 0xa51df1e2e637bf91) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, 0x0, &(0x7f0000000180)) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r1, 0x84, 0x66, &(0x7f00000001c0)={0x0, 0x1}, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)='bpf\x00', 0x61, &(0x7f0000000780)={[{@mode={'mode'}}, {@mode={'mode'}}, {@mode={'mode'}}]}) 19:59:54 executing program 0: sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) mremap(&(0x7f00003fb000/0x400000)=nil, 0x400000, 0x400000, 0x3, &(0x7f0000bff000/0x400000)=nil) syz_genetlink_get_family_id$fou(&(0x7f0000000040)='fou\x00') openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0xb6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dri(&(0x7f00000001c0)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(0x0, 0x0, 0x0) r2 = fcntl$dupfd(r0, 0x0, r1) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r2, 0x402c5342, &(0x7f00000000c0)={0x0, 0xb861}) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$EVIOCSFF(r2, 0x40304580, &(0x7f0000000000)={0x55, 0x750b, 0xb4, {0xffff, 0x6}, {0x0, 0x2}, @rumble={0x0, 0xfff}}) mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) ioctl$USBDEVFS_REAPURBNDELAY(0xffffffffffffffff, 0x4008550d, &(0x7f00000002c0)) clone(0x180000105, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8000000200000000, 0x800007f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000fb5ffc)='nfs\x00', 0x0, &(0x7f000000a000)) r3 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) write$P9_RATTACH(r3, &(0x7f0000000080)={0x14}, 0xfffffff4) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) 19:59:55 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = socket$key(0xf, 0x3, 0x2) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) ptrace$peekuser(0x3, 0x0, 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000005c0)={0xffffffffffffffff, 0x0, 0x0}, 0x10) sendmsg$key(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[]}}, 0x0) mount(0x0, &(0x7f0000000400)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) syz_mount_image$ext4(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=ANY=[]) open$dir(0x0, 0x0, 0x0) mknodat(0xffffffffffffffff, 0x0, 0x2, 0xfdf) mknodat(0xffffffffffffffff, &(0x7f0000000440)='./file0\x00', 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000040)='/dev/media#\x00', 0x40, 0xa51df1e2e637bf91) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, 0x0, &(0x7f0000000180)) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r1, 0x84, 0x66, &(0x7f00000001c0)={0x0, 0x1}, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)='bpf\x00', 0x61, &(0x7f0000000780)={[{@mode={'mode'}}, {@mode={'mode'}}, {@mode={'mode'}}]}) 19:59:55 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = socket$key(0xf, 0x3, 0x2) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) ptrace$peekuser(0x3, 0x0, 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000005c0)={0xffffffffffffffff, 0x0, 0x0}, 0x10) sendmsg$key(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[]}}, 0x0) mount(0x0, &(0x7f0000000400)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) syz_mount_image$ext4(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=ANY=[]) open$dir(0x0, 0x0, 0x0) mknodat(0xffffffffffffffff, 0x0, 0x2, 0xfdf) mknodat(0xffffffffffffffff, &(0x7f0000000440)='./file0\x00', 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000040)='/dev/media#\x00', 0x40, 0xa51df1e2e637bf91) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, 0x0, &(0x7f0000000180)) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r1, 0x84, 0x66, &(0x7f00000001c0)={0x0, 0x1}, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)='bpf\x00', 0x61, &(0x7f0000000780)={[{@mode={'mode'}}, {@mode={'mode'}}, {@mode={'mode'}}]}) 19:59:55 executing program 0: sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) mremap(&(0x7f00003fb000/0x400000)=nil, 0x400000, 0x400000, 0x3, &(0x7f0000bff000/0x400000)=nil) syz_genetlink_get_family_id$fou(&(0x7f0000000040)='fou\x00') openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0xb6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dri(&(0x7f00000001c0)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(0x0, 0x0, 0x0) r2 = fcntl$dupfd(r0, 0x0, r1) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r2, 0x402c5342, &(0x7f00000000c0)={0x0, 0xb861}) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$EVIOCSFF(r2, 0x40304580, &(0x7f0000000000)={0x55, 0x750b, 0xb4, {0xffff, 0x6}, {0x0, 0x2}, @rumble={0x0, 0xfff}}) mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) ioctl$USBDEVFS_REAPURBNDELAY(0xffffffffffffffff, 0x4008550d, &(0x7f00000002c0)) clone(0x180000105, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8000000200000000, 0x800007f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000fb5ffc)='nfs\x00', 0x0, &(0x7f000000a000)) r3 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) write$P9_RATTACH(r3, &(0x7f0000000080)={0x14}, 0xfffffff4) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) 19:59:55 executing program 3: sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) mremap(&(0x7f00003fb000/0x400000)=nil, 0x400000, 0x400000, 0x3, &(0x7f0000bff000/0x400000)=nil) syz_genetlink_get_family_id$fou(&(0x7f0000000040)='fou\x00') openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0xb6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dri(&(0x7f00000001c0)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(0x0, 0x0, 0x0) r2 = fcntl$dupfd(r0, 0x0, r1) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r2, 0x402c5342, &(0x7f00000000c0)={0x0, 0xb861}) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$EVIOCSFF(r2, 0x40304580, &(0x7f0000000000)={0x55, 0x750b, 0xb4, {0xffff, 0x6}, {0x0, 0x2}, @rumble={0x0, 0xfff}}) mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) ioctl$USBDEVFS_REAPURBNDELAY(0xffffffffffffffff, 0x4008550d, &(0x7f00000002c0)) clone(0x180000105, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8000000200000000, 0x800007f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000fb5ffc)='nfs\x00', 0x0, &(0x7f000000a000)) r3 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) write$P9_RATTACH(r3, &(0x7f0000000080)={0x14}, 0xfffffff4) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) 19:59:55 executing program 2: syz_mount_image$btrfs(&(0x7f0000000000)='btrfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000140)="8da4363ac0ed0200000007002301004d010000000000000000007a0000000000fff6f2a2299748aeb81e1b00920efd9a000001000000000001fffffff60000005f42485266535f4d", 0x48, 0x10000}], 0x0, 0x0) 19:59:55 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = socket$key(0xf, 0x3, 0x2) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) ptrace$peekuser(0x3, 0x0, 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000005c0)={0xffffffffffffffff, 0x0, 0x0}, 0x10) sendmsg$key(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[]}}, 0x0) mount(0x0, &(0x7f0000000400)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) syz_mount_image$ext4(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=ANY=[]) open$dir(0x0, 0x0, 0x0) mknodat(0xffffffffffffffff, 0x0, 0x2, 0xfdf) mknodat(0xffffffffffffffff, &(0x7f0000000440)='./file0\x00', 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000040)='/dev/media#\x00', 0x40, 0xa51df1e2e637bf91) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, 0x0, &(0x7f0000000180)) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r1, 0x84, 0x66, &(0x7f00000001c0)={0x0, 0x1}, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)='bpf\x00', 0x61, &(0x7f0000000780)={[{@mode={'mode'}}, {@mode={'mode'}}, {@mode={'mode'}}]}) 19:59:55 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = socket$key(0xf, 0x3, 0x2) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) ptrace$peekuser(0x3, 0x0, 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000005c0)={0xffffffffffffffff, 0x0, 0x0}, 0x10) sendmsg$key(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[]}}, 0x0) mount(0x0, &(0x7f0000000400)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) syz_mount_image$ext4(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=ANY=[]) open$dir(0x0, 0x0, 0x0) mknodat(0xffffffffffffffff, 0x0, 0x2, 0xfdf) mknodat(0xffffffffffffffff, &(0x7f0000000440)='./file0\x00', 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000040)='/dev/media#\x00', 0x40, 0xa51df1e2e637bf91) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, 0x0, &(0x7f0000000180)) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r1, 0x84, 0x66, &(0x7f00000001c0)={0x0, 0x1}, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)='bpf\x00', 0x61, &(0x7f0000000780)={[{@mode={'mode'}}, {@mode={'mode'}}, {@mode={'mode'}}]}) 19:59:55 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = socket$key(0xf, 0x3, 0x2) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) ptrace$peekuser(0x3, 0x0, 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000005c0)={0xffffffffffffffff, 0x0, 0x0}, 0x10) sendmsg$key(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[]}}, 0x0) mount(0x0, &(0x7f0000000400)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) syz_mount_image$ext4(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=ANY=[]) open$dir(0x0, 0x0, 0x0) mknodat(0xffffffffffffffff, 0x0, 0x2, 0xfdf) mknodat(0xffffffffffffffff, &(0x7f0000000440)='./file0\x00', 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000040)='/dev/media#\x00', 0x40, 0xa51df1e2e637bf91) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, 0x0, &(0x7f0000000180)) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r1, 0x84, 0x66, &(0x7f00000001c0)={0x0, 0x1}, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)='bpf\x00', 0x61, &(0x7f0000000780)={[{@mode={'mode'}}, {@mode={'mode'}}, {@mode={'mode'}}]}) 19:59:55 executing program 0: sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) mremap(&(0x7f00003fb000/0x400000)=nil, 0x400000, 0x400000, 0x3, &(0x7f0000bff000/0x400000)=nil) syz_genetlink_get_family_id$fou(&(0x7f0000000040)='fou\x00') openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0xb6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dri(&(0x7f00000001c0)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(0x0, 0x0, 0x0) r2 = fcntl$dupfd(r0, 0x0, r1) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r2, 0x402c5342, &(0x7f00000000c0)={0x0, 0xb861}) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$EVIOCSFF(r2, 0x40304580, &(0x7f0000000000)={0x55, 0x750b, 0xb4, {0xffff, 0x6}, {0x0, 0x2}, @rumble={0x0, 0xfff}}) mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) ioctl$USBDEVFS_REAPURBNDELAY(0xffffffffffffffff, 0x4008550d, &(0x7f00000002c0)) clone(0x180000105, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8000000200000000, 0x800007f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000fb5ffc)='nfs\x00', 0x0, &(0x7f000000a000)) r3 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) write$P9_RATTACH(r3, &(0x7f0000000080)={0x14}, 0xfffffff4) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) 19:59:55 executing program 2: syz_mount_image$btrfs(&(0x7f0000000000)='btrfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000140)="8da4363ac0ed0200000007002301004d010000000000000000007a0000000000fff6f2a2299748aeb81e1b00920efd9a000001000000000001fffffff60000005f42485266535f4d", 0x48, 0x10000}], 0x0, 0x0) 19:59:55 executing program 5: sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) mremap(&(0x7f00003fb000/0x400000)=nil, 0x400000, 0x400000, 0x3, &(0x7f0000bff000/0x400000)=nil) syz_genetlink_get_family_id$fou(&(0x7f0000000040)='fou\x00') openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0xb6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dri(&(0x7f00000001c0)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(0x0, 0x0, 0x0) r2 = fcntl$dupfd(r0, 0x0, r1) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r2, 0x402c5342, &(0x7f00000000c0)={0x0, 0xb861}) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$EVIOCSFF(r2, 0x40304580, &(0x7f0000000000)={0x55, 0x750b, 0xb4, {0xffff, 0x6}, {0x0, 0x2}, @rumble={0x0, 0xfff}}) mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) ioctl$USBDEVFS_REAPURBNDELAY(0xffffffffffffffff, 0x4008550d, &(0x7f00000002c0)) clone(0x180000105, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8000000200000000, 0x800007f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000fb5ffc)='nfs\x00', 0x0, &(0x7f000000a000)) r3 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) write$P9_RATTACH(r3, &(0x7f0000000080)={0x14}, 0xfffffff4) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) 19:59:55 executing program 3: sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) mremap(&(0x7f00003fb000/0x400000)=nil, 0x400000, 0x400000, 0x3, &(0x7f0000bff000/0x400000)=nil) syz_genetlink_get_family_id$fou(&(0x7f0000000040)='fou\x00') openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0xb6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dri(&(0x7f00000001c0)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(0x0, 0x0, 0x0) r2 = fcntl$dupfd(r0, 0x0, r1) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r2, 0x402c5342, &(0x7f00000000c0)={0x0, 0xb861}) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$EVIOCSFF(r2, 0x40304580, &(0x7f0000000000)={0x55, 0x750b, 0xb4, {0xffff, 0x6}, {0x0, 0x2}, @rumble={0x0, 0xfff}}) mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) ioctl$USBDEVFS_REAPURBNDELAY(0xffffffffffffffff, 0x4008550d, &(0x7f00000002c0)) clone(0x180000105, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8000000200000000, 0x800007f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000fb5ffc)='nfs\x00', 0x0, &(0x7f000000a000)) r3 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) write$P9_RATTACH(r3, &(0x7f0000000080)={0x14}, 0xfffffff4) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) 19:59:55 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = socket$key(0xf, 0x3, 0x2) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) ptrace$peekuser(0x3, 0x0, 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000005c0)={0xffffffffffffffff, 0x0, 0x0}, 0x10) sendmsg$key(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[]}}, 0x0) mount(0x0, &(0x7f0000000400)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) syz_mount_image$ext4(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=ANY=[]) open$dir(0x0, 0x0, 0x0) mknodat(0xffffffffffffffff, 0x0, 0x2, 0xfdf) mknodat(0xffffffffffffffff, &(0x7f0000000440)='./file0\x00', 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000040)='/dev/media#\x00', 0x40, 0xa51df1e2e637bf91) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, 0x0, &(0x7f0000000180)) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r1, 0x84, 0x66, &(0x7f00000001c0)={0x0, 0x1}, 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)='bpf\x00', 0x61, &(0x7f0000000780)={[{@mode={'mode'}}, {@mode={'mode'}}, {@mode={'mode'}}]}) 19:59:55 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) getsockname$packet(r2, 0x0, 0x0) fcntl$addseals(r0, 0x409, 0x0) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) setsockopt$inet6_MRT6_DEL_MFC(r0, 0x29, 0xcd, &(0x7f0000000040)={{0xa, 0x0, 0x0, @rand_addr="0242fd5c94773fad4114996e5c6b6837"}, {0xa, 0x0, 0x0, @local}}, 0x5c) rt_sigprocmask(0x1, &(0x7f0000000140)={0xde}, &(0x7f00000001c0), 0x8) 19:59:56 executing program 5: sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) mremap(&(0x7f00003fb000/0x400000)=nil, 0x400000, 0x400000, 0x3, &(0x7f0000bff000/0x400000)=nil) syz_genetlink_get_family_id$fou(&(0x7f0000000040)='fou\x00') openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0xb6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dri(&(0x7f00000001c0)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(0x0, 0x0, 0x0) r2 = fcntl$dupfd(r0, 0x0, r1) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r2, 0x402c5342, &(0x7f00000000c0)={0x0, 0xb861}) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$EVIOCSFF(r2, 0x40304580, &(0x7f0000000000)={0x55, 0x750b, 0xb4, {0xffff, 0x6}, {0x0, 0x2}, @rumble={0x0, 0xfff}}) mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) ioctl$USBDEVFS_REAPURBNDELAY(0xffffffffffffffff, 0x4008550d, &(0x7f00000002c0)) clone(0x180000105, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8000000200000000, 0x800007f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000fb5ffc)='nfs\x00', 0x0, &(0x7f000000a000)) r3 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) write$P9_RATTACH(r3, &(0x7f0000000080)={0x14}, 0xfffffff4) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) [ 273.286955][ T7975] FS-Cache: Duplicate cookie detected [ 273.292704][ T7975] FS-Cache: O-cookie c=00000000a234c5b2 [p=0000000051ecd2d2 fl=222 nc=0 na=1] [ 273.301640][ T7975] FS-Cache: O-cookie d=00000000c3380072 n=0000000046a99daf [ 273.308916][ T7975] FS-Cache: O-key=[10] '0200020000807f000008' [ 273.315223][ T7975] FS-Cache: N-cookie c=00000000b7af61aa [p=0000000051ecd2d2 fl=2 nc=0 na=1] [ 273.324052][ T7975] FS-Cache: N-cookie d=00000000c3380072 n=000000006ddbf913 [ 273.331416][ T7975] FS-Cache: N-key=[10] '0200020000807f000008' 19:59:56 executing program 0: sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) mremap(&(0x7f00003fb000/0x400000)=nil, 0x400000, 0x400000, 0x3, &(0x7f0000bff000/0x400000)=nil) syz_genetlink_get_family_id$fou(&(0x7f0000000040)='fou\x00') openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0xb6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dri(&(0x7f00000001c0)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(0x0, 0x0, 0x0) r2 = fcntl$dupfd(r0, 0x0, r1) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r2, 0x402c5342, &(0x7f00000000c0)={0x0, 0xb861}) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$EVIOCSFF(r2, 0x40304580, &(0x7f0000000000)={0x55, 0x750b, 0xb4, {0xffff, 0x6}, {0x0, 0x2}, @rumble={0x0, 0xfff}}) mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) ioctl$USBDEVFS_REAPURBNDELAY(0xffffffffffffffff, 0x4008550d, &(0x7f00000002c0)) clone(0x180000105, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8000000200000000, 0x800007f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000fb5ffc)='nfs\x00', 0x0, &(0x7f000000a000)) r3 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) write$P9_RATTACH(r3, &(0x7f0000000080)={0x14}, 0xfffffff4) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) 19:59:56 executing program 2: r0 = socket$kcm(0x11, 0x2, 0x0) setsockopt$sock_attach_bpf(r0, 0x107, 0x14, &(0x7f0000000000), 0x4) sendmsg(r0, &(0x7f0000001980)={&(0x7f00000001c0)=@caif=@rfm={0x25, 0x4, "f1975e1a281f380a9bc90d1cde9b2222"}, 0x80, 0x0}, 0x0) 19:59:56 executing program 3: sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) mremap(&(0x7f00003fb000/0x400000)=nil, 0x400000, 0x400000, 0x3, &(0x7f0000bff000/0x400000)=nil) syz_genetlink_get_family_id$fou(&(0x7f0000000040)='fou\x00') openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0xb6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dri(&(0x7f00000001c0)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(0x0, 0x0, 0x0) r2 = fcntl$dupfd(r0, 0x0, r1) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r2, 0x402c5342, &(0x7f00000000c0)={0x0, 0xb861}) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$EVIOCSFF(r2, 0x40304580, &(0x7f0000000000)={0x55, 0x750b, 0xb4, {0xffff, 0x6}, {0x0, 0x2}, @rumble={0x0, 0xfff}}) mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) ioctl$USBDEVFS_REAPURBNDELAY(0xffffffffffffffff, 0x4008550d, &(0x7f00000002c0)) clone(0x180000105, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8000000200000000, 0x800007f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000fb5ffc)='nfs\x00', 0x0, &(0x7f000000a000)) r3 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) write$P9_RATTACH(r3, &(0x7f0000000080)={0x14}, 0xfffffff4) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) 19:59:56 executing program 1: bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x0, 0x3, &(0x7f0000000000)=@framed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) r0 = syz_open_dev$media(&(0x7f0000000140)='/dev/media#\x00', 0x0, 0x0) ioctl$EVIOCGKEY(r0, 0xc0487c04, &(0x7f0000000000)=""/226) 19:59:56 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x10032, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000480)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = fcntl$dupfd(r3, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r5, 0x84, 0x66, &(0x7f0000013ff4)=@assoc_value, &(0x7f0000002000)=0xff0a) r6 = dup2(r0, r5) dup3(r6, r1, 0x0) 19:59:56 executing program 2: pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff) 19:59:56 executing program 5: sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) mremap(&(0x7f00003fb000/0x400000)=nil, 0x400000, 0x400000, 0x3, &(0x7f0000bff000/0x400000)=nil) syz_genetlink_get_family_id$fou(&(0x7f0000000040)='fou\x00') openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0xb6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dri(&(0x7f00000001c0)='/dev/dri/card#\x00', 0x0, 0x0) r1 = syz_open_dev$dri(0x0, 0x0, 0x0) r2 = fcntl$dupfd(r0, 0x0, r1) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r2, 0x402c5342, &(0x7f00000000c0)={0x0, 0xb861}) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$EVIOCSFF(r2, 0x40304580, &(0x7f0000000000)={0x55, 0x750b, 0xb4, {0xffff, 0x6}, {0x0, 0x2}, @rumble={0x0, 0xfff}}) mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) ioctl$USBDEVFS_REAPURBNDELAY(0xffffffffffffffff, 0x4008550d, &(0x7f00000002c0)) clone(0x180000105, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8000000200000000, 0x800007f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000fb5ffc)='nfs\x00', 0x0, &(0x7f000000a000)) r3 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) write$P9_RATTACH(r3, &(0x7f0000000080)={0x14}, 0xfffffff4) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) 19:59:56 executing program 1: creat(&(0x7f00000001c0)='./bus\x00', 0xffffffffffdffffe) r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) write$apparmor_current(r0, &(0x7f0000000380)=ANY=[@ANYRES64], 0x1) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r1, 0x4, 0x42800) lsetxattr$trusted_overlay_upper(&(0x7f0000000100)='./bus\x00', &(0x7f0000000200)='trusted.overlay.upper\x00', 0x0, 0x0, 0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x0, 0x0) lsetxattr$security_selinux(&(0x7f0000000240)='./bus\x00', &(0x7f00000002c0)='security.selinux\x00', &(0x7f0000000340)='system_u:object_r:inetd_var_run_t:s0\x00', 0x25, 0x0) sendfile(r0, r2, 0x0, 0x8000fffffffe) r3 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = open(&(0x7f0000000180)='./bus\x00', 0x0, 0x0) sendfile(r3, r4, 0x0, 0x8000fffffffe) write$FUSE_NOTIFY_RETRIEVE(r3, &(0x7f0000000300)={0x30, 0x5, 0x0, {0x0, 0x3, 0x8, 0x8}}, 0x30) creat(&(0x7f0000000140)='./bus\x00', 0x0) r5 = socket(0x0, 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{0x0}], 0x1, 0x0) bind$netlink(0xffffffffffffffff, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbfc, 0x200080}, 0xc) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f0000000280), 0x4) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cpuacct.usage_sys\x00\xc7\xec\xac\xd9&{\x0f\x96\xad\xd1\x8fl![\x8f\xb9\f\xca\x1d\xc2{\xee\xb7\x03K\x0f\xa6\xaa;\xf6\x89\xf7b^\xa5\xafI\r\xc4\x9f\v\xf2\x1c\xdc\xddp2\xb7\xbb\x1b\xfev\xea\xed\xe0\xaa\xe8\xceR`\xbb\xf2\xed;pC\x19\xbfn\x16\xaa\x199\xfe.Q\xebvB\xd2\x19&l?\x87\x17H\x1f.\xdbA\x1b\xafz\xe3\xdc};*\xec\xfe\xfa\xfb/\x18g\x80y\xfe\x89', 0x26e1, 0x0) close(r6) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000040)) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r7 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r8 = open(&(0x7f0000000180)='./bus\x00', 0x0, 0x0) sendfile(r7, r8, 0x0, 0x8000fffffffe) ioctl$RTC_ALM_READ(r8, 0x80247008, &(0x7f0000000080)) 19:59:56 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x23, 0x1, 0x0, 0x0, {0x4, 0xe00000000000000}, [@nested={0x8, 0x9, [@generic="11"]}]}, 0x1c}}, 0x0) 19:59:56 executing program 5: r0 = add_key$user(&(0x7f0000000080)='user\x00', &(0x7f00000000c0)={'syz', 0x1}, &(0x7f0000000180)="ce", 0x1, 0xfffffffffffffffd) r1 = add_key$user(&(0x7f0000000080)='user\x00', &(0x7f0000000100)={'syz', 0x1}, &(0x7f0000000140)="ff0edf8fc0fb5bcbbefeee8ddb462b3791f744be440fe658e84988badb5dc1d4fce9b5b3f9f9b6a864cf6e946965e6a2eb321b5547dc6c6d0c537734736625b0cffcbc1c606f4627309109edce0968a5544eea7470128254fe2c6467d04fe8ea73e5f7b1b19c51f9876f86f6e579577f4ba07c70bae267d290e585cfc9388532bdb301bc06c5500708e3ffa899dbdaa5b77f79720bf28a8cdc4ecc0792ab47cbbf49b635cda0521ade0b621bf85519f2a9666b0edadf9468415d39f29fa08808ab68033f6f30776353ed00b6fe01c361175338cc2cf14af7716525e5ce50baac653b6fb065c13e02d897ceee4f7ae1e9cd31e8a0e234f83831f96814e76e5bd4f3630a020ca179c5ef9cf6f924ede1f8f3a6fd2990ca1eaebd92ca9491f438150425bc6bec7340e902a6cfbb1cabda092b1d9d6cbacf6baf17ba1646a5a232b4114ca1f5566fbda74262de42ee344a5536756b1ffb30268f63d1a34f12a1328158a4e2156eb73ec8cdaf938dc157b6b762723efdfeef39d821b5949e7fe396aa031044b42ca77c482557754837be25adf582ab465ae29fef0a218080d226d0029ab47c00d88ccd8d039f8f87462d9b74b173f51faf994c498b5c69e0106bf960f095cdf5ed343df536c5a2d3c38fc171852b2181b7e49d015973841aec62ba5cc9812c2f169a24ec05899dccd7c739de62bbec9aacb0e04cb36d56175bd196507212c7403c4463bc04fd848fd0ffc32c358d254ec182505b5949f9ada38204d5c6380eca912ffc6424e9f27d85d83ec8ec66e9f6bc56363948cefaccf11b217da1cf3886227d9f3788d158a42b065e141f17d0b49280ca0f13c75d209035274a6315052c1b57fbe48e525f7e953dd8c4799d63262554102611566a6eea822bb2a0172538f7b4989ea7904afe04658682dd1f668c919915889b9c8ce9af5c6ef4aab29f0bb5a109d081130f4f8a3acc24508529ed135be1cbba67065fd62e180f5aa824a7bc0092d3b812534f5967eb45016c0688d75507cedbbb956c0c49c17f2587e8284608eca6e4581b1df5c70771dc42f43822a027013bd19030771f92f92719f1ba3bfecabe5816884e6c75c43fb6dd21a120d1ada5193eef243059086e9439cc957e38e5a4485afff8ae67e31c28ff043bbcdc276ec94acec1cd3f85a3035b164eb8fa590fd016bd4a47d204eeae89701aba1ab5d031f0e63f1386db52772a19dc550c46b9ac0ac0810e712e1af1613f96f63906b97759e6f073ce53ddea35084f99653e12cce111861ac58c56cf3e84df076364af58bed6efa0371a97cf7e14bdfb4f4157ea79df7b1efab1a56a16d29a3cdc316da1246222f0bdbc25c9329b97a55123ae7b4df4c7b68ce57a8198a62296f6d8b4894db1d232f012ee5646213330539d2d255104cc2b31f7b701d0cd430ae6f7f6c865d9ee44c5caa2265843ccc5ef2e2aa0ca58d65e1394436c1d38a0538748561bc1f698ba66d5b4d584d30fd65ec6e36bbc11b3b3f2ca8e99b6ba847a1c393e18cc74ec5a68c4ac9e552e1bd6e0c92cf76716a688061ee75ff0f6c2fe98460c7c272e181cde23770176caac5f1ed7baceb580b73ed6b210df9d78da5ea667a002a5b863041247f553002cd0c5f29e2aa36ad66cc9b1963f43d32cc4a6d09f86e1c7ae02a13c422d2608c5a65da79bec81b06301f6fe4b3aae9f33a73dc65e551e47996fb0464415ba6f42edf238c1bfc000a3f85fc98135c22c59c0ecb5783505e5bcdf4ae13f8692a6d09ed72e948044d44bb638b873f00ebdd2b3cc45dc38cab23ab4289926a269a1dc83e414b6790ad8b4642811ea1a2850465727a6bae892a62a2f057622eeec90c5f4a0e65b01686e105000a5acd620dc0cab64de2ca19f01291dfd7571ef1582de018c66c21e9734ea69b362daa0ef928d50bcfee104fd88978ec51aff460050aa31c1c9569f2205769b8de01ed9542318ea7d0cc4f1f8bedab11047444749ac32f613444aaffa029d66cbe82f6ff4583be8adec616874722ba3ac4e559a9b5a22e4bf00df709d9e11f6d5a62bf1b7962280c11278ccdd67f07688d150c364c87c88b384800a5fdfc9a7e1df613576f9053927f8f23819a7f117c6b2a66b6bcb7cf2262bc84416166bd7a5d7380fc51686d8023cddec3e1bc4ebed534f426e227acd020d9dc6b2aa2d59aeda3e90b83b3c19601682589e6cfaa521e537b44dc3e8eca94a553536876ee1bcebf0a48793b35bea799ae54f1a4143401394021c420f3dfe020b52f3a3cd544ef52c73c0e3c5e9e7845d8b8471222f2f7d0501f9335e5340ea2881cf565ef5a2595e6c6439f1feb90a1f7260199d30026394f45e2832ee4844f030ad0a718ea3dbd5defe0430ac134d83627c6eeef8cf8f95cdc5227412c8761958cf8a18b3aaca36b58a921d217c060d5c97ccb72dd4f81e2c678143819f99cc46825d1e2f4c3ae23060dca3db2e1b2482b01743ceba29d4b435a2cacb2cc62295a2ef13bac85df2ea3f989023c3c5b1a90cc5190d13e7045e178abde3809d285e9da11dbaea398dfee2a2cab8936162bc0e4c1ade9ff3eff900fa292e5121d542594265596ea21bfae1a683d4a121805a1bf366b9c2fb72824a57318b897ff9dfb99ad079fbb303a3bfeef5db82da3bd5042e58f6ee759795149c67aafe9efd686338d54b411a982d51408a85f9fad3bb28fa85646bc4484afc292e92e4140b88e071699ed6ae39b5d06bd397cc75e69031d7276f0315caea61dd05bc13d56b1a9667d8a25aaa30846052733010a97b17e06619ddcdaa11370635c4deead3a530610d67440ef2d273507f6cc18e638ac5045c0e2e7691822bdc93d3b61f79ca1e854e7e0eb6e998c80d718a77b78d2e9608ce93bf091ef78d44", 0x801, 0xffffffffffffffff) r2 = add_key$user(&(0x7f0000000080)='user\x00', &(0x7f00000000c0)={'syz', 0x1}, &(0x7f0000000180)="ce", 0x1, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000001140)={r0, r1, r2}, 0x0, 0x0, 0x0) 19:59:56 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000001380)='./file0\x00', &(0x7f0000000100)='ramfs\x00\xf5\x12\xd4\x1a\x06\xf2\xd1\x12\xb0\x14\x96\xb6\xac6\x89S\xe9\xd2X\xac\xfbl\x92\x83\xd7\x81k\xae\x01&\"\xe6\xe6\x18x--M~\xb2\xa4-\x16\xf6\x8d\xcb\xeb\x19=e\x0e=\xbe\xc3OvO%3\x1a\x18\xfb\x1a*\xb4-\xddgo\xdb%\xfb\x8b\x990\xb0\x9d\x91\xf4\'\xb7\xed\xf1\xe2\xff\x17\x16\xa5d\x9a|\xf3\xb4\x17(\x02A);\xbdn\xe7\xcf\xad\xa1\x17\x81\xf2D\xb2L', 0x101801d, 0x0) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000080)={&(0x7f0000000040)='./file0\x00'}, 0x10) [ 274.056007][ T26] kauditd_printk_skb: 8 callbacks suppressed [ 274.056026][ T26] audit: type=1804 audit(1575921596.769:31): pid=8024 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir367952272/syzkaller.YUTWAM/8/bus" dev="sda1" ino=16550 res=1 19:59:56 executing program 4: bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000002c0)='cpuacct.usage_user\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='/\x02roup.stap\x00', 0x2761, 0x0) socket$kcm(0x29, 0x0, 0x0) ioctl$TUNSETTXFILTER(0xffffffffffffffff, 0x400454d1, &(0x7f0000000000)=ANY=[@ANYBLOB="040000000000000000004080"]) r1 = socket$unix(0x1, 0x5, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) r3 = socket$unix(0x1, 0x2, 0x0) r4 = socket$unix(0x1, 0x2, 0x0) fcntl$dupfd(r3, 0x0, r4) fcntl$dupfd(r2, 0x0, 0xffffffffffffffff) getsockopt$MISDN_TIME_STAMP(r2, 0x0, 0x1, 0xfffffffffffffffe, &(0x7f0000000340)) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0xc0185879, 0x20000000) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000280)='memory.current\x00', 0x0, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f00000000c0), 0x4) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) write$cgroup_int(r0, &(0x7f0000000080), 0xfffffec7) perf_event_open(&(0x7f00000004c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x80000001, 0x0, 0x0, 0x5, 0x8, 0x0, 0x3, 0x0, @perf_bp={0x0}, 0x20, 0x100000000, 0x0, 0x0, 0x0, 0x6, 0x5}, 0x0, 0x5, 0xffffffffffffffff, 0x0) getpid() socket$kcm(0x2, 0x0, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4009}) [ 274.108176][ T8030] MPI: mpi too large (16392 bits) [ 274.274158][ T26] audit: type=1804 audit(1575921596.879:32): pid=8032 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir367952272/syzkaller.YUTWAM/8/bus" dev="sda1" ino=16550 res=1 19:59:57 executing program 3: modify_ldt$write(0x1, &(0x7f00007a7ff0), 0x10) modify_ldt$write2(0x11, &(0x7f0000000000), 0x10) 19:59:57 executing program 5: r0 = socket$inet6(0xa, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f3, &(0x7f0000000300)={'gre0\x00\x00\x00\b\x00', &(0x7f0000000580)=ANY=[@ANYBLOB="0008000042fdc20000000200000040070000000018001808152db425a19df02d4d54de82fff80000402f"]}) 19:59:57 executing program 2: r0 = socket$inet(0x2, 0x2000080001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) 19:59:57 executing program 0: openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f000005d000/0x400000)=nil, 0x400000, 0x0, 0x392d6ad36ec2c8b2, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x3) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x12}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() getpgrp(r0) setsockopt$inet_mreq(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, 0x0, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) [ 274.434674][ T26] audit: type=1804 audit(1575921596.879:33): pid=8032 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir367952272/syzkaller.YUTWAM/8/bus" dev="sda1" ino=16550 res=1 19:59:57 executing program 4: r0 = memfd_create(&(0x7f0000000380), 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x81000000000011, r0, 0x0) times(&(0x7f0000000000)) 19:59:57 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) fanotify_init(0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, 0x0, 0x0) setsockopt$inet_sctp_SCTP_RESET_ASSOC(0xffffffffffffffff, 0x84, 0x78, 0x0, 0xffffff15) rt_sigaction(0x2000019, 0x0, 0x0, 0x0, 0x0) socket(0x0, 0x0, 0x7) r0 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) r1 = socket$inet6(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e20}, 0x1c) listen(r1, 0xfffffffffffffffd) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000640)={{{@in6=@mcast2, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@loopback}}, &(0x7f00000005c0)=0xa47eee4f77827c38) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000600)={'team0\x00', r2}) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x82, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, &(0x7f0000000000)={0x0, 0xff}, 0x0) socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(0xffffffffffffffff, 0x84, 0x82, &(0x7f0000000000)=@assoc_value, 0x8) shmat(0x0, &(0x7f0000ffc000/0x3000)=nil, 0xd48a5a656600d03e) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_ifreq(r3, 0x8991, &(0x7f00000000c0)={'bond0\x00\x16\b\xea\xff\xff\x80\x00\x06\x02\xff', @ifru_names='bond_slave_1\x00t\x00'}) ioctl$sock_ifreq(r3, 0x8990, &(0x7f0000000240)={'bond0\x00\xe1\x03\f\x00!!\x00\x01\x00\x01', @ifru_names='bond_slave_1\x00\x00\x00\b'}) [ 274.581979][ T26] audit: type=1804 audit(1575921596.879:34): pid=8032 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir367952272/syzkaller.YUTWAM/8/bus" dev="sda1" ino=16550 res=1 19:59:57 executing program 4: r0 = memfd_create(&(0x7f0000000380), 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x81000000000011, r0, 0x0) times(&(0x7f0000000000)) [ 274.763270][ T8032] ================================================================== [ 274.771428][ T8032] BUG: KCSAN: data-race in ext4_setattr / generic_file_read_iter [ 274.779132][ T8032] [ 274.779220][ T26] audit: type=1804 audit(1575921596.969:35): pid=8037 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir367952272/syzkaller.YUTWAM/8/bus" dev="sda1" ino=16550 res=1 [ 274.781479][ T8032] read to 0xffff88812532f638 of 8 bytes by task 8024 on cpu 1: [ 274.812737][ T8032] generic_file_read_iter+0x860/0x1440 [ 274.818283][ T8032] ext4_file_read_iter+0xfa/0x240 [ 274.823310][ T8032] generic_file_splice_read+0x35c/0x500 [ 274.828943][ T8032] do_splice_to+0xf2/0x130 [ 274.830597][ T26] audit: type=1804 audit(1575921596.969:36): pid=8037 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir367952272/syzkaller.YUTWAM/8/bus" dev="sda1" ino=16550 res=1 [ 274.833370][ T8032] splice_direct_to_actor+0x1a1/0x510 [ 274.833383][ T8032] do_splice_direct+0x161/0x1e0 [ 274.833395][ T8032] do_sendfile+0x384/0x7f0 [ 274.833409][ T8032] __x64_sys_sendfile64+0x12a/0x140 [ 274.833437][ T8032] do_syscall_64+0xcc/0x370 [ 274.860823][ T26] audit: type=1804 audit(1575921597.479:37): pid=8032 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir367952272/syzkaller.YUTWAM/8/bus" dev="sda1" ino=16550 res=1 [ 274.862909][ T8032] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 274.862912][ T8032] [ 274.862926][ T8032] write to 0xffff88812532f638 of 8 bytes by task 8032 on cpu 0: [ 274.862939][ T8032] ext4_setattr+0xca8/0x15a0 [ 274.862995][ T8032] notify_change+0x7e1/0xaa0 [ 274.930613][ T8032] do_truncate+0xfb/0x180 [ 274.934952][ T8032] path_openat+0x2f48/0x36e0 [ 274.939545][ T8032] do_filp_open+0x11e/0x1b0 [ 274.944055][ T8032] do_sys_open+0x3b3/0x4f0 [ 274.948477][ T8032] __x64_sys_creat+0x45/0x60 [ 274.953074][ T8032] do_syscall_64+0xcc/0x370 [ 274.957577][ T8032] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 274.963470][ T8032] [ 274.965792][ T8032] Reported by Kernel Concurrency Sanitizer on: [ 274.971947][ T8032] CPU: 0 PID: 8032 Comm: syz-executor.1 Not tainted 5.4.0-syzkaller #0 [ 274.980178][ T8032] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 274.990256][ T8032] ================================================================== [ 274.998316][ T8032] Kernel panic - not syncing: panic_on_warn set ... [ 275.004911][ T8032] CPU: 0 PID: 8032 Comm: syz-executor.1 Not tainted 5.4.0-syzkaller #0 [ 275.013143][ T8032] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 275.023196][ T8032] Call Trace: [ 275.026499][ T8032] dump_stack+0x11d/0x181 [ 275.030872][ T8032] panic+0x210/0x640 [ 275.034867][ T8032] ? vprintk_func+0x8d/0x140 [ 275.039468][ T8032] kcsan_report.cold+0xc/0xd [ 275.044076][ T8032] kcsan_setup_watchpoint+0x3fe/0x460 [ 275.049573][ T8032] __tsan_unaligned_write8+0xc4/0x100 [ 275.054947][ T8032] ext4_setattr+0xca8/0x15a0 [ 275.059526][ T8032] ? ext4_journalled_write_end+0xb60/0xb60 [ 275.065347][ T8032] notify_change+0x7e1/0xaa0 [ 275.069971][ T8032] do_truncate+0xfb/0x180 [ 275.074304][ T8032] path_openat+0x2f48/0x36e0 [ 275.078900][ T8032] ? do_seccomp+0xace/0x1480 [ 275.083483][ T8032] do_filp_open+0x11e/0x1b0 [ 275.088034][ T8032] ? _raw_spin_unlock+0x4b/0x60 [ 275.092991][ T8032] ? __alloc_fd+0x2ef/0x3b0 [ 275.097562][ T8032] ? get_unused_fd_flags+0x93/0xc0 [ 275.102702][ T8032] do_sys_open+0x3b3/0x4f0 [ 275.107116][ T8032] __x64_sys_creat+0x45/0x60 [ 275.111707][ T8032] do_syscall_64+0xcc/0x370 [ 275.116223][ T8032] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 275.122114][ T8032] RIP: 0033:0x45a6f9 [ 275.126020][ T8032] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 275.145610][ T8032] RSP: 002b:00007f4e0f7e5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000055 [ 275.154013][ T8032] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 000000000045a6f9 [ 275.161980][ T8032] RDX: 0000000000000000 RSI: ffffffffffdffffe RDI: 00000000200001c0 [ 275.169936][ T8032] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 275.178151][ T8032] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f4e0f7e66d4 [ 275.186192][ T8032] R13: 00000000004c0fa8 R14: 00000000004d4da0 R15: 00000000ffffffff [ 275.195538][ T8032] Kernel Offset: disabled [ 275.199878][ T8032] Rebooting in 86400 seconds..